From 1404cccf87f77c8fe7aa231cc5270811ea8c9596 Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Mon, 31 Aug 2026 12:31:26 +0200 Subject: [PATCH 1/5] fix(composer): declare ext-xsl so dependabot can resolve (#533) Dependabot cannot propose composer updates for this app. Its updater fails with: Your requirements could not be resolved to an installable set of packages. - edgedesign/phpqa[v1.27.0, ..., v1.27.2] require ext-xsl * -> it is missing from your system. config.platform pins php 8.3 so composer resolves against a known PHP version, but says nothing about extensions. edgedesign/phpqa requires ext-xsl and the resolving environment does not have it, so the resolve fails before any bump can be computed. CI is unaffected, which is why this went unnoticed: composer install replays the committed lock and never re-resolves, so the pipeline stays green while dependabot -- which does re-resolve -- fails every time. The shared quality.yml installs no xsl extension anywhere and never invokes phpqa. Declaring ext-xsl beside the php pin makes resolution assume exactly what the committed lockfile already assumes. Verified in a clean composer:2 container without --ignore-platform-reqs: the same file fails without this line and resolves (103 installs, lock written) with it. Co-authored-by: Conduction Release Bot --- composer.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/composer.json b/composer.json index 846975a9e..aa2a335a4 100644 --- a/composer.json +++ b/composer.json @@ -86,7 +86,8 @@ "optimize-autoloader": true, "sort-packages": true, "platform": { - "php": "8.3" + "php": "8.3", + "ext-xsl": "1" } } } From cc1c153a7c4062eb9b92d82ff98ae6be9ec764e0 Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Mon, 31 Aug 2026 13:16:47 +0200 Subject: [PATCH 2/5] chore(deps): take @conduction/nextcloud-vue 2.27.2 (#542) Brings this app level with the rest of the fleet. Carries the flat, horizontal canonical KPI card, the calendar-aligned date range that follows the reader's calendar rather than UTC, and two later fixes: headerless is no longer chromeless, and a stat `variant` paints from the `-text` tokens rather than the fill tokens, which failed WCAG AA at 1.08:1 as a foreground colour. Lockfile only. Co-authored-by: Conduction Release Bot --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 3bbc156b3..76d00882a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -387,9 +387,9 @@ } }, "node_modules/@conduction/nextcloud-vue": { - "version": "2.26.0", - "resolved": "https://registry.npmjs.org/@conduction/nextcloud-vue/-/nextcloud-vue-2.26.0.tgz", - "integrity": "sha512-PrEd1Ej9UMXTw7qzq6WqqPnwdO2yLlJvj8/Lz7fGbtrUbO8xUAkPwgJlKNbsWHv2DhhF5G/MRN4ZA+YvNDaJIg==", + "version": "2.27.2", + "resolved": "https://registry.npmjs.org/@conduction/nextcloud-vue/-/nextcloud-vue-2.27.2.tgz", + "integrity": "sha512-FhDF3FvM+ee0Jx7z70Lki7o7Mm4DeX/GsOqHo33hOcdylzXR63UXLRbxKMedodEiIqgOFUAI6GTox735iyL8Dw==", "dev": true, "license": "EUPL-1.2", "dependencies": { From 9875263d25c99e8327d6fe11df876b11adcdecd7 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 16:04:17 +0200 Subject: [PATCH 3/5] chore(release): 1.1.12-unstable.20260831125624 (#548) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- appinfo/info.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/appinfo/info.xml b/appinfo/info.xml index 0a1cb3d7e..640065dfb 100644 --- a/appinfo/info.xml +++ b/appinfo/info.xml @@ -64,7 +64,7 @@ Gratis en open source onder de EUPL-1.2 licentie. which quoted the grep command in order to WARN about the problem — made it read ")[^". The warning reproduced the bug it described. --> - 1.1.10-unstable.20260831053139 + 1.1.12-unstable.20260831125624 EUPL-1.2 Conduction Thematiq From 9b0c30e4b7b1ab29ab5bfdb78c45cd15b28ab73c Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Thu, 3 Sep 2026 14:51:31 +0200 Subject: [PATCH 4/5] fix(ci): a standing release PR ran every development push twice Every push to development fired Code Quality TWICE on the same commit: once for the push event, once for the pull_request event of the permanently-open "Release: merge development into beta", whose head_ref IS development. The concurrency block is not the bug and must not be changed: it suffixes the group by event name deliberately so the push run is NOT cancelled by the PR run, because the push run is the only carrier of Coverage Baseline Check, SBOM and Features Extract. The consequence is that both lanes run to completion, so the duplicate has to be dropped at the job. The PR run is the one to drop: its head sha IS development's, which the push run already decided, and it runs strictly fewer jobs. Not done by removing `beta` from pull_request.branches, though that would also stop it: the release/v* and sync/main-to-beta PRs target beta too and genuinely need their run. Only the head_ref:development PR is redundant. A development -> main promotion PR is skipped by the same clause, for the same reason and just as correctly. Proven on openregister#3370 before rolling out: run 33757014196 (pull_request, sha 4f3ef5e9) completed as `skipped` with ZERO jobs in 72s, while the push run for the same sha ran the full suite. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/code-quality.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml index d24194cb6..e5bef5273 100644 --- a/.github/workflows/code-quality.yml +++ b/.github/workflows/code-quality.yml @@ -148,6 +148,7 @@ permissions: jobs: quality: + if: (github.event_name != 'pull_request' || github.head_ref != 'development') uses: ConductionNL/.github/.github/workflows/quality.yml@main with: app-name: thematiq From 6d3c81fdc21f2262756d7712d59f72b833a643fa Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 4 Sep 2026 09:19:27 +0200 Subject: [PATCH 5/5] chore(deps-dev): Bump phpstan/phpstan from 2.2.9 to 2.2.10 (#549) Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) from 2.2.9 to 2.2.10. - [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits) --- updated-dependencies: - dependency-name: phpstan/phpstan dependency-version: 2.2.10 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- composer.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/composer.lock b/composer.lock index 144a1799f..1125f49e0 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "41aba6915f93777e686335d4f0b75f27", + "content-hash": "09674095784df6bd8ef3f0c7c8c2573c", "packages": [], "packages-dev": [ { @@ -3224,11 +3224,11 @@ }, { "name": "phpstan/phpstan", - "version": "2.2.9", + "version": "2.2.10", "dist": { "type": "zip", - "url": "https://api.github.com/repos/phpstan/phpstan/zipball/13d6b4f347bad222da436580c8304fa6f83e6bd0", - "reference": "13d6b4f347bad222da436580c8304fa6f83e6bd0", + "url": "https://api.github.com/repos/phpstan/phpstan/zipball/36d1509c998b0602811824143526b4a9ee2774e7", + "reference": "36d1509c998b0602811824143526b4a9ee2774e7", "shasum": "" }, "require": { @@ -3284,7 +3284,7 @@ "type": "github" } ], - "time": "2026-08-22T07:38:16+00:00" + "time": "2026-08-30T12:46:16+00:00" }, { "name": "phpunit/php-code-coverage",