Repository navigation
Update dependency symfony/flex to v2.12.0 - autoclosed - #49
Closed
renovate[bot] wants to merge 1 commit into
Closed
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
![artidezi-etke-cc[bot]](https://avatars.githubusercontent.com/in/4931784?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
The agent prepared adaptations for human review. The original change remains open.
Update Symfony Flex to 2.12.0 and regenerate lock metadata with the repository-pinned Composer 2.10.3. The source lock fails strict validation because its content hash does not match composer.json; the replacement preserves the Flex update and all other dependency versions. Composer install, validation/audit, PHP analysis/style checks and frontend checks passed. No workflow changes are needed; the proposal remains for human merge.
Agent-assessed risk: Low. Only the Flex plugin and lock metadata change, and installation plus PHP/frontend checks pass; deployment and recipe-update migrations were not exercised.
Evidence (8 items)
- Evidence:
git diff 852b23c0912f1992ec795ddb86287e3302613c32...refs/artidezi/inputs/source-pr— Merge base equals the recorded target base. The source changes only app/composer.lock: Flex 2.11.0 to 2.12.0 plus content hash, publication and plugin API metadata. There are no newer target-only changes to reconcile. - Release notes: source — Official release identifies commit 3d37e85, matching the locked package, and describes fixes to recipes, constraint handling and Composer integration. No operator migration is indicated for this plugin update.
- Local check:
./bin/composer validate --strict (source lock)— Failed with exit 2: lock file out of date with composer.json. This reproduces a concrete defect; the supplied PHP CI excerpt does not identify its failure cause. - Local check:
./bin/composer update --lock --no-install --no-scripts --no-interaction— Passed using the pinned Composer 2.10.3 helper. Regenerated metadata without changing resolved dependency versions; restored the valid target content hash and compatible Composer metadata while retaining Flex 2.12.0. - Local check:
./bin/composer validate --strict; ./bin/composer install --no-interaction --prefer-dist; ./bin/composer audit --locked— All passed on the replacement. Installed 92 packages with plugins enabled and generated autoload files. Audit reported no security vulnerability advisories. - Local check:
docker build --iidfile /tmp/artidezi-php-image.id etc/docker/php; docker run --rm --network none --user "$(id -u):$(id -g)" --mount "type=bind,src=$PWD,dst=/code" --workdir /code/app --entrypoint /bin/sh "$(cat /tmp/artidezi-php-image.id)" -ec <runtime probe and PHP checks>— Build passed using cached layers. Runtime autoload probe confirmed PHP 8.5.12, ext-mongodb 2.5.5, mongodb/mongodb 2.5.0 and Flex 2.12.0. Installed MongoDB library requires ext-mongodb ^2.5, satisfied by the actual image. vendor/bin/phpstan analyse -c phpstan.neon --no-progress passed; vendor/bin/php-cs-fixer check --config=.php-cs-fixer.dist.php passed for 146 files; vendor/bin/twig-cs-fixer lint --config=.twig-cs-fixer.dist.php passed for 38 files. CS Fixer emitted an advisory about the root PHP 8.4 minimum versus the PHP 8.5 runtime. No database or monitoring stack was started. - Local check:
just js-analyze js-build; ./bin/node /bin/sh -c 'cd /app/src && npm audit'; ./bin/node /bin/sh -c 'cd /app && npm ls --all'— All passed: ESLint, TypeScript tsc --noEmit and build.mjs asset build; npm audit found zero vulnerabilities and the installed dependency tree had no invalid/missing peers. Generated output remained ignored. Browser behavior was not exercised because no frontend dependency, asset-path or runtime-loading changes are present. - Local check:
git diff --check; git status --short— Whitespace check passed and the working tree was clean after committing the complete replacement series on the recorded target base. No workflow changes or forge actions were performed.
Adaptation: #50
Assessed source b96f5ae650c2250cee8630baab8733f167acfdbd.
renovate
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.11.0→2.12.0Release Notes
symfony/flex
v2.12.0Compare Source
What's Changed
null as array offsetwhen running composer without command by @JorickPepin in #1092$1, backslashes, quotes and generated secrets in recipe values by @nicolas-grekas in #1120assets-diroption to configure wherecontrollers.jsonis by @nicolas-grekas in #1119New Contributors
Full Changelog: symfony/flex@v2.11.0...v2.12.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.