Release v1.23.1

release: cut v1.23.1 (pin refresh + update-deps helper)

make update-deps now runs composer-update-helper --run so exact pins move;
bump hot-reload 1.4.0, FormKit 2.4.1, password kits, Mercure 0.5.0, and Symfony 8.1.4.

Changelog

Changed

• make update-deps: runs nowo-tech/composer-update-helper generate-composer-require.sh --run (rewrites exact pins in composer.json) before composer update + pnpm update. Preview still: make composer-outdated. Exact pins never move on composer update alone.
• Composer pins: Symfony 8.1.4 (console/form/framework/messenger/uid/validator/http-client/rate-limiter/redis-messenger/doctrine-messenger/translation + web-profiler); doctrine/orm 3.6.8; nelmio/api-doc-bundle 5.11.1; symfony/mercure-bundle 0.5.0 (host hubs stay protocol 0.x); FormKit 2.4.1; password-strength 2.2.0; password-toggle 2.1.1; nowo-tech/hot-reload-bundle 1.4.0 (nowo:hot-reload:check + profiler environment checks). Dev: php-cs-fixer 3.95.19, phpunit 13.3.1, rector 2.6.2. Frontend: @openai/codex-security ^0.1.14.

Notes for integrators

• No Doctrine migrations. No production operator runtime steps.
• After pull: composer install (and pnpm install if you rebuild assets). Dev: optional bin/console nowo:hot-reload:check after make up.