Bump the dev-dependencies group across 1 directory with 10 updates (#164 )

* Bump the dev-dependencies group across 1 directory with 10 updates Bumps the dev-dependencies group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [friendsofphp/php-cs-fixer](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer) | `3.95.8` | `3.95.11` | | [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) | `2.2.2` | `2.2.4` | | [phpstan/phpstan-phpunit](https://github.com/phpstan/phpstan-phpunit) | `2.0.16` | `2.0.17` | | [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit) | `13.2.1` | `13.2.2` | | [rector/rector](https://github.com/rectorphp/rector) | `2.4.6` | `2.5.2` | | [symfony/browser-kit](https://github.com/symfony/browser-kit) | `8.1.0` | `8.1.1` | | [symfony/phpunit-bridge](https://github.com/symfony/phpunit-bridge) | `8.1.0` | `8.1.1` | | [symfony/web-profiler-bundle](https://github.com/symfony/web-profiler-bundle) | `8.1.0` | `8.1.1` | | [thecodingmachine/phpstan-safe-rule](https://github.com/thecodingmachine/phpstan-safe-rule) | `1.4.3` | `1.4.7` | | [vincentlanglet/twig-cs-fixer](https://github.com/VincentLanglet/Twig-CS-Fixer) | `4.0.1` | `4.0.2` | Updates `friendsofphp/php-cs-fixer` from 3.95.8 to 3.95.11 - [Release notes](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases) - [Changelog](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/blob/master/CHANGELOG.md) - [Commits](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/compare/v3.95.8...v3.95.11) Updates `phpstan/phpstan` from 2.2.2 to 2.2.4 - [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits) Updates `phpstan/phpstan-phpunit` from 2.0.16 to 2.0.17 - [Release notes](https://github.com/phpstan/phpstan-phpunit/releases) - [Commits](https://github.com/phpstan/phpstan-phpunit/compare/2.0.16...2.0.17) Updates `phpunit/phpunit` from 13.2.1 to 13.2.2 - [Release notes](https://github.com/sebastianbergmann/phpunit/releases) - [Changelog](https://github.com/sebastianbergmann/phpunit/blob/13.2.2/ChangeLog-13.2.md) - [Commits](https://github.com/sebastianbergmann/phpunit/compare/13.2.1...13.2.2) Updates `rector/rector` from 2.4.6 to 2.5.2 - [Release notes](https://github.com/rectorphp/rector/releases) - [Commits](https://github.com/rectorphp/rector/compare/2.4.6...2.5.2) Updates `symfony/browser-kit` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/symfony/browser-kit/releases) - [Changelog](https://github.com/symfony/browser-kit/blob/8.2/CHANGELOG.md) - [Commits](https://github.com/symfony/browser-kit/compare/v8.1.0...v8.1.1) Updates `symfony/phpunit-bridge` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/symfony/phpunit-bridge/releases) - [Changelog](https://github.com/symfony/phpunit-bridge/blob/8.2/CHANGELOG.md) - [Commits](https://github.com/symfony/phpunit-bridge/compare/v8.1.0...v8.1.1) Updates `symfony/web-profiler-bundle` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/symfony/web-profiler-bundle/releases) - [Changelog](https://github.com/symfony/web-profiler-bundle/blob/8.2/CHANGELOG.md) - [Commits](https://github.com/symfony/web-profiler-bundle/compare/v8.1.0...v8.1.1) Updates `thecodingmachine/phpstan-safe-rule` from 1.4.3 to 1.4.7 - [Release notes](https://github.com/thecodingmachine/phpstan-safe-rule/releases) - [Commits](https://github.com/thecodingmachine/phpstan-safe-rule/compare/v1.4.3...v1.4.7) Updates `vincentlanglet/twig-cs-fixer` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/VincentLanglet/Twig-CS-Fixer/releases) - [Commits](https://github.com/VincentLanglet/Twig-CS-Fixer/compare/4.0.1...4.0.2) --- updated-dependencies: - dependency-name: friendsofphp/php-cs-fixer dependency-version: 3.95.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: phpstan/phpstan dependency-version: 2.2.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: phpstan/phpstan-phpunit dependency-version: 2.0.17 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: phpunit/phpunit dependency-version: 13.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: rector/rector dependency-version: 2.5.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: symfony/browser-kit dependency-version: 8.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: symfony/phpunit-bridge dependency-version: 8.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: symfony/web-profiler-bundle dependency-version: 8.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: thecodingmachine/phpstan-safe-rule dependency-version: 1.4.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: vincentlanglet/twig-cs-fixer dependency-version: 4.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * Ignore rector rule --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Marijn Doeve <marijn@doeve.me>
fix(ci): prevent script injection in Portainer deployment step (#170 )
2026-07-04 22:50:15 +02:00 · 2026-07-03 12:08:58 +00:00 · 2026-07-03 11:54:52 +00:00 · 2026-07-03 11:28:22 +00:00 · 2026-07-03 10:23:14 +00:00 · 2026-07-03 12:18:29 +02:00
6 changed files with 163 additions and 100 deletions
@@ -28,3 +28,7 @@ updates:
    directory: "/"
    schedule:
      interval: "daily"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
@@ -17,31 +17,57 @@ permissions:
  contents: read

 jobs:
-  quality:
-    name: Code Quality
+  build:
+    name: Build Dev Image
    runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Lint Dockerfile
-        uses: hadolint/hadolint-action@v3.1.0
+        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Build Docker images
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
        with:
          pull: true
+          files: |
+            compose.yaml
+            compose.override.yaml
+          set: |
+            *.cache-from=type=gha,scope=${{github.ref}}-devbuild
+            *.cache-from=type=gha,scope=refs/heads/main-devbuild
+            *.cache-to=type=gha,scope=${{github.ref}}-devbuild,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }}
+
+  quality:
+    name: Code Quality
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    needs: build
+    if: "!startsWith(github.ref, 'refs/tags/')"
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - name: Load Docker images
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
+        with:
          load: true
          files: |
            compose.yaml
            compose.override.yaml
          set: |
-            *.cache-from=type=gha,scope=${{github.ref}}-quality
-            *.cache-from=type=gha,scope=refs/heads/main
-            *.cache-to=type=gha,scope=${{github.ref}}-quality,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }}
+            *.cache-from=type=gha,scope=${{github.ref}}-devbuild
      - name: Start services
        run: docker compose up php database --wait --no-build
      - name: Warm up dev cache
@@ -78,27 +104,28 @@ jobs:
    name: Tests
    runs-on: ubuntu-latest
    timeout-minutes: 20
+    needs: build
+    if: "!startsWith(github.ref, 'refs/tags/')"
    permissions:
      checks: write
      pull-requests: write
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Build Docker images
-        uses: docker/bake-action@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - name: Load Docker images
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
        with:
-          pull: true
          load: true
          files: |
            compose.yaml
            compose.override.yaml
          set: |
-            *.cache-from=type=gha,scope=${{github.ref}}-tests
-            *.cache-from=type=gha,scope=refs/heads/main
-            *.cache-to=type=gha,scope=${{github.ref}}-tests,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }}
+            *.cache-from=type=gha,scope=${{github.ref}}-devbuild
      - name: Start services
        run: docker compose up php database --wait --no-build
      - name: Create test database
@@ -111,13 +138,34 @@ jobs:
        run: docker compose exec -T php vendor/bin/phpunit --log-junit var/phpunit/junit.xml
      - name: Publish PHPUnit test results
        if: always()
-        uses: mikepenz/action-junit-report@v5
+        uses: mikepenz/action-junit-report@d9f48fc87bc235f7e214acf696ca5abc0a986f16 # v6
        with:
          report_paths: var/phpunit/junit.xml
          check_name: PHPUnit
      - name: Doctrine Schema Validator
        run: docker compose exec -T php bin/console -e test doctrine:schema:validate

+  verify-prior-run:
+    name: Verify Prior CI Run
+    runs-on: ubuntu-latest
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/')
+    permissions:
+      actions: read
+    steps:
+      - name: Check for successful CI run on this commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          count=$(gh api \
+            "repos/${{ github.repository }}/actions/workflows/ci.yml/runs?head_sha=${{ github.sha }}&status=success&per_page=5" \
+            --jq "[.workflow_runs[] | select(.id != ${{ github.run_id }})] | length")
+          if [[ "$count" -eq 0 ]]; then
+            echo "::error::No prior successful CI run found for ${{ github.sha }}. Only tag commits that have passed CI on main."
+            exit 1
+          fi
+          echo "Found $count prior successful CI run(s) for this commit."
+
  build-deploy:
    name: Build and Deploy
    permissions:
@@ -126,17 +174,21 @@ jobs:
    environment:
      name: ${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'acceptance' }}
      url: ${{ vars.URL }}
-    needs: [quality, tests]
+    needs: [quality, tests, verify-prior-run]
    runs-on: ubuntu-latest
    timeout-minutes: 15
-    if: (github.ref == 'refs/heads/main' && false) || startsWith(github.ref, 'refs/tags/')
+    if: >-
+      always() && !cancelled() && !failure() &&
+      ((github.ref == 'refs/heads/main' && false) || startsWith(github.ref, 'refs/tags/'))
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -164,7 +216,7 @@ jobs:
          fi

      - name: Build and Push Docker images
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
        with:
          pull: true
          push: true
@@ -178,7 +230,7 @@ jobs:
            *.tags=${{ steps.meta.outputs.full_name }}

      - name: Create Sentry release
-        uses: getsentry/action-release@v3
+        uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
@@ -191,5 +243,7 @@ jobs:
        shell: bash
        env:
          PORTAINER_WEBHOOK: ${{secrets.PORTAINER_WEBHOOK}}
+          IMAGE_TAG: ${{steps.meta.outputs.tag}}
+          SENTRY_RELEASE: ${{steps.meta.outputs.sentry_version}}
        run: |
-          curl -v -X POST "${PORTAINER_WEBHOOK}?IMAGE_TAG=${{steps.meta.outputs.tag}}" --fail-with-body
+          curl -v -X POST "${PORTAINER_WEBHOOK}?IMAGE_TAG=${IMAGE_TAG}&SENTRY_RELEASE=${SENTRY_RELEASE}" --fail-with-body
@@ -12,7 +12,7 @@ jobs:
    steps:
      - name: Dependabot metadata
        id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@v3
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Enable auto-merge for Dependabot PRs
@@ -10,7 +10,7 @@ services:
      MAILER_DSN: ${MAILER_DSN}
      MAILER_SENDER: ${MAILER_SENDER}
      SENTRY_DSN: ${SENTRY_DSN}
-      SENTRY_RELEASE: ${IMAGE_TAG}
+      SENTRY_RELEASE: ${SENTRY_RELEASE}
      SENTRY_ENVIRONMENT: ${SENTRY_ENVIRONMENT}
    labels:
      - "traefik.enable=true"
@@ -9287,16 +9287,16 @@
        },
        {
            "name": "friendsofphp/php-cs-fixer",
-            "version": "v3.95.8",
+            "version": "v3.95.11",
            "source": {
                "type": "git",
                "url": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer.git",
-                "reference": "4140023f552ff02346df9b1329742532166f677f"
+                "reference": "35f98e1293283397824d7f349ce5afb8747c3cd5"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/PHP-CS-Fixer/PHP-CS-Fixer/zipball/4140023f552ff02346df9b1329742532166f677f",
-                "reference": "4140023f552ff02346df9b1329742532166f677f",
+                "url": "https://api.github.com/repos/PHP-CS-Fixer/PHP-CS-Fixer/zipball/35f98e1293283397824d7f349ce5afb8747c3cd5",
+                "reference": "35f98e1293283397824d7f349ce5afb8747c3cd5",
                "shasum": ""
            },
            "require": {
@@ -9330,7 +9330,7 @@
            "require-dev": {
                "facile-it/paraunit": "^1.3.1 || ^2.11.0",
                "infection/infection": "^0.32.7",
-                "justinrainbow/json-schema": "^6.9.0",
+                "justinrainbow/json-schema": "^6.10.0",
                "keradus/cli-executor": "^2.3",
                "mikey179/vfsstream": "^1.6.12",
                "php-coveralls/php-coveralls": "^2.9.1",
@@ -9380,7 +9380,7 @@
            ],
            "support": {
                "issues": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/issues",
-                "source": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/tree/v3.95.8"
+                "source": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/tree/v3.95.11"
            },
            "funding": [
                {
@@ -9388,7 +9388,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-06-16T09:52:26+00:00"
+            "time": "2026-06-25T14:17:04+00:00"
        },
        {
            "name": "myclabs/deep-copy",
@@ -9676,11 +9676,11 @@
        },
        {
            "name": "phpstan/phpstan",
-            "version": "2.2.2",
+            "version": "2.2.4",
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/e5cc34d491a90e79c216d824f60fe21fd4d93bd6",
-                "reference": "e5cc34d491a90e79c216d824f60fe21fd4d93bd6",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/f0fe3fb03bb53ce68cc2416785b260e62226ec27",
+                "reference": "f0fe3fb03bb53ce68cc2416785b260e62226ec27",
                "shasum": ""
            },
            "require": {
@@ -9736,7 +9736,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-06-05T09:00:01+00:00"
+            "time": "2026-07-03T07:00:23+00:00"
        },
        {
            "name": "phpstan/phpstan-doctrine",
@@ -9817,21 +9817,22 @@
        },
        {
            "name": "phpstan/phpstan-phpunit",
-            "version": "2.0.16",
+            "version": "2.0.17",
            "source": {
                "type": "git",
                "url": "https://github.com/phpstan/phpstan-phpunit.git",
-                "reference": "6ab598e1bc106e6827fd346ae4a12b4a5d634c32"
+                "reference": "c2f977551f0736d60467b3d754b2e0cf4e337b3f"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan-phpunit/zipball/6ab598e1bc106e6827fd346ae4a12b4a5d634c32",
-                "reference": "6ab598e1bc106e6827fd346ae4a12b4a5d634c32",
+                "url": "https://api.github.com/repos/phpstan/phpstan-phpunit/zipball/c2f977551f0736d60467b3d754b2e0cf4e337b3f",
+                "reference": "c2f977551f0736d60467b3d754b2e0cf4e337b3f",
                "shasum": ""
            },
            "require": {
+                "phar-io/version": "^3.2",
                "php": "^7.4 || ^8.0",
-                "phpstan/phpstan": "^2.1.32"
+                "phpstan/phpstan": "^2.2.3"
            },
            "conflict": {
                "phpunit/phpunit": "<7.0"
@@ -9841,7 +9842,8 @@
                "php-parallel-lint/php-parallel-lint": "^1.2",
                "phpstan/phpstan-deprecation-rules": "^2.0",
                "phpstan/phpstan-strict-rules": "^2.0",
-                "phpunit/phpunit": "^9.6"
+                "phpunit/phpunit": "^9.6",
+                "shipmonk/name-collision-detector": "^2.1"
            },
            "type": "phpstan-extension",
            "extra": {
@@ -9867,9 +9869,9 @@
            ],
            "support": {
                "issues": "https://github.com/phpstan/phpstan-phpunit/issues",
-                "source": "https://github.com/phpstan/phpstan-phpunit/tree/2.0.16"
+                "source": "https://github.com/phpstan/phpstan-phpunit/tree/2.0.17"
            },
-            "time": "2026-02-14T09:05:21+00:00"
+            "time": "2026-06-29T05:32:23+00:00"
        },
        {
            "name": "phpstan/phpstan-symfony",
@@ -10330,16 +10332,16 @@
        },
        {
            "name": "phpunit/phpunit",
-            "version": "13.2.1",
+            "version": "13.2.2",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/phpunit.git",
-                "reference": "60da0ff1e10a0f72ee18a24117ec3b613a346bba"
+                "reference": "492c067e618de7b3c76105082c90f9d2833401b7"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/60da0ff1e10a0f72ee18a24117ec3b613a346bba",
-                "reference": "60da0ff1e10a0f72ee18a24117ec3b613a346bba",
+                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/492c067e618de7b3c76105082c90f9d2833401b7",
+                "reference": "492c067e618de7b3c76105082c90f9d2833401b7",
                "shasum": ""
            },
            "require": {
@@ -10410,7 +10412,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/phpunit/issues",
                "security": "https://github.com/sebastianbergmann/phpunit/security/policy",
-                "source": "https://github.com/sebastianbergmann/phpunit/tree/13.2.1"
+                "source": "https://github.com/sebastianbergmann/phpunit/tree/13.2.2"
            },
            "funding": [
                {
@@ -10418,7 +10420,7 @@
                    "type": "other"
                }
            ],
-            "time": "2026-06-15T13:14:22+00:00"
+            "time": "2026-06-29T13:36:29+00:00"
        },
        {
            "name": "react/cache",
@@ -10948,16 +10950,16 @@
        },
        {
            "name": "rector/rector",
-            "version": "2.4.6",
+            "version": "2.5.2",
            "source": {
                "type": "git",
                "url": "https://github.com/rectorphp/rector.git",
-                "reference": "9b9e5c76618e4d359f65b54ca2eabcad3d1761ee"
+                "reference": "49ff6339174bdbdf50b0b35ecbcff14a05ac9e24"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/rectorphp/rector/zipball/9b9e5c76618e4d359f65b54ca2eabcad3d1761ee",
-                "reference": "9b9e5c76618e4d359f65b54ca2eabcad3d1761ee",
+                "url": "https://api.github.com/repos/rectorphp/rector/zipball/49ff6339174bdbdf50b0b35ecbcff14a05ac9e24",
+                "reference": "49ff6339174bdbdf50b0b35ecbcff14a05ac9e24",
                "shasum": ""
            },
            "require": {
@@ -10996,7 +10998,7 @@
            ],
            "support": {
                "issues": "https://github.com/rectorphp/rector/issues",
-                "source": "https://github.com/rectorphp/rector/tree/2.4.6"
+                "source": "https://github.com/rectorphp/rector/tree/2.5.2"
            },
            "funding": [
                {
@@ -11004,7 +11006,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-06-17T11:56:28+00:00"
+            "time": "2026-06-22T11:39:33+00:00"
        },
        {
            "name": "sebastian/cli-parser",
@@ -12167,16 +12169,16 @@
        },
        {
            "name": "symfony/browser-kit",
-            "version": "v8.1.0",
+            "version": "v8.1.1",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/browser-kit.git",
-                "reference": "74e18e582cdda0eca35f7c74e1e48e62f0ede853"
+                "reference": "f2ac86001ca9f487e8c6d0e11c8e33e6a9b8b2d5"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/browser-kit/zipball/74e18e582cdda0eca35f7c74e1e48e62f0ede853",
-                "reference": "74e18e582cdda0eca35f7c74e1e48e62f0ede853",
+                "url": "https://api.github.com/repos/symfony/browser-kit/zipball/f2ac86001ca9f487e8c6d0e11c8e33e6a9b8b2d5",
+                "reference": "f2ac86001ca9f487e8c6d0e11c8e33e6a9b8b2d5",
                "shasum": ""
            },
            "require": {
@@ -12215,7 +12217,7 @@
            "description": "Simulates the behavior of a web browser, allowing you to make requests, click on links and submit forms programmatically",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/browser-kit/tree/v8.1.0"
+                "source": "https://github.com/symfony/browser-kit/tree/v8.1.1"
            },
            "funding": [
                {
@@ -12235,7 +12237,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-29T05:06:50+00:00"
+            "time": "2026-06-09T10:54:51+00:00"
        },
        {
            "name": "symfony/css-selector",
@@ -12308,16 +12310,16 @@
        },
        {
            "name": "symfony/dom-crawler",
-            "version": "v8.1.0",
+            "version": "v8.1.1",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/dom-crawler.git",
-                "reference": "77ca351474ea018daba5f2e473cbf1b9b8e72ac6"
+                "reference": "1dfadd25537c8fcb6752cce5775f24647d976bdc"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/dom-crawler/zipball/77ca351474ea018daba5f2e473cbf1b9b8e72ac6",
-                "reference": "77ca351474ea018daba5f2e473cbf1b9b8e72ac6",
+                "url": "https://api.github.com/repos/symfony/dom-crawler/zipball/1dfadd25537c8fcb6752cce5775f24647d976bdc",
+                "reference": "1dfadd25537c8fcb6752cce5775f24647d976bdc",
                "shasum": ""
            },
            "require": {
@@ -12354,7 +12356,7 @@
            "description": "Eases DOM navigation for HTML and XML documents",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/dom-crawler/tree/v8.1.0"
+                "source": "https://github.com/symfony/dom-crawler/tree/v8.1.1"
            },
            "funding": [
                {
@@ -12374,7 +12376,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-29T05:06:50+00:00"
+            "time": "2026-06-05T06:23:12+00:00"
        },
        {
            "name": "symfony/maker-bundle",
@@ -12477,16 +12479,16 @@
        },
        {
            "name": "symfony/phpunit-bridge",
-            "version": "v8.1.0",
+            "version": "v8.1.1",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/phpunit-bridge.git",
-                "reference": "1fed488f8033f2dece371e60a1c66f2add274916"
+                "reference": "3e1c9a9167e07474ec115555b632f0ffadb0f94d"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/phpunit-bridge/zipball/1fed488f8033f2dece371e60a1c66f2add274916",
-                "reference": "1fed488f8033f2dece371e60a1c66f2add274916",
+                "url": "https://api.github.com/repos/symfony/phpunit-bridge/zipball/3e1c9a9167e07474ec115555b632f0ffadb0f94d",
+                "reference": "3e1c9a9167e07474ec115555b632f0ffadb0f94d",
                "shasum": ""
            },
            "require": {
@@ -12538,7 +12540,7 @@
                "testing"
            ],
            "support": {
-                "source": "https://github.com/symfony/phpunit-bridge/tree/v8.1.0"
+                "source": "https://github.com/symfony/phpunit-bridge/tree/v8.1.1"
            },
            "funding": [
                {
@@ -12558,20 +12560,20 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-29T05:06:50+00:00"
+            "time": "2026-06-09T10:54:51+00:00"
        },
        {
            "name": "symfony/web-profiler-bundle",
-            "version": "v8.1.0",
+            "version": "v8.1.1",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/web-profiler-bundle.git",
-                "reference": "f8ccea08797a511b85a698b0da40e1b9e6461086"
+                "reference": "eb4cf71d8fc496d790ec85b1b684a7ac30d57a96"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/web-profiler-bundle/zipball/f8ccea08797a511b85a698b0da40e1b9e6461086",
-                "reference": "f8ccea08797a511b85a698b0da40e1b9e6461086",
+                "url": "https://api.github.com/repos/symfony/web-profiler-bundle/zipball/eb4cf71d8fc496d790ec85b1b684a7ac30d57a96",
+                "reference": "eb4cf71d8fc496d790ec85b1b684a7ac30d57a96",
                "shasum": ""
            },
            "require": {
@@ -12623,7 +12625,7 @@
                "dev"
            ],
            "support": {
-                "source": "https://github.com/symfony/web-profiler-bundle/tree/v8.1.0"
+                "source": "https://github.com/symfony/web-profiler-bundle/tree/v8.1.1"
            },
            "funding": [
                {
@@ -12643,27 +12645,27 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-29T05:06:50+00:00"
+            "time": "2026-06-05T06:23:12+00:00"
        },
        {
            "name": "thecodingmachine/phpstan-safe-rule",
-            "version": "v1.4.3",
+            "version": "v1.4.7",
            "source": {
                "type": "git",
                "url": "https://github.com/thecodingmachine/phpstan-safe-rule.git",
-                "reference": "5c804889253ce9498ef185e108e9f94b6023208e"
+                "reference": "51fa2a35a270f683fc9ea53384a03e892b4d7b51"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/thecodingmachine/phpstan-safe-rule/zipball/5c804889253ce9498ef185e108e9f94b6023208e",
-                "reference": "5c804889253ce9498ef185e108e9f94b6023208e",
+                "url": "https://api.github.com/repos/thecodingmachine/phpstan-safe-rule/zipball/51fa2a35a270f683fc9ea53384a03e892b4d7b51",
+                "reference": "51fa2a35a270f683fc9ea53384a03e892b4d7b51",
                "shasum": ""
            },
            "require": {
                "nikic/php-parser": "^5",
                "php": "^8.1",
-                "phpstan/phpstan": "^2.1.11",
-                "thecodingmachine/safe": "^1.2 || ^2.0 || ^3.0"
+                "phpstan/phpstan": "^2.2.2",
+                "thecodingmachine/safe": "^3.1"
            },
            "require-dev": {
                "php-coveralls/php-coveralls": "^2.1",
@@ -12699,9 +12701,9 @@
            "description": "A PHPStan rule to detect safety issues. Must be used in conjunction with thecodingmachine/safe",
            "support": {
                "issues": "https://github.com/thecodingmachine/phpstan-safe-rule/issues",
-                "source": "https://github.com/thecodingmachine/phpstan-safe-rule/tree/v1.4.3"
+                "source": "https://github.com/thecodingmachine/phpstan-safe-rule/tree/v1.4.7"
            },
-            "time": "2025-11-21T09:41:49+00:00"
+            "time": "2026-06-21T07:55:55+00:00"
        },
        {
            "name": "theseer/tokenizer",
@@ -12755,16 +12757,16 @@
        },
        {
            "name": "vincentlanglet/twig-cs-fixer",
-            "version": "4.0.1",
+            "version": "4.0.2",
            "source": {
                "type": "git",
                "url": "https://github.com/VincentLanglet/Twig-CS-Fixer.git",
-                "reference": "366f7cca494a6f95c5f410ae542aef9c164d329e"
+                "reference": "1cb75618f7dd0f9bf51924aa6d3aa8c588f51d5a"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/VincentLanglet/Twig-CS-Fixer/zipball/366f7cca494a6f95c5f410ae542aef9c164d329e",
-                "reference": "366f7cca494a6f95c5f410ae542aef9c164d329e",
+                "url": "https://api.github.com/repos/VincentLanglet/Twig-CS-Fixer/zipball/1cb75618f7dd0f9bf51924aa6d3aa8c588f51d5a",
+                "reference": "1cb75618f7dd0f9bf51924aa6d3aa8c588f51d5a",
                "shasum": ""
            },
            "require": {
@@ -12820,7 +12822,7 @@
            "homepage": "https://github.com/VincentLanglet/Twig-CS-Fixer",
            "support": {
                "issues": "https://github.com/VincentLanglet/Twig-CS-Fixer/issues",
-                "source": "https://github.com/VincentLanglet/Twig-CS-Fixer/tree/4.0.1"
+                "source": "https://github.com/VincentLanglet/Twig-CS-Fixer/tree/4.0.2"
            },
            "funding": [
                {
@@ -12828,7 +12830,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-06-18T15:31:27+00:00"
+            "time": "2026-06-29T15:22:14+00:00"
        }
    ],
    "aliases": [],
@@ -3,6 +3,7 @@
 declare(strict_types=1);

 use Rector\Config\RectorConfig;
+use Rector\PHPUnit\CodeQuality\Rector\Class_\AddSeeTestAnnotationRector;
 use Rector\Symfony\Bridge\Symfony\Routing\SymfonyRoutesProvider;
 use Rector\Symfony\Contract\Bridge\Symfony\Routing\SymfonyRoutesProviderInterface;

@@ -13,7 +14,7 @@ return RectorConfig::configure()
        __DIR__.'/src',
        __DIR__.'/tests',
    ])
-    ->withSkip([__DIR__.'/config/reference.php'])
+    ->withSkipPath(__DIR__.'/config/reference.php')
    ->withSymfonyContainerXml(__DIR__.'/var/cache/dev/Tvdt_KernelDevDebugContainer.xml')
    ->withSymfonyContainerPhp(__DIR__.'/tests/symfony-container.php')
    ->registerService(SymfonyRoutesProvider::class, SymfonyRoutesProviderInterface::class)
@@ -34,4 +35,6 @@ return RectorConfig::configure()
    )
    ->withAttributesSets(all: true)
    ->withComposerBased(twig: true, doctrine: true, phpunit: true, symfony: true)
+    ->withSkip([AddSeeTestAnnotationRector::class])
+
 ;
Author	SHA1	Message	Date
dependabot[bot]	212401a97f	Bump the dev-dependencies group across 1 directory with 10 updates (#164 ) * Bump the dev-dependencies group across 1 directory with 10 updates Bumps the dev-dependencies group with 10 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [friendsofphp/php-cs-fixer](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer) \| `3.95.8` \| `3.95.11` \| \| [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) \| `2.2.2` \| `2.2.4` \| \| [phpstan/phpstan-phpunit](https://github.com/phpstan/phpstan-phpunit) \| `2.0.16` \| `2.0.17` \| \| [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit) \| `13.2.1` \| `13.2.2` \| \| [rector/rector](https://github.com/rectorphp/rector) \| `2.4.6` \| `2.5.2` \| \| [symfony/browser-kit](https://github.com/symfony/browser-kit) \| `8.1.0` \| `8.1.1` \| \| [symfony/phpunit-bridge](https://github.com/symfony/phpunit-bridge) \| `8.1.0` \| `8.1.1` \| \| [symfony/web-profiler-bundle](https://github.com/symfony/web-profiler-bundle) \| `8.1.0` \| `8.1.1` \| \| [thecodingmachine/phpstan-safe-rule](https://github.com/thecodingmachine/phpstan-safe-rule) \| `1.4.3` \| `1.4.7` \| \| [vincentlanglet/twig-cs-fixer](https://github.com/VincentLanglet/Twig-CS-Fixer) \| `4.0.1` \| `4.0.2` \| Updates `friendsofphp/php-cs-fixer` from 3.95.8 to 3.95.11 - [Release notes](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases) - [Changelog](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/blob/master/CHANGELOG.md) - [Commits](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/compare/v3.95.8...v3.95.11) Updates `phpstan/phpstan` from 2.2.2 to 2.2.4 - [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits) Updates `phpstan/phpstan-phpunit` from 2.0.16 to 2.0.17 - [Release notes](https://github.com/phpstan/phpstan-phpunit/releases) - [Commits](https://github.com/phpstan/phpstan-phpunit/compare/2.0.16...2.0.17) Updates `phpunit/phpunit` from 13.2.1 to 13.2.2 - [Release notes](https://github.com/sebastianbergmann/phpunit/releases) - [Changelog](https://github.com/sebastianbergmann/phpunit/blob/13.2.2/ChangeLog-13.2.md) - [Commits](https://github.com/sebastianbergmann/phpunit/compare/13.2.1...13.2.2) Updates `rector/rector` from 2.4.6 to 2.5.2 - [Release notes](https://github.com/rectorphp/rector/releases) - [Commits](https://github.com/rectorphp/rector/compare/2.4.6...2.5.2) Updates `symfony/browser-kit` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/symfony/browser-kit/releases) - [Changelog](https://github.com/symfony/browser-kit/blob/8.2/CHANGELOG.md) - [Commits](https://github.com/symfony/browser-kit/compare/v8.1.0...v8.1.1) Updates `symfony/phpunit-bridge` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/symfony/phpunit-bridge/releases) - [Changelog](https://github.com/symfony/phpunit-bridge/blob/8.2/CHANGELOG.md) - [Commits](https://github.com/symfony/phpunit-bridge/compare/v8.1.0...v8.1.1) Updates `symfony/web-profiler-bundle` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/symfony/web-profiler-bundle/releases) - [Changelog](https://github.com/symfony/web-profiler-bundle/blob/8.2/CHANGELOG.md) - [Commits](https://github.com/symfony/web-profiler-bundle/compare/v8.1.0...v8.1.1) Updates `thecodingmachine/phpstan-safe-rule` from 1.4.3 to 1.4.7 - [Release notes](https://github.com/thecodingmachine/phpstan-safe-rule/releases) - [Commits](https://github.com/thecodingmachine/phpstan-safe-rule/compare/v1.4.3...v1.4.7) Updates `vincentlanglet/twig-cs-fixer` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/VincentLanglet/Twig-CS-Fixer/releases) - [Commits](https://github.com/VincentLanglet/Twig-CS-Fixer/compare/4.0.1...4.0.2) --- updated-dependencies: - dependency-name: friendsofphp/php-cs-fixer dependency-version: 3.95.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: phpstan/phpstan dependency-version: 2.2.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: phpstan/phpstan-phpunit dependency-version: 2.0.17 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: phpunit/phpunit dependency-version: 13.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: rector/rector dependency-version: 2.5.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: symfony/browser-kit dependency-version: 8.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: symfony/phpunit-bridge dependency-version: 8.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: symfony/web-profiler-bundle dependency-version: 8.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: thecodingmachine/phpstan-safe-rule dependency-version: 1.4.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: vincentlanglet/twig-cs-fixer dependency-version: 4.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * Ignore rector rule --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Marijn Doeve <marijn@doeve.me>	2026-07-03 12:08:58 +00:00
Marijn	7c74574d3c	fix(ci): prevent script injection in Portainer deployment step (#170 ) Move IMAGE_TAG and SENTRY_RELEASE step outputs into env: vars so they are passed as environment variables rather than interpolated directly into the shell command string, eliminating a potential script-injection vector via a crafted tag or Sentry version value.	2026-07-03 11:54:52 +00:00
Marijn	b1f84d441f	fix: align SENTRY_RELEASE env var with the release created by the Sentry action (#169 ) The Sentry action receives the v-stripped version (e.g. 0.1.1) but the app's SENTRY_RELEASE was set to IMAGE_TAG (e.g. v0.1.1). This caused Sentry to auto-create a second release from incoming events, labelling it (non-semver) instead of associating events with the properly created release. Pass SENTRY_RELEASE as a separate query param through the Portainer webhook (using the already-computed sentry_version output) and reference that in compose.prod.yaml instead of IMAGE_TAG.	2026-07-03 11:28:22 +00:00
dependabot[bot]	8c72b1b217	Bump dependabot/fetch-metadata from 2 to 3 (#168 ) Bumps [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) from 2 to 3. - [Release notes](https://github.com/dependabot/fetch-metadata/releases) - [Commits](https://github.com/dependabot/fetch-metadata/compare/v2...v3) --- updated-dependencies: - dependency-name: dependabot/fetch-metadata dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-03 10:23:14 +00:00
Marijn	806cff8c0f	ci: optimise build pipeline — shared dev image build and skip tests on tag push (#167 ) * ci: split dev image build into a shared job Extract the Docker build step into a dedicated `build` job so `quality` and `tests` no longer each build the image independently. Both jobs now load from the shared `devbuild` GHA cache scope and declare `needs: build`. * ci: skip quality+tests on tag push, verify prior CI run instead When tagging a commit that already passed CI on main, there is no need to run quality and tests again. Both jobs now skip for tag refs. A new `verify-prior-run` job runs instead: it queries the GitHub API for a prior successful CI run on the same SHA (excluding the current run) and fails fast if none is found, preventing deployment of untested tags. `build-deploy` now uses `always() && !cancelled() && !failure()` so it handles the mix of skipped (quality/tests) and successful (verify-prior-run) needed jobs correctly. * ci: bump GitHub Actions to Node.js 24 compatible versions * ci: add Dependabot config for GitHub Actions version updates * ci: pin all GitHub Actions to commit SHAs * ci: disable credential persistence on all checkout steps	2026-07-03 12:18:29 +02:00