v1.6.1

What's Changed

• b-1.5 => main by @nlo-tronet in #99
• feat(#140): bin/release CLI + metapackage fold-in prerequisites by @ralftrapp in #121
• feat(#140): post-#121 fixes from 12.1 live dry-run + UX by @ralftrapp in #123
• docs(#140): close §13 (wiki) and §14 (branch normalization) by @ralftrapp in #124
• docs(#140): extend §14 to cover 5 missed release-eligible repos by @ralftrapp in #125
• feat(#140): wire live execution in ReleaseCommand (§15) by @ralftrapp in #126
• feat(#140): zero-config repo discovery + auto-clone + UpToDateGate (§16) by @ralftrapp in #127
• feat(#140): ComposerInstallGate refinements + --no-audit CLI flag by @ralftrapp in #128
• fix(#140): use bundled composer in ComposerInstallGate by @ralftrapp in #129
• fix(#140): drop --no-audit; bundled composer 2.2.x predates audit feature by @ralftrapp in #130
• docs+feat(#140): close §17/§18, archive change, auto-detect nested working trees by @ralftrapp in #131
• chore(#148): drop unused symfony/expression-language dep by @ralftrapp in #135
• feat(#145): auto-bump theme.php version line at release time by @ralftrapp in #132
• feat(#137): fail quality gate when coverage drops below 90% by @ralftrapp in #133
• perf(#112): speed up admin order overview (SQL index-friendliness + skip stats on detail view) by @ralftrapp in #138
• fix(#125): Config::reinitialize must clear in-memory params before re-init by @ralftrapp in #139
• feat(#143): bin/oe-console oe:user:change-password + oe:user:create --role={admin|customer} by @ralftrapp in #134
• fix(#140): bump CI composer pin 2.2.21 → 2.2.28 (GHSA-f9f8-rm49-7jv2) by @ralftrapp in #141
• Delete .github/workflows/tests.yml by @nlo-tronet in #142
• test(#127): regression guard for docker.sh exit-code propagation by @ralftrapp in #137
• 124 make unit tests theme agnostic flip test fixture default to o3 theme by @nlo-tronet in #147
• feat: multi-worktree Docker — shared MariaDB, per-worktree shop instances with isolated ports and databases by @nlo-tronet in #148
• B 1.6 claude and scripts by @nlo-tronet in #151
• Configurable log level for unknown-controller requests (bot probe noise) by @nlo-tronet in #150
• feat: add oe:module:rebuild-configuration command (#132) by @nlo-tronet in #146
• fix(#157): silence Composer autoload warning on --no-dev install by @nlo-tronet in #149
• 109 test suite detects exceptions by scraping shared oxideshoplog error only substring exception fragile order dependent destructive by @nlo-tronet in #105
• sec: symfony/dom-crawler and symfony/yaml CVEs investigated — not exploitable in O3-Shop, see report-cve-2026-05-26.md by @nlo-tronet in #152
• chore: metapackage update resolves composer/composer advisories — re-baseline audit reports by @nlo-tronet in #154
• bc: Basket::getPaymentId() is now a required basket contract in OrderController::getPayment() by @nlo-tronet in #153
• fix: ensure consistent log directory path handling in Config by @nlo-tronet in #155
• 166 sourcebootstrapphp rewrite hard references exithandler breaks composer install for any 13x 16x upgrade with a non empty vendor by @nlo-tronet in #156
• Adjust bin/release for the metapackage fold-out by @ralftrapp in #157
• fix(#166): guard ExitHandler registration with interface_exists() by @ralftrapp in #158
• refactor(#169): tag shop-metapackage-ce at --to verbatim (drop the --bump workaround) by @ralftrapp in #159
• German language inactive by default — should ship active by @ralftrapp in #160
• fix: export SHOP_CONTAINER for playwright suite after #148 rename by @ralftrapp in #161
• Security review: symfony/yaml & symfony/polyfill-intl-idn CVEs (Low) — not exploitable in O3-Shop; yaml fix deferred to Symfony stack migration by @nlo-tronet in #162
• fix: update initial_data.sql for o3-Theme v1.4.0 color settings by @egate-media-Frank in #165
• fix: use INSERT IGNORE for o3-theme oxconfigdisplay block in initial_… by @egate-media-Frank in #166
• issue #185 by @egate-media-Frank in #167

New Contributors

• @egate-media-Frank made their first contribution in #165

Full Changelog: v1.6.0...v1.6.1