Release v2.13.3

v2.13.3

Changelog

Reproducible JS bundle: the build stamp is a hash of the sources instead of the build time. See UPGRADING.

Changed

• Assets: reproducible bundle build. __FORM_KIT_HELP_MODAL_BUILD_TIME__ now holds a build id (a hash of the TypeScript/CSS sources and pnpm-lock.yaml) instead of the build time, so rebuilding unchanged sources (make assets, make release-check) no longer rewrites the committed JS; the console line reads script loaded, build: <id>.
• Developer tooling (REQ-MAKE-002): make release-check runs the full REQ-MAKE-002 chain in order: ensure-up now runs first and the demo release-check runs before test-ts (ensure-up, co-author and open-PR gates, check-twig-extra, composer-sync, cs-fix, cs-check, rector-dry, phpstan, igor, coverage-check, demo release-check, test-ts). New make check-no-raw-html-form target (.scripts/check-no-raw-html-form.sh, REQ-TWIG-005); it joins the chain once the remaining raw form markup is migrated or allowlisted as form-theme files.
• Demo (REQ-TWIG-003): the showcase pages (choice_fields, ckeditor, conditional_fields, data_transformers, nowo_special_fields, ux_autocomplete, nested, locale_tabs, search, dropzone, cropper) and the ConditionalFieldsLive component render their forms through the child loop instead of one form_row(form.x) per field: grid columns come from a field-name map, the nested section headings open at the field named in a map, locale_tabs emits the _locale_tabs include at the first name_* field and search keeps its input-group layout (rule 3); form_end(form) replaces form_rest + render_rest: false.

Security

• Dev dependencies: the bundle and demo/symfony8 pnpm lockfiles resolve source-map-js 1.2.2 (was 1.2.1, GHSA high) and vite 6.4.5 (was 6.4.1); the vite range is now ^6.4.5. The rebuilt help-modal.js is byte-identical, so no shipped asset changes.

Full Changelog: v2.13.2...v2.13.3