Release v1.5.5

Release 1.5.5

See docs/CHANGELOG.md for details.

Changelog

Changed

• Demos: MySQL env policy in FrankenPHP stack (REQ-DEMO-011).
• Docs: PHP-FIG PSR evaluation (REQ-CS-007).
• Dependencies: routine Composer/npm bumps (Dependabot).

Notes

• No API or configuration changes for integrators unless noted above.

What's Changed

• chore(ci): bump actions/checkout from 6 to 7 by @dependabot[bot] in #5
• chore(ci): bump actions/setup-node from 4 to 7 by @dependabot[bot] in #6

Full Changelog: v1.5.4...v1.5.5

Release v1.5.4

Release v1.5.4: ship Flex recipe access_control files

Changelog

Security

• Flex recipe: ship security_nowo_task_board.yaml access rules (REQ-SEC-004). Prefer ^1.5.4 over v1.5.3.

What's Changed

• feat(recipe): security access_control for task board by @HecFranco in #4

Full Changelog: v1.5.3...v1.5.4

Release v1.5.3

Release v1.5.3: Flex recipe access_control

Changelog

Security

• Flex recipe: security.access_control for task board routes (REQ-SEC-004).

Full Changelog: v1.5.2...v1.5.3

Release v1.5.2

Release v1.5.2: Symfony 8 demos and Hot Reload 1.4.

Changelog

Changed

• Demos: pin nowo-tech/hot-reload-bundle to ^1.4 with FrankenPHP Mercure/hot_reload (dev/test only).

What's Changed

• chore(deps): update vincentlanglet/twig-cs-fixer requirement from ^3.0 to ^4.0 by @dependabot[bot] in #1
• fix(cs): exclude demo reference.php from PHP-CS-Fixer by @HecFranco in #2
• docs: align README and roadmap with shipped functionality by @HecFranco in #3

New Contributors

• @dependabot[bot] made their first contribution in #1
• @HecFranco made their first contribution in #2

Full Changelog: v1.5.1...v1.5.2

Release v1.5.1

Release v1.5.1: fix services_timetrack.yaml indentation.

Changelog

Fixed

• CI: correct indentation in src/Resources/config/services_timetrack.yaml (YAML parse error broke container boot / PHPUnit).

Full Changelog: v1.5.0...v1.5.1

Release v1.5.0

Release v1.5.0

Changelog

Changed

• FormKitBundle: depend on nowo-tech/form-kit-bundle ^2.0. Admin form types use FormOptionsTrait + profile task_board (#[FormKitConfig]). Extension prepends that profile when missing; form types are tagged form.type so FormOptionsMerger is injected.

Added

• REQ-TWIG-004: require twig/extra-bundle + twig/string-extra; make check-twig-extra in release-check; demos register TwigExtraBundle.
• Twig-CS-Fixer: vincentlanglet/twig-cs-fixer, .twig-cs-fixer.php, composer twig:lint / twig:fix.

Changed

• REQ-UI-001-kit: Requires nowo-tech/ui-kit-bundle ^1.4. Layout/manage Twig load asset('css/nowo-ui.css', 'nowo_ui_kit') and import @NowoUiKitBundle/macros/ui.html.twig (domain macros _task_member_label / _task_priority_tag unchanged). Extension seeds nowo_ui_kit from templates.css_framework when the host has not configured UiKit. Demo registers NowoUiKitBundle + nowo_ui_kit.yaml.

Full Changelog: v1.4.0...v1.5.0

Release v1.4.0

Release v1.4.0 - REQ-UI-002 allow_unauthenticated + Packagist TimeTrack

Changelog

Added

• REQ-UI-002 — security.allow_unauthenticated (default false) and AllowAllTaskBoardAccessChecker for trusted demos/dev only.
• Compile-time guard: when allow_unauthenticated is false, symfony/security-bundle is required (LogicException otherwise).
• GitHub hygiene workflows: Dependabot, stale issues/PRs (actions/stale v11), semantic PR title lint, Copilot instructions.

Changed

• CI / local Compose no longer clone or path-mount sibling TimeTrack / TagInput / TipTap repos; TimeTrack comes from Packagist (^1.0).
• Demo composer.json pins nowo-tech/twig-inspector-bundle to ^1.0.
• Docs: CONFIGURATION / SECURITY document allow_unauthenticated and the SecurityBundle requirement.

Compatibility

• PHP >=8.2, <8.6; Symfony ^7.4 || ^8.0.
• Manage UI with default security settings requires SecurityBundle (or set allow_unauthenticated: true for trusted local demos).

Full Changelog: v1.3.1...v1.4.0

Release v1.3.1

v1.3.1

Changelog

Security

• REQ-SEC-005 — CSRF on bare manage POSTs that previously lacked tokens: column reorder, task move (kanban drag), task advance, priority update, remove link, remove member. Invalid/missing _token → access denied (fail-closed). Bundle Twig and board Stimulus fetch now send matching tokens.

Full Changelog: v1.3.0...v1.3.1

Release v1.3.0

Release v1.3.0 - templates.layout / css_framework (REQ-UI-001)

Changelog

Added

• REQ-UI-001 layout wiring — templates.layout is exposed as Twig global nowo_task_board_layout via TaskBoardTwigExtension. Manage pages {% extends nowo_task_board_layout %} and stack CSS/JS with {{ parent() }}. Demo layout.html.twig keeps Tabler CDN; hosts set templates.layout to the project layout or a bridge (layout_integrate_host.html.twig). Documented in CONFIGURATION.md / USAGE.md / UPGRADING.md.
• REQ-UI-001 templates.css_framework — enum (tabler default, matching demo CDN; also bootstrap5 / bootstrap / bootstrap4 / tailwind / foundation / custom / none). Container parameter nowo_task_board.templates.css_framework and Twig global nowo_task_board_css_framework. Invalid values rejected.

Full Changelog: v1.2.4...v1.3.0

Release v1.2.4

Release v1.2.4 - FrankenPHP banner, demo PHP 8.5, PHPStan stubs