Repository navigation
Conversation
…llow comments with email addresses.
…f applicable. Sort translations correctly. Show/hide password.
* Add check for phone number in CommentModel * Add check for phone number in CommentController * Add anti-spam check in RelationsController Added functions to check for email address and phone number, and only add the comment if none are detected
…ved to spam on block word.
…nd make forum work with strict mode for DB.
…tes only that member's avatars (#519) setLatitude('')/setLongitude('') into ?float and setChatGoogle(<id string>) into int threw a TypeError on the first member, so nobody was anonymised. Now null, null and 0 (v3.8.5 stored 0 there). Avatars: name('<id>*') also matched other members (12 took 120_xs, 1234); now '<id>' and '<id>_<size>' only. Checked on stage with a test member and look-alike files. Audit B2.
The three empty uk .db marker files were deleted while uk stays in LOCALES, so the database translations for Ukrainian were not loaded. Restored from v3.8.5. Audit B4.
Every autocomplete request wrote the member's search text at ALERT level; prod logs it at debug, which is not recorded. Audit B5.
Port of prod's formatConversation (also develop's): zero-width characters stripped and NFKC applied to a copy before the check, plus .shop, system and support. The message itself stays as written. ConversationModelTest fails on the old code. Audit I1.
route C's lock came from develop and had 27 packages older than prod v3.8.5, among them ezyang/htmlpurifier 4.18 (prod 4.19). composer update of those 27 with dependencies; brick/math kept on prod's 0.18 line. composer audit: no advisories. Two PHPStan baseline entries the newer PHPStan no longer reports are removed. Audit I3.
DBAL 4 rejects ':types'/':memberId' as parameter names and needs an array type for IN (); the errors were swallowed and the filtered list stayed empty. Checked on stage: the adapter's count equals SQL's (81,837). LogAdapterTest fails on the old code. Audit I5.
…s again (#519) The legacy profile editor uses the jQuery rangeslider (.rangeslider); only develop's .rangeSlider rules were left. prod's rules added next to them; the production asset build passes. Audit I7.
Credits from v3.8.5: Znuny listed again, no Matomo tracker (matomo.bewelcome.org is stopped), the HTML Purifier badge served locally. /favicon.ico restored (2,082 requests in prod's recent access logs). Audit I9.
…519) /signup/finalize/{username} let anyone who knew a new member's username fill in their name, birth date, gender, location and accommodation. The finalize page now opens only in the session that proved ownership: right after step 1, through the confirmation link, or after logging in with the password (UserChecker throws in checkPostAuth). Others go to the login page. develop's finishSetup has the same gap. Audit B3.
…neypot (#519) As prod's sign-up: a hidden 'sweet' field that bots fill in stops the sign-up with prod's message, and the finalize step asks one mother tongue (spoken and signed languages grouped, prod's translated texts), stored as a MotherLanguage level like prod and develop. prod's sign-up feedback to volunteers was a hidden, always empty field; nothing to restore. Audit I8.
The validator translates in the 'validators' domain; BeWelcome's keys (signup.error.username, error.name, ...) live in 'messages', so the new sign-up showed raw keys. The form theme translates a message that is still equal to its key in 'messages'. Symfony's own messages are unchanged. develop has the same theme.
develop dropped the Shout entity in 4530357 (Symfony 7.2 upgrade) while the export page, its texts and the shouts table stayed: an oversight. Restores the read-only entity (attributes, `table` quoted) and the shouts extractor as on prod v3.8.5. Checked on stage with prod's data: all 1,931 shouts load; member 71's export source returns their 45. Audit I4.
The legacy profile page showed the last 10 comment pairs unsorted; prod shows all of them, latest activity first (a new experience moves a pair up). Restores CommentSorterProfile; CommentSorter reads dates through two overridable getters (same behaviour for CommentRepository). Checked on stage: member 13993 has 238 pairs, all shown, newest first. Audit I6.
isDeniedAccess() allowed only five statuses and refused ChoiceInactive, NeedMore, ActiveHidden and Pending members (4,360 on prod, 81 of them active in the last 30 days). Back to prod's rule (v3.8.5): refuse only members whose profile cannot be browsed. Checked on stage with real members of each status. MemberLoginTest.
…members again (#519) Carbon 3's diffInMinutes() is signed: for a past last login it is negative, so '> 5' was never true and neither the last login nor the status was ever updated (search, statistics, reminders, retention rely on it). Uses the absolute difference. getAge() casts Carbon 3's float. AuthenticationEventSubscriberTest fails on the old code.
…message again, not an error page (#519) checkTimeElapsedOnPasswordReset() was called with null. Checked on stage: 200 with 'Couldn't find a user with that name or email address.'
They were docblock annotations, which Symfony 7 no longer reads: creating a group, editing a photo, translations, FAQ and FAQ categories, reporting a comment, community news comments and admin change-username accepted anything. Now attributes with the same options. ValidationRulesTest fails on the old code.
…#519) The locale switch saved the short code into PreferenceLanguage, which Member::initializePreferredLanguage() and prod's data (400,000+ rows) hold as the language id; members fell back to English at the next login and in mails.
…rs again (#519) The getters were dropped with develop's Member rewrite and the export block with them. Restores getCryptedField(), getPhoneNumbers(), getMessengers() and getWebsite() from prod (v3.8.5) on route C's fields relation, and the template block (website loop null-safe). Checked on stage with a member's three phones and two messengers.
delete_translation_multiple() got its parameters in a new order on develop; the caller still used the old one, so nothing was deleted.
#519) Two lines used u: classes, which this Tailwind setup (prefix u-, separator :) does not generate. Prod's classes restored.
…519) Only six languages were bundled; prod built all of them. One lazily loaded translation per interface language (39 of 42; rm, su, sw have none, as on prod), and no translations option when there is none (CKEditor 47 fails on an empty array). Drops five script tags for build/cktranslations, which no longer exists.
offerdinner, offertour, profile_picture and about_me are now offers_dinner, offers_tour, has_profile_picture and has_about_me; old URLs are mapped. SearchLegacyParametersTest.
… goals, as on prod (#519) base-lite and error lacked the _analytics include, so the 'Signup Confirmed' event flash showed to members as a raw alert. Restores Review Written, Message Sent, Request Sent and Host Search. Audit I2.
…e error (#519) Profile comment read more/less labels come from the page again where it has them (prod), the library default elsewhere. check.js ended with a stray 'g' instead of getPasswordScore().
Twig syntax error ('} %})') in the template, also on prod v3.8.5; found by lint:twig.
What testers and members will notice: new, changed on purpose (feedback wanted), fixed during review (same as 3.8.5 again), fixed problems of 3.8.5, removed, known issues. Format: Keep a Changelog.
5 tasks
Contributor
|
It should already be clear from the long, long list of check-ins and the now conflicted merge that this is no longer a proof of concept but an obstacle in bringing the site to the modern stack that as said several times already runs in develop. Instead of spending several hours on this PoC fixing develop to run would have been way more valuable. |
Contributor
Author
I am not sure you took the time to actually test it before adding your comment. It's further than PoC indeed and is already better than prod as it has no regression compared to prod. But indeed develop has a lot of gaps to be covered which I tried to cover in the parts I cherry picked. If develop had solved those problems effectively I would have just cherry picked them. Also I am able to evaluate when it's too much work for me no worries. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Target branch:
mainPart of #519 (route C: upgrade the framework first, redesign the schema later).
What:
developat4a3b74550, the lastdevelopcommit that runs on prod's database, with Symfony 7.4, PHP 8.4, Doctrine ORM 3 and Manticore 29.mainis ported on top (Docker and CI, the redesign, fixes), except Automate reminders #590 and Fix #604: Really remove database entries and images. #607, which are left to their author; our follow-ups fix(analytics): login reminder UTM source and campaign the right way round (#590) #603 and fix(routing): ship the legacy alias cache and read it instead of rebuilding it (#605) #606 are reverted onmaintoo (Revert #606 (alias cache) and #603 (login reminder UTM) #609).main's history is merged in with-s ours(7a107f1), so this merges without conflicts and keeps this branch's files.Why: prod runs a framework line that is no longer developed; this brings it onto
develop's code without changing the database.Checked:
8f7c4e818(commits re-signed, same files assha-4e997f2).mainand this branch rehearsed on stage with plain deploys; the deploy swaps the Manticore data per version (sysadmins-infra #740).Rollback: deploy
3.8.5again; the deploy puts Manticore 6.3.8's data back; the database needs nothing (no migrations).Before merging:
Questions for review
4a3b74550the right base, or should this start from a laterdevelopcommit and keep the oldmemberstable some other way?main's flow until the schema step (as Privacy: member email addresses in /signup/resend URLs reach Plausible and logs (low priority) #541 suggests,develop's sign-up comes with the new tables)?mainsorts them (new experiences first),developshows the last 10. Which one?forum_tradsview fromVersion20200307133359then need another way into fresh databases (devcontainer, CI), for example a SQL file next tolanguages.sql.What changes, in detail
developat4a3b74550(2025-10-20) is the lastdevelopcommit that still runs on prod's database. One commit later (7ecf67c4c, "Introduce new member entity")developmoves the login and about 160 files to the newmembertable. At4a3b74550it already has Symfony 7.4, PHP 8.4 and Doctrine ORM 3, and its CI was green.On top of it, everything needed to run it the way prod runs:
docker/,docker-compose.yml,.trivyignore, image workflowsmain7.4.x-devto 7.4.20 releases (SYMFONY_REQUIRE=7.4.*), Twig, Guzzle patch releasescomposer update, audit clean300d2e2e2, #535)maincircle-flagsand@tomickigrzegorz/autocompletefrom npm (the GitHub sources need git in the build; the autocomplete commit no longer exists)developDB_*instead of aDATABASE_URLbuilt in.env; the session handler reuses the Doctrine connectionmaintranslations:add:missing: bind the three parametersdevelopParamConverterdocblocks to#[MapEntity](5 controllers)develop{username:member}on 23 routes (controller_resolver.auto_mappingis false)develop:in the conversation adaptersdevelophas the same bugerror500.html.twigtrans({username: ...})mainanddeveloppublic/images/logo_index_top.pngmainprofile.jsnull check for the language switchstageimage tagsTest history
First stage test (prod data copy, 2026-10-09)
sha-cbf2c40: deploy and stage smoke tests green, Trivy 0 findings (OS, npm, Composer), no CRITICAL in the PHP log after deploy./faqand/feedback,/locale/fr404, visitors page redirect.mainhas the new header, logos and home page (2026-04-24, 2026-05-12); this branch hasdevelop's older header. That is part of the list below.Later runs
-s oursmerge with main takes them off main as well.expect_signup=develop): sha-e92ef7c, 2026-10-13, https://github.com/BeWelcome/sysadmins-infra/actions/runs/38401014353 (suite from #724, which includes #722).bewelcome.ymland tested by its own e2e step, no suite from a branch: all 4 jobs green, no page over the speed budget, https://github.com/BeWelcome/sysadmins-infra/actions/runs/38520759267main's commits since the branch point (125, ported or left out)
These were the porting list when this PR was opened (2026-10-12). All are on this branch now, except #590 and #607 (left to their author) and #603/#606 (reverted, #609). The header and home page redesign is ported.
Docker, CI and deploy (28)
6105114a82026-05-31 Update admin templates to align with current deployment.08e3e91892026-05-31 Update admin templates to align with current deployment.901b23a9c2026-08-03 Make master work on php8.2 and update docker setup accordingly.acb28089a2026-08-05 fix(docker): fix 5 bugs in Shevek's PHP 8.2 Docker setup (fix(docker): fix 5 bugs in Shevek's PHP 8.2 Docker setup #470)58fdc4a4b2026-08-15 feat(docker): production PHP-FPM/Nginx image, Manticore 6.3.8, OPcache preload, config split; fix mailer Reply-Tof856534fd2026-08-15 feat(docker): write /srv/VERSION from APP_VERSION build argef118ed2f2026-08-15 fix(ci): add SHA tag for Nginx image, include web_image in dispatch payload4446c68cf2026-08-20 fix(ci): bust apk layer cache + pin Trivy to v0.74.0c9d7e03fe2026-08-27 feat(docker): create feature/docker-master branch from master infra baselined082e2f202026-08-27 fix(ci): ignore CVE-2026-54164 - api-platform/core v2.x, no fix in v2 line1e5c62dea2026-08-27 fix(legacy-mvc): use DIR for entrypoints.json path158a337422026-09-04 feat: Add DevContainer configuration for local development (feat: Add DevContainer configuration for local development #484)6b41b74eb2026-09-05 ci: add missing build/ lib/ modules/ roxlauncher/ tools/ to build trigger paths33b1840302026-09-10 feat(analytics): add Plausible CE tracking script for beta.stage.bewelcome.org852f7d3c52026-09-13 fix(docker): warm Symfony cache for non-php-fpm containers79d9f5fed2026-09-15 ci: rename beta→stage workflow, add prod release workflow, run CI on docker-masterec459a4eb2026-10-02 fix(docker): refresh apk packages daily despite the layer cache; drop unused python3 (fix(docker): refresh apk packages daily despite the layer cache; drop unused python3 #538)06bc861bb2026-10-02 chore(trivy): drop the CVE-2026-58055 exception, nghttp2 is fixed (chore(trivy): drop the CVE-2026-58055 exception, nghttp2 is fixed #539)6e23fd3be2026-10-02 ci: run CI on PHP 8.3 and Node 20, bump PHP_CodeSniffer past CVE-2026-67434 (ci: run CI on PHP 8.3 and Node 20, bump PHP_CodeSniffer past CVE-2026-67434 #530)1298cf72c2026-10-08 chore(trivy): ignore CVE-2026-102633 until Alpine 3.24 ships libexpat 2.9.0 (chore(trivy): ignore CVE-2026-102633 until Alpine 3.24 ships libexpat 2.9.0 #562)b09768e942026-10-09 fix(docker): keep git and openssh-client out of the runtime image (fix(docker): keep git and openssh-client out of the runtime image #565)966e0a7fd2026-10-09 ci: build, CI and the GitLab mirror run from main (Make the deployed rox branch the protected default branch, named main #518) (ci: build, CI and the GitLab mirror run from main (#518) #567)43fb43a7d2026-10-09 ci: make the code checks runnable on main (CI fails on every push to the production branch, so PRs always show red #517) (ci: make the code checks runnable on main (#517) #572)6cc861f332026-10-09 fix(ci): PHP-Code-Sniffer and PHPCPD green on main (CI fails on every push to the production branch, so PRs always show red #517) (fix(ci): PHP-Code-Sniffer and PHPCPD green on main (#517) #574)18c74aa4c2026-10-09 fix(ci): PHPUnit green on main (CI fails on every push to the production branch, so PRs always show red #517) (fix(ci): PHPUnit green on main (#517) #575)20018d6722026-10-09 fix(ci): JS security check green on main (CI fails on every push to the production branch, so PRs always show red #517) (fix(ci): JS security check green on main (#517) #576)476cf78db2026-10-09 ci: skip image builds and the GitLab mirror on forks (CI fails on every push to the production branch, so PRs always show red #517) (ci: skip image builds and the GitLab mirror on forks (#517) #578)5e6bedb962026-10-09 ci: build the images on every pull request to main (Pull requests do not build the images we ship, so broken builds reach main #577) (ci: build the images on every pull request to main (#577) #579)Security and privacy (7)
23aae920e2024-04-27 Use session invalidation to force user logout to avoid re-activation of just retired member.58ceac4ff2026-08-15 fix(proxy): forward X-Forwarded-Proto so Symfony generates https:// URLs5fdbc73ad2026-08-27 fix(proxy): declare trusted_proxies/headers in framework.yaml; cookie_samesite lax0633769fb2026-08-27 fix(proxy): trusted_headers must be YAML list in Symfony 5.4, not env stringaa9ed3ee22026-08-27 chore: remove api-platform/core (unused, accumulating CVEs)777a5d0a02026-09-02 Migrate cron job to symfony command.3eb41314c2026-09-27 fix(session): keep members logged in for 7 days, remember-me samesite lax (fix(session): keep members logged in for 7 days, remember-me samesite lax #516)Mail (9)
65d53478e2023-07-10 Re-add comment notification emails.ec31a52062026-08-05 fix(mailer): use noreply@bewelcome.org as From to pass DMARC (fix(mailer): use noreply@bewelcome.org as From to pass DMARC #471)893caed0a2026-08-31 feat(newsletter): add List-Unsubscribe, Precedence, and one-click POST handler (feat(newsletter): add List-Unsubscribe headers and RFC 8058 one-click handler #488)8b547b40c2026-09-02 Use new logo in email notifications.741ceed2b2026-09-02 Opening pages from email notification in mobile browsers failed with stric setting.74529902e2026-09-09 feat(mailer): route bulk newsletters through dedicated news relayce458f1892026-09-09 fix(mailer): remove default_transport - not supported in Symfony 5.xd6aed15192026-09-13 fix(email): remove spurious < from anchor in request templatefd5df055a2026-10-02 feat(analytics): Plausible on every layout; signup, login, 404 and donation events; newsletter UTM (Signups, logins, profiles and donations are not counted in Plausible #540) (feat(analytics): Plausible on every layout; signup, login, 404 and donation events; newsletter UTM (#540) #543)Frontend, layout and UX (10)
a441668322026-04-24 Add new logos everywhere. Update navigation and footer. New home page.fcf91311f2026-04-25 Fix menu for legacy pages like signup.c43ed79022026-04-25 Fix menu for pages that work without login.46fae7b9e2026-04-25 Fix menu for policy pages.4c1cf43372026-04-26 Fix menu overflow on legacy pages.6c8e691942026-05-06 Use new logo on error pages. Update yarn.lock for browserslist.002be53782026-05-12 login access from header + redesign login pagee7286e0542026-05-31 Give full logo space to breath. Fix wordmark becoming too small compared to icon.0ad55a7782026-06-10 Make sure the member menu is right aligned.5a56b53502026-06-13 Update web preview images. Fix old logo in base-lite template.Bug fixes (29)
21b74aa3d2022-06-16 Fix not set entry in membersphots table.b87a565402024-04-27 Fix problem with user authentication and only report blank errors for form fields.18d1f2ff12024-04-27 Fix problem with user authentication and only report blank errors for form fields.a384058922026-04-26 Fix formatting of language dropdown.79fe269b92026-05-06 Fixing server errors due to wrong trans usage. Allow Ukrainian as translation language.0e0b7cbc02026-06-23 Fix redirect problems.3d6e26e7e2026-08-15 fix(fpm): increase PHP-FPM worker pool from 5 to 258ea7efaa02026-08-27 fix(manticore): fix geonames column name, forum query, and add negotiation dep9abfd8eab2026-08-27 fix(nginx): set HTTPS fastcgi param so legacy PHP detects HTTPS9eb5030412026-08-27 fix(api-platform): remove leftover bundle registration and annotations0109bda242026-08-27 fix: apply Shevek's review - bump APCu to 5.1.28, drop Phinx migration dead coded1836d9652026-08-30 Fix forum reply (MariaDB in safe mode; not default value for authorid)1a3d001ea2026-09-02 Fix broken range slider on signup and edit my profile page.0491b2bdc2026-09-05 fix(forum): use configured Manticore host/port for search045626d102026-09-06 fix(manticore): revert geoname_id → geonameid in SQL queries4868d2a9a2026-09-08 fix(php): set date.timezone to Europe/Berlin to match Lion and DBcc2281edd2026-09-16 fix(translation): handle missing DB schema gracefully during cache:clear67f1b71d72026-09-19 Fix manticore index generation.d6363ae9d2026-09-19 fix(manticore,nginx): fix geonames rebuild and font caching (fix(manticore,nginx): fix geonames rebuild and font caching #506)b25faacd22026-09-19 Fix display glitch on search location input.6cfaac3442026-09-21 Fix/feat: Always show trips even if legs' location is missing in database.4a1ac75c32026-09-22 Fix: Newly added translations were not imported.f66cc1ef52026-10-01 fix(upload): raise nginx and PHP upload limits to match Lion (8M) (fix(upload): raise nginx and PHP upload limits to match Lion (8M) #528)e18ea1fa22026-10-02 fix(public): serve the lion-only verification files; https for dev seed downloads (fix(public): serve the lion-only verification files; https for dev seed downloads #537)8fad344d02026-10-04 Fix ValueError for translations containing %.2f94d37af2026-10-05 fix(logging): prod logs errors to stderr, deprecations on demand (Prod writes about 2 GB of debug logs a day inside the container #524) (fix(logging): prod logs errors to stderr, deprecations on demand (#524) #558)5368d83462026-10-08 fix(seo): canonical tags, apex sitemap and valid robots.txt (sysadmins-infra#654) (fix(seo): canonical tags, apex sitemap and valid robots.txt (sysadmins-infra#654) #561)4e2339a542026-10-08 fix(terms): correct BeVolunteer RNA number (W353003546) (fix(terms): correct BeVolunteer RNA number (W353003546) #563)5f5ff1b902026-10-09 fix(seo): /about/faq is a permanent redirect, links go to /faq (BeWelcome/sysadmins-infra#654) (fix(seo): /about/faq is a permanent redirect, links go to /faq (sysadmins-infra#654) #564)Other (42)
51f0d0aed2023-07-10 Add flash that is shown if comment is locked.6d620c3442023-07-11 Set status to active after successful login (even if login was using remember me).ee51b7cfb2023-07-13 Show comment update on profile page and set ADMIN_CHECK for negative comments.c6c666b1f2024-04-27 Make /deleteprofile accessible without redirect from Play store compliance.ee911ab632026-05-06 Add blocked messages to the admin tools.007022ed72026-05-09 Force checkbox appearance.5860d89b32026-05-11 Add more constraints for activities.a111d0bb62026-05-11 Align master with production.9759638922026-05-13 Further align master and www.32dd5d34f2026-05-13 Move to Noto Sans and some alignment of master and www.229b4cfde2026-05-31 Align login forms. Fix signup date.7690667482026-06-06 Use full size sheet only for xs and sm screens.ff0b408772026-06-07 Use Noto Sans on /login as well.93157bfa92026-08-04 Use latest ACPu extension.4ce44da922026-08-13 Update formatting options for messages.4d0622f5d2026-08-15 perf(nginx): enable gzip and long-lived cache for hashed assets90137e8b62026-08-27 perf(homepage): cache statistics queries for 1 hour112fd85c42026-08-27 chore: remove api-platform Serializer normalizers left behind by 3dd46fc7db45bf3e2026-08-27 chore: remove unused @groups annotations from entitiesed15175202026-08-27 perf(trips): add bounding-box pre-filter before haversine GeoDistancef2cd5dfec2026-08-30 chore(db): pin MariaDB to 12.3 LTS (mariadb:lts tag)965102a022026-09-02 Rewrite to use only PHP 7.4 features.e255945742026-09-02 Add system to highlights.92297d20b2026-09-02 Add external contact info.5984133e32026-09-02 Set correct anchor (#external is referenced in tou).efabe053c2026-09-06 Remove SQL_CALC_FOUND_ROWS everywhere.5d265d2ef2026-09-06 Some cleanup in ForumCleanupCommand.96117b2ce2026-09-10 Removing spurious < from template.fc6bc398e2026-09-10 feat(analytics): parameterize Plausible script URL via PLAUSIBLE_SCRIPT_URL env var0249203aa2026-09-15 feat(analytics): add Plausible custom event tracking for key user actions70b7df3ec2026-09-19 Revert fix for display glitch (not effective).782c9ccee2026-09-20 Update LOCALES to include Armeniand28f0215f2026-09-20 Add necessary files to support Armenian in translations directory.02cf7e57c2026-09-20 Use object instances instead of static access for Mod_htmlpure.fcd8c91bc2026-09-21 Feat: Add znuny to the credits page. Closes Add znuny to the credits page #510.455c600642026-10-01 Add Ukrainian and fix display glitch in language dropdown.ec4b029392026-10-02 Use symfony translator instead of loading rows from the database.300d2e2e22026-10-02 Upgrade to Intervention image library v4.x and adapt image handling code accordingly.0dd7c69062026-10-04 Set absolute URL on empty referrer. Return a valid redirect response in all cases.af342242f2026-10-04 Backport fix for 548 to production source.fa6a635672026-10-05 feat(logging): write warnings to stderr in prod as they happen (Prod writes about 2 GB of debug logs a day inside the container #524 follow-up) (feat(logging): write warnings to stderr in prod as they happen (#524 follow-up) #559)43d64020d2026-10-09 style: bring src/ back in line with php-cs-fixer (CI fails on every push to the production branch, so PRs always show red #517) (style: bring src/ back in line with php-cs-fixer (#517) #573)