Skip to content

Release v1.24.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Aug 07:40
· 24 commits to main since this release
v1.24.0
1e66f2f

docs(release): cut v1.24.0 changelog, upgrading, and roadmap.

AuthKit 1.20 security kits, ops ingest hardening (106), and SQL error context (107).

Changelog

Added

  • AuthKit 1.20.0 with optional kits: nowo-tech/slide-to-confirm-bundle 1.1.0 (registration consent slider, profile gate; clear history in project Settings uses the danger profile), nowo-tech/device-intelligence-bundle 1.1.1 (collect on AuthKit pages, new-device email, extra device-keyed rate limit on register/reset/magic, Account → Security → Trusted browsers), and nowo-tech/otp-input-bundle on /reset-password/complete (otp_input.enabled, multi-box OtpType; server OTP checks unchanged). Device ID is not a credential; AuthKit never auto-trusts a device after login. QR approve stays a button (UC-AUTH-22). Cookie di_obs is inventoried as required account-security. Migration Version20260824120000. Phone SMS verification remains ROADMAP Later.
  • Ops ingest hardening (106): Redis-backed MessengerQueueHealth depths for async_ingest / async / failed on Ops overview and /metrics (beacon_messenger_failed_pending); cached daily/monthly event quota usage; one Envelope flush retry on unique-constraint races; batched retention purge (1000-row batches); shared PrivateNetworkTarget SSRF helper for Mercure hub + outbound webhooks; app:project:api-key-legacy-secrets dry-run / --apply for redundant Halite API-key ciphertext; EVENT-STORAGE.md growth stages.
  • SQL / database error context (107): issue and event detail show a Query panel (SQLSTATE, vendor code, SQL, bindings) derived from contexts.db, extra, query breadcrumbs, or exception text. Stack opens the in-app frame. issue.culprit widened to 255 (migration Version20260826120000 on MySQL). AI export includes optional query. Sample seed issue #1 is a QueryException-like event. Companion BeaconBundle 1.8.0 attaches contexts.db on PDO/DBAL exceptions.
  • Setup: paste SITE_SETUP_TOKEN through a FormKit GET gate on the setup wizard.

Changed

  • Guest AuthKit layout loads slide-to-confirm, device-intelligence, and OTP-input assets; device collect boot uses the CSP nonce (vendor inline script would be blocked).
  • Composer pins (nowo-tech/* patch + FormKit minor): audit-kit 1.1.15, auth-kit 1.20.0, beacon-bundle 1.8.0, breadcrumb-kit 2.1.7, cookie-consent 1.9.6, dashboard-menu 2.1.10, device-intelligence 1.1.1, doctrine-encrypt 2.3.12, form-kit 2.5.2, http-log 1.1.5, login-throttle 3.1.4, maintenance-mode 1.5.7, migrations-kit 2.0.21, password-policy 1.4.3, password-strength 2.2.3, password-toggle 2.1.4, phone-input 1.3.3, pwa 1.3.3, routing-kit 1.4.4, select-all-choice 1.5.4, site-backup 1.13.8, tag-input 1.1.3, ui-kit 1.8.3, user-kit 1.1.9. Symfony 8.1.5 where that patch exists (console/form/framework/http-client/mailer/messenger/translation/uid/validator/yaml + browser-kit/css-selector/web-profiler). Dev: php-cs-fixer 3.95.22, composer-update-helper 2.0.36, hot-reload 1.4.2, phpstan-frankenphp 1.1.3, twig-inspector 1.1.4, phpstan 2.2.9.
  • Dashboard Menu 2.1.10: kit tags SearchQueryType as form.type (with FormOptionsMerger); remove host config/services/dashboard_menu.yaml override that was required on 2.1.9.
  • FormKit 2.5.2: drop host nowo_form_kit.type_map.search (built-in since 2.4.0); project clear history uses addSlideToConfirmField() (mapped: false is the type default).
  • Device collect while gated: MaintenanceMode excludes /_device; PWA deny_cache_patterns includes /_device (cache_version v6). SiteBackup documents setup.short_circuit_when_done: true (1.13.7+ default — Beacon detectors must not re-open the wizard after done).
  • Member alert preference/event and push subscription timestamps use AuditKit TimestampableTrait (not host-copied trait logic).
  • PHPStan / QA: empty baseline; no ignoreErrors in phpstan.neon.dist; injectable Clock / DNS / Halite FS seams for FrankenPHP rules; Rector semantic-only (CS-Fixer owns formatting); PHPUnit suite PHPStan-clean; includable coverage 100%.
  • Cookie consent embedded without a kernel sub-request (faster public pages).
  • Prod Compose: Messenger Redis DSNs no longer use path /messages (path is the stream name, not a DB index).

Fixed

  • Mercure hub URL guard aligned with outbound webhook SSRF policy (PrivateNetworkTarget; metadata targets always blocked).
  • Ops overview queue depth sourced from App\Ops\Messenger\MessengerQueueHealth (Redis transports, including failed).
  • E2E: slide-to-confirm confirmed via pointer drag and keyboard in CI; flaky 403 navigation retries.

Notes for integrators

  • Doctrine migrations: Version20260824120000 (device intelligence tables) and Version20260826120000 (issue.culprit → VARCHAR(255) on MySQL).
  • After pull: composer install, php bin/console doctrine:migrations:migrate -n, php bin/console assets:install (or make ready), make seed-platform (cookie inventory for di_obs), rebuild assets if you override kit templates (make vite-build).
  • Dogfood / client apps: pin nowo-tech/beacon-bundle ≥ 1.8.0 for structured contexts.db on database exceptions.
  • PWA operators: deploy assets/SW so cache_version v6 picks up /_device deny-cache.
  • See UPGRADING.md Upgrading from 1.23.3 to 1.24.0.
Assets 2
Loading