Renovate (#39): the Symfony package rule restricted every symfony/* package to ~7.4. symfony/monolog-bundle has its own version line (4.x) and no 7.4 releases, so Renovate never offered it updates. It is now excluded from that rule. No other locked Symfony package is affected: symfony/flex, the polyfills and the *-contracts packages were already excluded.
PHP security update: PHP 8.4.27 fixes CVE-2026-109618 and CVE-2026-109619, both critical RCEs (advisory). The images keep the floating dunglas/frankenphp:1-php8.4-alpine tag. docker-publish.yml now sets pull: true, so every release build fetches the newest 8.4 patch instead of reusing a cached base image.
Notes
Running deployments get PHP 8.4.27 only after a new release tag is built. For local dev, rebuild with docker compose build --pull.
Renovate does not open PRs for the floating base image tag. Pinning digests (pinDigests) would change that if wanted.
Not tested: no image was built and no test suite was run for these changes.
## Summary
- **Renovate (#39):** the Symfony package rule restricted every `symfony/*` package to `~7.4`. `symfony/monolog-bundle` has its own version line (4.x) and no 7.4 releases, so Renovate never offered it updates. It is now excluded from that rule. No other locked Symfony package is affected: `symfony/flex`, the polyfills and the `*-contracts` packages were already excluded.
- **PHP security update:** PHP 8.4.27 fixes CVE-2026-109618 and CVE-2026-109619, both critical RCEs ([advisory](https://www.php.net/archive/2026.php#2026-10-21-5)). The images keep the floating `dunglas/frankenphp:1-php8.4-alpine` tag. `docker-publish.yml` now sets `pull: true`, so every release build fetches the newest 8.4 patch instead of reusing a cached base image.
## Notes
- Running deployments get PHP 8.4.27 only after a new release tag is built. For local dev, rebuild with `docker compose build --pull`.
- Renovate does not open PRs for the floating base image tag. Pinning digests (`pinDigests`) would change that if wanted.
- Not tested: no image was built and no test suite was run for these changes.
Closes #39
🤖 Generated with [Claude Code](https://claude.com/claude-code)
monolog-bundle is versioned independently (4.x) and has no 7.4 releases,
so the allowedVersions constraint blocked all its updates.
Closes#39
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Picks up PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE)
via the floating 1-php8.4-alpine tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
haylan
scheduled this pull request to auto merge when all checks succeed 2026-10-22 22:03:17 +00:00
Here are some key observations to aid the review process:
⏱️Estimated effort to review: 2 🔵🔵⚪⚪⚪
🧪No relevant tests
🔒No security concerns identified
⚡No major issues detected
## PR Reviewer Guide 🔍
<!-- pr-agent:review:full -->
Here are some key observations to aid the review process:
<table>
<tr><td>⏱️ <strong>Estimated effort to review</strong>: 2 🔵🔵⚪⚪⚪</td></tr>
<tr><td>🧪 <strong>No relevant tests</strong></td></tr>
<tr><td>🔒 <strong>No security concerns identified</strong></td></tr>
<tr><td>⚡ <strong>No major issues detected</strong></td></tr>
</table>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
symfony/*package to~7.4.symfony/monolog-bundlehas its own version line (4.x) and no 7.4 releases, so Renovate never offered it updates. It is now excluded from that rule. No other locked Symfony package is affected:symfony/flex, the polyfills and the*-contractspackages were already excluded.dunglas/frankenphp:1-php8.4-alpinetag.docker-publish.ymlnow setspull: true, so every release build fetches the newest 8.4 patch instead of reusing a cached base image.Notes
docker compose build --pull.pinDigests) would change that if wanted.Closes #39
🤖 Generated with Claude Code
Failed to update PR description
PR Reviewer Guide 🔍
Here are some key observations to aid the review process:
PR Code Suggestions ✨
No code suggestions found for the PR.