Release v1.9.2

v1.9.2

Changelog

Profile filter and CSRF action types are FormKit types (REQ-TWIG-005 rule 11, no markup change). See UPGRADING.

Changed

• FormKit Types (REQ-TWIG-005 rule 11): ProfileFilterType (GET profile switcher) and CsrfActionType (seed / import YAML / toggle / delete) now carry #[FormKitConfig('marketing_kit')] + FormOptionsTrait, like MarketingToolType. Field names (profile, flat _token), CSRF token ids and markup are unchanged. The marketing_kit profile override is documented in CONFIGURATION.

Release v1.9.1

v1.9.1

Changelog

Bundle routes are opt-in again: controllers are no longer autoconfigured, so a host's routing.controllers import does not expose them (REQ-SF-004 rule 7). See UPGRADING.

Fixed

• Admin routes registered without being imported (REQ-SF-004 rule 7): on Symfony >= 7.3 the #[Route] on MarketingToolAdminController made the autoconfigured service carry the routing.controller tag, so a host with the default controllers: { resource: routing.controllers } got the nowo_marketing_kit_admin_* routes without importing @NowoMarketingKitBundle/Resources/config/routing.yaml (still behind the admin access checker). The controller service is no longer autoconfigured (explicit controller.service_arguments + container.service_subscriber tags); the routes exist only where the host imports them. Regression test with a kernel that only loads routing.controllers.

Release v1.9.0

v1.9.0

Changelog

UiKit page contract admin, Playwright e2e + screenshots, SEC-004 hardening: empty roles deny, CSRF fail-closed, consent category allowlist, CSP nonce See UPGRADING.

Security hardening after the SEC-004 audit of 2026-10-27. See UPGRADING.

Security

• Admin access fails closed (M1): an empty security.access_roles now denies everyone; it used to grant the
  admin (and so site-wide script authority through any tag manager container) to every visitor, anonymous included.
• CSRF required (L1): with web_ui.enabled: true the container refuses to compile without
  framework.csrf_protection / framework.form.csrf_protection (CsrfProtectionPass); without the form CSRF
  extension the admin's CSRF-only forms were valid with no token. The tool form uses the explicit token id
  nowo_marketing_kit_tool (I6).
• No consent bypass for trackers (L2): categories are an allowlist (required, preferences, analytics,
  marketing); built-in trackers cannot use required (which skips the consent gate) unless
  security.allow_required_trackers: true — rejected in YAML and in the admin form, and earlier database rows are
  gated as marketing at render time.
• CSP nonce (L4): nowo_marketing_head|body_start|body_end(profile, nonce) and security.csp_nonce_attribute
  add nonce="…" to the built-in <script> tags; custom HTML stays as configured.
• Access before lookup (I2): edit / toggle / delete check access before loading the tool (403 for any id instead
  of a 404 / 403 oracle).
• Vary: Cookie (I3) on responses whose tags were gated by the consent cookies.
• Hotjar IDs (I4) must be 1–16 digits without a leading zero.
• Profiles (I5): seed / import YAML refuse a posted profile that is not configured; new / the tool form only
  accept configured profiles.
• Custom HTML (I7) cannot be saved from the admin while security.allow_custom_html is false.
• Docs (L3, L5, L6): docs/SECURITY.md threat model (the admin is site-wide script authority; dedicated role,
  audit trail), recipe access_control path vs web_ui.path_prefix, .github/SECURITY.md supported versions.

Fixed

• Admin {id} routes accept at most 18 digits, so an id beyond PHP_INT_MAX returns 404 instead of a 500 TypeError (SEC-004 fix verification N1).
• %env()% provider IDs (as in the Flex recipe and the README) no longer fail the compile-time ID check; they are
  validated at render time (I1). The Flex recipe no longer sets the removed admin/layout.html.twig layout.

Admin pages on the UiKit page contract (REQ-UI-001 / REQ-UI-003), Playwright e2e + README screenshots (REQ-DEMO-013),
native PHPUnit deprecation gate (REQ-SF-005). See UPGRADING.

Added

• web_ui.enabled (admin routes answer 404 when false), web_ui.path_prefix (default /admin/marketing),
  web_ui.templates.index|form (per-page template overrides) and web_ui.form_themes (default the UiKit form theme
  @NowoUiKit/form/nowo_ui_layout.html.twig) — the REQ-UI-003 configuration vocabulary.
• Nowo\MarketingKitBundle\Ui\MarketingKitPages: layout / template / form-theme resolution and the ListPage /
  FormPage view models of the admin pages.
• docs/TEMPLATES.md (page → scaffold, view-model fields, data blocks) and the UiKit page contract test
  (tests/Integration/Contract/PageContractTest.php).
• Translation keys admin.enable, admin.disable, admin.confirm_delete_title, admin.empty_title,
  admin.col.actions, admin.form_intro (7 locales).
• Demo: Playwright e2e (demo/symfony8/e2e, make -C demo/symfony8 test-e2e), README screenshots
  (make -C demo/symfony8 demo-screenshots, WebP under docs/images/demo/), make -C demo/symfony8 reset-demo, and
  a demo host layout (nowo_ui_kit.layouts.admin) with a masthead (REQ-DEMO-013).

Changed

• Template contract (REQ-UI-003): admin/index.html.twig extends the UiKit list scaffold and
  admin/form.html.twig the UiKit form scaffold; they render inside nowo_ui_kit.layouts.admin (or
  web_ui.layout_template). Header actions, filters, row actions (Edit, Enable / Disable, Delete), the confirm
  dialog, the empty state and flashes come from UiKit; the local mk-* styles and the inline onsubmit /
  onchange handlers are gone (Delete uses the UiKit confirm <dialog>, the profile filter an Apply button).
• web_ui.layout_template defaults to null (UiKit layout). A 1.x layout that renders only {% block body %} is
  wrapped in the deprecated bridge admin/_legacy_layout.html.twig.
• The seeded FormKit profile marketing_kit no longer adds Bootstrap classes (form-control, form-select,
  mb-2, …) and sets convention_requires_translation: true (no raw *.help / *.placeholder keys in the form).
• An invalid tool form submission answers 422 (it did through AbstractController::render() with the form object).
• Requirements: nowo-tech/ui-kit-bundle ^2.15 (was ^1.4 || ^2.2), nowo-tech/form-kit-bundle ^2.10 (was
  ^2.0).
• PHPUnit fails on any deprecation triggered by the package (failOnDeprecation, ignoreSuppressionOfDeprecations,
  self / direct deprecations not ignored), including Symfony's silenced trigger_deprecation() calls;
  symfony/phpunit-bridge does not hook PHPUnit >= 10 (REQ-SF-005).
• make coverage-check gates at 100% PHP lines, like the CI Code Coverage job (was 99%) (REQ-TEST-003).

Fixed

• Demo: the session is enabled (framework.session); Seed catalog, Import from YAML, toggle and delete failed with
  SessionNotFoundException when adding their flash message (found by the new e2e suite).

Deprecated

• web_ui.css_framework and web_ui.icon_set: set nowo_ui_kit.css_framework / nowo_ui_kit.icon_set once for
  every bundle. They still seed the UiKit keys when the host leaves them unset.
• The 1.x layout bridge admin/_legacy_layout.html.twig and the Twig globals nowo_marketing_kit_layout /
  nowo_marketing_kit_css_framework (unused by the pages; removed in 2.0).

Removed

• admin/base.html.twig and admin/layout.html.twig (the bundle's own page shell with inline CSS). The former
  default web_ui.layout_template value @NowoMarketingKitBundle/admin/layout.html.twig is treated as null.
• Demo compose.override.yaml, which published the MySQL service port to the host (REQ-DEMO-006).

Release v1.8.0

v1.8.0

Changelog

Forms in the bundle views are Symfony Form Types rendered with form_start / child loop / form_end, no raw form controls (REQ-TWIG-005). See UPGRADING.

Changed

• Developer tooling (REQ-MAKE-002): make release-check runs the full REQ-MAKE-002 chain in order (ensure-up, co-author and open-PR gates, check-twig-extra, composer-sync, cs-fix, cs-check, rector-dry, phpstan, igor, validate-translations, coverage-check, demo release-check). make check-no-raw-html-form (.scripts/check-no-raw-html-form.sh, REQ-TWIG-005) now runs in the chain.
• Admin list (REQ-TWIG-005): the profile switcher, seed / import YAML toolbar and the per-row toggle / delete actions are Symfony Forms (ProfileFilterType, CsrfActionType) rendered with form_start / child loop / form_end instead of raw <form> / <select> / hand-rolled _token inputs; the controller validates them with handleRequest + isSubmitted() / isValid(). Same routes, field names and CSRF ids; see UPGRADING for template overrides.

Release v1.7.1

v1.7.1

Changelog

Bundle views render form bodies through the child loop (REQ-TWIG-003). See UPGRADING.

Changed

• admin/form.html.twig renders the tool form through the child loop instead of one form_row(form.x) per field: the main fields loop skips the option_* children, which the "Provider options" fieldset renders with a second loop guarded by not child.rendered (REQ-TWIG-003).

Release v1.7.0

v1.7.0

Changelog

Dependency refresh, @Final admin controller, PHPStan without ignores, demo restart/test/verify targets and demo smoke workflow. See UPGRADING.

Changed

• Dependencies refreshed (Composer and pnpm/npm lock files of the bundle and its demos, campaign 2026-10-19).
• .php-cs-fixer.dist.php: new ParallelConfig(2) (REQ-CS-001).
• MarketingToolAdminController is marked @final (real final in 2.0); its unit test drives the real controller through a test container instead of subclassing it, and phpstan.neon.dist is back to ignoreErrors: [] (REQ-PHP-001, REQ-CS-006). See UPGRADING.
• Demo: make up installs vendor/ in a one-off container first, so worker mode boots from a fresh checkout; make restart, make test (container + Twig lint) and make verify (final HTTP 200 on / and /admin/marketing); release-verify / make demo-smoke require a final HTTP 200; new Demo smoke workflow (tags, weekly, manual) (REQ-MAKE-003, REQ-TEST-011); the co-author check accepts git worktrees.
• Documentation: wave-1 REQ compliance — README documentation list order and section order (Version information after Requirements, License section), canonical issue templates, CONTRIBUTING Cursor Agent settings (REQ-IDE-006), tables of contents in long docs, DEMO-FRANKENPHP production section, commented demo .env.example, Spec Kit baseline refresh (categorized 49/49 inventory, FR-MK-011, non-goals).

Release v1.6.1

v1.6.1

Changelog

Allows nowo-tech/ui-kit-bundle 2.x (^1.4 || ^2.2) so hosts can move to UiKit 2.2. See UPGRADING.

Changed

• Allows nowo-tech/ui-kit-bundle 2.x (^1.4 || ^2.2); the dev lock and the demo lock use 2.2.0. Templates are unchanged (compatibility release). With UiKit 2.x nowo-ui.css ships in @layer nowo-ui, so unlayered host/framework CSS wins equal-specificity conflicts with kit rules in the admin pages; to keep the 1.x cascade, override the admin stylesheets block and link css/nowo-ui.unlayered.css (UiKit 2.x only).

Release v1.6.0

Release v1.6.0: unused doctrine.connection option deprecated.

Changelog

Deprecated

• nowo_marketing_kit.doctrine.connection was documented but never used. It is now deprecated (setting it triggers a deprecation) and has no effect: the default Doctrine entity manager and its connection are always used. Removal planned for 2.0.

Release v1.5.0

Release v1.5.0: security and fixes - validated provider IDs, Twig globals registered, unique tool codes.

Changelog

Security

• Provider tracking IDs (GTM, GA4, Meta Pixel, LinkedIn, TikTok, Hotjar, Clarity) are validated against a per-provider format at YAML config compile time and on admin save; renderers emit nothing for a non-matching ID and place IDs in JavaScript as JSON string literals, so a crafted ID can no longer break out of the snippet.

Fixed

• Twig globals nowo_marketing_kit_layout / nowo_marketing_kit_css_framework were never registered (the extension did not implement GlobalsInterface), so web_ui.layout_template and web_ui.css_framework were ignored by the admin templates.
• Admin create/edit of a marketing tool with an existing (profile, code) pair (e.g. after "Seed catalog") now shows a validation error instead of a 500; blank or over-long profile / code are rejected too (UniqueEntity, NotBlank, Length). symfony/validator is now an explicit requirement.
• web_ui.icon_set is now a real configuration key (default bootstrap-icons) used to seed nowo_ui_kit.icon_set; previously it was read but could not be set.

Release v1.4.3

Release v1.4.3: dependency refresh and repository maintenance.

Changelog

Changed

• Development: composer.json pins config.platform.php to 8.2.0 so the committed lock stays installable on the minimum PHP; CI overrides the platform per matrix cell. Dev lock re-resolved for PHP 8.2 (Symfony 8.1 -> 7.4 LTS, doctrine/doctrine-bundle 3.3 -> 2.19).
• Repository: .twig-cs-fixer.cache is now git-ignored.

Dependencies

• nowo-tech/form-kit-bundle 2.6.2 → 2.7.1 (development lock; #14).
• igor-php/igor-php 0.9.7 → 0.10.1 (require-dev constraint + development lock; #15).
• doctrine/orm 3.7.4 → 3.7.5 (development lock; #16).
• nowo-tech/ui-kit-bundle 1.9.2 → 1.11.0 (development lock; #18).
• vincentlanglet/twig-cs-fixer 3.14.0 → 4.1.1 (require-dev constraint + development lock; #17).