Release v1.3.0

v1.3.0

Changelog

doctrine.table_prefix (TablePrefixListener), SECURITY.md threat model, SensitiveParameter on certificate passwords, PHP 8.5 curl_close deprecation See UPGRADING.

Added

• doctrine.table_prefix (REQ-ORM-002). New option nowo_verifactu.doctrine.table_prefix (default '', letters / digits / underscores only). A Doctrine loadClassMetadata listener (Nowo\VerifactuBundle\Doctrine\TablePrefixListener) prepends it to the verifactu_hash_chain table, its unique constraint and any many-to-many join table of bundle entities (e.g. app_ yields app_verifactu_hash_chain). Host and third-party entities are never touched; the default keeps the historical name.

Security

• Certificate passwords are #[\SensitiveParameter] in CertificateLoader::load() and CurlSoapTransport::send() (redacted from stack traces).

Fixed

• CurlSoapTransport no longer calls curl_close() (no effect since PHP 8.0, deprecated in PHP 8.5).

Deprecated

• nowo_verifactu.hash_chain.table_prefix was never applied; setting it now triggers a deprecation pointing to doctrine.table_prefix. It is still accepted and still has no effect.

Changed

• Developer tooling: Rector targets PHP 8.2, the declared php floor (REQ-CS-003, REQ-SF-001).

Added

• Developer tooling: make check-no-raw-html-form fails on raw <form> / <input> / <textarea> / <select> in bundle views and demo templates, and runs in release-check (REQ-TWIG-005).

Changed

• Demo: the invoice generator renders through a Symfony Form Type (App\Form\InvoiceType; flat field names unchanged, CSRF token id demo_invoice) with form_start / form_row / child loop / form_end; the controller validates with handleRequest + isValid(); the demo now requires symfony/form and symfony/security-csrf (REQ-TWIG-005).
• Developer tooling: make release-check runs the full REQ-MAKE-002 chain in order (ensure-up first, then check-no-cursor-coauthor, check-open-prs, composer-sync, cs-fix, cs-check, rector-dry, phpstan, igor, test-coverage-100, demo release-check); check-open-prs also fails on conflicted pull requests (REQ-REL-003).
• Dependencies refreshed (Composer and pnpm/npm lock files of the bundle and its demos, campaign 2026-10-19).
• .php-cs-fixer.dist.php: new ParallelConfig(2) (REQ-CS-001).

Documentation

• PHPDoc descriptions on every public method in src/ (REQ-CS-001).
• docs/SECURITY.md restructured as a security analysis: scope, attack surface, threat model (threat → mitigation), secrets and cryptography, logging policy, dependency policy, exposure (REQ-SEC-001).
• docs/CONFIGURATION.md documents doctrine.table_prefix with the resulting table names.
• Documentation: wave-1 REQ compliance — README documentation list order (canonical labels, PSR under Additional documentation), Symfony badge lists 7.4 explicitly and GitHub stars image uses the package name, canonical issue templates, demo README links DEMO-FRANKENPHP, per-variable comments in the demo .env.example, CONTRIBUTING Cursor Agent settings, TOCs for long docs, Spec Kit inventory refresh (55/55, LockableHashChainRepositoryInterface).