Release v1.16.0

Release v1.16.0

Changelog

Added

• setup.worker_memo (schema_probe_ttl, default 60; progress_ddl_ttl, default 3600): per-worker TTL memos (Setup\Memo\WorkerTtlMemo, deliberately not ResetInterface) so FrankenPHP workers stop probing information_schema and running CREATE TABLE IF NOT EXISTS on every request. MemoizedSchemaExistenceChecker wraps the cold-start MysqlSchemaExistenceChecker; DoctrineConnectDetector / DoctrineSchemaEmptyDetector reuse a healthy answer; DoctrineDbalSetupProgressStorage / DoctrineDbalSetupStepJournal remember the DDL across kernel.reset. Only positive answers are cached; a dropped table is still re-created on the first failing query. 0 restores the previous behaviour.
• bump_time_limit (default false) + bump_time_limit_seconds (default null = process_timeout; 0 = unlimited): LongRequestTimeLimitSubscriber calls set_time_limit() on main requests under the setup prefix (incl. /{locale} variants) and the panel prefix, so migrate / dump / restore subprocesses are not killed mid-pipe by a short prod max_execution_time.
• nowo:site-backup:db-dump: built-in backup.database_dump_command — mysqldump from DATABASE_URL (or --url), password via MYSQL_PWD (never argv), --single-transaction --no-tablespaces, no --routines (restore replays through PDO), optional --skip-ssl-verify-server-cert (MariaDB client), --binary, repeatable -o options. Pure argv builder: Database\MysqlDumpCommandFactory.
• security_guard (opt-in, default enabled: false): ProductionSecretsGuardSubscriber fails closed outside local_environments (default dev, test) on HTTP requests and console commands when the setup token, panel password hash or APP_SECRET are empty, listed placeholders or (APP_SECRET) shorter than 16 characters. Skips cache:clear, cache:warmup, assets:install, nowo:site-backup:hash-password.

Changed

• CSP: inline script and style tags in the restore page, setup and panel layouts, wizard and panel index carry nonce from the request attribute csp_nonce when present (nowo-tech kit convention). Panel restore / delete confirms use data-nowo-confirm + one delegated nonce'd listener instead of onsubmit="return confirm(…)". Inline style="" attributes were replaced by classes (wizard progress bar is now a <progress class="bar"> element).
• Docs: setup.reopen_when_detector_requires documents its cost (one detector pass per request).

Full Changelog: v1.15.1...v1.16.0

Release v1.15.1

v1.15.1

Changelog

Fixed

• Tests: DetectorsTest no longer uses an anonymous readonly class (PHP 8.3+), so the suite parses on PHP 8.2.

Changed

• Dependencies (lock refresh): UiKitBundle 1.9.1; dev PHPStan 2.3.1 (+ phpunit/symfony extensions 2.1), PHPUnit 10.5.66, Rector 2.7.0, nowo-tech/phpstan-frankenphp 1.2.3.
• Demo (Symfony 8): regenerated config/reference.php.

Full Changelog: v1.15.0...v1.15.1

Release v1.15.0

Release v1.15.0

Add setup.reopen_when_detector_requires, SetupWizardReopener and DurableSetupDoneStoreInterface::clearDone().

Changelog

Added

• setup.reopen_when_detector_requires (default false, BC): when true, short_circuit_when_done no longer hides detectors. If setup.done or the durable store says complete but a tagged SetupNeedDetectorInterface still reports setup required (e.g. platform catalogs wiped), SetupNeedEvaluator clears setup.done, calls DurableSetupDoneStoreInterface::clearDone() and resets wizard progress so the wizard can run again. Costs one detector pass per request.
• SetupWizardReopener (public service): kit-side helper (reopen(), resetProgress()) so hosts no longer copy the clear-done / reset-progress logic into their own subscribers.
• DurableSetupDoneStoreInterface::clearDone(): void (SPI). NullDurableSetupDoneStore implements it as a no-op.

Changed

• BC note (SPI): custom DurableSetupDoneStoreInterface implementations must add clearDone() (no-op is acceptable if the host does not want the bundle to clear its durable flag).

Fixed

• Tests: avoid PHP 8.4-only new Foo()->method() chaining in UnlocalizedDefaultLocaleSubscriberTest so PHP 8.2/8.3 CI jobs parse the suite.

What's Changed

• chore(deps): bump the symfony group with 2 updates by @dependabot[bot] in #24
• chore(deps): bump nowo-tech/ui-kit-bundle from 1.8.4 to 1.8.5 by @dependabot[bot] in #25

Full Changelog: v1.14.3...v1.15.0

Release v1.14.3

Release v1.14.3

Changelog

Fixed

• setup.locale.unlocalized: serve: UnlocalizedDefaultLocaleSubscriber forces setup.locale.default at request time on SiteBackup *_unlocalized routes (after Symfony LocaleListener), so bare /setup stays correct when the compiled route _locale default was warmed with a different value (Docker image build vs runtime env). Registered only when setup is enabled, in_path: both, and unlocalized: serve.

What's Changed

• chore(deps): bump nowo-tech/ui-kit-bundle from 1.8.3 to 1.8.4 by @dependabot[bot] in #22
• fix(locale): force setup.locale.default on *_unlocalized serve routes by @HecFranco in #23

Full Changelog: v1.14.2...v1.14.3

Release v1.14.2

Release v1.14.2

Changelog

Security

• Empty security.access_roles is fail-closed (deny) unless allow_unauthenticated or a custom access_checker is set.

Full Changelog: v1.14.1...v1.14.2

Release v1.14.1

v1.14.1

Changelog

Added

• REQ-CS-008: igor-php/igor-php (require-dev only), root igor.json, Composer/Makefile igor target, and release-check wiring for FrankenPHP worker-state audit.

Changed

• Worker safety (Igor): justified // @igor-ignore annotations and/or ResetInterface / request-scoped fixes so make igor passes on package src/.

Full Changelog: v1.14.0...v1.14.1

Release v1.13.5

v1.13.5

Changelog

Changed

• Tests: coverage-completion cases for schema checker, setup journal, DI, and panel forms (REQ-TEST-003).
• Tests: extract FakeDbalConnection / FakeDbalResult / FakeDurableSetupDoneStore so coverage tests can autoload and subclass them.

Full Changelog: v1.13.0...v1.13.5

Release v1.14.0

Release v1.14.0 - FrankenPHP worker mode (reset false) + worker restart signal

Changelog

Added

• Worker restart signal (FrankenPHP worker mode): Worker\WorkerRestartSignal writes var/site-backup/worker-restart.required and dispatches Event\WorkerRestartRequiredEvent after a restore applied files, after cache_clear, and after database_url wrote .env.local. Command nowo:site-backup:worker-restart shows the signal (exit code 3 when a restart is required) and clears it with --clear.
• ConditionalAnswerStep::getInner().
• Audit document FRANKENPHP-WORKER-AUDIT.md (scenario B: kernel not reset between requests).

Fixed

• Worker mode (scenario B): DoctrineDbalSetupProgressStorage and DoctrineDbalSetupStepJournal no longer trust a stale "schema ensured" flag for the life of the worker. When a query fails after the table was created earlier in the process (database dropped / recreated), the table is re-created and the query retried once. Both services implement ResetInterface (kernel.reset); correctness does not depend on the resetter.
• Cold-start PDO fallback sets PDO::ATTR_TIMEOUT (5 s).
• PHPStan findings cleared (level 8).

Documentation

• UPGRADING.md From 1.13.8 to 1.14.0; DEMO-FRANKENPHP.md links the worker audit.

What's Changed

• chore(deps): bump friendsofphp/php-cs-fixer from 3.95.22 to 3.95.23 by @dependabot[bot] in #18
• chore(deps): bump the symfony group with 2 updates by @dependabot[bot] in #19
• chore(deps): bump friendsofphp/php-cs-fixer from 3.95.23 to 3.95.24 by @dependabot[bot] in #20
• chore(deps): bump the symfony group with 2 updates by @dependabot[bot] in #21

Full Changelog: v1.13.8...v1.14.0

Release v1.13.8

Release 1.13.8

See docs/CHANGELOG.md for details.

Changelog

Changed

• Docs: PHP-FIG PSR evaluation (REQ-CS-007).
• Style: PHP CS Fixer alignment.

Notes

• No API or configuration changes for integrators unless noted above.

What's Changed

• chore(deps): bump friendsofphp/php-cs-fixer from 3.95.18 to 3.95.20 by @dependabot[bot] in #17
• chore(deps): bump nowo-tech/ui-kit-bundle from 1.7.0 to 1.8.2 by @dependabot[bot] in #16

Full Changelog: v1.13.7...v1.13.8

Release v1.13.7

Release v1.13.7

Changelog

Added

• setup.short_circuit_when_done (default true): SetupNeedEvaluator skips all need detectors when the setup.done marker exists or DurableSetupDoneStoreInterface::isDone() is true. Avoids repeated Doctrine / host catalog probes on every request after setup. Set false only if a host detector must re-open the gate after done.

Full Changelog: v1.13.6...v1.13.7