MERCURE 0.5.0 / symfony/mercure 0.8.0, kept out of the earlier sweep
because it carries the live-update transport and should not ride along
with eighteen patch bumps. It earned that: HubInterface gained
getProtocolVersion() and getCookieName(), so the two hub doubles in
CalendarSyncFinishedNotificationTest stopped satisfying it — a fatal
error, not a failing test. Both implement them now, returning what a real
hub would rather than pretending to configuration these tests do not
have. Verified where it matters: the full browser suite, including the
specs that stop and restart the hub to prove the stream recovers.
A DATABASE OF ITS OWN for the unit suite.
Both suites run APP_ENV=test, and doctrine.yaml's
`dbname_suffix: '_test%env(default::TEST_TOKEN)%'` therefore pointed both
at app_test. One database, two suites — and one test in here truncates
real tables, because exercising a data reset is its whole purpose.
Sequentially that is safe; Postgres rolls a TRUNCATE back like anything
else. Concurrently it is not: TRUNCATE takes an ACCESS EXCLUSIVE lock, so
live queries from the browser suite block until the unit test's
transaction ends, and specs with no connection to any of this report
timeouts. It fits the transaction abort seen here once and never
reproduced.
TEST_TOKEN is Symfony's own mechanism for exactly this, so the fix uses
it rather than inventing a second DATABASE_URL. bin/test-unit.sh sets it
and does the create/migrate/seed a fresh database needs.
The seeding is the part worth guarding: PageRendersTest, ListFragmentTest
and others SKIP THEMSELVES when the admin user is missing, so without it a
green run would quietly be ~50 tests smaller than it looks — a worse
failure than a red one. Checked rather than assumed: 4047 tests either
way, no skipped or incomplete markers.
The assertion count moved, 11540 → 11526, and settled there across runs.
That is the point of the change showing up: the unit suite was reading
rows the browser stack had left behind, and now it reads only its own.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Five of the six open Dependabot PRs, taken locally in one pass rather
than merged one at a time: each rebase triggers the expensive workflow
and they all touch the same two lock files. The sixth, the actions group,
was merged as it was — its own CI was green, and it clears the Node 20
deprecation the runner has been printing.
symfony/* 8.1.0/8.1.1 → 8.1.5 (18 packages)
symfonycasts/tailwind-bundle 0.14.0 → 1.0.0
@types/node 22 → 26.2.0
typescript 5.6 → 7.0.2
PLAYWRIGHT IS PINNED AT ~1.61.1, deliberately, and this is the only part
worth arguing about.
1.62 failed eight cases in appearance/list-display.spec.ts, every one of
them asserting that a clip-path'd element is visible. Tailwind was the
obvious suspect and is innocent: the compiled clip-path and spacing rules
are byte-identical between the two builds. Reverting Playwright alone
took it from eight failures to none.
Then the question that actually matters — whether 1.62 is RIGHT, because
"element is hidden" could mean a real UI bug. It is not. The account
corner measures 10×10 at (957, 336), display block, visibility visible,
opacity 1, an opaque background, and a parent that does not clip. It is
on screen and painted. 1.62 changed what it counts as visible for
clipped elements and is wrong about this one.
`~1.61.1` rather than `^`: a caret would walk straight back into 1.62 on
the next clean install.
TypeScript 7 earned its place. It found a genuine error — el.click() on
`HTMLElement | SVGElement`, in a test written this morning, since TS7's
lib.dom no longer puts click() on SVGElement — plus nine implicit-anys
that TS5 had also been reporting into a void, because CI does not run
typecheck. All eleven fixed: `npm run typecheck` is clean for the first
time. A typecheck that is permanently red is one nobody runs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A wiki is where somebody already inside GitHub looks. It has no way to be
the thing a link to plMail shows a person who has never seen it, so there
is now a site as well: a landing page and the whole handbook, at
karatektus.github.io/pl_mail, deployed by .github/workflows/pages.yml on
every push to main.
It holds no content. The landing page IS README.md and the handbook IS
docs/, rendered into a shell by bin/build-site.php — nothing on the site
can say something the repository does not, because there is nowhere for
it to be written down. Even the hero is lifted rather than written: its
lead is README's own opening paragraph, because a hero composed here
would be the one piece of prose no file backs and the first thing to go
stale. The wiki mirror stays; two outputs of one source cannot disagree
with each other.
The tree is preserved rather than flattened, unlike the wiki mirror,
which had to flatten because a wiki has one namespace. So a cross-link
between two pages needs only its extension changed and an image reference
needs nothing, and the rewriting that remains is the small honest kind: a
path that escapes docs/ becomes a link into GitHub, because the site
carries the handbook and not the source.
**The theme picker is generated from the app's own enum.** Theme::swatch()
already carries surface, ink and accent per theme for the appearance
picker, and the rest of a palette is derived from those at build time —
so the site offers exactly the seven plMail offers, and adding an eighth
to the app adds it here. Transcribing them would have agreed until
somebody added one, and then the site would quietly offer six of seven.
The language picker lists a locale as available when docs/<locale>/
exists and as "not translated yet" when it does not, which makes
translating the handbook the act of creating that directory and nothing
else. Today that means English, with German and Pirate shown and
disabled — a switcher that silently omitted them would say the site has
no opinion about German, where this says where the gap is.
Search is the whole handbook as 140KB of JSON, fetched on first focus and
matched in the browser. A hosted index would be faster to write and would
stop the site being a directory of files that works from a checkout, from
a fork's Pages, and behind whatever proxy somebody puts it behind.
league/commonmark is a require-dev dependency: the site is built in CI and
never by the application, so a Markdown parser in the runtime image would
be a package nothing runs. Bumped guzzlehttp/guzzle to 7.15.2 while
composer was open — 7.15.1 carries two advisories, one of which is a
noncanonical host bypassing host-based checks, which is the shape of the
SSRF guard.
Also corrects this file's claim that the non-Docker Playwright variants
start `symfony serve`. They have not since that server was replaced.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Storage is JSCalendar (RFC 8984) in jsonb, with everything a query touches
projected into real columns. Both halves earn their place. JSCalendar is
canonical because everything this will ever talk to speaks it or converts
cleanly — iCalendar both ways, CalDAV, JMAP calendars when that draft
lands — and a bespoke schema gets re-derived badly the first time an .ics
round-trips, silently dropping participants, alerts and overrides. But
Postgres cannot do range logic on "PT1H", so the columns exist too.
Recurrence is the part that is easy to get almost right, and there are
only three options. Expanding RRULEs at query time means loading every
recurring event ever created to answer "what is in July" — a standup from
2019 still generates instances — and nothing is indexable. Materialising
everything does not terminate for FREQ=DAILY with no UNTIL. So:
materialise to a bounded horizon, roll it forward nightly, and fall back
to live expansion outside it.
calendar_event_occurrence carries a GENERATED tsrange, and views read it
with `span && tsrange(from, to)` against a GiST index. The naive
`starts_at < :to AND ends_at > :from` is not just slower — it silently
misses the conference that started last week and is still running, because
starts_at ordering stops approximating ends_at ordering once multi-day
events exist. That index lives only in the migration: this DBAL has no
flag for USING gist, so every schema diff asks to drop it, and nothing
here may run doctrine:schema:update.
Two findings from writing the tests:
* sabre accepts FREQ=SECONDLY and FREQ=MINUTELY at validation but its
iterator has no branch to advance on either, so it yields one instant
forever. The occurrence cap turned that into a thousand identical rows
— a worse failure than a hang, because it looks like it worked. The
converter now refuses both frequencies, and the materialiser stops on
any rule that fails to move forward.
* Expansion has to happen in the event's own zone. A 09:00 Berlin
standup is 08:00 UTC in winter and 07:00 UTC in summer; expanding in
UTC passes every test written in UTC and moves everyone's meeting
twice a year. Pinned by testWeeklyExpansionHoldsLocalTimeAcrossADst-
Transition.
Provenance tables (event_source_link, event_suppression) ship now though
nothing writes them yet: they are what will let extraction re-run over a
whole mailbox as a backfill rather than a resync, and a suppression the
user has already expressed must survive that.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The README has always said AGPL-3.0 and the repository invites pull
requests, but there was no LICENSE file and composer.json declared
"proprietary". In that state nobody could legally fork or contribute,
and GitHub could not detect a licence at all.
Adds the AGPL-3.0 text — which the licence itself requires be
distributed with the source — and corrects the composer declaration to
AGPL-3.0-or-later.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
dependabot[bot]