From 7cf4ebd20f8cdcfb492fc69835e6875dbbd45b4d Mon Sep 17 00:00:00 2001 From: Tobias Munk Date: Fri, 13 Nov 2026 12:55:10 +0100 Subject: [PATCH] feat(deps): require dmstr/api-configuration-bundle ^0.7 [*] Ignore advisory PKSA-s52d-n7sx-trsg for the dev-only mcp/sdk 0.8 until api-platform/core 4.4 supports mcp/sdk 0.9. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 10 ++++++++++ composer.json | 9 +++++++-- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 75c144b..b9f02a3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,16 @@ All notable changes to this bundle. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow [SemVer](https://semver.org/) and come from the Git tags. Releases before 0.9.0 are described in the [GitHub releases](https://github.com/dmstr/flowable-bundle/releases). +## [Unreleased] + +### Changed + +- **Requires `dmstr/api-configuration-bundle` `^0.7`** (adds the optional `ApiConfiguration::$sourceKey`; applications run its migration `Version20261111100000`). Applications on api-configuration-bundle 0.6 stay on 0.11.0. + +### Development + +- The advisory [PKSA-s52d-n7sx-trsg](https://github.com/modelcontextprotocol/php-sdk/security/advisories/GHSA-f4rf-6ghj-mhr6) on `mcp/sdk` 0.8 is ignored in `config.audit.ignore` so the test suite installs again. `mcp/sdk` is a dev-only dependency of this bundle (applications choose their own version); `api-platform/core` 4.4 supports `mcp/sdk` 0.9 only from [api-platform/core#8837](https://github.com/api-platform/core/pull/8837) on. The entry is removed once that is released. + ## [0.11.0] - 2026-10-29 The bundle no longer checks role names: every HTTP operation and every MCP tool checks its own permission. diff --git a/composer.json b/composer.json index 70ca4b2..7cc06fc 100644 --- a/composer.json +++ b/composer.json @@ -20,7 +20,7 @@ "require": { "php": ">=8.5", "api-platform/core": "^4.3.18", - "dmstr/api-configuration-bundle": "^0.6", + "dmstr/api-configuration-bundle": "^0.7", "dmstr/api-platform-utils-bundle": "^0.6.0", "dmstr/openapi-json-schema-bundle": "^0.3.0 || ^0.4.0", "doctrine/orm": "^3.0", @@ -65,6 +65,11 @@ } }, "config": { - "sort-packages": true + "sort-packages": true, + "audit": { + "ignore": { + "PKSA-s52d-n7sx-trsg": "mcp/sdk 0.8 is a dev-only dependency here; api-platform/core 4.4 supports mcp/sdk 0.9 only after api-platform/core#8837 (4.4.8). Remove once released." + } + } } }