Skip to content

release(starter): 2.1.10 (theme 2.1.10) - security updates, core 0.15.11 - #19

Merged
palicko merged 1 commit into
mainfrom
starter/2.1.10
Nov 9, 2026
Merged

palicko merged 1 commit into
mainfrom
starter/2.1.10

Conversation

@palicko

@palicko palicko commented Nov 9, 2026

Copy link
Copy Markdown
Member
  • Theme: Symfony 7.4.20 → 7.4.23. These are runtime packages via Acorn and fix the http-foundation, http-kernel, routing and mime advisories. Also Vite 8.3.7, patched transitive dev deps, and webentor-core 0.15.11 (custom block colours).
  • Starter dev tools: Symfony 6.4.x → 6.4.50 (yaml, config, filesystem; via grumphp).
  • Composer audit is clean for starter and theme. Both locks pass check-platform-reqs --lock on PHP 8.3. Frozen theme install + build OK. check:versions and test-release pass.
  • The theme still has dev-only npm advisories with no in-range fix: minimatch (pinned exactly by typescript-estree 6 via @10up/block-components), glob and uuid (need majors), deepmerge (no fix), and rollup/webpack, which are auto-installed peers that the Vite 8 (Rolldown) build never runs.

Consumer migration is in the starter changelog.

https://claude.ai/code/session_018BdBLDan3sbdTko7XUnd5c

Theme: Symfony 7.4.23 (runtime), Vite 8.3.7, core 0.15.11. Starter dev tools:
Symfony 6.4.50. Both locks pass check-platform-reqs on PHP 8.3.

Claude-Session: https://claude.ai/code/session_018BdBLDan3sbdTko7XUnd5c
@palicko
palicko merged commit 8408643 into main Nov 9, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant