From 0707e913bd6f817016d6cb831e2f51886e1986be Mon Sep 17 00:00:00 2001 From: ArthurErlich Date: Thu, 22 Oct 2026 23:59:23 +0200 Subject: [PATCH 1/3] fix(renovate): exclude symfony/monolog-bundle from the ~7.4 Symfony rule monolog-bundle is versioned independently (4.x) and has no 7.4 releases, so the allowedVersions constraint blocked all its updates. Closes #39 Co-Authored-By: Claude Opus 5.5 --- renovate.json | 1 + 1 file changed, 1 insertion(+) diff --git a/renovate.json b/renovate.json index cf928ea..2777a21 100644 --- a/renovate.json +++ b/renovate.json @@ -15,6 +15,7 @@ "matchPackageNames": [ "/^symfony//", "!symfony/flex", + "!symfony/monolog-bundle", "!/^symfony/polyfill-/", "!/-contracts$/" ] -- 2.54.0 From 0b10cd6a04d137c7c7e512a2b601556127f5c34e Mon Sep 17 00:00:00 2001 From: ArthurErlich Date: Thu, 22 Oct 2026 23:59:23 +0200 Subject: [PATCH 2/3] fix(docker): always pull the latest PHP 8.4 base image on release builds Picks up PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE) via the floating 1-php8.4-alpine tag. Co-Authored-By: Claude Opus 5.5 --- .gitea/workflows/docker-publish.yml | 1 + CHANGELOG.md | 8 ++++++++ 2 files changed, 9 insertions(+) diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml index b57d4b0..b954390 100644 --- a/.gitea/workflows/docker-publish.yml +++ b/.gitea/workflows/docker-publish.yml @@ -77,6 +77,7 @@ jobs: target: final platforms: linux/amd64,linux/arm64 push: true + pull: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} # Registry-based layer cache — survives between runs without a separate cache store. diff --git a/CHANGELOG.md b/CHANGELOG.md index c9d16e6..c58d41e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - `phpstan/phpstan` 2.2.5 → 2.2.16 - Docker builds copy `symfony.lock` so Flex doesn't re-apply recipes during `composer install` +### Fixed + +- Renovate no longer pins `symfony/monolog-bundle` to `~7.4` — it is versioned independently (4.x) and was blocked from updates (#39) + +### Security + +- Release images are built against the latest picks up PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE) + ## [0.2.1] - 2026-07-31 ### Added -- 2.54.0 From bb23ae88193b6f9acc318c20d2bf2941cf07bad8 Mon Sep 17 00:00:00 2001 From: ArthurErlich Date: Fri, 23 Oct 2026 00:06:17 +0200 Subject: [PATCH 3/3] chore(deps): fixed changelog text --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c58d41e..4b98068 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -25,7 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Security -- Release images are built against the latest picks up PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE) +- Release images are built against the latest PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE) ## [0.2.1] - 2026-07-31 -- 2.54.0