release(starter): 2.1.10 (theme 2.1.10) - security updates, core 0.15.11

docs/src/compatibility-matrix.md

@@ -4,6 +4,7 @@
 
 | starterVersion | themeVersion | coreVersion | configsVersion | setupCliVersion | php | node |
 | --- | --- | --- | --- | --- | --- | --- |
+| 2.1.10 | 2.1.10 | 0.15.11 | 1.1.1 | 1.4.0 | >=8.3 | >=24 |
 | 2.1.9 | 2.1.9 | 0.15.11 | 1.1.1 | 1.4.0 | >=8.3 | >=24 |
 | 2.1.9 | 2.1.9 | 0.15.10 | 1.1.1 | 1.4.0 | >=8.3 | >=24 |
 | 2.1.8 | 2.1.8 | 0.15.10 | 1.1.1 | 1.4.0 | >=8.3 | >=24 |

packages/webentor-starter/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Webentor Starter Changelog
 
+### 2.1.10
+
+- **Security updates.** The theme locks Symfony 7.4.23 (runtime through Acorn: http-foundation,
+  http-kernel, routing, mime advisories) and `webentor-core` **0.15.11**, which renders custom
+  block colours. Starter dev tools lock Symfony 6.4.50 (yaml, config, filesystem); theme dev
+  tooling locks Vite 8.3.7 and patched transitive deps. Both Composer audits are clean.
+- **Consumer migration:** in the theme run `composer update 'symfony/*' webikon/webentor-core --with-dependencies`
+  and `pnpm up @webikon/webentor-core vite`.
+
 ### 2.1.9
 
 - **Fix: the 2.1.7 and 2.1.8 locks do not install on PHP 8.3.** They were resolved on PHP 8.4,

packages/webentor-starter/composer.json

@@ -1,7 +1,7 @@
 {
   "name": "webikon/webentor-starter",
   "type": "project",
-  "version": "2.1.9",
+  "version": "2.1.10",
   "license": "MIT",
   "description": "WordPress boilerplate with Composer, easier configuration, and an improved folder structure",
   "homepage": "https://roots.io/bedrock/",