Release v2.0.18

Release 2.0.18

• Empty PHPStan baseline (level 8) + docs/PHPSTAN.md
• QA: coverage-check, check-open-prs, demo-smoke, deprecation helper
• Docs TOCs; ConstraintDefinitionFactory validates Constraint FQCNs
• Dev deps: php-cs-fixer 3.95.17, rector 2.5.8, phpstan 2.2.6

Changelog

Added

• docs/PHPSTAN.md — PHPStan level 8 policy: empty baseline (ignoreErrors: []); fix findings in code/tests instead of silencing.
• QA Make targets — coverage-check (fail if Lines < 99%, REQ-TEST-003), check-open-prs (REQ-REL-003), demo-smoke (REQ-TEST-011); wired into release-check.
• Scripts — .scripts/coverage-fail-under.sh, .scripts/check-open-prs.sh.
• PHPUnit / CI — SYMFONY_DEPRECATIONS_HELPER=max[direct]=0 (REQ-SF-005) in phpunit.xml.dist and CI test jobs.
• PHPUnit — Broader coverage for traits, controller trait, constraint factory, TwigPathsPass, FormKitExtension.

Changed

• PHPStan — Cleared phpstan-baseline.neon suppressions; PHPDoc and small type-safe cleanups across src/ (traits, mergers, CSS utilities, constraints, static types).
• Docs — Table of contents on CHANGELOG, UPGRADING, INSTALLATION, CONFIGURATION, ROADMAP, SECURITY notes, GITHUB_CI, SPEC-DRIVEN-DEVELOPMENT; README coverage badge 99.4%.
• Dev dependencies — friendsofphp/php-cs-fixer 3.95.15 → 3.95.17; rector/rector 2.5.7 → 2.5.8; phpstan/phpstan 2.2.5 → 2.2.6 (Dependabot).
• Flex recipe stubs — Comment URLs point to GitHub repo FormKitBundle.

Fixed

• .github/SECURITY.md — Correct product name (Form Kit Bundle).
• ConstraintDefinitionFactory — Reject FQCNs that do not extend Symfony Constraint.

What's Changed

• chore(deps): bump phpstan/phpstan from 2.2.5 to 2.2.6 in the phpstan group by @dependabot[bot] in #20
• chore(deps): bump friendsofphp/php-cs-fixer from 3.95.15 to 3.95.17 by @dependabot[bot] in #21
• chore(deps): bump rector/rector from 2.5.7 to 2.5.8 by @dependabot[bot] in #22

Full Changelog: v2.0.17...v2.0.18