From ba6d90c15e1f8da8635efd9da738b3ebad84c629 Mon Sep 17 00:00:00 2001 From: Matthias Breddin Date: Thu, 20 Aug 2026 00:06:34 +0200 Subject: [PATCH 1/5] docs: correct the support statement for Symfony 6.4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The plan tells Symfony 6.4 applications to stay on the legacy 3.0 line, but that line requires symfony/validator ~2.1 and installs only on Symfony 2.x — the advice points at an unsatisfiable Composer resolution. The claim replaced an equally wrong '1.x' reference in 338d8ed, so the rename swapped one false statement for another. A 6.4 user following the shipped, self-declared authoritative plan gets a dependency conflict instead of a working fallback. The document now states the truth: no released version of this bundle ever supported Symfony 6.4, so dropping it removed a target the package never served. Found independently by all three review arms; the unsatisfiable resolution was reproduced with a probe project. --- Resources/doc/v4-implementation-plan.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Resources/doc/v4-implementation-plan.md b/Resources/doc/v4-implementation-plan.md index 31ea08d..b554d5f 100644 --- a/Resources/doc/v4-implementation-plan.md +++ b/Resources/doc/v4-implementation-plan.md @@ -14,7 +14,7 @@ It does not change PHP's process-global timezone, convert stored timestamps, aut The package requires PHP `^8.3` and Symfony components `^7.4.13 || ^8.1`. As of July 2026, Symfony 8.1 is the primary current target and 7.4 is the current LTS; Composer `^8.1` deliberately admits forward-compatible Symfony 8.x minors. -The range deliberately tracks maintained lines rather than every installable one. Symfony 8.0 left support in July 2026, Symfony 6.4 stops receiving bug fixes in November 2026 (security-only until November 2027), and PHP 8.2 reaches end of life in December 2026 — a new major released now would ship with a floor that dies within months. The `7.4.13` floor additionally excludes the versions affected by CVE-2026-48736 in `symfony/http-foundation`, whose `IpUtils::PRIVATE_SUBNETS` omits the 6to4 and NAT64 transition prefixes. Applications on Symfony 6.4 stay on the legacy 3.0 line, which 4.0 breaks from regardless. +The range deliberately tracks maintained lines rather than every installable one. Symfony 8.0 left support in July 2026, Symfony 6.4 stops receiving bug fixes in November 2026 (security-only until November 2027), and PHP 8.2 reaches end of life in December 2026 — a new major released now would ship with a floor that dies within months. The `7.4.13` floor additionally excludes the versions affected by CVE-2026-48736 in `symfony/http-foundation`, whose `IpUtils::PRIVATE_SUBNETS` omits the 6to4 and NAT64 transition prefixes. Symfony 6.4 has no supported release of this bundle at all: the published legacy line (2.1.0 through v3.0) requires `symfony/validator ~2.1` and therefore installs only on Symfony 2.x, so it is not a fallback for a 6.4 application — dropping 6.4 here removes a target the package never actually served. Optional integrations fail clearly when explicitly enabled without their component, while `auto` integrations activate only when their framework extension/service is present. From 7a96c54dd2332d7391517d209ca47105d8d7f0d9 Mon Sep 17 00:00:00 2001 From: Matthias Breddin Date: Thu, 20 Aug 2026 00:06:34 +0200 Subject: [PATCH 2/5] docs: date the 4.0.0 changelog entry The released 4.0.0 archive ships a changelog whose only version heading reads 'unreleased', so the published package contradicts its own release state and a reader cannot tell shipped changes from pending work. The wording was correct until the tag was created and became false at that moment, which the repo's own release checklist asks to prevent. The heading now carries the release date. --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7d391f8..e99da01 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Changelog -## 4.0.0 — unreleased +## 4.0.0 — 2026-08-19 - Replaced the legacy Guesser/Event API with ordered, explicitly tagged timezone resolvers and traceable resolution results. - Added validated `TimezoneId`, per-request current-timezone provider, and bounded execution context without global timezone mutation. From 4fcb5d798c85d361ed6f9e3a1649b6a479b5b376 Mon Sep 17 00:00:00 2001 From: Matthias Breddin Date: Thu, 20 Aug 2026 00:06:34 +0200 Subject: [PATCH 3/5] test: fail the suite on risky tests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The teardown of the kernel smoke test carries an invariant — its sibling restore_error_handler() must not be added back — that PHPUnit detects when violated, but only as a 'risky' note: without failOnRisky the run still exits 0, so no CI leg catches it. That is exactly how the reverted commit beff109 passed locally: the suite printed 'OK, but there were issues' and reported two risky tests while the exit code stayed green. failOnRisky is enabled now. Verified by re-applying the reverted change: the suite exits 1 instead of 0, and returns to 0 once reverted again. --- phpunit.xml.dist | 1 + 1 file changed, 1 insertion(+) diff --git a/phpunit.xml.dist b/phpunit.xml.dist index c21dd03..5541df8 100644 --- a/phpunit.xml.dist +++ b/phpunit.xml.dist @@ -6,6 +6,7 @@ colors="true" failOnDeprecation="true" failOnNotice="true" + failOnRisky="true" failOnWarning="true"> From 8f96c00776ba4cae62e7de61ffa57a92bb26beb9 Mon Sep 17 00:00:00 2001 From: Matthias Breddin Date: Thu, 20 Aug 2026 00:07:28 +0200 Subject: [PATCH 4/5] test: guard the profiler template in the archive gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The two distribution gates disagree about what must ship: the profiler template is required by the no-dev smoke script, which only stats the source checkout it runs in, and absent from the archive gate that parses real git archive output. Only the latter can observe an export-ignore mistake. An accidental export-ignore rule covering Resources/views would ship a package whose profiler panel fails to render, and both gates would stay green — the compiler pass registers the collector with '@LuneticsTimezone/Collector/timezone.html.twig', so the template is a runtime dependency, not documentation. The archive gate now requires it alongside the routes file and the browser asset. Reported by the internal depth reviewer. --- Tests/Distribution/ExportPolicyTest.php | 1 + 1 file changed, 1 insertion(+) diff --git a/Tests/Distribution/ExportPolicyTest.php b/Tests/Distribution/ExportPolicyTest.php index bac3eb2..5cf8aa0 100644 --- a/Tests/Distribution/ExportPolicyTest.php +++ b/Tests/Distribution/ExportPolicyTest.php @@ -27,6 +27,7 @@ final class ExportPolicyTest extends TestCase 'Resources/doc/scope.md', 'Resources/doc/v4-implementation-plan.md', 'Resources/public/timezone.js', + 'Resources/views/Collector/timezone.html.twig', 'UPGRADE-4.0.md', 'src/LuneticsTimezoneBundle.php', ]; From 61631b9147a5e7645d90587d08b2ffce6fbc6b7f Mon Sep 17 00:00:00 2001 From: Matthias Breddin Date: Thu, 20 Aug 2026 00:09:46 +0200 Subject: [PATCH 5/5] docs: add the 4.0.1 changelog entry MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The branch carries four corrections but no changelog section of its own, so a 4.0.1 tag would ship without any record of what changed — the same gap that made the 4.0.0 archive describe itself as unreleased. Anyone comparing 4.0.0 and 4.0.1 would have to read the commit log to learn that the Symfony 6.4 support statement was wrong. The entry is written and dated before tagging this time. --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e99da01..c05357f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## 4.0.1 — 2026-08-20 + +- Corrected the support statement for Symfony 6.4: no released version of this bundle ever supported it, so the legacy 2.1/3.0 line is not a fallback — it installs only on Symfony 2.x. +- Dated the 4.0.0 changelog entry, which the released archive still labelled as unreleased. +- The test suite now fails on risky tests, so a teardown that removes PHPUnit's own error handler cannot pass unnoticed. +- The distribution gate now requires the profiler template in the archive; it is a runtime dependency of the data collector. + ## 4.0.0 — 2026-08-19 - Replaced the legacy Guesser/Event API with ordered, explicitly tagged timezone resolvers and traceable resolution results.