Release v0.3.48

Release 0.3.48

Changelog

Added

• Security (REQ-UI-002): canonical security.access_roles (default ROLE_ADMIN), optional access_checker, allow_unauthenticated (demo/dev only); DashboardMenuAccessCheckerInterface + Configurable/AllowAll checkers; DashboardMenuSecurityPass.
• Docs (REQ-DOCS-005 / REQ-TEST-003): TOC on long docs; COVERAGE.md for the PHPUnit coverage gate.
• Tooling (REQ-REL-003 / REQ-MAKE-002 / REQ-TEST-003 / REQ-TEST-011): check-open-prs, coverage-check (fail-under 99%), demo-smoke in release-check.

Changed

• Config BC: dashboard.required_role maps to security.access_roles (deprecated config node). Default access is no longer open when required_role was unset.
• DI (REQ-DI-001 / REQ-OBS-001): ImportExportRateLimiter uses Psr\Clock\ClockInterface and optional LoggerInterface.
• CI / PHPUnit (REQ-SF-005): SYMFONY_DEPRECATIONS_HELPER=max[direct]=0.
• Demos (REQ-DEMO-010): Symfony 8 FrankenPHP image 1-php8.5-alpine; demos set security.allow_unauthenticated: true.
• Dependencies: Dependabot bumps (PHPStan, PHP CS Fixer, Rector, actions/cache v6).
• Demos / QA: demo/Makefile release-check runs update + HTTP verify (no nested path-repo PHPUnit coverage); drop redundant demo exclude from phpunit.xml.dist that broke coverage walks via Composer path symlinks.

Documentation

• UPGRADING.md: 0.3.47 → 0.3.48 (security config migration).
• CONFIGURATION.md, SECURITY.md, GITHUB_CI.md: security + coverage gate notes.

What's Changed

• chore(ci): bump actions/cache from 5 to 6 by @dependabot[bot] in #33
• chore(deps): bump phpstan/phpstan from 2.2.5 to 2.2.6 in the phpstan group by @dependabot[bot] in #36
• chore(deps): bump friendsofphp/php-cs-fixer from 3.95.16 to 3.95.17 by @dependabot[bot] in #37
• chore(deps): bump rector/rector from 2.5.7 to 2.5.8 by @dependabot[bot] in #38

Full Changelog: v0.3.47...v0.3.48