fix: correct the Symfony 6.4 support claim and harden the release gates

CHANGELOG.md

@@ -1,6 +1,13 @@
 # Changelog
 
-## 4.0.0 — unreleased
+## 4.0.1 — 2026-08-20
+
+- Corrected the support statement for Symfony 6.4: no released version of this bundle ever supported it, so the legacy 2.1/3.0 line is not a fallback — it installs only on Symfony 2.x.
+- Dated the 4.0.0 changelog entry, which the released archive still labelled as unreleased.
+- The test suite now fails on risky tests, so a teardown that removes PHPUnit's own error handler cannot pass unnoticed.
+- The distribution gate now requires the profiler template in the archive; it is a runtime dependency of the data collector.
+
+## 4.0.0 — 2026-08-19
 
 - Replaced the legacy Guesser/Event API with ordered, explicitly tagged timezone resolvers and traceable resolution results.
 - Added validated `TimezoneId`, per-request current-timezone provider, and bounded execution context without global timezone mutation.

Resources/doc/v4-implementation-plan.md

@@ -14,7 +14,7 @@ It does not change PHP's process-global timezone, convert stored timestamps, aut
 
 The package requires PHP `^8.3` and Symfony components `^7.4.13 || ^8.1`. As of July 2026, Symfony 8.1 is the primary current target and 7.4 is the current LTS; Composer `^8.1` deliberately admits forward-compatible Symfony 8.x minors.
 
-The range deliberately tracks maintained lines rather than every installable one. Symfony 8.0 left support in July 2026, Symfony 6.4 stops receiving bug fixes in November 2026 (security-only until November 2027), and PHP 8.2 reaches end of life in December 2026 — a new major released now would ship with a floor that dies within months. The `7.4.13` floor additionally excludes the versions affected by CVE-2026-48736 in `symfony/http-foundation`, whose `IpUtils::PRIVATE_SUBNETS` omits the 6to4 and NAT64 transition prefixes. Applications on Symfony 6.4 stay on the legacy 3.0 line, which 4.0 breaks from regardless.
+The range deliberately tracks maintained lines rather than every installable one. Symfony 8.0 left support in July 2026, Symfony 6.4 stops receiving bug fixes in November 2026 (security-only until November 2027), and PHP 8.2 reaches end of life in December 2026 — a new major released now would ship with a floor that dies within months. The `7.4.13` floor additionally excludes the versions affected by CVE-2026-48736 in `symfony/http-foundation`, whose `IpUtils::PRIVATE_SUBNETS` omits the 6to4 and NAT64 transition prefixes. Symfony 6.4 has no supported release of this bundle at all: the published legacy line (2.1.0 through v3.0) requires `symfony/validator ~2.1` and therefore installs only on Symfony 2.x, so it is not a fallback for a 6.4 application — dropping 6.4 here removes a target the package never actually served.
 
 Optional integrations fail clearly when explicitly enabled without their component, while `auto` integrations activate only when their framework extension/service is present.
 

Tests/Distribution/ExportPolicyTest.php

@@ -27,6 +27,7 @@ final class ExportPolicyTest extends TestCase
         'Resources/doc/scope.md',
         'Resources/doc/v4-implementation-plan.md',
         'Resources/public/timezone.js',
+        'Resources/views/Collector/timezone.html.twig',
         'UPGRADE-4.0.md',
         'src/LuneticsTimezoneBundle.php',
     ];

phpunit.xml.dist

@@ -6,6 +6,7 @@
          colors="true"
          failOnDeprecation="true"
          failOnNotice="true"
+         failOnRisky="true"
          failOnWarning="true">
     <testsuites>
         <testsuite name="Lunetics TimezoneBundle">