AlexSkrypnyk · Oct 26, 2026 · Aug 31, 2026 · Aug 31, 2026 · Oct 25, 2026 · Oct 25, 2026
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -157,9 +157,14 @@ jobs:
       #;> TOOL_HADOLINT
 
       #;< TOOL_DCLINT
+      # The remote Docker engine has no access to the checkout, so the files
+      # are copied into the container.
       - run:
           name: Lint Docker Compose files with DCLint
-          command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:3.1.0 . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+          command: |
+            container="$(docker create --rm zavoloklom/dclint:3.1.0 .)"
+            docker cp ./. "${container}:/app"
+            docker start --attach "${container}" || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ]
       #;> TOOL_DCLINT
 
       - run:
@@ -249,10 +254,15 @@ jobs:
           command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ]
 
       #;< CI_GITLEAKS
+      # The remote Docker engine has no access to the checkout, so the files
+      # are copied into the container.
       - run:
           name: Scan for committed secrets with Gitleaks
           when: always
-          command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:v8.30.1 dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ]
+          command: |
+            container="$(docker create --rm -w /repo ghcr.io/gitleaks/gitleaks:v8.30.1 dir . --no-banner)"
+            docker cp ./. "${container}:/repo"
+            docker start --attach "${container}" || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ]
       #;> CI_GITLEAKS
 
   # Test the provisioned site. Runs in parallel with the lint and build jobs.
@@ -561,6 +571,11 @@ jobs:
       - store_artifacts:
           path: *artifacts
 
+      # Placed after the test steps so a dirty tree never suppresses them.
+      - run:
+          name: Check that the build left a clean working tree
+          command: ./vendor/bin/vortex-check-worktree-changes || [ "${VORTEX_CI_WORKTREE_CHANGES_IGNORE_FAILURE:-0}" -eq 1 ]
+
   #;< DEPLOYMENT
   # Build the deployable in parallel with the lint and test jobs. For artifact
   # deployments, it exports the built codebase for the deploy job; for

diff --git a/.circleci/update-dependencies.yml b/.circleci/update-dependencies.yml
@@ -33,7 +33,7 @@ jobs:
   # Variables provided below can be overridden in the CircleCI project settings.
   update-dependencies:
     docker:
-      - image: renovate/renovate:40.36.8
+      - image: renovate/renovate:44.176.2
         environment:
           RENOVATE_PLATFORM: 'github'
           RENOVATE_AUTODISCOVER: false

diff --git a/.circleci/vortex-test-common.yml b/.circleci/vortex-test-common.yml
@@ -418,6 +418,11 @@ jobs:
       - store_artifacts:
           path: *artifacts
 
+      # Placed after the test steps so a dirty tree never suppresses them.
+      - run:
+          name: Check that the build left a clean working tree
+          command: ./vendor/bin/vortex-check-worktree-changes || [ "${VORTEX_CI_WORKTREE_CHANGES_IGNORE_FAILURE:-0}" -eq 1 ]
+
   # DIDI-FI variant jobs
   vortex-dev-didi-database-fi:
     <<: *runner_config
@@ -481,9 +486,10 @@ jobs:
   vortex-dev-database-ii:
     <<: *runner_config
     environment:
-      VORTEX_FETCH_DB_SOURCE: VORTEX_CONTAINER_REGISTRY
+      VORTEX_FETCH_DB_SOURCE: container_registry
       VORTEX_FETCH_DB_FORCE: 1
       VORTEX_DB_IMAGE: drevops/vortex-dev-mariadb-drupal-data-demo-destination-11.x
+      COMPOSE_PROGRESS: plain
       VORTEX_PUSH_CONTAINER_REGISTRY_IMAGE_TAG: vortex-dev-database-ii
       VORTEX_EXPORT_DB_CONTAINER_REGISTRY_PUSH_PROCEED: 1
       VORTEX_CI_DB_CACHE_BRANCH: vortex-dev-didi-ii

diff --git a/.claude/settings.json b/.claude/settings.json
@@ -4,5 +4,16 @@
       "Bash(ahoy:*)"
     ],
     "deny": []
+  },
+  "extraKnownMarketplaces": {
+    "vortex": {
+      "source": {
+        "source": "directory",
+        "path": "./.vortex"
+      }
+    }
+  },
+  "enabledPlugins": {
+    "vortex@vortex": true
   }
 }
diff --git a/.docker/clamav.dockerfile b/.docker/clamav.dockerfile
@@ -8,7 +8,7 @@
 # @see https://hub.docker.com/r/uselagoon/commons/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/commons
 
-FROM uselagoon/commons:26.8.1 AS commons
+FROM uselagoon/commons:26.10.0 AS commons
 
 FROM clamav/clamav-debian:1.5.4
 

diff --git a/.docker/cli.dockerfile b/.docker/cli.dockerfile
@@ -8,7 +8,7 @@
 # @see https://hub.docker.com/r/uselagoon/php-8.4-cli-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/php-cli-drupal
 
-FROM uselagoon/php-8.4-cli-drupal:26.8.1
+FROM uselagoon/php-8.4-cli-drupal:26.10.0
 
 # Add missing variables.
 # @todo Remove once https://github.com/uselagoon/lagoon/issues/3121 is resolved.
@@ -62,11 +62,12 @@ ENV PHP_INI_SCAN_DIR="${PHP_INI_SCAN_DIR}:/app/drush/php-ini"
 # Add more tools.
 # hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache ncurses pv tzdata autoconf g++ make && \
-    pecl install pcov && \
-    docker-php-ext-enable pcov && \
+    pie install --no-build-tools-check pecl/pcov && \
     docker-php-ext-install pcntl && \
     apk del g++ make autoconf
 
+COPY ./.docker/config/cli/custom.ini /usr/local/etc/php/conf.d/custom.ini
+
 # Add patches and scripts.
 COPY patches /app/patches
 COPY scripts /app/scripts
@@ -78,7 +79,7 @@ COPY scripts /app/scripts
 # to the repository.
 # The .env file (and other environment files) is copied into the image, as it
 # may be needed by Composer scripts to access additional variables.
-COPY composer.json composer.* patches.lock.* .env* auth* /app/
+COPY composer.json composer.* patches.lock.* .env* /app/
 
 #;< VORTEX_DEV
 # Copy the in-tree drevops/vortex-tooling package so the path repository

diff --git a/.docker/config/cli/custom.ini b/.docker/config/cli/custom.ini
@@ -0,0 +1 @@
+; Custom configuration for the CLI service.
diff --git a/.docker/config/php/custom.ini b/.docker/config/php/custom.ini
@@ -0,0 +1,6 @@
+; Custom configuration for the PHP service.
+
+[Session]
+; Drupal does not use session upload progress, so it is turned off to reduce
+; the attack surface of multipart requests.
+session.upload_progress.enabled = Off
diff --git a/.docker/database.dockerfile b/.docker/database.dockerfile
@@ -8,7 +8,7 @@
 #
 # The ARG value will be updated with a value passed from docker-compose.yml
 
-ARG IMAGE=uselagoon/mysql-8.4:26.8.1
+ARG IMAGE=uselagoon/mysql-8.4:26.10.0
 FROM ${IMAGE}
 
 # hadolint ignore=DL3066 # named account provided by the base image

diff --git a/.docker/nginx-drupal.dockerfile b/.docker/nginx-drupal.dockerfile
@@ -8,7 +8,7 @@
 ARG CLI_IMAGE
 FROM ${CLI_IMAGE:-cli} AS cli
 
-FROM uselagoon/nginx-drupal:26.8.1
+FROM uselagoon/nginx-drupal:26.10.0
 
 # Webroot is used for Nginx web root configuration.
 ARG WEBROOT=web

diff --git a/.docker/php.dockerfile b/.docker/php.dockerfile
@@ -9,9 +9,11 @@
 ARG CLI_IMAGE
 FROM ${CLI_IMAGE:-cli} AS cli
 
-FROM uselagoon/php-8.4-fpm:26.8.1
+FROM uselagoon/php-8.4-fpm:26.10.0
 
 # hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache tzdata
 
+COPY ./.docker/config/php/custom.ini /usr/local/etc/php/conf.d/custom.ini
+
 COPY --from=cli /app /app
diff --git a/.docker/solr.dockerfile b/.docker/solr.dockerfile
@@ -3,7 +3,7 @@
 # @see https://hub.docker.com/r/uselagoon/solr-9-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/blob/main/images/solr-drupal/9.Dockerfile
 
-FROM uselagoon/solr-9-drupal:26.8.1
+FROM uselagoon/solr-9-drupal:26.10.0
 
 # Solr jump-start config needs to be manually copied from the search_api_solr
 # Drupal module to .docker/config/solr/config-set.

diff --git a/.dockerignore b/.dockerignore
@@ -11,6 +11,9 @@
 .vscode
 **/.DS_Store
 
+# Credentials. The package token reaches the build through a build secret.
+auth*
+
 # Drupal directories generated by Composer during the image build.
 web/core
 web/libraries

diff --git a/.editorconfig b/.editorconfig
@@ -14,7 +14,7 @@ trim_trailing_whitespace = true
 insert_final_newline = true
 
 # Matches the Prettier 'printWidth' in .prettierrc.json.
-[*.js]
+[*.{js,mjs,cjs}]
 max_line_length = 160
 
 [*.{json,lock}]
@@ -23,9 +23,6 @@ indent_size = 4
 [*.xml]
 indent_size = 4
 
-[eslint.config.mjs]
-indent_size = 2
-
 [.prettierrc.json]
 indent_size = 2
 

diff --git a/.env b/.env
@@ -111,7 +111,7 @@ DRUPAL_CLAMAV_MODE=daemon
 ################################################################################
 
 # By "provision", we mean the process of initialising the database (from dump
-# or fresh install from profile), running updates, appying configuration
+# or fresh install from profile), running updates, applying configuration
 # changes, clearing caches and performing other tasks that prepare the site for
 # use.
 # @see https://www.vortextemplate.com/docs/development/provision
@@ -141,6 +141,12 @@ VORTEX_PROVISION_FALLBACK_TO_PROFILE=0
 # drush config:import from silently overwriting those changes.
 VORTEX_PROVISION_VERIFY_CONFIG_UNCHANGED_AFTER_UPDATE=0
 
+# Verify that configuration was not changed by post-provision operations.
+# If enabled and config files are present, the provision will fail if any
+# active configuration item differs from the exported configuration once
+# configuration imports, deployment hooks and deploy steps have run.
+VORTEX_PROVISION_VERIFY_CONFIG_UNCHANGED_AFTER_PROVISION=0
+
 #;< !PROVISION_TYPE_PROFILE
 # Skip database sanitization.
 #

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
@@ -70,7 +70,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
         with:
           php-version: '8.4'
           tools: composer

diff --git a/.github/workflows/build-test-deploy.yml b/.github/workflows/build-test-deploy.yml
@@ -92,7 +92,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
         with:
           php-version: '8.4'
           tools: composer
@@ -272,7 +272,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
         with:
           php-version: '8.4'
           tools: composer
@@ -490,7 +490,7 @@ jobs:
 
       #;< CODE_COVERAGE_PROVIDER_CODECOV
       - name: Upload coverage report to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
         if: ${{ env.VORTEX_CI_IS_PHPUNIT_RUNNER == 'true' && env.CODECOV_TOKEN != '' }}
         continue-on-error: true
         with:
@@ -552,7 +552,7 @@ jobs:
           fi
 
       - name: Upload test artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: test-artifacts-${{ matrix.instance }}
@@ -572,6 +572,11 @@ jobs:
             .logs/test_results/**/*.xml
       #;> TOOL_PHPUNIT_BEHAT
 
+      # Placed after the test steps so a dirty tree never suppresses them.
+      - name: Check that the build left a clean working tree
+        run: ./vendor/bin/vortex-check-worktree-changes
+        continue-on-error: ${{ vars.VORTEX_CI_WORKTREE_CHANGES_IGNORE_FAILURE == '1' }}
+
       - name: Setup tmate session
         if: ${{ !cancelled() && github.event.inputs.enable_terminal }}
         uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3
@@ -617,7 +622,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
         with:
           php-version: '8.4'
           tools: composer
@@ -651,7 +656,7 @@ jobs:
           du -sh "/tmp/artifacts"
 
       - name: Upload exported codebase as an artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: ${{ contains(env.VORTEX_DEPLOY_TYPES, 'artifact') }}
         with:
           name: code-artifact
@@ -705,7 +710,7 @@ jobs:
           ref: ${{ env.DEPLOY_BRANCH || github.head_ref || github.ref_name }}
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
         with:
           php-version: '8.4'
           tools: composer
@@ -720,7 +725,7 @@ jobs:
       #;< DEPLOY_TYPES_ARTIFACT
       # Artifact deployments do not work for manual deploys as the build job is skipped.
       - name: Download exported codebase as an artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         if: ${{ !inputs.deploy_target && contains(env.VORTEX_DEPLOY_TYPES, 'artifact') }}
         with:
           name: code-artifact

diff --git a/.github/workflows/draft-release-notes.yml b/.github/workflows/draft-release-notes.yml
@@ -41,8 +41,13 @@ jobs:
           echo "Version set to ${VERSION}"
 
       - name: Draft release notes
-        uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0
+        uses: release-drafter/release-drafter@978bb0b30c5ee8cdd332ced253758157150d43f0 # v7.10.0
         with:
           tag: ${{ steps.calver.outputs.version }}
           name: ${{ steps.calver.outputs.version }}
           version: ${{ steps.calver.outputs.version }}
+          #;< VORTEX_DEV
+          # The previous release is the numerically highest one, so the range
+          # excludes the releases left behind by the switch from CalVer.
+          filter-by-range: '>=1.0.0 <7.0.0'
+          #;> VORTEX_DEV
diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
@@ -58,16 +58,16 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22.17.1
 
       - name: Validate Renovate configuration
-        uses: suzuki-shunsuke/github-action-renovate-config-validator@ee9f69e1f683ed0d08225086482b34fc9abe9300 # v2.1.0
+        uses: suzuki-shunsuke/github-action-renovate-config-validator@1e1604219a6b38ae9a10aff42a28a3656322c31a # v2.4.1
 
       - name: Run Renovate
         if: steps.check-requirements.outputs.should_run == 'true'
-        uses: renovatebot/github-action@e09d604f8f803bb527bd8321ed5be06c460b8682 # v46.2.2
+        uses: renovatebot/github-action@f0f41e5f2e706165f6814b1d0f0d0e319de7d1d9 # v46.3.8
         with:
           configurationFile: renovate.json
           token: ${{ secrets.RENOVATE_TOKEN }}