Release v1.23.0

v1.23.0

Changelog

Security: the admin UI refuses to compile without form CSRF protection (CsrfProtectionPass, fail closed). See UPGRADING.

Security

• CSRF fails closed also when only form CSRF is disabled: new CsrfProtectionPass makes the container refuse to compile while the panel (web_ui.enabled) or the setup wizard (setup.enabled) is registered and security.csrf.token_manager or form.type_extension.csrf is missing, or framework.form.csrf_protection is false. The controllers already denied mutations without a token manager, but with framework.form.csrf_protection: false the token manager exists while the panel / wizard forms skipped token validation, so backup / restore / delete and setup steps accepted tokenless cross-site POSTs. See UPGRADING and SECURITY.

Added

• Developer tooling: make check-no-raw-html-form fails on raw <form> / <input> / <textarea> / <select> in bundle views and demo templates, and runs in release-check (REQ-TWIG-005).

Changed

• Demo: the force-setup flag buttons (home page and guest layout gate escape) render through a Symfony Form Type (CsrfOnlyType, CSRF token id demo_force_setup) with form_start / child loop / form_end, and the POST handlers validate with handleRequest + isValid() instead of a hand-rolled _csrf_token input (REQ-TWIG-005).

• Developer tooling: make release-check runs the full REQ-MAKE-002 chain with ensure-up first (then the Cursor co-author, open-PR and Twig extra gates, composer-sync, cs-fix, cs-check, rector-dry, phpstan, igor, translations, coverage-check and the demo release-check).

• Developer tooling: composer test-coverage runs PHPUnit with memory_limit=1G so the HTML coverage report no longer runs out of memory at the 128M default (make test-coverage / coverage-check read the % again).

What's Changed

• fix(security): panel and setup wizard refuse to compile without form CSRF by @HecFranco in #27

Full Changelog: v1.22.2...v1.23.0