[{"data":1,"prerenderedAt":1477},["ShallowReactive",2],{"navigation":3,"\u002Fgetting-started\u002Freleases":604,"\u002Fgetting-started\u002Freleases-surround":878,"$fu4qvupmcr9a5":883},[4,24,67,93,236,533],{"title":5,"path":6,"stem":7,"children":8,"collapsed":23},"Getting Started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,11,15,19],{"title":10,"path":6,"stem":7},"Introduction",{"title":12,"path":13,"stem":14},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation",{"title":16,"path":17,"stem":18},"Key Ideas","\u002Fgetting-started\u002Fkey-ideas","1.getting-started\u002F3.key-ideas",{"title":20,"path":21,"stem":22},"Releases","\u002Fgetting-started\u002Freleases","1.getting-started\u002F4.releases",true,{"title":25,"path":26,"stem":27,"children":28,"collapsed":23},"Core Concepts","\u002Fcore-concepts","2.core-concepts\u002F0.index",[29,31,35,39,43,47,51,55,59,63],{"title":30,"path":26,"stem":27},"Overview",{"title":32,"path":33,"stem":34},"How It All Works","\u002Fcore-concepts\u002Farchitecture","2.core-concepts\u002F1.architecture",{"title":36,"path":37,"stem":38},"The Data Model","\u002Fcore-concepts\u002Fthe-data-model","2.core-concepts\u002F2.the-data-model",{"title":40,"path":41,"stem":42},"Layouts & Pages","\u002Fcore-concepts\u002Flayouts-and-pages","2.core-concepts\u002F3.layouts-and-pages",{"title":44,"path":45,"stem":46},"Dynamic Pages","\u002Fcore-concepts\u002Fdynamic-pages","2.core-concepts\u002F4.dynamic-pages",{"title":48,"path":49,"stem":50},"Components","\u002Fcore-concepts\u002Fcomponents","2.core-concepts\u002F5.components",{"title":52,"path":53,"stem":54},"Draft & Publish Workflow","\u002Fcore-concepts\u002Fdraft-and-publish","2.core-concepts\u002F6.draft-and-publish",{"title":56,"path":57,"stem":58},"The Admin Panel","\u002Fcore-concepts\u002Fadmin-panel","2.core-concepts\u002F7.admin-panel",{"title":60,"path":61,"stem":62},"Caching","\u002Fcore-concepts\u002Fcaching","2.core-concepts\u002F8.caching",{"title":64,"path":65,"stem":66},"Glossary","\u002Fcore-concepts\u002Fglossary","2.core-concepts\u002F9.glossary",{"title":68,"path":69,"stem":70,"children":71,"collapsed":23},"Guides","\u002Fguides","3.guides\u002F0.index",[72,73,77,81,85,89],{"title":30,"path":69,"stem":70},{"title":74,"path":75,"stem":76},"Your First Layout","\u002Fguides\u002Fyour-first-layout","3.guides\u002F1.your-first-layout",{"title":78,"path":79,"stem":80},"Your First Page Template","\u002Fguides\u002Fyour-first-page-template","3.guides\u002F2.your-first-page-template",{"title":82,"path":83,"stem":84},"Your First Component","\u002Fguides\u002Fyour-first-component","3.guides\u002F3.your-first-component",{"title":86,"path":87,"stem":88},"Alternative UI Variants","\u002Fguides\u002Falternative-ui-variants","3.guides\u002F4.alternative-ui-variants",{"title":90,"path":91,"stem":92},"Your First Dynamic Page","\u002Fguides\u002Fyour-first-dynamic-page","3.guides\u002F5.your-first-dynamic-page",{"title":94,"path":95,"stem":96,"children":97,"collapsed":23},"API Bundle (Back-End)","\u002Fapi","4.api\u002F0.index",[98,99,103,107,129,175,179,183,212,216,220,224,228,232],{"title":30,"path":95,"stem":96},{"title":100,"path":101,"stem":102},"Bundle Setup","\u002Fapi\u002Fbundle-setup","4.api\u002F02.bundle-setup",{"title":104,"path":105,"stem":106},"Configuration Reference","\u002Fapi\u002Fconfiguration","4.api\u002F03.configuration",{"title":108,"path":109,"stem":110,"children":111,"page":128},"Users","\u002Fapi\u002Fusers","4.api\u002F04.users",[112,116,120,124],{"title":113,"path":114,"stem":115},"Authentication","\u002Fapi\u002Fusers\u002Fauthentication","4.api\u002F04.users\u002F1.authentication",{"title":117,"path":118,"stem":119},"User Emails","\u002Fapi\u002Fusers\u002Fuser-emails","4.api\u002F04.users\u002F2.user-emails",{"title":121,"path":122,"stem":123},"Access Control","\u002Fapi\u002Fusers\u002Faccess-control","4.api\u002F04.users\u002F3.access-control",{"title":125,"path":126,"stem":127},"Sites with Non-Admin Users","\u002Fapi\u002Fusers\u002Fnon-admin-users","4.api\u002F04.users\u002F4.non-admin-users",false,{"title":48,"path":130,"stem":131,"children":132,"page":128},"\u002Fapi\u002Fcomponents","4.api\u002F05.components",[133,137,158,171],{"title":134,"path":135,"stem":136},"Creating Components","\u002Fapi\u002Fcomponents\u002Fcreating-components","4.api\u002F05.components\u002F1.creating-components",{"title":138,"path":139,"stem":140,"children":141,"page":128},"Annotations","\u002Fapi\u002Fcomponents\u002Fannotations","4.api\u002F05.components\u002F2.annotations",[142,146,150,154],{"title":143,"path":144,"stem":145},"Publishable","\u002Fapi\u002Fcomponents\u002Fannotations\u002Fpublishable","4.api\u002F05.components\u002F2.annotations\u002F1.publishable",{"title":147,"path":148,"stem":149},"Uploadable","\u002Fapi\u002Fcomponents\u002Fannotations\u002Fuploadable","4.api\u002F05.components\u002F2.annotations\u002F2.uploadable",{"title":151,"path":152,"stem":153},"Timestamped","\u002Fapi\u002Fcomponents\u002Fannotations\u002Ftimestamped","4.api\u002F05.components\u002F2.annotations\u002F3.timestamped",{"title":155,"path":156,"stem":157},"Explicit Allow Only","\u002Fapi\u002Fcomponents\u002Fannotations\u002Fexplicit-allow-only","4.api\u002F05.components\u002F2.annotations\u002F4.explicit-allow-only",{"title":159,"path":160,"stem":161,"children":162,"page":128},"Built Ins","\u002Fapi\u002Fcomponents\u002Fbuilt-ins","4.api\u002F05.components\u002F3.built-ins",[163,167],{"title":164,"path":165,"stem":166},"Collection Component","\u002Fapi\u002Fcomponents\u002Fbuilt-ins\u002Fcollection-component","4.api\u002F05.components\u002F3.built-ins\u002F1.collection-component",{"title":168,"path":169,"stem":170},"Form Component","\u002Fapi\u002Fcomponents\u002Fbuilt-ins\u002Fform-component","4.api\u002F05.components\u002F3.built-ins\u002F2.form-component",{"title":172,"path":173,"stem":174},"Groups & Positions","\u002Fapi\u002Fcomponents\u002Fcomponent-groups","4.api\u002F05.components\u002F4.component-groups",{"title":176,"path":177,"stem":178},"Page Data & Nested Pages","\u002Fapi\u002Fdynamic-pages","4.api\u002F06.dynamic-pages",{"title":180,"path":181,"stem":182},"Routes","\u002Fapi\u002Froutes","4.api\u002F07.routes",{"title":184,"path":185,"stem":186,"children":187,"page":128},"Data Fixtures","\u002Fapi\u002Fdata-fixtures","4.api\u002F08.data-fixtures",[188,192,196,200,204,208],{"title":189,"path":190,"stem":191},"Getting Started with Fixtures","\u002Fapi\u002Fdata-fixtures\u002Fgetting-started","4.api\u002F08.data-fixtures\u002F1.getting-started",{"title":193,"path":194,"stem":195},"Writing a Scaffold","\u002Fapi\u002Fdata-fixtures\u002Fwriting-a-scaffold","4.api\u002F08.data-fixtures\u002F2.writing-a-scaffold",{"title":197,"path":198,"stem":199},"Builder Reference","\u002Fapi\u002Fdata-fixtures\u002Fbuilder-reference","4.api\u002F08.data-fixtures\u002F3.builder-reference",{"title":201,"path":202,"stem":203},"Seeding Content","\u002Fapi\u002Fdata-fixtures\u002Fseeding-content","4.api\u002F08.data-fixtures\u002F4.seeding-content",{"title":205,"path":206,"stem":207},"Appending & Multiple Scaffolds","\u002Fapi\u002Fdata-fixtures\u002Fappending","4.api\u002F08.data-fixtures\u002F5.appending",{"title":209,"path":210,"stem":211},"Generating Fixtures","\u002Fapi\u002Fdata-fixtures\u002Fgenerating-fixtures","4.api\u002F08.data-fixtures\u002F6.generating-fixtures",{"title":213,"path":214,"stem":215},"Real-Time (Mercure)","\u002Fapi\u002Freal-time","4.api\u002F09.real-time",{"title":217,"path":218,"stem":219},"Versions & Conflicts","\u002Fapi\u002Fversions-and-conflicts","4.api\u002F09.versions-and-conflicts",{"title":221,"path":222,"stem":223},"HTTP Caching","\u002Fapi\u002Fhttp-caching","4.api\u002F10.http-caching",{"title":225,"path":226,"stem":227},"Orphaned Data","\u002Fapi\u002Forphaned-data","4.api\u002F11.orphaned-data",{"title":229,"path":230,"stem":231},"Console Commands","\u002Fapi\u002Fconsole-commands","4.api\u002F12.console-commands",{"title":233,"path":234,"stem":235},"Debugging & Errors","\u002Fapi\u002Fdebugging","4.api\u002F13.debugging",{"title":237,"path":238,"stem":239,"children":240,"collapsed":23},"Nuxt Module (Front-End)","\u002Fnuxt-module","5.nuxt-module\u002F0.index",[241,242,246,259,279,308,329,460,494,497,525,529],{"title":30,"path":238,"stem":239},{"title":243,"path":244,"stem":245},"Module Setup","\u002Fnuxt-module\u002Fmodule-setup","5.nuxt-module\u002F01.module-setup",{"title":247,"path":248,"stem":249,"children":250,"page":128},"Configuration","\u002Fnuxt-module\u002Fconfiguration","5.nuxt-module\u002F02.configuration",[251,255],{"title":252,"path":253,"stem":254},"Nuxt Config","\u002Fnuxt-module\u002Fconfiguration\u002Fnuxt-config","5.nuxt-module\u002F02.configuration\u002F1.nuxt-config",{"title":256,"path":257,"stem":258},"Site Config & SEO","\u002Fnuxt-module\u002Fconfiguration\u002Fsite-config-and-seo","5.nuxt-module\u002F02.configuration\u002F2.site-config-and-seo",{"title":260,"path":261,"stem":262,"children":263,"page":128},"Building Your Ui","\u002Fnuxt-module\u002Fbuilding-your-ui","5.nuxt-module\u002F03.building-your-ui",[264,268,272,275],{"title":265,"path":266,"stem":267},"Layouts","\u002Fnuxt-module\u002Fbuilding-your-ui\u002Fcreating-layouts","5.nuxt-module\u002F03.building-your-ui\u002F1.creating-layouts",{"title":269,"path":270,"stem":271},"Page Templates","\u002Fnuxt-module\u002Fbuilding-your-ui\u002Fcreating-page-templates","5.nuxt-module\u002F03.building-your-ui\u002F2.creating-page-templates",{"title":48,"path":273,"stem":274},"\u002Fnuxt-module\u002Fbuilding-your-ui\u002Fcreating-components","5.nuxt-module\u002F03.building-your-ui\u002F3.creating-components",{"title":276,"path":277,"stem":278},"CLI Generator","\u002Fnuxt-module\u002Fbuilding-your-ui\u002Fcwa-cli","5.nuxt-module\u002F03.building-your-ui\u002F4.cwa-cli",{"title":280,"path":281,"stem":282,"children":283,"page":128},"Component Helpers","\u002Fnuxt-module\u002Fcomponent-helpers","5.nuxt-module\u002F04.component-helpers",[284,288,292,296,300,304],{"title":285,"path":286,"stem":287},"Images & Media","\u002Fnuxt-module\u002Fcomponent-helpers\u002Fimages-and-uploads","5.nuxt-module\u002F04.component-helpers\u002F1.images-and-uploads",{"title":289,"path":290,"stem":291},"Collections & Pagination","\u002Fnuxt-module\u002Fcomponent-helpers\u002Fcollections-and-pagination","5.nuxt-module\u002F04.component-helpers\u002F2.collections-and-pagination",{"title":293,"path":294,"stem":295},"HTML Content","\u002Fnuxt-module\u002Fcomponent-helpers\u002Fhtml-content","5.nuxt-module\u002F04.component-helpers\u002F3.html-content",{"title":297,"path":298,"stem":299},"Rich-Text Editor","\u002Fnuxt-module\u002Fcomponent-helpers\u002Frich-text-editor","5.nuxt-module\u002F04.component-helpers\u002F4.rich-text-editor",{"title":301,"path":302,"stem":303},"Real-Time Updates","\u002Fnuxt-module\u002Fcomponent-helpers\u002Freal-time-updates","5.nuxt-module\u002F04.component-helpers\u002F5.real-time-updates",{"title":305,"path":306,"stem":307},"Forms","\u002Fnuxt-module\u002Fcomponent-helpers\u002Fforms","5.nuxt-module\u002F04.component-helpers\u002F6.forms",{"title":309,"path":310,"stem":311,"children":312,"page":128},"Cwa Components","\u002Fnuxt-module\u002Fcwa-components","5.nuxt-module\u002F05.cwa-components",[313,317,321,325],{"title":314,"path":315,"stem":316},"\u003CCwaComponentGroup \u002F>","\u002Fnuxt-module\u002Fcwa-components\u002Fcwa-component-group","5.nuxt-module\u002F05.cwa-components\u002F1.cwa-component-group",{"title":318,"path":319,"stem":320},"\u003CCwaPage \u002F>","\u002Fnuxt-module\u002Fcwa-components\u002Fcwa-page","5.nuxt-module\u002F05.cwa-components\u002F2.cwa-page",{"title":322,"path":323,"stem":324},"\u003CCwaLink \u002F>","\u002Fnuxt-module\u002Fcwa-components\u002Fcwa-link","5.nuxt-module\u002F05.cwa-components\u002F3.cwa-link",{"title":326,"path":327,"stem":328},"\u003CCwaDefaultLayout \u002F>","\u002Fnuxt-module\u002Fcwa-components\u002Fcwa-default-layout","5.nuxt-module\u002F05.cwa-components\u002F5.cwa-default-layout",{"title":330,"path":331,"stem":332,"children":333,"page":128},"Composables","\u002Fnuxt-module\u002Fcomposables","5.nuxt-module\u002F06.composables",[334,337,345,370,390,415,435],{"title":30,"path":335,"stem":336},"\u002Fnuxt-module\u002Fcomposables\u002Foverview","5.nuxt-module\u002F06.composables\u002F0.overview",{"title":338,"path":339,"stem":340,"children":341,"page":128},"Layout","\u002Fnuxt-module\u002Fcomposables\u002Flayout","5.nuxt-module\u002F06.composables\u002F1.layout",[342],{"title":338,"path":343,"stem":344},"\u002Fnuxt-module\u002Fcomposables\u002Flayout\u002Fuse-cwa-layout","5.nuxt-module\u002F06.composables\u002F1.layout\u002F1.use-cwa-layout",{"title":346,"path":347,"stem":348,"children":349,"page":128},"Component","\u002Fnuxt-module\u002Fcomposables\u002Fcomponent","5.nuxt-module\u002F06.composables\u002F2.component",[350,354,358,362,366],{"title":351,"path":352,"stem":353},"Component (recommended)","\u002Fnuxt-module\u002Fcomposables\u002Fcomponent\u002Fuse-cwa-component","5.nuxt-module\u002F06.composables\u002F2.component\u002F1.use-cwa-component",{"title":355,"path":356,"stem":357},"Resource","\u002Fnuxt-module\u002Fcomposables\u002Fcomponent\u002Fuse-cwa-resource","5.nuxt-module\u002F06.composables\u002F2.component\u002F2.use-cwa-resource",{"title":359,"path":360,"stem":361},"File Field","\u002Fnuxt-module\u002Fcomposables\u002Fcomponent\u002Fuse-cwa-file-field","5.nuxt-module\u002F06.composables\u002F2.component\u002F3.use-cwa-file-field",{"title":363,"path":364,"stem":365},"Collection Pagination","\u002Fnuxt-module\u002Fcomposables\u002Fcomponent\u002Fuse-cwa-collection-pagination","5.nuxt-module\u002F06.composables\u002F2.component\u002F4.use-cwa-collection-pagination",{"title":367,"path":368,"stem":369},"Collection Resource (deprecated)","\u002Fnuxt-module\u002Fcomposables\u002Fcomponent\u002Fuse-cwa-collection-resource","5.nuxt-module\u002F06.composables\u002F2.component\u002F9.use-cwa-collection-resource",{"title":371,"path":372,"stem":373,"children":374,"page":128},"Form","\u002Fnuxt-module\u002Fcomposables\u002Fform","5.nuxt-module\u002F06.composables\u002F3.form",[375,378,382,386],{"title":371,"path":376,"stem":377},"\u002Fnuxt-module\u002Fcomposables\u002Fform\u002Fuse-cwa-form","5.nuxt-module\u002F06.composables\u002F3.form\u002F1.use-cwa-form",{"title":379,"path":380,"stem":381},"Form Input","\u002Fnuxt-module\u002Fcomposables\u002Fform\u002Fuse-cwa-form-input","5.nuxt-module\u002F06.composables\u002F3.form\u002F2.use-cwa-form-input",{"title":383,"path":384,"stem":385},"Form Repeated","\u002Fnuxt-module\u002Fcomposables\u002Fform\u002Fuse-cwa-form-repeated","5.nuxt-module\u002F06.composables\u002F3.form\u002F3.use-cwa-form-repeated",{"title":387,"path":388,"stem":389},"Form Collection","\u002Fnuxt-module\u002Fcomposables\u002Fform\u002Fuse-cwa-form-collection","5.nuxt-module\u002F06.composables\u002F3.form\u002F4.use-cwa-form-collection",{"title":391,"path":392,"stem":393,"children":394,"page":128},"Admin Manager","\u002Fnuxt-module\u002Fcomposables\u002Fadmin-manager","5.nuxt-module\u002F06.composables\u002F4.admin-manager",[395,399,403,407,411],{"title":396,"path":397,"stem":398},"Manager Tab","\u002Fnuxt-module\u002Fcomposables\u002Fadmin-manager\u002Fuse-cwa-resource-manager-tab","5.nuxt-module\u002F06.composables\u002F4.admin-manager\u002F1.use-cwa-resource-manager-tab",{"title":400,"path":401,"stem":402},"Resource Model","\u002Fnuxt-module\u002Fcomposables\u002Fadmin-manager\u002Fuse-cwa-resource-model","5.nuxt-module\u002F06.composables\u002F4.admin-manager\u002F2.use-cwa-resource-model",{"title":404,"path":405,"stem":406},"Resource Upload","\u002Fnuxt-module\u002Fcomposables\u002Fadmin-manager\u002Fuse-cwa-resource-upload","5.nuxt-module\u002F06.composables\u002F4.admin-manager\u002F3.use-cwa-resource-upload",{"title":408,"path":409,"stem":410},"Remote Changes","\u002Fnuxt-module\u002Fcomposables\u002Fadmin-manager\u002Fon-remote-change","5.nuxt-module\u002F06.composables\u002F4.admin-manager\u002F4.on-remote-change",{"title":412,"path":413,"stem":414},"Real-Time Events","\u002Fnuxt-module\u002Fcomposables\u002Fadmin-manager\u002Fuse-cwa-realtime","5.nuxt-module\u002F06.composables\u002F4.admin-manager\u002F5.use-cwa-realtime",{"title":416,"path":417,"stem":418,"children":419,"page":128},"Utilities","\u002Fnuxt-module\u002Fcomposables\u002Futilities","5.nuxt-module\u002F06.composables\u002F5.utilities",[420,424,428,432],{"title":421,"path":422,"stem":423},"Resource Endpoint","\u002Fnuxt-module\u002Fcomposables\u002Futilities\u002Fuse-cwa-resource-endpoint","5.nuxt-module\u002F06.composables\u002F5.utilities\u002F1.use-cwa-resource-endpoint",{"title":425,"path":426,"stem":427},"Query Model","\u002Fnuxt-module\u002Fcomposables\u002Futilities\u002Fuse-query-bound-model","5.nuxt-module\u002F06.composables\u002F5.utilities\u002F2.use-query-bound-model",{"title":429,"path":430,"stem":431},"Resource Route","\u002Fnuxt-module\u002Fcomposables\u002Futilities\u002Fuse-cwa-resource-route","5.nuxt-module\u002F06.composables\u002F5.utilities\u002F3.use-cwa-resource-route",{"title":293,"path":433,"stem":434},"\u002Fnuxt-module\u002Fcomposables\u002Futilities\u002Fuse-html-content","5.nuxt-module\u002F06.composables\u002F5.utilities\u002F4.use-html-content",{"title":436,"path":437,"stem":438,"children":439,"page":128},"Auth","\u002Fnuxt-module\u002Fcomposables\u002Fauth","5.nuxt-module\u002F06.composables\u002F6.auth",[440,444,448,452,456],{"title":441,"path":442,"stem":443},"Login","\u002Fnuxt-module\u002Fcomposables\u002Fauth\u002Fuse-login","5.nuxt-module\u002F06.composables\u002F6.auth\u002F1.use-login",{"title":445,"path":446,"stem":447},"Forgot Password","\u002Fnuxt-module\u002Fcomposables\u002Fauth\u002Fuse-forgot-password","5.nuxt-module\u002F06.composables\u002F6.auth\u002F2.use-forgot-password",{"title":449,"path":450,"stem":451},"Reset Password","\u002Fnuxt-module\u002Fcomposables\u002Fauth\u002Fuse-reset-password","5.nuxt-module\u002F06.composables\u002F6.auth\u002F3.use-reset-password",{"title":453,"path":454,"stem":455},"Verify Email","\u002Fnuxt-module\u002Fcomposables\u002Fauth\u002Fuse-verify-email","5.nuxt-module\u002F06.composables\u002F6.auth\u002F4.use-verify-email",{"title":457,"path":458,"stem":459},"Resend Verify Email","\u002Fnuxt-module\u002Fcomposables\u002Fauth\u002Fuse-resend-verify-email","5.nuxt-module\u002F06.composables\u002F6.auth\u002F5.use-resend-verify-email",{"title":461,"path":462,"stem":463,"children":464,"page":128},"Cwa Api","\u002Fnuxt-module\u002Fcwa-api","5.nuxt-module\u002F07.cwa-api",[465,468,472,476,479,482,486,490],{"title":30,"path":466,"stem":467},"\u002Fnuxt-module\u002Fcwa-api\u002Foverview","5.nuxt-module\u002F07.cwa-api\u002F1.overview",{"title":469,"path":470,"stem":471},"Resources","\u002Fnuxt-module\u002Fcwa-api\u002Fresources","5.nuxt-module\u002F07.cwa-api\u002F2.resources",{"title":473,"path":474,"stem":475},"Resources Manager","\u002Fnuxt-module\u002Fcwa-api\u002Fresources-manager","5.nuxt-module\u002F07.cwa-api\u002F3.resources-manager",{"title":436,"path":477,"stem":478},"\u002Fnuxt-module\u002Fcwa-api\u002Fauth","5.nuxt-module\u002F07.cwa-api\u002F4.auth",{"title":305,"path":480,"stem":481},"\u002Fnuxt-module\u002Fcwa-api\u002Fforms","5.nuxt-module\u002F07.cwa-api\u002F5.forms",{"title":483,"path":484,"stem":485},"Admin","\u002Fnuxt-module\u002Fcwa-api\u002Fadmin","5.nuxt-module\u002F07.cwa-api\u002F6.admin",{"title":487,"path":488,"stem":489},"Site Config","\u002Fnuxt-module\u002Fcwa-api\u002Fsite-config","5.nuxt-module\u002F07.cwa-api\u002F7.site-config",{"title":491,"path":492,"stem":493},"Orphaned Resources","\u002Fnuxt-module\u002Fcwa-api\u002Forphaned-resources","5.nuxt-module\u002F07.cwa-api\u002F8.orphaned-resources",{"title":113,"path":495,"stem":496},"\u002Fnuxt-module\u002Fauthentication","5.nuxt-module\u002F08.authentication",{"title":498,"path":499,"stem":500,"children":501,"page":128},"Cwa Layer","\u002Fnuxt-module\u002Fcwa-layer","5.nuxt-module\u002F9.cwa-layer",[502,505,509,513,517,521],{"title":30,"path":503,"stem":504},"\u002Fnuxt-module\u002Fcwa-layer\u002Foverview","5.nuxt-module\u002F9.cwa-layer\u002F1.overview",{"title":506,"path":507,"stem":508},"Auth Pages","\u002Fnuxt-module\u002Fcwa-layer\u002Fauth-pages","5.nuxt-module\u002F9.cwa-layer\u002F2.auth-pages",{"title":510,"path":511,"stem":512},"Admin Panel","\u002Fnuxt-module\u002Fcwa-layer\u002Fadmin-panel","5.nuxt-module\u002F9.cwa-layer\u002F3.admin-panel",{"title":514,"path":515,"stem":516},"Styling","\u002Fnuxt-module\u002Fcwa-layer\u002Fstyling","5.nuxt-module\u002F9.cwa-layer\u002F4.styling",{"title":518,"path":519,"stem":520},"Date Pickers","\u002Fnuxt-module\u002Fcwa-layer\u002Fdate-pickers","5.nuxt-module\u002F9.cwa-layer\u002F5.date-pickers",{"title":522,"path":523,"stem":524},"Maintenance","\u002Fnuxt-module\u002Fcwa-layer\u002Fmaintenance","5.nuxt-module\u002F9.cwa-layer\u002F6.maintenance",{"title":526,"path":527,"stem":528},"PWA & Offline","\u002Fnuxt-module\u002Fpwa","5.nuxt-module\u002F91.pwa",{"title":530,"path":531,"stem":532},"Page Caching","\u002Fnuxt-module\u002Fpage-caching","5.nuxt-module\u002F92.page-caching",{"title":534,"path":535,"stem":536,"children":537,"collapsed":23},"Deployment & Operations","\u002Fdeployment","6.deployment\u002F0.index",[538,540,544,548,552,556,560,564,568,572,576,580,584,588,592,596,600],{"title":539,"path":535,"stem":536},"Deploying a CWA Site",{"title":541,"path":542,"stem":543},"Docker","\u002Fdeployment\u002Fdocker","6.deployment\u002F1.docker",{"title":545,"path":546,"stem":547},"Deploy to One Server","\u002Fdeployment\u002Fone-server","6.deployment\u002F1.one-server",{"title":549,"path":550,"stem":551},"Kubernetes & Helm","\u002Fdeployment\u002Fkubernetes","6.deployment\u002F2.kubernetes",{"title":553,"path":554,"stem":555},"Moving From One Server to Kubernetes","\u002Fdeployment\u002Fmoving-to-kubernetes","6.deployment\u002F2.moving-to-kubernetes",{"title":557,"path":558,"stem":559},"Scaled Mode","\u002Fdeployment\u002Fscaled-mode","6.deployment\u002F2.scaled-mode",{"title":561,"path":562,"stem":563},"CI\u002FCD","\u002Fdeployment\u002Fci-cd","6.deployment\u002F3.ci-cd",{"title":565,"path":566,"stem":567},"Migrations and Backups","\u002Fdeployment\u002Fmigrations-and-backups","6.deployment\u002F3.migrations-and-backups",{"title":569,"path":570,"stem":571},"CI\u002FCD Variables","\u002Fdeployment\u002Fvariables","6.deployment\u002F4.variables",{"title":573,"path":574,"stem":575},"Cloudflare","\u002Fdeployment\u002Fcloudflare","6.deployment\u002F5.cloudflare",{"title":577,"path":578,"stem":579},"Origin Protection","\u002Fdeployment\u002Forigin-protection","6.deployment\u002F5.origin-protection",{"title":581,"path":582,"stem":583},"Load Testing","\u002Fdeployment\u002Fload-testing","6.deployment\u002F6.load-testing",{"title":585,"path":586,"stem":587},"Performance Audit","\u002Fdeployment\u002Fperformance-audit","6.deployment\u002F6.performance-audit",{"title":589,"path":590,"stem":591},"Reading Lighthouse Scores","\u002Fdeployment\u002Freading-lighthouse-scores","6.deployment\u002F6.reading-lighthouse-scores",{"title":593,"path":594,"stem":595},"Browser Tests","\u002Fdeployment\u002Fbrowser-tests","6.deployment\u002F7.browser-tests",{"title":597,"path":598,"stem":599},"Faster Functional Tests","\u002Fdeployment\u002Ffaster-functional-tests","6.deployment\u002F7.faster-functional-tests",{"title":601,"path":602,"stem":603},"Troubleshooting","\u002Fdeployment\u002Ftroubleshooting","6.deployment\u002F7.troubleshooting",{"id":605,"title":20,"badge":606,"body":607,"description":873,"extension":874,"links":606,"meta":875,"navigation":23,"path":21,"seo":876,"stem":22,"__hash__":877},"docs\u002F1.getting-started\u002F4.releases.md",null,{"type":608,"value":609,"toc":866},"minimark",[610,614,647,650,671,676,783,786,839,843,846,849,853],[611,612,613],"p",{},"A CWA site is built from three parts, each released on its own:",[615,616,617,625,634],"ul",{},[618,619,620,624],"li",{},[621,622,623],"strong",{},"api-components-bundle",", the Symfony bundle, installed with Composer.",[618,626,627,633],{},[621,628,629],{},[630,631,632],"code",{},"@cwa\u002Fnuxt",", the Nuxt module, installed from npm.",[618,635,636,639,640,643,644,646],{},[621,637,638],{},"The template"," (components-web-app), the project ",[630,641,642],{},"create-cwa"," generates. ",[630,645,642],{}," has the same version as the template release it installs.",[611,648,649],{},"CWA 2 is a prerelease (2.0.0-alpha), heading for a beta. It runs production sites; configuration can still change between releases, always with upgrade notes. Update the three together, and follow the upgrade notes of every release you skip over.",[651,652,654],"callout",{"icon":653},"i-heroicons-light-bulb",[611,655,656,659,660,663,664,667,668,670],{},[621,657,658],{},"The docs describe the current version."," They follow the bundle's ",[630,661,662],{},"main",", the module's ",[630,665,666],{},"dev"," and the template's ",[630,669,662],{},", which can be ahead of the last release, and they don't say which release a feature arrived in. What changed in each release, and how to upgrade, is in its release notes below.",[672,673,675],"h2",{"id":674},"versions-and-support","Versions and support",[615,677,678,684,698,723,748,770],{},[618,679,680,683],{},[621,681,682],{},"SemVer from 2.0.0."," Until then every release is a prerelease, and any release can include a breaking change. Each one comes with an upgrade note in its release notes, so apply the notes of every release you skip.",[618,685,686,689,690,697],{},[621,687,688],{},"The beta freezes the data model."," Before the beta, the template's migrations are squashed into one (",[691,692,696],"a",{"href":693,"rel":694},"https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F192",[695],"nofollow","template #192","). From the beta on, schema changes come as new migrations only, and breaking changes still come with upgrade notes.",[618,699,700,706,707,709,710,713,714,717,718,722],{},[621,701,702,703,705],{},"The template and ",[630,704,642],{}," share one version."," ",[630,708,642],{}," X installs the template tagged ",[630,711,712],{},"vX",", and ",[630,715,716],{},"--ref"," installs another branch or tag (see ",[691,719,721],{"href":720},"\u002Fgetting-started\u002Finstallation#_1-scaffold-your-project","Installation › 1. Scaffold your project",").",[618,724,725,706,732,734,735,737,738,740,741,734,744,747],{},[621,726,727,728,731],{},"npm's ",[630,729,730],{},"latest"," tag carries prereleases until 2.0.0.",[630,733,642],{}," and ",[630,736,632],{}," publish each prerelease as ",[630,739,730],{},", so ",[630,742,743],{},"pnpm create cwa",[630,745,746],{},"pnpm add @cwa\u002Fnuxt"," install the newest release.",[618,749,750,753,754,759,760,764,765,769],{},[621,751,752],{},"Only the latest prerelease is supported."," Older alphas get no fixes, security fixes included: upgrade to the latest release. Each repository's security policy says so and explains how to report a problem privately: the template's ",[691,755,758],{"href":756,"rel":757},"https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fblob\u002Fmain\u002FSECURITY.md",[695],"SECURITY.md",", the API bundle's ",[691,761,758],{"href":762,"rel":763},"https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fblob\u002Fmain\u002FSECURITY.md",[695]," and the Nuxt module's ",[691,766,758],{"href":767,"rel":768},"https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fblob\u002Fmain\u002FSECURITY.md",[695],".",[618,771,772,775,776,778,779,769],{},[621,773,774],{},"Some bundle and module versions must be updated together."," The bundle each ",[630,777,632],{}," release needs is in ",[691,780,782],{"href":781},"\u002Fnuxt-module\u002Fmodule-setup#bundle-versions","Module Setup › Bundle versions",[611,784,785],{},"Each template release moves to a bundle and a module version:",[787,788,789,805],"table",{},[790,791,792],"thead",{},[793,794,795,799,801],"tr",{},[796,797,798],"th",{},"Template",[796,800,623],{},[796,802,803],{},[630,804,632],{},[806,807,808,825],"tbody",{},[793,809,810,819,822],{},[811,812,813,818],"td",{},[691,814,817],{"href":815,"rel":816},"https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.45",[695],"2.0.0-alpha.45"," (latest)",[811,820,821],{},"2.0.0-alpha.34",[811,823,824],{},"2.0.0-alpha.25",[793,826,827,834,836],{},[811,828,829],{},[691,830,833],{"href":831,"rel":832},"https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.44",[695],"2.0.0-alpha.44",[811,835,821],{},[811,837,838],{},"2.0.0-alpha.24",[672,840,842],{"id":841},"latest-releases","Latest releases",[611,844,845],{},"Each release's notes come straight from GitHub, including its upgrade notes. Template releases also say which bundle and module versions they move to.",[847,848],"release-notes",{},[672,850,852],{"id":851},"the-modules-minimum-bundle","The module's minimum bundle",[611,854,855,856,858,859,861,862,769],{},"Some ",[630,857,632],{}," releases need a newer bundle. The table of the bundle each module release needs, and why, is in ",[691,860,782],{"href":781},". The module's other requirements, such as its Nuxt version, are in ",[691,863,865],{"href":864},"\u002Fnuxt-module\u002Fmodule-setup#requirements","Module Setup › Requirements",{"title":867,"searchDepth":868,"depth":868,"links":869},"",2,[870,871,872],{"id":674,"depth":868,"text":675},{"id":841,"depth":868,"text":842},{"id":851,"depth":868,"text":852},"The latest api-components-bundle, @cwa\u002Fnuxt and template releases, with their notes and upgrade steps from GitHub.","md",{},{"title":20,"description":873},"iwU2mE_pwsiC-Y5OnO5kvBszRAaZojUB2P_yEZAKhuw",[879,881],{"title":16,"path":17,"stem":18,"description":880,"children":-1},"The handful of terms the guides use — layouts, pages, component groups, IRIs, uiComponent, page data and edit mode — each in a sentence or two.",{"title":30,"path":26,"stem":27,"description":882,"children":-1},"How a CWA site works, from the request to the data model, caching and the admin. Who this section is for and the order to read it.",[884,890,895,900,906,912,917,922,927,932,937,942,947,952,957,962,967,972,977,982,987,992,997,1002,1006,1011,1015,1020,1024,1029,1034,1039,1044,1049,1054,1059,1064,1069,1074,1079,1084,1089,1094,1099,1104,1109,1114,1118,1123,1128,1132,1137,1142,1147,1152,1157,1162,1167,1172,1177,1181,1186,1190,1195,1200,1205,1209,1214,1219,1224,1229,1233,1238,1242,1246,1251,1255,1260,1265,1269,1273,1278,1282,1287,1292,1296,1300,1305,1310,1315,1319,1323,1328,1332,1336,1340,1344,1349,1354,1358,1362,1366,1370,1374,1378,1383,1387,1392,1396,1401,1406,1410,1414,1419,1425,1430,1435,1439,1445,1450,1454,1459,1464,1469,1473],{"part":885,"tag":886,"name":886,"publishedAt":887,"url":888,"body":889},"template","v2.0.0-alpha.55","2026-11-01T10:41:20Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.55","## [2.0.0-alpha.55](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.55) - 2026-11-01\n\n### Upgrade notes\n\n- **create-cwa's questions changed** ([commit](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd84cbe77780b1d1959063f7a60e20f7918af24ea)): `--yes` and `--ci` now pick the pre-selected components (navigation, rich text, images; was none) and `--content demo`. Pass `--features none` for the old default. `--fixtures`\u002F`--no-fixtures` still work, as `--content demo`\u002F`--content empty`, and `--content home` creates just the layout and home page. Scripts that call create-cwa unattended should check their flags.\n\n### Added\n\n- **Single-server deploys from CI over SSH** ([#212](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F212), [commit](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1aec0c9a9741e7fd81b7788cad8eb4eeb6608d94), [README](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F801b3e3f361aa192fd35bb4efb98ecebec7c83ba)): GitLab's manual `production server` job and GitHub's `server.yml` run `bin\u002Fdevops\u002Fserver-deploy.sh`. It copies the commit to the server with rsync, never sending or deleting what git ignores there (`.env.prod`, `backups\u002F`), and runs `bin\u002Fserver\u002Fdeploy.sh`. Setting `CWA_CI_SERVER_HOST` makes a project single-server, and every Kubernetes deploy job then skips. Also set `CWA_CI_SERVER_SSH_KEY` (secret) and `CWA_CI_SERVER_KNOWN_HOSTS` (host keys are always checked), with optional `_USER` (`deploy`), `_PORT` and `_PATH` (`cwa`). Take `.gitlab-ci.yml`, or `.github\u002Fworkflows\u002F` (`server.yml` is new; `ci.yml`, `cleanup.yml` and `production.yml` skip on it), with `bin\u002Fdevops\u002Fserver-deploy.sh`.\n- **Single-server deploys run the images CI built** ([commit](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff92f7dd9f3d955f876be6d916f539a2295045e01)): the server pulls the pipeline's php and app images by digest instead of building them, with a registry login that only lasts the run. `CWA_CI_SERVER_BUILD=\"true\"` builds on the server instead (for a server of another architecture than the runners).\n- **create-cwa asks where to deploy and which starting pages to create** ([commit](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd84cbe77780b1d1959063f7a60e20f7918af24ea)):\n  - \"Deploy to?\" (with a pipeline): Kubernetes, or one server (`--deploy`).\n  - The components are named by what an editor gets, with navigation, rich text and images pre-selected (`--features default`).\n  - \"Start with example pages?\": an example of each component, just a home page, or an empty site (`--content demo|home|empty`).\n- `api\u002Ftests\u002FFunctional\u002FContentWritePermissionTest.php` ([#228](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F228)): a signed-in user without `ROLE_ADMIN` gets 403 on writes to components, layouts, pages, routes, component groups and positions; an admin can write. It guards `publishable.permission` (`is_granted('ROLE_ADMIN')`). ([commit](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fa97c9f9b8855c27af795366725b400fc206c2bc7))\n\n### Security\n\n- `pnpm audit` and `composer audit` (2026-11-01): nothing new. Still accepted, not in the server output: deepmerge 4.3.1 (GHSA-gcqx-w48m-w2h4, low), glob 10.5.0, 11.1.0 and 13.0.6 (GHSA-3g3m-2fjr-6pw4, moderate) and minimatch 5.1.9, 9.0.9 and 10.2.6 (GHSA-g3hv-75wg-m249, moderate), all build-only, waiting on fixes their dependents allow.\n\n### Fixed\n\n- **A create-cwa project without the image feature builds and passes its tests** ([#227](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F227)): `AltHtmlContent.vue` uses a plain `\u003Cimg>` instead of `\u003Cnuxt-img>` (`@nuxt\u002Fimage` goes with the image feature), and `api\u002Ftests\u002FFunctional\u002FImageTest.php` goes with it too. A project created without images takes `app\u002Fapp\u002Fcwa\u002Fcomponents\u002FHtmlContent\u002Fui\u002FAltHtmlContent.vue` and deletes `api\u002Ftests\u002FFunctional\u002FImageTest.php`. `bin\u002Ftest\u002Fmanifest-features.php` (template CI only) checks every feature's exclude list. ([commit](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F72b27ee26ce7e6860d31ac9ec483e0561c793b23))\n\n### cwa-php-base 2.0.0-alpha.55\n\nPin it as `ghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.55@sha256:61113ef15c9c2c6835223eb74a0f38b4baf0451f5c7d0e380e6cdde4b940adb1`.\n\nVerify it with:\n\n```sh\ngh attestation verify oci:\u002F\u002Fghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.55 --repo components-web-app\u002Fcomponents-web-app \\\n  --signer-workflow components-web-app\u002Fcomponents-web-app\u002F.github\u002Fworkflows\u002Fpublish-php-base.yml --source-ref refs\u002Ftags\u002Fv2.0.0-alpha.55\n```\n\n```\n# Base images (from the build provenance)\npkg:docker\u002Fcaddy@builder?platform=linux%2Famd64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0\npkg:docker\u002Fcaddy@builder?platform=linux%2Farm64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315\npkg:docker\u002Fdocker\u002Fdockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Famd64 sha256:8a7b37474d2778a745ca1bd8a0b6d0cd15c6f7b2a835117bad108411781869ec\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Farm64 sha256:8a7b37474d2778a745ca1bd8a0b6d0cd15c6f7b2a835117bad108411781869ec\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Famd64 sha256:6f86f003f1478bafa7befe6ec26db5575e703882171f785189de1e222df0e38e\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Farm64 sha256:6f86f003f1478bafa7befe6ec26db5575e703882171f785189de1e222df0e38e\n\nPHP 8.5.12 (cli) (built: Oct 28 2026 01:23:40) (ZTS)\nCopyright (c) The PHP Group\nBuilt by https:\u002F\u002Fgithub.com\u002Fdocker-library\u002Fphp\nZend Engine v4.5.12, Copyright (c) Zend Technologies\n    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies\n\n[PHP Modules]\napcu\nbrotli\nCore\nctype\ncurl\ndate\ndom\nexif\nFFI\nfileinfo\nfilter\ngd\nhash\niconv\nintl\njson\nlexbor\nlibxml\nmbstring\nmysqlnd\nopenssl\npcre\nPDO\npdo_pgsql\npdo_sqlite\nPhar\nposix\nrandom\nreadline\nReflection\nsession\nSimpleXML\nsodium\nSPL\nsqlite3\nstandard\ntokenizer\nuri\nxml\nxmlreader\nxmlwriter\nxsl\nZend OPcache\nzip\nzlib\n\n[Zend Modules]\nZend OPcache\n\n\ngo\tgo1.27.3\npath\tcaddy\nmod\tcaddy\t(devel)\t\ndep\tcel.dev\u002Fcel-go\tv0.32.0\th1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=\ndep\tcel.dev\u002Fexpr\tv0.25.3\th1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=\ndep\tcloud.google.com\u002Fgo\u002Fauth\tv0.24.1\th1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=\ndep\tcloud.google.com\u002Fgo\u002Fauth\u002Foauth2adapt\tv0.3.0\th1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=\ndep\tcloud.google.com\u002Fgo\u002Fcompute\u002Fmetadata\tv0.10.0\th1:pyKMUQSwchgkIBBJGdILqQbs\u002FBNJXqwSA7Ej6LAvvtY=\ndep\tdario.cat\u002Fmergo\tv1.0.2\th1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=\ndep\tfilippo.io\u002Fbigmod\tv0.1.0\th1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=\ndep\tfilippo.io\u002Fedwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=\ndep\tgithub.com\u002FBurntSushi\u002Ftoml\tv1.6.0\th1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=\ndep\tgithub.com\u002FDeRuina\u002Ftimberjack\tv1.4.9\th1:9RjDMSkUDQRYzwVNB\u002FFLonXNurcZVEh9sK43m2jw3A4=\ndep\tgithub.com\u002FKimMachineGun\u002Fautomemlimit\tv1.0.1\th1:87PowSIJFht5TmyyZKJNR4y2v7Cm9OdCzsSMR8jXJHM=\ndep\tgithub.com\u002FMasterminds\u002Fgoutils\tv1.1.1\th1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=\ndep\tgithub.com\u002FMasterminds\u002Fsemver\u002Fv3\tv3.5.0\th1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ\u002F2OOE=\ndep\tgithub.com\u002FMasterminds\u002Fsprig\u002Fv3\tv3.3.0\th1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=\ndep\tgithub.com\u002FMauriceGit\u002Fskiplist\tv0.0.0-20211105230623-77f5c8d3e145\th1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=\ndep\tgithub.com\u002FMicahParks\u002Fjwkset\tv0.11.3\th1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=\ndep\tgithub.com\u002FMicahParks\u002Fkeyfunc\u002Fv3\tv3.8.2\th1:eydEwk\u002FpBAVrDIpmFfB\u002FgkCcrp++xQ7YYXirrI2zlWE=\ndep\tgithub.com\u002FRoaringBitmap\u002Froaring\u002Fv2\tv2.30.0\th1:1sD4xsCenNd9n\u002FgOWaExCWanP9WTyiNuqLAvaDQ5jkY=\ndep\tgithub.com\u002Falecthomas\u002Fchroma\u002Fv2\tv2.27.0\th1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v\u002Fr5BXYZs=\ndep\tgithub.com\u002Fantlabs\u002Fstl\tv0.0.1\th1:TRD3csCrjREeLhLoQ\u002FsupaoCvFhNLBTNIwuRGrDIs6Q=\ndep\tgithub.com\u002Fantlabs\u002Ftimer\tv0.0.11\th1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=\ndep\tgithub.com\u002Fantlr4-go\u002Fantlr\u002Fv4\tv4.13.1\th1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=\ndep\tgithub.com\u002Faryann\u002Fdifflib\tv0.0.0-20210328193216-ff5ff6dc229b\th1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=\ndep\tgithub.com\u002Fbeorn7\u002Fperks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=\ndep\tgithub.com\u002Fbits-and-blooms\u002Fbitset\tv1.26.0\th1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=\ndep\tgithub.com\u002Fbwmarrin\u002Fsnowflake\tv0.3.0\th1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=\ndep\tgithub.com\u002Fcaddyserver\u002Fcaddy\u002Fv2\tv2.11.7\th1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=\ndep\tgithub.com\u002Fcaddyserver\u002Fcertmagic\tv0.25.6\th1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=\ndep\tgithub.com\u002Fcaddyserver\u002Fzerossl\tv0.1.6\th1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT\u002F4REW\u002F\u002Flsas=\ndep\tgithub.com\u002Fccoveille\u002Fgo-safecast\u002Fv2\tv2.0.1\th1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=\ndep\tgithub.com\u002Fcenkalti\u002Fbackoff\u002Fv5\tv5.0.3\th1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=\ndep\tgithub.com\u002Fcespare\u002Fxxhash\u002Fv2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=\ndep\tgithub.com\u002Fchzyer\u002Freadline\tv1.5.1\th1:upd\u002F6fQk4src78LMRzh5vItIt361\u002Fo4uq553V8B5sGI=\ndep\tgithub.com\u002Fcloudflare\u002Fcircl\tv1.6.5\th1:O64F26HEqNhznd\u002FhrC5KZXVKYuKM2rx4deZDTc4ihQA=\ndep\tgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fapi\u002Ffrankenphp\u002Fcaddy\u002Fqueryallowlist\tv0.0.0-20261101092458-4a75f4e1c5d0\n=>\t\u002Ftmp\u002Fqueryallowlist\t(devel)\t\n\ndep\tgithub.com\u002Fcoreos\u002Fgo-oidc\u002Fv3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=\ndep\tgithub.com\u002Fcpuguy83\u002Fgo-md2man\u002Fv2\tv2.0.7\th1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\tv1.7.9\n=>\t\u002Ftmp\u002Fsouin\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\u002Fplugins\u002Fcaddy\tv1.7.9\th1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\tv0.0.21\th1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M\u002FJRc+zhN7Wsx0=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\u002Fcaddy\tv0.0.22\th1:4\u002FbyA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fcore\tv0.0.21\th1:zfa0Bqzdm9\u002FoPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\tv0.0.22\n=>\t\u002Ftmp\u002Fstorages-go-redis\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\u002Fcaddy\tv0.0.22\th1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\tv0.0.21\th1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\u002Fcaddy\tv0.0.22\th1:kg\u002FHYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\tv0.0.21\th1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\u002Fcaddy\tv0.0.22\th1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=\ndep\tgithub.com\u002Fdgraph-io\u002Fbadger\u002Fv4\tv4.9.1\th1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=\ndep\tgithub.com\u002Fdgraph-io\u002Fristretto\u002Fv2\tv2.2.0\th1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=\ndep\tgithub.com\u002Fdgryski\u002Fgo-rendezvous\tv0.0.0-20200823014737-9f7001d12a5f\th1:lO4WD4F\u002FrVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=\ndep\tgithub.com\u002Fdlclark\u002Fregexp2\u002Fv2\tv2.10.0\th1:zSNli+yyb7Rg4VzzLiZuJ3eZup\u002FOObARXm\u002Fqs1a2\u002F\u002Fc=\ndep\tgithub.com\u002Fdolthub\u002Fmaphash\tv0.1.0\th1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L\u002FQxPDyQ=\ndep\tgithub.com\u002Fdunglas\u002Fcaddy-cbrotli\tv1.0.1\th1:mkg7EB1GmoyfBt3kY3mq4o\u002F0bfnBeq7ZLQjmVmdBE3Y=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\tv1.13.4\th1:MK45+Ai4Hnd+\u002FV3fpcFNXh5JknkOx+VIbmThLgHiDrw=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\u002Fcaddy\tv1.13.4\th1:PY4Q1l5CJM6ZfWeKU+dTeo4b8DHjoJ923ik+ugHU9NM=\ndep\tgithub.com\u002Fdunglas\u002Fgo-urlpattern\tv1.0.0\th1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=\ndep\tgithub.com\u002Fdunglas\u002Fhttpsfv\tv1.1.2\th1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ\u002FDkmc=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\tv1.1.5\th1:SlEUgMTiQst0zhx4HlPKuo95GRZM6bHCrxH1Me7jQ4M=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\u002Fcaddy\tv1.1.5\th1:Rl1Xh55YwZkFisNnlEZNLpLDL97bfdePSktcbhNb\u002FRU=\ndep\tgithub.com\u002Fdunglas\u002Fskipfilter\tv1.2.0\th1:J7\u002FRXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\tv1.4.5\th1:vO7CS3\u002FKwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\u002Fcaddy\tv1.4.5\th1:2qzg18nEkpsc1QIvpNn\u002FoztSHRxY1\u002FG6xuxylxVobGY=\ndep\tgithub.com\u002Fdustin\u002Fgo-humanize\tv1.1.0\th1:dbKTrvD0klcbBV\u002Fh4AWJdMuZogJACoMlvWIWZ5b2xWg=\ndep\tgithub.com\u002Fe-dant\u002Fwatcher\tv0.0.0-20260223030516-06f84a1314be\th1:vqHrvilasyJcnru\u002F0Z4FoojsQJUIfXGVplte7JtupfY=\ndep\tgithub.com\u002Felnormous\u002Fcontenttype\tv1.0.4\th1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=\ndep\tgithub.com\u002Ffelixge\u002Fhttpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw\u002FQDuVfpNhoA31zeORc=\ndep\tgithub.com\u002Ffxamacker\u002Fcbor\u002Fv2\tv2.9.6\th1:NHZPxuUjJXQjX9itA785y\u002F5NKSlI4HQ+S7noZsmI7hs=\ndep\tgithub.com\u002Fgammazero\u002Fdeque\tv0.2.1\th1:qSdsbG6pgp6nL7A0+K\u002FB7s12mcCY\u002F5l5SIUpMOl+dC0=\ndep\tgithub.com\u002Fgetkin\u002Fkin-openapi\tv0.152.0\th1:XRVo77lMRyOGMHf1paMu9lxX3wzuQDZeprssZJnz\u002Fx8=\ndep\tgithub.com\u002Fgo-chi\u002Fchi\u002Fv5\tv5.5.0\th1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv3\tv3.0.5\th1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv4\tv4.1.6\th1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=\ndep\tgithub.com\u002Fgo-logr\u002Flogr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg\u002F+cPVcbP\u002F8=\ndep\tgithub.com\u002Fgo-logr\u002Fstdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=\ndep\tgithub.com\u002Fgo-openapi\u002Fjsonpointer\tv1.0.2\th1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=\ndep\tgithub.com\u002Fgofrs\u002Fflock\tv0.13.0\th1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ\u002FA8dRYMzw=\ndep\tgithub.com\u002Fgofrs\u002Fuuid\tv4.4.0+incompatible\th1:3qXRTX8\u002FNbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=\ndep\tgithub.com\u002Fgolang-jwt\u002Fjwt\u002Fv5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=\ndep\tgithub.com\u002Fgoogle\u002Fbrotli\u002Fgo\u002Fcbrotli\tv1.2.1\th1:3NEHODycoTQr6cCq\u002FyYNyBqcuk9fKRjSuiADFy2V8h8=\ndep\tgithub.com\u002Fgoogle\u002Fcertificate-transparency-go\tv1.4.0\th1:78uNaR2knzCoKKXXDSAGVkz9XPkDg5xXJRP9tP6+rr0=\ndep\tgithub.com\u002Fgoogle\u002Fflatbuffers\tv25.2.10+incompatible\th1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H\u002FpNX4FP1v0Q=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tpm\tv0.9.8\th1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tspi\tv0.3.0\th1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=\ndep\tgithub.com\u002Fgoogle\u002Fs2a-go\tv0.1.11\th1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=\ndep\tgithub.com\u002Fgoogle\u002Fuuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=\ndep\tgithub.com\u002Fgoogleapis\u002Fenterprise-certificate-proxy\tv0.3.24\th1:G9iCJIY+AYVmUskKdjX8FVy7sG+nbzjOQ41cvlmhcvg=\ndep\tgithub.com\u002Fgoogleapis\u002Fgax-go\u002Fv2\tv2.27.0\th1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc\u002FRRZhKA\u002F2g0=\ndep\tgithub.com\u002Fgorilla\u002Fhandlers\tv1.5.2\th1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=\ndep\tgithub.com\u002Fgorilla\u002Fmux\tv1.8.1\th1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=\ndep\tgithub.com\u002Fgrpc-ecosystem\u002Fgrpc-gateway\u002Fv2\tv2.32.0\th1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=\ndep\tgithub.com\u002Fhuandu\u002Fxstrings\tv1.6.3\th1:7997PcI0mYC9uPNBJ7udg\u002FKrdJh1GhJid8f2tzKFHYQ=\ndep\tgithub.com\u002Fklauspost\u002Fcompress\tv1.20.3\th1:zWNoFqq\u002FlSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=\ndep\tgithub.com\u002Fklauspost\u002Fcpuid\u002Fv2\tv2.4.1\th1:I9KxadAkvo+QjtcEE2f2tyfEvmIla\u002FT0m+14PrZNl0U=\ndep\tgithub.com\u002Flibdns\u002Flibdns\tv1.1.1\th1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS\u002FP\u002FU=\ndep\tgithub.com\u002Fmanifoldco\u002Fpromptui\tv0.9.0\th1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=\ndep\tgithub.com\u002Fmattn\u002Fgo-colorable\tv0.1.16\th1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=\ndep\tgithub.com\u002Fmattn\u002Fgo-isatty\tv0.0.24\th1:tGZZoVgT\u002FKiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\tv1.2.4\th1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\u002Fv2\tv2.4.0\th1:1XpRRWaq9DRIqZV7UtglS4VLzYKSsnFOQmzV+KZxLb0=\ndep\tgithub.com\u002Fmgutz\u002Fansi\tv0.0.0-20200706080929-d51e80ef957d\th1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=\ndep\tgithub.com\u002Fmholt\u002Facmez\u002Fv3\tv3.1.7\th1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=\ndep\tgithub.com\u002Fmholt\u002Fcaddy-ratelimit\tv0.1.0\th1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=\ndep\tgithub.com\u002Fmiekg\u002Fdns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=\ndep\tgithub.com\u002Fmitchellh\u002Fcopystructure\tv1.2.0\th1:vpKXTN4ewci03Vljg\u002Fq9QvCGUDttBOGBIa15WveJJGw=\ndep\tgithub.com\u002Fmitchellh\u002Fgo-ps\tv1.0.0\th1:i6ampVEEF4wQFF+bkYfwYgY+F\u002FuYJDktmvLPf7qIgjc=\ndep\tgithub.com\u002Fmitchellh\u002Freflectwalk\tv1.0.2\th1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=\ndep\tgithub.com\u002Fmunnerz\u002Fgoautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01\u002FOq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=\ndep\tgithub.com\u002Fnlnwa\u002Fwhatwg-url\tv0.6.2\th1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ\u002FQ=\ndep\tgithub.com\u002Fnutsdb\u002Fnutsdb\tv1.0.4\th1:BurzkxijXJY1\u002FAkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=\ndep\tgithub.com\u002Foasdiff\u002Fyaml\tv0.1.1\th1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=\ndep\tgithub.com\u002Foasdiff\u002Fyaml3\tv0.0.14\th1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=\ndep\tgithub.com\u002Fpbnjay\u002Fmemory\tv0.0.0-20210728143218-7b4eea64cf58\th1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=\ndep\tgithub.com\u002Fpierrec\u002Flz4\u002Fv4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=\ndep\tgithub.com\u002Fpires\u002Fgo-proxyproto\tv0.16.0\th1:9KYT\u002FfM3wpjT8bdMEj\u002F7FBcoiUG1KyzEjRYnPu+vz7A=\ndep\tgithub.com\u002Fpkg\u002Ferrors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=\ndep\tgithub.com\u002Fpquerna\u002Fcachecontrol\tv0.2.0\th1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=\ndep\tgithub.com\u002Fprometheus\u002Fclient_golang\tv1.25.0\th1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=\ndep\tgithub.com\u002Fprometheus\u002Fclient_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=\ndep\tgithub.com\u002Fprometheus\u002Fcommon\tv0.72.1\th1:ZAiQed\u002Fnk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=\ndep\tgithub.com\u002Fprometheus\u002Fotlptranslator\tv1.0.0\th1:s0LJW\u002FiN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=\ndep\tgithub.com\u002Fprometheus\u002Fprocfs\tv0.23.0\th1:ad+S6FTkzwaMgacKLM5h6bNKExS+DMH0YiUwXItH\u002Fo4=\ndep\tgithub.com\u002Fquic-go\u002Fqpack\tv0.6.0\th1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=\ndep\tgithub.com\u002Fquic-go\u002Fquic-go\tv0.64.1\th1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=\ndep\tgithub.com\u002Fredis\u002Fgo-redis\u002Fv9\tv9.18.0\th1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=\ndep\tgithub.com\u002Frs\u002Fcors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=\ndep\tgithub.com\u002Frs\u002Fxid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=\ndep\tgithub.com\u002Frussross\u002Fblackfriday\u002Fv2\tv2.1.0\th1:JIOH55\u002F0cWyOuilr9\u002Fqlrm0BSXldqnqwMsf35Ld67mk=\ndep\tgithub.com\u002Fsanthosh-tekuri\u002Fjsonschema\u002Fv6\tv6.0.3\th1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls\u002F28=\ndep\tgithub.com\u002Fshopspring\u002Fdecimal\tv1.6.0\th1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=\ndep\tgithub.com\u002FshurcooL\u002Fsanitized_anchor_name\tv1.0.0\th1:PdmoCO6wvbs+7yrJyMORt4\u002FBmY5IYyJwS\u002FkOiWx8mHo=\ndep\tgithub.com\u002Fsirupsen\u002Flogrus\tv1.10.2\th1:G2SED73\u002FqrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=\ndep\tgithub.com\u002Fslackhq\u002Fnebula\tv1.11.2\th1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=\ndep\tgithub.com\u002Fsmallstep\u002Fcertificates\tv0.30.2\th1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf\u002FiQtA5QlN0Y=\ndep\tgithub.com\u002Fsmallstep\u002Fcli-utils\tv0.12.2\th1:lGzM9PJrH\u002FqawbzMC\u002Fs2SvgLdJPKDWKwKzx9doCVO+k=\ndep\tgithub.com\u002Fsmallstep\u002Fgo-attestation\tv0.4.9\th1:\u002FfVmzB8A8tk7B2PCGPlszWzyl\u002FGDcEQbynqcg2PMaZ0=\ndep\tgithub.com\u002Fsmallstep\u002Flinkedca\tv0.26.0\th1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=\ndep\tgithub.com\u002Fsmallstep\u002Fnosql\tv0.8.0\th1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli\u002FXB4Jp4A=\ndep\tgithub.com\u002Fsmallstep\u002Fpkcs7\tv0.2.3\th1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=\ndep\tgithub.com\u002Fsmallstep\u002Fscep\tv0.0.0-20261014185058-63893dadfda8\th1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=\ndep\tgithub.com\u002Fsmallstep\u002Ftruststore\tv0.13.0\th1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi\u002Fpy4=\ndep\tgithub.com\u002Fspf13\u002Fcast\tv1.10.0\th1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=\ndep\tgithub.com\u002Fspf13\u002Fcobra\tv1.10.2\th1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=\ndep\tgithub.com\u002Fspf13\u002Fpflag\tv1.0.10\th1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=\ndep\tgithub.com\u002Ftailscale\u002Ftscert\tv0.0.0-20251216020129-aea342f6d747\th1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=\ndep\tgithub.com\u002Ftidwall\u002Fbtree\tv1.6.0\th1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=\ndep\tgithub.com\u002Funrolled\u002Fsecure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=\ndep\tgithub.com\u002Furfave\u002Fcli\tv1.22.17\th1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=\ndep\tgithub.com\u002Fx448\u002Ffloat16\tv0.8.4\th1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=\ndep\tgithub.com\u002Fxujiajun\u002Fmmap-go\tv1.0.1\th1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv\u002FWHc=\ndep\tgithub.com\u002Fxujiajun\u002Futils\tv0.0.0-20220904132955-5f7c5b914235\th1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark\tv1.8.6\th1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark-highlighting\u002Fv2\tv2.0.0-20230729083705-37449abec8cc\th1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=\ndep\tgithub.com\u002Fzeebo\u002Fblake3\tv0.2.4\th1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM\u002FyBqhaZI=\ndep\tgo.etcd.io\u002Fbbolt\tv1.5.0\th1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P\u002FbD4lxU=\ndep\tgo.opentelemetry.io\u002Fauto\u002Fsdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ\u002FipaZ64=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fbridges\u002Fprometheus\tv0.72.0\th1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w\u002F1ROwHEM7M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fexporters\u002Fautoexport\tv0.72.0\th1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Finstrumentation\u002Fnet\u002Fhttp\u002Fotelhttp\tv0.72.0\th1:LxwW\u002F9ctSCv+QkE\u002FcLR7M91ZIkXNMqJtEMi1vCw9U8s=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fautoprop\tv0.72.0\th1:\u002FKv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Faws\tv1.47.0\th1:n\u002F2x\u002FvQki1ojD7R2jYHdnNdI74Yx\u002FOFdY4YXFFesm8M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fb3\tv1.47.0\th1:vlKDmtjhe1R0d7kdov\u002F+KVTKWOKeGLyohB+iXoDPRMQ=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fjaeger\tv1.47.0\th1:2lDw6AKPV33\u002F7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fot\tv1.47.0\th1:nZUqh0\u002F8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=\ndep\tgo.opentelemetry.io\u002Fotel\tv1.47.0\th1:j7ALJ\u002FzgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploggrpc\tv0.23.0\th1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploghttp\tv0.23.0\th1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI\u002FnE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetricgrpc\tv1.47.0\th1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetrichttp\tv1.47.0\th1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\tv1.47.0\th1:julhjPeUH\u002Fq\u002F7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracegrpc\tv1.47.0\th1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracehttp\tv1.47.0\th1:aXZXsZ012wOgVkqaiQv+Z\u002Fd8V0xKjmg70F6m4CE94lc=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fprometheus\tv0.69.0\th1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutlog\tv0.23.0\th1:PW\u002FE9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutmetric\tv1.47.0\th1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdouttrace\tv1.47.0\th1:N3YQCxjxQ\u002FbMjyc3heladfRm9t9RTksGQH8z4w6yU\u002F0=\ndep\tgo.opentelemetry.io\u002Fotel\u002Flog\tv1.47.0\th1:cOTS1CcLbSQeZKanGJ+0JpF\u002F+t4PELi3O3bbl2lqCcI=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fmetric\tv1.47.0\th1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\tv1.47.0\th1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Flog\tv1.47.0\th1:W4N\u002FZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Fmetric\tv1.47.0\th1:lfISg2j93VT6yqdk9OfUaZmw\u002FGfcZqCCV3jdXtsPnKw=\ndep\tgo.opentelemetry.io\u002Fotel\u002Ftrace\tv1.47.0\th1:JOjX\u002FOci8K94QHddo+bbfya\u002FAi\u002Fnf6\u002Fdt9ZfrFNWSrM=\ndep\tgo.opentelemetry.io\u002Fproto\u002Fotlp\tv1.11.1\th1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=\ndep\tgo.step.sm\u002Fcrypto\tv0.91.0\th1:0mN0DwVOvUuh7VbyTnxABZuAkxwak\u002FGrp8Y\u002Fb4YaZDU=\ndep\tgo.uber.org\u002Fatomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp\u002FAUETXlHW0DxSjE=\ndep\tgo.uber.org\u002Fautomaxprocs\tv1.6.0\th1:O3y2\u002FQNTOdbF+e\u002FdpXNNW7Rx2hZ4sTIPyybbxyNqTUs=\ndep\tgo.uber.org\u002Fmultierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=\ndep\tgo.uber.org\u002Fzap\tv1.28.0\th1:IZzaP1Fv73\u002FT\u002FpBMLk4VutPl36uNC+OSUh3JLG3FIjo=\ndep\tgo.uber.org\u002Fzap\u002Fexp\tv0.3.0\th1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=\ndep\tgo.yaml.in\u002Fyaml\u002Fv3\tv3.0.5\th1:N6y\u002FpJk8buWs9NY5ERU2HSMfm+IuD\u002FOtfdAnq6kESPw=\ndep\tgolang.org\u002Fx\u002Fcrypto\tv0.58.0\th1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K\u002FM\u002F54=\ndep\tgolang.org\u002Fx\u002Fcrypto\u002Fx509roots\u002Ffallback\tv0.0.0-20261020153306-9f2b28d4331a\th1:V5oicZXS0oqZx30gY\u002FapgSVD7YvNBfrIOdcMnlelJY4=\ndep\tgolang.org\u002Fx\u002Fexp\tv0.0.0-20261014143641-f0251eb4aa3e\th1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI\u002FA=\ndep\tgolang.org\u002Fx\u002Fnet\tv0.61.0\th1:RR+6j\u002FBTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=\ndep\tgolang.org\u002Fx\u002Foauth2\tv0.37.0\th1:JUlcxA8oAtauLfiH8FX2\u002FFkAWHAdi0QtGCGc+hofE98=\ndep\tgolang.org\u002Fx\u002Fsync\tv0.24.0\th1:iqiDrGoDgyuvAKrhLQthUEzU\u002FR378N78gXbBjxed7oA=\ndep\tgolang.org\u002Fx\u002Fsys\tv0.49.0\th1:XbzkgYJHdqh\u002F8m2Uu0W\u002FdQv8nktxx4BFHp1M0gROTXA=\ndep\tgolang.org\u002Fx\u002Fterm\tv0.47.0\th1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ\u002FBM=\ndep\tgolang.org\u002Fx\u002Ftext\tv0.43.0\th1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5\u002FUGUTJVXoWc=\ndep\tgolang.org\u002Fx\u002Ftime\tv0.16.0\th1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q\u002F6gY2hDM6VDE=\ndep\tgoogle.golang.org\u002Fapi\tv0.308.0\th1:iGb+4qT3nVb3uuIzwor3yP2nyu+rMZr31PvLFiRNJQk=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Fapi\tv0.0.0-20261019180522-ce908d29299b\th1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Frpc\tv0.0.0-20261019180522-ce908d29299b\th1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=\ndep\tgoogle.golang.org\u002Fgrpc\tv1.84.0\th1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=\ndep\tgoogle.golang.org\u002Fprotobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o\u002Ffwxc=\ndep\tgopkg.in\u002Fyaml.v3\tv3.0.1\th1:fxVm\u002FGzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=\nbuild\t-buildmode=exe\nbuild\t-compiler=gc\nbuild\t-ldflags=\"-w -s\"\nbuild\t-tags=nobadger,nomysql,nopgx\nbuild\tCGO_ENABLED=1\nbuild\tCGO_CFLAGS=\"-I\u002Fusr\u002Flocal\u002Finclude\u002Fphp -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fmain -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FTSRM -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FZend -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext\u002Fdate\u002Flib\"\nbuild\tCGO_CPPFLAGS=\"-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64\"\nbuild\tCGO_CXXFLAGS=\nbuild\tCGO_LDFLAGS=\"-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto\"\nbuild\tGOARCH=amd64\nbuild\tGOOS=linux\nbuild\tGOAMD64=v1\n\n```\n",{"part":885,"tag":891,"name":891,"publishedAt":892,"url":893,"body":894},"v2.0.0-alpha.54","2026-11-01T09:38:51Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.54","## [2.0.0-alpha.54](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.54) - 2026-11-01\n\n### Upgrade notes\n\n- **PostgreSQL 18** ([commit](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fb711a4d8c1a8ffe6bf6904e09d49311b5ff4ebfd)): Doctrine's `server_version`, compose's database image and `serverVersion` default, the e2e image, the CI test service and the backup job's default image go to 18. PG18 images keep their data under `\u002Fvar\u002Flib\u002Fpostgresql` (a versioned directory), so compose mounts the volume there instead of `\u002Fdata`: an existing local PG14\u002F16 volume won't start under 18. Dump it first (`pg_dump`) or recreate it (`docker compose down -v`, then `bin\u002Fup`).\n- **The in-cluster PostgreSQL is the chart's own StatefulSet on `postgres:18-alpine`** ([commit](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fbaa7c0bd0572fdafc705ef0e94601303a0bd27f7)), replacing the Bitnami subchart, which never published PostgreSQL 18. Take `helm\u002Fcwa` whole (`templates\u002Fpostgresql.yaml` is new, `Chart.lock` goes), with `bin\u002Fdevops\u002Fk8s.sh` and `bin\u002Ftest\u002Fdatabase-job-chart.sh`. It upgrades a release in place (same immutable StatefulSet fields; rehearsed from chart 14.3.3 in kind), but the data directory is new, so an in-cluster database starts empty on its first deploy: reload fixtures, or `pg_dump` a persistent one first. `CWA_CI_POSTGRES_IMAGE_TAG` is now an official image tag (default `18-alpine`); `POSTGRES_ROOT_PASSWORD` (the Bitnami `postgres` superuser's password) is no longer read: delete it from a project's CI variables.\n- **No chart dependencies, and the chart's PostgreSQL values are flat** ([commit](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fba19c6300e1ec158587c36e612ab97e5ca5d77b8)): `helm_init` is gone from `bin\u002Fdevops\u002Fk8s.sh`, so take `.gitlab-ci.yml` or `.github\u002Fworkflows\u002Fci.yml` and `production.yml` with it (a project job still calling `helm_init` fails with \"not found\"). `postgresql.global.postgresql.auth` is now `postgresql.auth`, and `postgresql.primary.persistence`, `.resources` and `.pullPolicy` are `postgresql.persistence` etc.: move any `project_values` or `--set` that used the old paths. GitHub's functional-test service and the backup image's fallback also go to PostgreSQL 18.\n\n### Security\n\n- `pnpm audit` and `composer audit` (2026-11-01): nothing new. Still accepted, not in the server output: deepmerge 4.3.1 (GHSA-gcqx-w48m-w2h4, low), glob 10.5.0, 11.1.0 and 13.0.6 (GHSA-3g3m-2fjr-6pw4, moderate) and minimatch 5.1.9, 9.0.9 and 10.2.6 (GHSA-g3hv-75wg-m249, moderate), all build-only, waiting on fixes their dependents allow.\n\n### Fixed\n\n- The browser-test and server-script stacks mount the database's tmpfs on `\u002Fvar\u002Flib\u002Fpostgresql`: PostgreSQL 18 images refuse to start with a mount on `\u002Fvar\u002Flib\u002Fpostgresql\u002Fdata`. A project that copies `e2e\u002F` takes `e2e\u002Fcompose.yaml`. ([commit](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F91ef577adbababa7a8414bec433584bb36fd004b))\n\n\n### cwa-php-base 2.0.0-alpha.54\n\nPin it as `ghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.54@sha256:e655cd15377f6915a3a5c5a305b3af71c2282e60b2a1249b0e86900856717ade`.\n\nVerify it with:\n\n```sh\ngh attestation verify oci:\u002F\u002Fghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.54 --repo components-web-app\u002Fcomponents-web-app \\\n  --signer-workflow components-web-app\u002Fcomponents-web-app\u002F.github\u002Fworkflows\u002Fpublish-php-base.yml --source-ref refs\u002Ftags\u002Fv2.0.0-alpha.54\n```\n\n```\n# Base images (from the build provenance)\npkg:docker\u002Fcaddy@builder?platform=linux%2Famd64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0\npkg:docker\u002Fcaddy@builder?platform=linux%2Farm64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315\npkg:docker\u002Fdocker\u002Fdockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Famd64 sha256:8a7b37474d2778a745ca1bd8a0b6d0cd15c6f7b2a835117bad108411781869ec\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Farm64 sha256:8a7b37474d2778a745ca1bd8a0b6d0cd15c6f7b2a835117bad108411781869ec\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Famd64 sha256:6f86f003f1478bafa7befe6ec26db5575e703882171f785189de1e222df0e38e\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Farm64 sha256:6f86f003f1478bafa7befe6ec26db5575e703882171f785189de1e222df0e38e\n\nPHP 8.5.12 (cli) (built: Oct 28 2026 01:23:40) (ZTS)\nCopyright (c) The PHP Group\nBuilt by https:\u002F\u002Fgithub.com\u002Fdocker-library\u002Fphp\nZend Engine v4.5.12, Copyright (c) Zend Technologies\n    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies\n\n[PHP Modules]\napcu\nbrotli\nCore\nctype\ncurl\ndate\ndom\nexif\nFFI\nfileinfo\nfilter\ngd\nhash\niconv\nintl\njson\nlexbor\nlibxml\nmbstring\nmysqlnd\nopenssl\npcre\nPDO\npdo_pgsql\npdo_sqlite\nPhar\nposix\nrandom\nreadline\nReflection\nsession\nSimpleXML\nsodium\nSPL\nsqlite3\nstandard\ntokenizer\nuri\nxml\nxmlreader\nxmlwriter\nxsl\nZend OPcache\nzip\nzlib\n\n[Zend Modules]\nZend OPcache\n\n\ngo\tgo1.27.3\npath\tcaddy\nmod\tcaddy\t(devel)\t\ndep\tcel.dev\u002Fcel-go\tv0.32.0\th1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=\ndep\tcel.dev\u002Fexpr\tv0.25.3\th1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=\ndep\tcloud.google.com\u002Fgo\u002Fauth\tv0.24.1\th1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=\ndep\tcloud.google.com\u002Fgo\u002Fauth\u002Foauth2adapt\tv0.3.0\th1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=\ndep\tcloud.google.com\u002Fgo\u002Fcompute\u002Fmetadata\tv0.10.0\th1:pyKMUQSwchgkIBBJGdILqQbs\u002FBNJXqwSA7Ej6LAvvtY=\ndep\tdario.cat\u002Fmergo\tv1.0.2\th1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=\ndep\tfilippo.io\u002Fbigmod\tv0.1.0\th1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=\ndep\tfilippo.io\u002Fedwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=\ndep\tgithub.com\u002FBurntSushi\u002Ftoml\tv1.6.0\th1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=\ndep\tgithub.com\u002FDeRuina\u002Ftimberjack\tv1.4.9\th1:9RjDMSkUDQRYzwVNB\u002FFLonXNurcZVEh9sK43m2jw3A4=\ndep\tgithub.com\u002FKimMachineGun\u002Fautomemlimit\tv1.0.1\th1:87PowSIJFht5TmyyZKJNR4y2v7Cm9OdCzsSMR8jXJHM=\ndep\tgithub.com\u002FMasterminds\u002Fgoutils\tv1.1.1\th1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=\ndep\tgithub.com\u002FMasterminds\u002Fsemver\u002Fv3\tv3.5.0\th1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ\u002F2OOE=\ndep\tgithub.com\u002FMasterminds\u002Fsprig\u002Fv3\tv3.3.0\th1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=\ndep\tgithub.com\u002FMauriceGit\u002Fskiplist\tv0.0.0-20211105230623-77f5c8d3e145\th1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=\ndep\tgithub.com\u002FMicahParks\u002Fjwkset\tv0.11.3\th1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=\ndep\tgithub.com\u002FMicahParks\u002Fkeyfunc\u002Fv3\tv3.8.2\th1:eydEwk\u002FpBAVrDIpmFfB\u002FgkCcrp++xQ7YYXirrI2zlWE=\ndep\tgithub.com\u002FRoaringBitmap\u002Froaring\u002Fv2\tv2.30.0\th1:1sD4xsCenNd9n\u002FgOWaExCWanP9WTyiNuqLAvaDQ5jkY=\ndep\tgithub.com\u002Falecthomas\u002Fchroma\u002Fv2\tv2.27.0\th1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v\u002Fr5BXYZs=\ndep\tgithub.com\u002Fantlabs\u002Fstl\tv0.0.1\th1:TRD3csCrjREeLhLoQ\u002FsupaoCvFhNLBTNIwuRGrDIs6Q=\ndep\tgithub.com\u002Fantlabs\u002Ftimer\tv0.0.11\th1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=\ndep\tgithub.com\u002Fantlr4-go\u002Fantlr\u002Fv4\tv4.13.1\th1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=\ndep\tgithub.com\u002Faryann\u002Fdifflib\tv0.0.0-20210328193216-ff5ff6dc229b\th1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=\ndep\tgithub.com\u002Fbeorn7\u002Fperks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=\ndep\tgithub.com\u002Fbits-and-blooms\u002Fbitset\tv1.26.0\th1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=\ndep\tgithub.com\u002Fbwmarrin\u002Fsnowflake\tv0.3.0\th1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=\ndep\tgithub.com\u002Fcaddyserver\u002Fcaddy\u002Fv2\tv2.11.7\th1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=\ndep\tgithub.com\u002Fcaddyserver\u002Fcertmagic\tv0.25.6\th1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=\ndep\tgithub.com\u002Fcaddyserver\u002Fzerossl\tv0.1.6\th1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT\u002F4REW\u002F\u002Flsas=\ndep\tgithub.com\u002Fccoveille\u002Fgo-safecast\u002Fv2\tv2.0.1\th1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=\ndep\tgithub.com\u002Fcenkalti\u002Fbackoff\u002Fv5\tv5.0.3\th1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=\ndep\tgithub.com\u002Fcespare\u002Fxxhash\u002Fv2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=\ndep\tgithub.com\u002Fchzyer\u002Freadline\tv1.5.1\th1:upd\u002F6fQk4src78LMRzh5vItIt361\u002Fo4uq553V8B5sGI=\ndep\tgithub.com\u002Fcloudflare\u002Fcircl\tv1.6.5\th1:O64F26HEqNhznd\u002FhrC5KZXVKYuKM2rx4deZDTc4ihQA=\ndep\tgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fapi\u002Ffrankenphp\u002Fcaddy\u002Fqueryallowlist\tv0.0.0-20261101082154-a6d4ca67f6e0\n=>\t\u002Ftmp\u002Fqueryallowlist\t(devel)\t\n\ndep\tgithub.com\u002Fcoreos\u002Fgo-oidc\u002Fv3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=\ndep\tgithub.com\u002Fcpuguy83\u002Fgo-md2man\u002Fv2\tv2.0.7\th1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\tv1.7.9\n=>\t\u002Ftmp\u002Fsouin\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\u002Fplugins\u002Fcaddy\tv1.7.9\th1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\tv0.0.21\th1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M\u002FJRc+zhN7Wsx0=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\u002Fcaddy\tv0.0.22\th1:4\u002FbyA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fcore\tv0.0.21\th1:zfa0Bqzdm9\u002FoPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\tv0.0.22\n=>\t\u002Ftmp\u002Fstorages-go-redis\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\u002Fcaddy\tv0.0.22\th1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\tv0.0.21\th1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\u002Fcaddy\tv0.0.22\th1:kg\u002FHYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\tv0.0.21\th1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\u002Fcaddy\tv0.0.22\th1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=\ndep\tgithub.com\u002Fdgraph-io\u002Fbadger\u002Fv4\tv4.9.1\th1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=\ndep\tgithub.com\u002Fdgraph-io\u002Fristretto\u002Fv2\tv2.2.0\th1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=\ndep\tgithub.com\u002Fdgryski\u002Fgo-rendezvous\tv0.0.0-20200823014737-9f7001d12a5f\th1:lO4WD4F\u002FrVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=\ndep\tgithub.com\u002Fdlclark\u002Fregexp2\u002Fv2\tv2.10.0\th1:zSNli+yyb7Rg4VzzLiZuJ3eZup\u002FOObARXm\u002Fqs1a2\u002F\u002Fc=\ndep\tgithub.com\u002Fdolthub\u002Fmaphash\tv0.1.0\th1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L\u002FQxPDyQ=\ndep\tgithub.com\u002Fdunglas\u002Fcaddy-cbrotli\tv1.0.1\th1:mkg7EB1GmoyfBt3kY3mq4o\u002F0bfnBeq7ZLQjmVmdBE3Y=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\tv1.13.4\th1:MK45+Ai4Hnd+\u002FV3fpcFNXh5JknkOx+VIbmThLgHiDrw=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\u002Fcaddy\tv1.13.4\th1:PY4Q1l5CJM6ZfWeKU+dTeo4b8DHjoJ923ik+ugHU9NM=\ndep\tgithub.com\u002Fdunglas\u002Fgo-urlpattern\tv1.0.0\th1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=\ndep\tgithub.com\u002Fdunglas\u002Fhttpsfv\tv1.1.2\th1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ\u002FDkmc=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\tv1.1.5\th1:SlEUgMTiQst0zhx4HlPKuo95GRZM6bHCrxH1Me7jQ4M=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\u002Fcaddy\tv1.1.5\th1:Rl1Xh55YwZkFisNnlEZNLpLDL97bfdePSktcbhNb\u002FRU=\ndep\tgithub.com\u002Fdunglas\u002Fskipfilter\tv1.2.0\th1:J7\u002FRXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\tv1.4.5\th1:vO7CS3\u002FKwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\u002Fcaddy\tv1.4.5\th1:2qzg18nEkpsc1QIvpNn\u002FoztSHRxY1\u002FG6xuxylxVobGY=\ndep\tgithub.com\u002Fdustin\u002Fgo-humanize\tv1.1.0\th1:dbKTrvD0klcbBV\u002Fh4AWJdMuZogJACoMlvWIWZ5b2xWg=\ndep\tgithub.com\u002Fe-dant\u002Fwatcher\tv0.0.0-20260223030516-06f84a1314be\th1:vqHrvilasyJcnru\u002F0Z4FoojsQJUIfXGVplte7JtupfY=\ndep\tgithub.com\u002Felnormous\u002Fcontenttype\tv1.0.4\th1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=\ndep\tgithub.com\u002Ffelixge\u002Fhttpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw\u002FQDuVfpNhoA31zeORc=\ndep\tgithub.com\u002Ffxamacker\u002Fcbor\u002Fv2\tv2.9.6\th1:NHZPxuUjJXQjX9itA785y\u002F5NKSlI4HQ+S7noZsmI7hs=\ndep\tgithub.com\u002Fgammazero\u002Fdeque\tv0.2.1\th1:qSdsbG6pgp6nL7A0+K\u002FB7s12mcCY\u002F5l5SIUpMOl+dC0=\ndep\tgithub.com\u002Fgetkin\u002Fkin-openapi\tv0.152.0\th1:XRVo77lMRyOGMHf1paMu9lxX3wzuQDZeprssZJnz\u002Fx8=\ndep\tgithub.com\u002Fgo-chi\u002Fchi\u002Fv5\tv5.5.0\th1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv3\tv3.0.5\th1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv4\tv4.1.6\th1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=\ndep\tgithub.com\u002Fgo-logr\u002Flogr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg\u002F+cPVcbP\u002F8=\ndep\tgithub.com\u002Fgo-logr\u002Fstdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=\ndep\tgithub.com\u002Fgo-openapi\u002Fjsonpointer\tv1.0.2\th1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=\ndep\tgithub.com\u002Fgofrs\u002Fflock\tv0.13.0\th1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ\u002FA8dRYMzw=\ndep\tgithub.com\u002Fgofrs\u002Fuuid\tv4.4.0+incompatible\th1:3qXRTX8\u002FNbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=\ndep\tgithub.com\u002Fgolang-jwt\u002Fjwt\u002Fv5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=\ndep\tgithub.com\u002Fgoogle\u002Fbrotli\u002Fgo\u002Fcbrotli\tv1.2.1\th1:3NEHODycoTQr6cCq\u002FyYNyBqcuk9fKRjSuiADFy2V8h8=\ndep\tgithub.com\u002Fgoogle\u002Fcertificate-transparency-go\tv1.4.0\th1:78uNaR2knzCoKKXXDSAGVkz9XPkDg5xXJRP9tP6+rr0=\ndep\tgithub.com\u002Fgoogle\u002Fflatbuffers\tv25.2.10+incompatible\th1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H\u002FpNX4FP1v0Q=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tpm\tv0.9.8\th1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tspi\tv0.3.0\th1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=\ndep\tgithub.com\u002Fgoogle\u002Fs2a-go\tv0.1.11\th1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=\ndep\tgithub.com\u002Fgoogle\u002Fuuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=\ndep\tgithub.com\u002Fgoogleapis\u002Fenterprise-certificate-proxy\tv0.3.24\th1:G9iCJIY+AYVmUskKdjX8FVy7sG+nbzjOQ41cvlmhcvg=\ndep\tgithub.com\u002Fgoogleapis\u002Fgax-go\u002Fv2\tv2.27.0\th1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc\u002FRRZhKA\u002F2g0=\ndep\tgithub.com\u002Fgorilla\u002Fhandlers\tv1.5.2\th1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=\ndep\tgithub.com\u002Fgorilla\u002Fmux\tv1.8.1\th1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=\ndep\tgithub.com\u002Fgrpc-ecosystem\u002Fgrpc-gateway\u002Fv2\tv2.32.0\th1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=\ndep\tgithub.com\u002Fhuandu\u002Fxstrings\tv1.6.3\th1:7997PcI0mYC9uPNBJ7udg\u002FKrdJh1GhJid8f2tzKFHYQ=\ndep\tgithub.com\u002Fklauspost\u002Fcompress\tv1.20.3\th1:zWNoFqq\u002FlSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=\ndep\tgithub.com\u002Fklauspost\u002Fcpuid\u002Fv2\tv2.4.1\th1:I9KxadAkvo+QjtcEE2f2tyfEvmIla\u002FT0m+14PrZNl0U=\ndep\tgithub.com\u002Flibdns\u002Flibdns\tv1.1.1\th1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS\u002FP\u002FU=\ndep\tgithub.com\u002Fmanifoldco\u002Fpromptui\tv0.9.0\th1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=\ndep\tgithub.com\u002Fmattn\u002Fgo-colorable\tv0.1.16\th1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=\ndep\tgithub.com\u002Fmattn\u002Fgo-isatty\tv0.0.24\th1:tGZZoVgT\u002FKiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\tv1.2.4\th1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\u002Fv2\tv2.4.0\th1:1XpRRWaq9DRIqZV7UtglS4VLzYKSsnFOQmzV+KZxLb0=\ndep\tgithub.com\u002Fmgutz\u002Fansi\tv0.0.0-20200706080929-d51e80ef957d\th1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=\ndep\tgithub.com\u002Fmholt\u002Facmez\u002Fv3\tv3.1.7\th1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=\ndep\tgithub.com\u002Fmholt\u002Fcaddy-ratelimit\tv0.1.0\th1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=\ndep\tgithub.com\u002Fmiekg\u002Fdns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=\ndep\tgithub.com\u002Fmitchellh\u002Fcopystructure\tv1.2.0\th1:vpKXTN4ewci03Vljg\u002Fq9QvCGUDttBOGBIa15WveJJGw=\ndep\tgithub.com\u002Fmitchellh\u002Fgo-ps\tv1.0.0\th1:i6ampVEEF4wQFF+bkYfwYgY+F\u002FuYJDktmvLPf7qIgjc=\ndep\tgithub.com\u002Fmitchellh\u002Freflectwalk\tv1.0.2\th1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=\ndep\tgithub.com\u002Fmunnerz\u002Fgoautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01\u002FOq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=\ndep\tgithub.com\u002Fnlnwa\u002Fwhatwg-url\tv0.6.2\th1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ\u002FQ=\ndep\tgithub.com\u002Fnutsdb\u002Fnutsdb\tv1.0.4\th1:BurzkxijXJY1\u002FAkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=\ndep\tgithub.com\u002Foasdiff\u002Fyaml\tv0.1.1\th1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=\ndep\tgithub.com\u002Foasdiff\u002Fyaml3\tv0.0.14\th1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=\ndep\tgithub.com\u002Fpbnjay\u002Fmemory\tv0.0.0-20210728143218-7b4eea64cf58\th1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=\ndep\tgithub.com\u002Fpierrec\u002Flz4\u002Fv4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=\ndep\tgithub.com\u002Fpires\u002Fgo-proxyproto\tv0.16.0\th1:9KYT\u002FfM3wpjT8bdMEj\u002F7FBcoiUG1KyzEjRYnPu+vz7A=\ndep\tgithub.com\u002Fpkg\u002Ferrors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=\ndep\tgithub.com\u002Fpquerna\u002Fcachecontrol\tv0.2.0\th1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=\ndep\tgithub.com\u002Fprometheus\u002Fclient_golang\tv1.25.0\th1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=\ndep\tgithub.com\u002Fprometheus\u002Fclient_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=\ndep\tgithub.com\u002Fprometheus\u002Fcommon\tv0.72.1\th1:ZAiQed\u002Fnk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=\ndep\tgithub.com\u002Fprometheus\u002Fotlptranslator\tv1.0.0\th1:s0LJW\u002FiN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=\ndep\tgithub.com\u002Fprometheus\u002Fprocfs\tv0.23.0\th1:ad+S6FTkzwaMgacKLM5h6bNKExS+DMH0YiUwXItH\u002Fo4=\ndep\tgithub.com\u002Fquic-go\u002Fqpack\tv0.6.0\th1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=\ndep\tgithub.com\u002Fquic-go\u002Fquic-go\tv0.64.1\th1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=\ndep\tgithub.com\u002Fredis\u002Fgo-redis\u002Fv9\tv9.18.0\th1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=\ndep\tgithub.com\u002Frs\u002Fcors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=\ndep\tgithub.com\u002Frs\u002Fxid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=\ndep\tgithub.com\u002Frussross\u002Fblackfriday\u002Fv2\tv2.1.0\th1:JIOH55\u002F0cWyOuilr9\u002Fqlrm0BSXldqnqwMsf35Ld67mk=\ndep\tgithub.com\u002Fsanthosh-tekuri\u002Fjsonschema\u002Fv6\tv6.0.3\th1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls\u002F28=\ndep\tgithub.com\u002Fshopspring\u002Fdecimal\tv1.6.0\th1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=\ndep\tgithub.com\u002FshurcooL\u002Fsanitized_anchor_name\tv1.0.0\th1:PdmoCO6wvbs+7yrJyMORt4\u002FBmY5IYyJwS\u002FkOiWx8mHo=\ndep\tgithub.com\u002Fsirupsen\u002Flogrus\tv1.10.2\th1:G2SED73\u002FqrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=\ndep\tgithub.com\u002Fslackhq\u002Fnebula\tv1.11.2\th1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=\ndep\tgithub.com\u002Fsmallstep\u002Fcertificates\tv0.30.2\th1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf\u002FiQtA5QlN0Y=\ndep\tgithub.com\u002Fsmallstep\u002Fcli-utils\tv0.12.2\th1:lGzM9PJrH\u002FqawbzMC\u002Fs2SvgLdJPKDWKwKzx9doCVO+k=\ndep\tgithub.com\u002Fsmallstep\u002Fgo-attestation\tv0.4.9\th1:\u002FfVmzB8A8tk7B2PCGPlszWzyl\u002FGDcEQbynqcg2PMaZ0=\ndep\tgithub.com\u002Fsmallstep\u002Flinkedca\tv0.26.0\th1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=\ndep\tgithub.com\u002Fsmallstep\u002Fnosql\tv0.8.0\th1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli\u002FXB4Jp4A=\ndep\tgithub.com\u002Fsmallstep\u002Fpkcs7\tv0.2.3\th1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=\ndep\tgithub.com\u002Fsmallstep\u002Fscep\tv0.0.0-20261014185058-63893dadfda8\th1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=\ndep\tgithub.com\u002Fsmallstep\u002Ftruststore\tv0.13.0\th1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi\u002Fpy4=\ndep\tgithub.com\u002Fspf13\u002Fcast\tv1.10.0\th1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=\ndep\tgithub.com\u002Fspf13\u002Fcobra\tv1.10.2\th1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=\ndep\tgithub.com\u002Fspf13\u002Fpflag\tv1.0.10\th1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=\ndep\tgithub.com\u002Ftailscale\u002Ftscert\tv0.0.0-20251216020129-aea342f6d747\th1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=\ndep\tgithub.com\u002Ftidwall\u002Fbtree\tv1.6.0\th1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=\ndep\tgithub.com\u002Funrolled\u002Fsecure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=\ndep\tgithub.com\u002Furfave\u002Fcli\tv1.22.17\th1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=\ndep\tgithub.com\u002Fx448\u002Ffloat16\tv0.8.4\th1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=\ndep\tgithub.com\u002Fxujiajun\u002Fmmap-go\tv1.0.1\th1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv\u002FWHc=\ndep\tgithub.com\u002Fxujiajun\u002Futils\tv0.0.0-20220904132955-5f7c5b914235\th1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark\tv1.8.6\th1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark-highlighting\u002Fv2\tv2.0.0-20230729083705-37449abec8cc\th1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=\ndep\tgithub.com\u002Fzeebo\u002Fblake3\tv0.2.4\th1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM\u002FyBqhaZI=\ndep\tgo.etcd.io\u002Fbbolt\tv1.5.0\th1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P\u002FbD4lxU=\ndep\tgo.opentelemetry.io\u002Fauto\u002Fsdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ\u002FipaZ64=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fbridges\u002Fprometheus\tv0.72.0\th1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w\u002F1ROwHEM7M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fexporters\u002Fautoexport\tv0.72.0\th1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Finstrumentation\u002Fnet\u002Fhttp\u002Fotelhttp\tv0.72.0\th1:LxwW\u002F9ctSCv+QkE\u002FcLR7M91ZIkXNMqJtEMi1vCw9U8s=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fautoprop\tv0.72.0\th1:\u002FKv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Faws\tv1.47.0\th1:n\u002F2x\u002FvQki1ojD7R2jYHdnNdI74Yx\u002FOFdY4YXFFesm8M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fb3\tv1.47.0\th1:vlKDmtjhe1R0d7kdov\u002F+KVTKWOKeGLyohB+iXoDPRMQ=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fjaeger\tv1.47.0\th1:2lDw6AKPV33\u002F7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fot\tv1.47.0\th1:nZUqh0\u002F8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=\ndep\tgo.opentelemetry.io\u002Fotel\tv1.47.0\th1:j7ALJ\u002FzgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploggrpc\tv0.23.0\th1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploghttp\tv0.23.0\th1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI\u002FnE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetricgrpc\tv1.47.0\th1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetrichttp\tv1.47.0\th1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\tv1.47.0\th1:julhjPeUH\u002Fq\u002F7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracegrpc\tv1.47.0\th1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracehttp\tv1.47.0\th1:aXZXsZ012wOgVkqaiQv+Z\u002Fd8V0xKjmg70F6m4CE94lc=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fprometheus\tv0.69.0\th1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutlog\tv0.23.0\th1:PW\u002FE9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutmetric\tv1.47.0\th1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdouttrace\tv1.47.0\th1:N3YQCxjxQ\u002FbMjyc3heladfRm9t9RTksGQH8z4w6yU\u002F0=\ndep\tgo.opentelemetry.io\u002Fotel\u002Flog\tv1.47.0\th1:cOTS1CcLbSQeZKanGJ+0JpF\u002F+t4PELi3O3bbl2lqCcI=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fmetric\tv1.47.0\th1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\tv1.47.0\th1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Flog\tv1.47.0\th1:W4N\u002FZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Fmetric\tv1.47.0\th1:lfISg2j93VT6yqdk9OfUaZmw\u002FGfcZqCCV3jdXtsPnKw=\ndep\tgo.opentelemetry.io\u002Fotel\u002Ftrace\tv1.47.0\th1:JOjX\u002FOci8K94QHddo+bbfya\u002FAi\u002Fnf6\u002Fdt9ZfrFNWSrM=\ndep\tgo.opentelemetry.io\u002Fproto\u002Fotlp\tv1.11.1\th1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=\ndep\tgo.step.sm\u002Fcrypto\tv0.91.0\th1:0mN0DwVOvUuh7VbyTnxABZuAkxwak\u002FGrp8Y\u002Fb4YaZDU=\ndep\tgo.uber.org\u002Fatomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp\u002FAUETXlHW0DxSjE=\ndep\tgo.uber.org\u002Fautomaxprocs\tv1.6.0\th1:O3y2\u002FQNTOdbF+e\u002FdpXNNW7Rx2hZ4sTIPyybbxyNqTUs=\ndep\tgo.uber.org\u002Fmultierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=\ndep\tgo.uber.org\u002Fzap\tv1.28.0\th1:IZzaP1Fv73\u002FT\u002FpBMLk4VutPl36uNC+OSUh3JLG3FIjo=\ndep\tgo.uber.org\u002Fzap\u002Fexp\tv0.3.0\th1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=\ndep\tgo.yaml.in\u002Fyaml\u002Fv3\tv3.0.5\th1:N6y\u002FpJk8buWs9NY5ERU2HSMfm+IuD\u002FOtfdAnq6kESPw=\ndep\tgolang.org\u002Fx\u002Fcrypto\tv0.58.0\th1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K\u002FM\u002F54=\ndep\tgolang.org\u002Fx\u002Fcrypto\u002Fx509roots\u002Ffallback\tv0.0.0-20261020153306-9f2b28d4331a\th1:V5oicZXS0oqZx30gY\u002FapgSVD7YvNBfrIOdcMnlelJY4=\ndep\tgolang.org\u002Fx\u002Fexp\tv0.0.0-20261014143641-f0251eb4aa3e\th1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI\u002FA=\ndep\tgolang.org\u002Fx\u002Fnet\tv0.61.0\th1:RR+6j\u002FBTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=\ndep\tgolang.org\u002Fx\u002Foauth2\tv0.37.0\th1:JUlcxA8oAtauLfiH8FX2\u002FFkAWHAdi0QtGCGc+hofE98=\ndep\tgolang.org\u002Fx\u002Fsync\tv0.24.0\th1:iqiDrGoDgyuvAKrhLQthUEzU\u002FR378N78gXbBjxed7oA=\ndep\tgolang.org\u002Fx\u002Fsys\tv0.49.0\th1:XbzkgYJHdqh\u002F8m2Uu0W\u002FdQv8nktxx4BFHp1M0gROTXA=\ndep\tgolang.org\u002Fx\u002Fterm\tv0.47.0\th1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ\u002FBM=\ndep\tgolang.org\u002Fx\u002Ftext\tv0.43.0\th1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5\u002FUGUTJVXoWc=\ndep\tgolang.org\u002Fx\u002Ftime\tv0.16.0\th1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q\u002F6gY2hDM6VDE=\ndep\tgoogle.golang.org\u002Fapi\tv0.308.0\th1:iGb+4qT3nVb3uuIzwor3yP2nyu+rMZr31PvLFiRNJQk=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Fapi\tv0.0.0-20261019180522-ce908d29299b\th1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Frpc\tv0.0.0-20261019180522-ce908d29299b\th1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=\ndep\tgoogle.golang.org\u002Fgrpc\tv1.84.0\th1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=\ndep\tgoogle.golang.org\u002Fprotobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o\u002Ffwxc=\ndep\tgopkg.in\u002Fyaml.v3\tv3.0.1\th1:fxVm\u002FGzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=\nbuild\t-buildmode=exe\nbuild\t-compiler=gc\nbuild\t-ldflags=\"-w -s\"\nbuild\t-tags=nobadger,nomysql,nopgx\nbuild\tCGO_ENABLED=1\nbuild\tCGO_CFLAGS=\"-I\u002Fusr\u002Flocal\u002Finclude\u002Fphp -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fmain -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FTSRM -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FZend -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext\u002Fdate\u002Flib\"\nbuild\tCGO_CPPFLAGS=\"-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64\"\nbuild\tCGO_CXXFLAGS=\nbuild\tCGO_LDFLAGS=\"-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto\"\nbuild\tGOARCH=amd64\nbuild\tGOOS=linux\nbuild\tGOAMD64=v1\n\n```\n",{"part":885,"tag":896,"name":896,"publishedAt":897,"url":898,"body":899},"v2.0.0-alpha.53","2026-11-01T00:20:05Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.53","## [2.0.0-alpha.53](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.53) - 2026-10-31\n\n### Upgrade notes\n\n- **Bundle 2.0.0-alpha.40 and `@cwa\u002Fnuxt` 2.0.0-alpha.32 go together**: take both in one deploy (`api\u002Fcomposer.lock`, `api\u002Fconfig\u002Freference.php`, `app\u002Fpackage.json`, `app\u002Fpnpm-lock.yaml`). No migration.\n  - Every write to CWA content (pages, layouts, routes, component groups and positions, components including `\u002Fmove`, and page data, your own classes included) now needs `publishable.permission` (the template's is `is_granted('ROLE_ADMIN')`) or the class's `#[Publishable(isGranted:)]`. A project resource that anyone else writes needs `extraProperties: ['publishable_permission' => false]` on that operation. Form `\u002Fsubmit` stays public.\n  - An email change now confirms at the new address, and setting `newEmailAddress` needs the signed-in user's own password as `oldPassword` (an admin changing another user's email enters their own). The module's admin user page sends it; a project's own change-email form must too. ([merge](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fc2b118f71de153562b39271c22d5c7171a3b5f18))\n\n### Security\n\n- `pnpm audit` and `composer audit` (2026-10-31): nothing new besides the two below. Still accepted, not in the server output: deepmerge 4.3.1 (GHSA-gcqx-w48m-w2h4, low), @rollup\u002Fplugin-node-resolve's at build only, with no fix released.\n- Accepted, not in the server output: glob 10.5.0, 11.1.0 and 13.0.6 (GHSA-3g3m-2fjr-6pw4, moderate; archiver-utils, workbox-build and @vercel\u002Fnft at build only) and minimatch 5.1.9, 9.0.9 and 10.2.6 (GHSA-g3hv-75wg-m249, moderate; under them, filelist and readdir-glob). Both are fixed only in new majors (glob 14, minimatch 11) that their dependents don't allow; the production app image has them only in the Node image's own npm CLI. ([commit](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F91343e9f527ab441276ae6a51446731ada23a614))\n\n### Changed\n\n- api-components-bundle 2.0.0-alpha.40 (also: an email logo setting, `emails.logo`, and user fixes) and `@cwa\u002Fnuxt` 2.0.0-alpha.32 (the synchroniser runs only for admins; the admin user page sends `oldPassword`). ([merge](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fc2b118f71de153562b39271c22d5c7171a3b5f18))\n- **A release's create-cwa smoke test runs on its own image** ([#226](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F226)): `publish-php-base.yml` calls `create-cwa-smoke.yml` once the release's `cwa-php-base` is tagged, failing (not skipping) without it, and `publish-create-cwa.yml` publishes only after that run passed. The push-time smoke jobs still skip on a release commit. Template CI only. ([merge](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd863dc5fe325f8e16d2d839beadd35467f85010a))\n- The php entrypoint retries `composer install` three times, 10 s apart, and a failed smoke test prints php's full log and how its network reaches `api.github.com` (#226). ([merge](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd863dc5fe325f8e16d2d839beadd35467f85010a))\n\n### cwa-php-base 2.0.0-alpha.53\n\nPin it as `ghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.53@sha256:8e373dbe54f8b8e7c2b25947c6a0bd24db3ef651c5da23f8487a61f95b057b64`.\n\nVerify it with:\n\n```sh\ngh attestation verify oci:\u002F\u002Fghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.53 --repo components-web-app\u002Fcomponents-web-app \\\n  --signer-workflow components-web-app\u002Fcomponents-web-app\u002F.github\u002Fworkflows\u002Fpublish-php-base.yml --source-ref refs\u002Ftags\u002Fv2.0.0-alpha.53\n```\n\n```\n# Base images (from the build provenance)\npkg:docker\u002Fcaddy@builder?platform=linux%2Famd64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0\npkg:docker\u002Fcaddy@builder?platform=linux%2Farm64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315\npkg:docker\u002Fdocker\u002Fdockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Famd64 sha256:47412b99ece26524ca61b457a1fdf69fc020e66a19eaa6b4165342f1b4dece44\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Farm64 sha256:47412b99ece26524ca61b457a1fdf69fc020e66a19eaa6b4165342f1b4dece44\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Famd64 sha256:c8abcc7925f16b1431f139d0410abe8f48db3fd862bacb646b05a4413337106a\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Farm64 sha256:c8abcc7925f16b1431f139d0410abe8f48db3fd862bacb646b05a4413337106a\n\nPHP 8.5.12 (cli) (built: Oct 28 2026 01:23:40) (ZTS)\nCopyright (c) The PHP Group\nBuilt by https:\u002F\u002Fgithub.com\u002Fdocker-library\u002Fphp\nZend Engine v4.5.12, Copyright (c) Zend Technologies\n    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies\n\n[PHP Modules]\napcu\nbrotli\nCore\nctype\ncurl\ndate\ndom\nexif\nFFI\nfileinfo\nfilter\ngd\nhash\niconv\nintl\njson\nlexbor\nlibxml\nmbstring\nmysqlnd\nopenssl\npcre\nPDO\npdo_pgsql\npdo_sqlite\nPhar\nposix\nrandom\nreadline\nReflection\nsession\nSimpleXML\nsodium\nSPL\nsqlite3\nstandard\ntokenizer\nuri\nxml\nxmlreader\nxmlwriter\nxsl\nZend OPcache\nzip\nzlib\n\n[Zend Modules]\nZend OPcache\n\n\ngo\tgo1.27.3\npath\tcaddy\nmod\tcaddy\t(devel)\t\ndep\tcel.dev\u002Fcel-go\tv0.32.0\th1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=\ndep\tcel.dev\u002Fexpr\tv0.25.3\th1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=\ndep\tcloud.google.com\u002Fgo\u002Fauth\tv0.24.1\th1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=\ndep\tcloud.google.com\u002Fgo\u002Fauth\u002Foauth2adapt\tv0.3.0\th1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=\ndep\tcloud.google.com\u002Fgo\u002Fcompute\u002Fmetadata\tv0.10.0\th1:pyKMUQSwchgkIBBJGdILqQbs\u002FBNJXqwSA7Ej6LAvvtY=\ndep\tdario.cat\u002Fmergo\tv1.0.2\th1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=\ndep\tfilippo.io\u002Fbigmod\tv0.1.0\th1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=\ndep\tfilippo.io\u002Fedwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=\ndep\tgithub.com\u002FBurntSushi\u002Ftoml\tv1.6.0\th1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=\ndep\tgithub.com\u002FDeRuina\u002Ftimberjack\tv1.4.9\th1:9RjDMSkUDQRYzwVNB\u002FFLonXNurcZVEh9sK43m2jw3A4=\ndep\tgithub.com\u002FKimMachineGun\u002Fautomemlimit\tv1.0.1\th1:87PowSIJFht5TmyyZKJNR4y2v7Cm9OdCzsSMR8jXJHM=\ndep\tgithub.com\u002FMasterminds\u002Fgoutils\tv1.1.1\th1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=\ndep\tgithub.com\u002FMasterminds\u002Fsemver\u002Fv3\tv3.5.0\th1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ\u002F2OOE=\ndep\tgithub.com\u002FMasterminds\u002Fsprig\u002Fv3\tv3.3.0\th1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=\ndep\tgithub.com\u002FMauriceGit\u002Fskiplist\tv0.0.0-20211105230623-77f5c8d3e145\th1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=\ndep\tgithub.com\u002FMicahParks\u002Fjwkset\tv0.11.3\th1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=\ndep\tgithub.com\u002FMicahParks\u002Fkeyfunc\u002Fv3\tv3.8.2\th1:eydEwk\u002FpBAVrDIpmFfB\u002FgkCcrp++xQ7YYXirrI2zlWE=\ndep\tgithub.com\u002FRoaringBitmap\u002Froaring\u002Fv2\tv2.30.0\th1:1sD4xsCenNd9n\u002FgOWaExCWanP9WTyiNuqLAvaDQ5jkY=\ndep\tgithub.com\u002Falecthomas\u002Fchroma\u002Fv2\tv2.27.0\th1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v\u002Fr5BXYZs=\ndep\tgithub.com\u002Fantlabs\u002Fstl\tv0.0.1\th1:TRD3csCrjREeLhLoQ\u002FsupaoCvFhNLBTNIwuRGrDIs6Q=\ndep\tgithub.com\u002Fantlabs\u002Ftimer\tv0.0.11\th1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=\ndep\tgithub.com\u002Fantlr4-go\u002Fantlr\u002Fv4\tv4.13.1\th1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=\ndep\tgithub.com\u002Faryann\u002Fdifflib\tv0.0.0-20210328193216-ff5ff6dc229b\th1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=\ndep\tgithub.com\u002Fbeorn7\u002Fperks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=\ndep\tgithub.com\u002Fbits-and-blooms\u002Fbitset\tv1.26.0\th1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=\ndep\tgithub.com\u002Fbwmarrin\u002Fsnowflake\tv0.3.0\th1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=\ndep\tgithub.com\u002Fcaddyserver\u002Fcaddy\u002Fv2\tv2.11.7\th1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=\ndep\tgithub.com\u002Fcaddyserver\u002Fcertmagic\tv0.25.6\th1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=\ndep\tgithub.com\u002Fcaddyserver\u002Fzerossl\tv0.1.6\th1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT\u002F4REW\u002F\u002Flsas=\ndep\tgithub.com\u002Fccoveille\u002Fgo-safecast\u002Fv2\tv2.0.1\th1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=\ndep\tgithub.com\u002Fcenkalti\u002Fbackoff\u002Fv5\tv5.0.3\th1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=\ndep\tgithub.com\u002Fcespare\u002Fxxhash\u002Fv2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=\ndep\tgithub.com\u002Fchzyer\u002Freadline\tv1.5.1\th1:upd\u002F6fQk4src78LMRzh5vItIt361\u002Fo4uq553V8B5sGI=\ndep\tgithub.com\u002Fcloudflare\u002Fcircl\tv1.6.5\th1:O64F26HEqNhznd\u002FhrC5KZXVKYuKM2rx4deZDTc4ihQA=\ndep\tgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fapi\u002Ffrankenphp\u002Fcaddy\u002Fqueryallowlist\tv0.0.0-20261031205830-3ebcdeeed2ad\n=>\t\u002Ftmp\u002Fqueryallowlist\t(devel)\t\n\ndep\tgithub.com\u002Fcoreos\u002Fgo-oidc\u002Fv3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=\ndep\tgithub.com\u002Fcpuguy83\u002Fgo-md2man\u002Fv2\tv2.0.7\th1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\tv1.7.9\n=>\t\u002Ftmp\u002Fsouin\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\u002Fplugins\u002Fcaddy\tv1.7.9\th1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\tv0.0.21\th1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M\u002FJRc+zhN7Wsx0=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\u002Fcaddy\tv0.0.22\th1:4\u002FbyA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fcore\tv0.0.21\th1:zfa0Bqzdm9\u002FoPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\tv0.0.22\n=>\t\u002Ftmp\u002Fstorages-go-redis\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\u002Fcaddy\tv0.0.22\th1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\tv0.0.21\th1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\u002Fcaddy\tv0.0.22\th1:kg\u002FHYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\tv0.0.21\th1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\u002Fcaddy\tv0.0.22\th1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=\ndep\tgithub.com\u002Fdgraph-io\u002Fbadger\u002Fv4\tv4.9.1\th1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=\ndep\tgithub.com\u002Fdgraph-io\u002Fristretto\u002Fv2\tv2.2.0\th1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=\ndep\tgithub.com\u002Fdgryski\u002Fgo-rendezvous\tv0.0.0-20200823014737-9f7001d12a5f\th1:lO4WD4F\u002FrVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=\ndep\tgithub.com\u002Fdlclark\u002Fregexp2\u002Fv2\tv2.10.0\th1:zSNli+yyb7Rg4VzzLiZuJ3eZup\u002FOObARXm\u002Fqs1a2\u002F\u002Fc=\ndep\tgithub.com\u002Fdolthub\u002Fmaphash\tv0.1.0\th1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L\u002FQxPDyQ=\ndep\tgithub.com\u002Fdunglas\u002Fcaddy-cbrotli\tv1.0.1\th1:mkg7EB1GmoyfBt3kY3mq4o\u002F0bfnBeq7ZLQjmVmdBE3Y=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\tv1.13.4\th1:MK45+Ai4Hnd+\u002FV3fpcFNXh5JknkOx+VIbmThLgHiDrw=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\u002Fcaddy\tv1.13.4\th1:PY4Q1l5CJM6ZfWeKU+dTeo4b8DHjoJ923ik+ugHU9NM=\ndep\tgithub.com\u002Fdunglas\u002Fgo-urlpattern\tv1.0.0\th1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=\ndep\tgithub.com\u002Fdunglas\u002Fhttpsfv\tv1.1.2\th1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ\u002FDkmc=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\tv1.1.5\th1:SlEUgMTiQst0zhx4HlPKuo95GRZM6bHCrxH1Me7jQ4M=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\u002Fcaddy\tv1.1.5\th1:Rl1Xh55YwZkFisNnlEZNLpLDL97bfdePSktcbhNb\u002FRU=\ndep\tgithub.com\u002Fdunglas\u002Fskipfilter\tv1.2.0\th1:J7\u002FRXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\tv1.4.5\th1:vO7CS3\u002FKwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\u002Fcaddy\tv1.4.5\th1:2qzg18nEkpsc1QIvpNn\u002FoztSHRxY1\u002FG6xuxylxVobGY=\ndep\tgithub.com\u002Fdustin\u002Fgo-humanize\tv1.1.0\th1:dbKTrvD0klcbBV\u002Fh4AWJdMuZogJACoMlvWIWZ5b2xWg=\ndep\tgithub.com\u002Fe-dant\u002Fwatcher\tv0.0.0-20260223030516-06f84a1314be\th1:vqHrvilasyJcnru\u002F0Z4FoojsQJUIfXGVplte7JtupfY=\ndep\tgithub.com\u002Felnormous\u002Fcontenttype\tv1.0.4\th1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=\ndep\tgithub.com\u002Ffelixge\u002Fhttpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw\u002FQDuVfpNhoA31zeORc=\ndep\tgithub.com\u002Ffxamacker\u002Fcbor\u002Fv2\tv2.9.6\th1:NHZPxuUjJXQjX9itA785y\u002F5NKSlI4HQ+S7noZsmI7hs=\ndep\tgithub.com\u002Fgammazero\u002Fdeque\tv0.2.1\th1:qSdsbG6pgp6nL7A0+K\u002FB7s12mcCY\u002F5l5SIUpMOl+dC0=\ndep\tgithub.com\u002Fgetkin\u002Fkin-openapi\tv0.152.0\th1:XRVo77lMRyOGMHf1paMu9lxX3wzuQDZeprssZJnz\u002Fx8=\ndep\tgithub.com\u002Fgo-chi\u002Fchi\u002Fv5\tv5.5.0\th1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv3\tv3.0.5\th1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv4\tv4.1.6\th1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=\ndep\tgithub.com\u002Fgo-logr\u002Flogr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg\u002F+cPVcbP\u002F8=\ndep\tgithub.com\u002Fgo-logr\u002Fstdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=\ndep\tgithub.com\u002Fgo-openapi\u002Fjsonpointer\tv1.0.2\th1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=\ndep\tgithub.com\u002Fgofrs\u002Fflock\tv0.13.0\th1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ\u002FA8dRYMzw=\ndep\tgithub.com\u002Fgofrs\u002Fuuid\tv4.4.0+incompatible\th1:3qXRTX8\u002FNbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=\ndep\tgithub.com\u002Fgolang-jwt\u002Fjwt\u002Fv5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=\ndep\tgithub.com\u002Fgoogle\u002Fbrotli\u002Fgo\u002Fcbrotli\tv1.2.1\th1:3NEHODycoTQr6cCq\u002FyYNyBqcuk9fKRjSuiADFy2V8h8=\ndep\tgithub.com\u002Fgoogle\u002Fcertificate-transparency-go\tv1.4.0\th1:78uNaR2knzCoKKXXDSAGVkz9XPkDg5xXJRP9tP6+rr0=\ndep\tgithub.com\u002Fgoogle\u002Fflatbuffers\tv25.2.10+incompatible\th1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H\u002FpNX4FP1v0Q=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tpm\tv0.9.8\th1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tspi\tv0.3.0\th1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=\ndep\tgithub.com\u002Fgoogle\u002Fs2a-go\tv0.1.11\th1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=\ndep\tgithub.com\u002Fgoogle\u002Fuuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=\ndep\tgithub.com\u002Fgoogleapis\u002Fenterprise-certificate-proxy\tv0.3.24\th1:G9iCJIY+AYVmUskKdjX8FVy7sG+nbzjOQ41cvlmhcvg=\ndep\tgithub.com\u002Fgoogleapis\u002Fgax-go\u002Fv2\tv2.27.0\th1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc\u002FRRZhKA\u002F2g0=\ndep\tgithub.com\u002Fgorilla\u002Fhandlers\tv1.5.2\th1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=\ndep\tgithub.com\u002Fgorilla\u002Fmux\tv1.8.1\th1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=\ndep\tgithub.com\u002Fgrpc-ecosystem\u002Fgrpc-gateway\u002Fv2\tv2.32.0\th1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=\ndep\tgithub.com\u002Fhuandu\u002Fxstrings\tv1.6.3\th1:7997PcI0mYC9uPNBJ7udg\u002FKrdJh1GhJid8f2tzKFHYQ=\ndep\tgithub.com\u002Fklauspost\u002Fcompress\tv1.20.3\th1:zWNoFqq\u002FlSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=\ndep\tgithub.com\u002Fklauspost\u002Fcpuid\u002Fv2\tv2.4.1\th1:I9KxadAkvo+QjtcEE2f2tyfEvmIla\u002FT0m+14PrZNl0U=\ndep\tgithub.com\u002Flibdns\u002Flibdns\tv1.1.1\th1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS\u002FP\u002FU=\ndep\tgithub.com\u002Fmanifoldco\u002Fpromptui\tv0.9.0\th1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=\ndep\tgithub.com\u002Fmattn\u002Fgo-colorable\tv0.1.16\th1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=\ndep\tgithub.com\u002Fmattn\u002Fgo-isatty\tv0.0.24\th1:tGZZoVgT\u002FKiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\tv1.2.4\th1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\u002Fv2\tv2.4.0\th1:1XpRRWaq9DRIqZV7UtglS4VLzYKSsnFOQmzV+KZxLb0=\ndep\tgithub.com\u002Fmgutz\u002Fansi\tv0.0.0-20200706080929-d51e80ef957d\th1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=\ndep\tgithub.com\u002Fmholt\u002Facmez\u002Fv3\tv3.1.7\th1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=\ndep\tgithub.com\u002Fmholt\u002Fcaddy-ratelimit\tv0.1.0\th1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=\ndep\tgithub.com\u002Fmiekg\u002Fdns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=\ndep\tgithub.com\u002Fmitchellh\u002Fcopystructure\tv1.2.0\th1:vpKXTN4ewci03Vljg\u002Fq9QvCGUDttBOGBIa15WveJJGw=\ndep\tgithub.com\u002Fmitchellh\u002Fgo-ps\tv1.0.0\th1:i6ampVEEF4wQFF+bkYfwYgY+F\u002FuYJDktmvLPf7qIgjc=\ndep\tgithub.com\u002Fmitchellh\u002Freflectwalk\tv1.0.2\th1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=\ndep\tgithub.com\u002Fmunnerz\u002Fgoautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01\u002FOq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=\ndep\tgithub.com\u002Fnlnwa\u002Fwhatwg-url\tv0.6.2\th1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ\u002FQ=\ndep\tgithub.com\u002Fnutsdb\u002Fnutsdb\tv1.0.4\th1:BurzkxijXJY1\u002FAkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=\ndep\tgithub.com\u002Foasdiff\u002Fyaml\tv0.1.1\th1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=\ndep\tgithub.com\u002Foasdiff\u002Fyaml3\tv0.0.14\th1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=\ndep\tgithub.com\u002Fpbnjay\u002Fmemory\tv0.0.0-20210728143218-7b4eea64cf58\th1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=\ndep\tgithub.com\u002Fpierrec\u002Flz4\u002Fv4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=\ndep\tgithub.com\u002Fpires\u002Fgo-proxyproto\tv0.16.0\th1:9KYT\u002FfM3wpjT8bdMEj\u002F7FBcoiUG1KyzEjRYnPu+vz7A=\ndep\tgithub.com\u002Fpkg\u002Ferrors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=\ndep\tgithub.com\u002Fpquerna\u002Fcachecontrol\tv0.2.0\th1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=\ndep\tgithub.com\u002Fprometheus\u002Fclient_golang\tv1.25.0\th1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=\ndep\tgithub.com\u002Fprometheus\u002Fclient_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=\ndep\tgithub.com\u002Fprometheus\u002Fcommon\tv0.72.1\th1:ZAiQed\u002Fnk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=\ndep\tgithub.com\u002Fprometheus\u002Fotlptranslator\tv1.0.0\th1:s0LJW\u002FiN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=\ndep\tgithub.com\u002Fprometheus\u002Fprocfs\tv0.23.0\th1:ad+S6FTkzwaMgacKLM5h6bNKExS+DMH0YiUwXItH\u002Fo4=\ndep\tgithub.com\u002Fquic-go\u002Fqpack\tv0.6.0\th1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=\ndep\tgithub.com\u002Fquic-go\u002Fquic-go\tv0.64.1\th1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=\ndep\tgithub.com\u002Fredis\u002Fgo-redis\u002Fv9\tv9.18.0\th1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=\ndep\tgithub.com\u002Frs\u002Fcors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=\ndep\tgithub.com\u002Frs\u002Fxid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=\ndep\tgithub.com\u002Frussross\u002Fblackfriday\u002Fv2\tv2.1.0\th1:JIOH55\u002F0cWyOuilr9\u002Fqlrm0BSXldqnqwMsf35Ld67mk=\ndep\tgithub.com\u002Fsanthosh-tekuri\u002Fjsonschema\u002Fv6\tv6.0.3\th1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls\u002F28=\ndep\tgithub.com\u002Fshopspring\u002Fdecimal\tv1.6.0\th1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=\ndep\tgithub.com\u002FshurcooL\u002Fsanitized_anchor_name\tv1.0.0\th1:PdmoCO6wvbs+7yrJyMORt4\u002FBmY5IYyJwS\u002FkOiWx8mHo=\ndep\tgithub.com\u002Fsirupsen\u002Flogrus\tv1.10.2\th1:G2SED73\u002FqrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=\ndep\tgithub.com\u002Fslackhq\u002Fnebula\tv1.11.2\th1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=\ndep\tgithub.com\u002Fsmallstep\u002Fcertificates\tv0.30.2\th1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf\u002FiQtA5QlN0Y=\ndep\tgithub.com\u002Fsmallstep\u002Fcli-utils\tv0.12.2\th1:lGzM9PJrH\u002FqawbzMC\u002Fs2SvgLdJPKDWKwKzx9doCVO+k=\ndep\tgithub.com\u002Fsmallstep\u002Fgo-attestation\tv0.4.9\th1:\u002FfVmzB8A8tk7B2PCGPlszWzyl\u002FGDcEQbynqcg2PMaZ0=\ndep\tgithub.com\u002Fsmallstep\u002Flinkedca\tv0.26.0\th1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=\ndep\tgithub.com\u002Fsmallstep\u002Fnosql\tv0.8.0\th1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli\u002FXB4Jp4A=\ndep\tgithub.com\u002Fsmallstep\u002Fpkcs7\tv0.2.3\th1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=\ndep\tgithub.com\u002Fsmallstep\u002Fscep\tv0.0.0-20261014185058-63893dadfda8\th1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=\ndep\tgithub.com\u002Fsmallstep\u002Ftruststore\tv0.13.0\th1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi\u002Fpy4=\ndep\tgithub.com\u002Fspf13\u002Fcast\tv1.10.0\th1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=\ndep\tgithub.com\u002Fspf13\u002Fcobra\tv1.10.2\th1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=\ndep\tgithub.com\u002Fspf13\u002Fpflag\tv1.0.10\th1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=\ndep\tgithub.com\u002Ftailscale\u002Ftscert\tv0.0.0-20251216020129-aea342f6d747\th1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=\ndep\tgithub.com\u002Ftidwall\u002Fbtree\tv1.6.0\th1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=\ndep\tgithub.com\u002Funrolled\u002Fsecure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=\ndep\tgithub.com\u002Furfave\u002Fcli\tv1.22.17\th1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=\ndep\tgithub.com\u002Fx448\u002Ffloat16\tv0.8.4\th1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=\ndep\tgithub.com\u002Fxujiajun\u002Fmmap-go\tv1.0.1\th1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv\u002FWHc=\ndep\tgithub.com\u002Fxujiajun\u002Futils\tv0.0.0-20220904132955-5f7c5b914235\th1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark\tv1.8.6\th1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark-highlighting\u002Fv2\tv2.0.0-20230729083705-37449abec8cc\th1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=\ndep\tgithub.com\u002Fzeebo\u002Fblake3\tv0.2.4\th1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM\u002FyBqhaZI=\ndep\tgo.etcd.io\u002Fbbolt\tv1.5.0\th1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P\u002FbD4lxU=\ndep\tgo.opentelemetry.io\u002Fauto\u002Fsdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ\u002FipaZ64=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fbridges\u002Fprometheus\tv0.72.0\th1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w\u002F1ROwHEM7M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fexporters\u002Fautoexport\tv0.72.0\th1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Finstrumentation\u002Fnet\u002Fhttp\u002Fotelhttp\tv0.72.0\th1:LxwW\u002F9ctSCv+QkE\u002FcLR7M91ZIkXNMqJtEMi1vCw9U8s=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fautoprop\tv0.72.0\th1:\u002FKv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Faws\tv1.47.0\th1:n\u002F2x\u002FvQki1ojD7R2jYHdnNdI74Yx\u002FOFdY4YXFFesm8M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fb3\tv1.47.0\th1:vlKDmtjhe1R0d7kdov\u002F+KVTKWOKeGLyohB+iXoDPRMQ=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fjaeger\tv1.47.0\th1:2lDw6AKPV33\u002F7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fot\tv1.47.0\th1:nZUqh0\u002F8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=\ndep\tgo.opentelemetry.io\u002Fotel\tv1.47.0\th1:j7ALJ\u002FzgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploggrpc\tv0.23.0\th1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploghttp\tv0.23.0\th1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI\u002FnE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetricgrpc\tv1.47.0\th1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetrichttp\tv1.47.0\th1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\tv1.47.0\th1:julhjPeUH\u002Fq\u002F7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracegrpc\tv1.47.0\th1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracehttp\tv1.47.0\th1:aXZXsZ012wOgVkqaiQv+Z\u002Fd8V0xKjmg70F6m4CE94lc=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fprometheus\tv0.69.0\th1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutlog\tv0.23.0\th1:PW\u002FE9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutmetric\tv1.47.0\th1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdouttrace\tv1.47.0\th1:N3YQCxjxQ\u002FbMjyc3heladfRm9t9RTksGQH8z4w6yU\u002F0=\ndep\tgo.opentelemetry.io\u002Fotel\u002Flog\tv1.47.0\th1:cOTS1CcLbSQeZKanGJ+0JpF\u002F+t4PELi3O3bbl2lqCcI=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fmetric\tv1.47.0\th1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\tv1.47.0\th1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Flog\tv1.47.0\th1:W4N\u002FZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Fmetric\tv1.47.0\th1:lfISg2j93VT6yqdk9OfUaZmw\u002FGfcZqCCV3jdXtsPnKw=\ndep\tgo.opentelemetry.io\u002Fotel\u002Ftrace\tv1.47.0\th1:JOjX\u002FOci8K94QHddo+bbfya\u002FAi\u002Fnf6\u002Fdt9ZfrFNWSrM=\ndep\tgo.opentelemetry.io\u002Fproto\u002Fotlp\tv1.11.1\th1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=\ndep\tgo.step.sm\u002Fcrypto\tv0.91.0\th1:0mN0DwVOvUuh7VbyTnxABZuAkxwak\u002FGrp8Y\u002Fb4YaZDU=\ndep\tgo.uber.org\u002Fatomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp\u002FAUETXlHW0DxSjE=\ndep\tgo.uber.org\u002Fautomaxprocs\tv1.6.0\th1:O3y2\u002FQNTOdbF+e\u002FdpXNNW7Rx2hZ4sTIPyybbxyNqTUs=\ndep\tgo.uber.org\u002Fmultierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=\ndep\tgo.uber.org\u002Fzap\tv1.28.0\th1:IZzaP1Fv73\u002FT\u002FpBMLk4VutPl36uNC+OSUh3JLG3FIjo=\ndep\tgo.uber.org\u002Fzap\u002Fexp\tv0.3.0\th1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=\ndep\tgo.yaml.in\u002Fyaml\u002Fv3\tv3.0.5\th1:N6y\u002FpJk8buWs9NY5ERU2HSMfm+IuD\u002FOtfdAnq6kESPw=\ndep\tgolang.org\u002Fx\u002Fcrypto\tv0.58.0\th1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K\u002FM\u002F54=\ndep\tgolang.org\u002Fx\u002Fcrypto\u002Fx509roots\u002Ffallback\tv0.0.0-20261020153306-9f2b28d4331a\th1:V5oicZXS0oqZx30gY\u002FapgSVD7YvNBfrIOdcMnlelJY4=\ndep\tgolang.org\u002Fx\u002Fexp\tv0.0.0-20261014143641-f0251eb4aa3e\th1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI\u002FA=\ndep\tgolang.org\u002Fx\u002Fnet\tv0.61.0\th1:RR+6j\u002FBTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=\ndep\tgolang.org\u002Fx\u002Foauth2\tv0.37.0\th1:JUlcxA8oAtauLfiH8FX2\u002FFkAWHAdi0QtGCGc+hofE98=\ndep\tgolang.org\u002Fx\u002Fsync\tv0.24.0\th1:iqiDrGoDgyuvAKrhLQthUEzU\u002FR378N78gXbBjxed7oA=\ndep\tgolang.org\u002Fx\u002Fsys\tv0.49.0\th1:XbzkgYJHdqh\u002F8m2Uu0W\u002FdQv8nktxx4BFHp1M0gROTXA=\ndep\tgolang.org\u002Fx\u002Fterm\tv0.47.0\th1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ\u002FBM=\ndep\tgolang.org\u002Fx\u002Ftext\tv0.43.0\th1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5\u002FUGUTJVXoWc=\ndep\tgolang.org\u002Fx\u002Ftime\tv0.16.0\th1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q\u002F6gY2hDM6VDE=\ndep\tgoogle.golang.org\u002Fapi\tv0.308.0\th1:iGb+4qT3nVb3uuIzwor3yP2nyu+rMZr31PvLFiRNJQk=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Fapi\tv0.0.0-20261019180522-ce908d29299b\th1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Frpc\tv0.0.0-20261019180522-ce908d29299b\th1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=\ndep\tgoogle.golang.org\u002Fgrpc\tv1.84.0\th1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=\ndep\tgoogle.golang.org\u002Fprotobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o\u002Ffwxc=\ndep\tgopkg.in\u002Fyaml.v3\tv3.0.1\th1:fxVm\u002FGzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=\nbuild\t-buildmode=exe\nbuild\t-compiler=gc\nbuild\t-ldflags=\"-w -s\"\nbuild\t-tags=nobadger,nomysql,nopgx\nbuild\tCGO_ENABLED=1\nbuild\tCGO_CFLAGS=\"-I\u002Fusr\u002Flocal\u002Finclude\u002Fphp -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fmain -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FTSRM -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FZend -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext\u002Fdate\u002Flib\"\nbuild\tCGO_CPPFLAGS=\"-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64\"\nbuild\tCGO_CXXFLAGS=\nbuild\tCGO_LDFLAGS=\"-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto\"\nbuild\tGOARCH=amd64\nbuild\tGOOS=linux\nbuild\tGOAMD64=v1\n\n```\n",{"part":901,"tag":902,"name":902,"publishedAt":903,"url":904,"body":905},"module","v2.0.0-alpha.32","2026-10-31T19:54:17Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.32","- Changing a user's email in the admin asks for your own current password and sends it as `oldPassword`; a wrong or missing password is shown on the field. Needs api-components-bundle 2.0.0-alpha.40, which also sends the email-change confirmation to the new address ([#451](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fpull\u002F451), [#449](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F449))\n- The component group synchroniser only creates or updates groups for an admin; a signed-in non-admin's page load no longer sends writes that api-components-bundle#569 refuses with a 403 ([#450](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fpull\u002F450), [#448](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F448))\n- An admin can select and move a page-data slot's component straight after navigating between pages that share a template; before, a component the manifest showed before the position's re-fetch landed was not counted as the position's, so its clicks missed the position and Move said \"Nothing can be placed here\" ([#445](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fpull\u002F445), [#443](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F443))\n- Dependencies updated to their latest versions, including set-cookie-parser 3.2.2 ([d83192bb](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fd83192bb))\n",{"part":907,"tag":908,"name":908,"publishedAt":909,"url":910,"body":911},"bundle","2.0.0-alpha.40","2026-10-31T18:54:07Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.40","### Breaking\n- Writing CWA content (pages, layouts, routes, component groups and their order, component positions, every component including `\u002Fmove`, and every page data class, project classes included) requires `publishable.permission` (or the class's `#[Publishable(isGranted:)]`), ANDed with any `security` the operation already has; opt an operation or resource out with `extraProperties: ['publishable_permission' => false]`. Form `\u002Fsubmit` stays public ([#579](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F579))\n- An email change's confirmation link goes to the new address instead of the current one, and setting `newEmailAddress` needs the signed-in user's current password as `oldPassword` on API writes and in `NewEmailAddressType` (a super admin enters their own; a cancel needs none) ([#580](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F580))\n\n### Added\n- `emails.logo` (a Twig path, default the bundle's logo) and `emails.logo_width` (pixels, optional) set the logo at the top of every email the bundle sends, whose alt text is now the `website_name` instead of `Logo` ([#576](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F576))\n- A notice to the current address when an email change is requested, with the new address masked and no link; `user.emails.change_email_notice` sets its subject or disables it ([#580](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F580))\n\n### Fixed\n- A user referenced by IRI from another resource's write is no longer processed as a new registration, which reset their `emailAddressVerified` ([#575](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F575))\n- A `plainPassword` set through the API is validated (6 to 4096 characters, 422 on `plainPassword`) before it is hashed, and setting a password no longer marks the email address verified; only a password reset does ([#577](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F577))\n- User lookups trim the identifier, so a username or email address with a trailing space (a mobile keyboard's) still signs in and still finds the user for password reset and resend verification ([#578](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F578))\n",{"part":885,"tag":913,"name":913,"publishedAt":914,"url":915,"body":916},"v2.0.0-alpha.52","2026-10-30T21:57:46Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.52","## [2.0.0-alpha.52](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.52) - 2026-10-30\n\n### Upgrade notes\n\n- **Bundle 2.0.0-alpha.39 ([api-components-bundle#567](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F567)).** Take `api\u002Fcomposer.lock` and `api\u002Fconfig\u002Freference.php`; no migration, no module or CORS change. A project that fetches a resource through its item URL by an id that isn't a UUID (alpha.51's upgrade note) now lists that resource's class under `silverback_api_components.uuid_uri_variables.accept_any_identifier` instead of decorating `silverback.api_components.api_platform.uuid_uri_variable_transformer`, and removes the decorator. For a page looked up by `reference`: `accept_any_identifier: ['Silverback\\ApiComponentsBundle\\Entity\\Core\\Page']`. Classes are matched exactly, and a listed class needs a provider that resolves the string or returns null. ([merge](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F0f7faa88c92dc71123879ae2a4a721df8eeaa9e8))\n\n### Security\n\n- No new advisories (`pnpm audit` and `composer audit`, 2026-10-30). Still accepted, not in the server output: deepmerge 4.3.1 (GHSA-gcqx-w48m-w2h4, low), @rollup\u002Fplugin-node-resolve's at build only, with no fix released.\n\n### Fixed\n\n- The example form refuses a blank `text_children` entry (\"Please fill in this entry or remove it\"); before, only entries of one character were refused. ([merge](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F0f7faa88c92dc71123879ae2a4a721df8eeaa9e8))\n\n### cwa-php-base 2.0.0-alpha.52\n\nPin it as `ghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.52@sha256:c937ef1645aec09813073d5d9c24ac7517744826ee9202979efc99a4d113fb48`.\n\nVerify it with:\n\n```sh\ngh attestation verify oci:\u002F\u002Fghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.52 --repo components-web-app\u002Fcomponents-web-app \\\n  --signer-workflow components-web-app\u002Fcomponents-web-app\u002F.github\u002Fworkflows\u002Fpublish-php-base.yml --source-ref refs\u002Ftags\u002Fv2.0.0-alpha.52\n```\n\n```\n# Base images (from the build provenance)\npkg:docker\u002Fcaddy@builder?platform=linux%2Famd64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0\npkg:docker\u002Fcaddy@builder?platform=linux%2Farm64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315\npkg:docker\u002Fdocker\u002Fdockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Famd64 sha256:47412b99ece26524ca61b457a1fdf69fc020e66a19eaa6b4165342f1b4dece44\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Farm64 sha256:47412b99ece26524ca61b457a1fdf69fc020e66a19eaa6b4165342f1b4dece44\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Famd64 sha256:c8abcc7925f16b1431f139d0410abe8f48db3fd862bacb646b05a4413337106a\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Farm64 sha256:c8abcc7925f16b1431f139d0410abe8f48db3fd862bacb646b05a4413337106a\n\nPHP 8.5.12 (cli) (built: Oct 28 2026 01:23:40) (ZTS)\nCopyright (c) The PHP Group\nBuilt by https:\u002F\u002Fgithub.com\u002Fdocker-library\u002Fphp\nZend Engine v4.5.12, Copyright (c) Zend Technologies\n    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies\n\n[PHP Modules]\napcu\nbrotli\nCore\nctype\ncurl\ndate\ndom\nexif\nFFI\nfileinfo\nfilter\ngd\nhash\niconv\nintl\njson\nlexbor\nlibxml\nmbstring\nmysqlnd\nopenssl\npcre\nPDO\npdo_pgsql\npdo_sqlite\nPhar\nposix\nrandom\nreadline\nReflection\nsession\nSimpleXML\nsodium\nSPL\nsqlite3\nstandard\ntokenizer\nuri\nxml\nxmlreader\nxmlwriter\nxsl\nZend OPcache\nzip\nzlib\n\n[Zend Modules]\nZend OPcache\n\n\ngo\tgo1.27.3\npath\tcaddy\nmod\tcaddy\t(devel)\t\ndep\tcel.dev\u002Fcel-go\tv0.32.0\th1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=\ndep\tcel.dev\u002Fexpr\tv0.25.3\th1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=\ndep\tcloud.google.com\u002Fgo\u002Fauth\tv0.24.1\th1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=\ndep\tcloud.google.com\u002Fgo\u002Fauth\u002Foauth2adapt\tv0.3.0\th1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=\ndep\tcloud.google.com\u002Fgo\u002Fcompute\u002Fmetadata\tv0.10.0\th1:pyKMUQSwchgkIBBJGdILqQbs\u002FBNJXqwSA7Ej6LAvvtY=\ndep\tdario.cat\u002Fmergo\tv1.0.2\th1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=\ndep\tfilippo.io\u002Fbigmod\tv0.1.0\th1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=\ndep\tfilippo.io\u002Fedwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=\ndep\tgithub.com\u002FBurntSushi\u002Ftoml\tv1.6.0\th1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=\ndep\tgithub.com\u002FDeRuina\u002Ftimberjack\tv1.4.9\th1:9RjDMSkUDQRYzwVNB\u002FFLonXNurcZVEh9sK43m2jw3A4=\ndep\tgithub.com\u002FKimMachineGun\u002Fautomemlimit\tv1.0.1\th1:87PowSIJFht5TmyyZKJNR4y2v7Cm9OdCzsSMR8jXJHM=\ndep\tgithub.com\u002FMasterminds\u002Fgoutils\tv1.1.1\th1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=\ndep\tgithub.com\u002FMasterminds\u002Fsemver\u002Fv3\tv3.5.0\th1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ\u002F2OOE=\ndep\tgithub.com\u002FMasterminds\u002Fsprig\u002Fv3\tv3.3.0\th1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=\ndep\tgithub.com\u002FMauriceGit\u002Fskiplist\tv0.0.0-20211105230623-77f5c8d3e145\th1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=\ndep\tgithub.com\u002FMicahParks\u002Fjwkset\tv0.11.3\th1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=\ndep\tgithub.com\u002FMicahParks\u002Fkeyfunc\u002Fv3\tv3.8.2\th1:eydEwk\u002FpBAVrDIpmFfB\u002FgkCcrp++xQ7YYXirrI2zlWE=\ndep\tgithub.com\u002FRoaringBitmap\u002Froaring\u002Fv2\tv2.30.0\th1:1sD4xsCenNd9n\u002FgOWaExCWanP9WTyiNuqLAvaDQ5jkY=\ndep\tgithub.com\u002Falecthomas\u002Fchroma\u002Fv2\tv2.27.0\th1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v\u002Fr5BXYZs=\ndep\tgithub.com\u002Fantlabs\u002Fstl\tv0.0.1\th1:TRD3csCrjREeLhLoQ\u002FsupaoCvFhNLBTNIwuRGrDIs6Q=\ndep\tgithub.com\u002Fantlabs\u002Ftimer\tv0.0.11\th1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=\ndep\tgithub.com\u002Fantlr4-go\u002Fantlr\u002Fv4\tv4.13.1\th1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=\ndep\tgithub.com\u002Faryann\u002Fdifflib\tv0.0.0-20210328193216-ff5ff6dc229b\th1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=\ndep\tgithub.com\u002Fbeorn7\u002Fperks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=\ndep\tgithub.com\u002Fbits-and-blooms\u002Fbitset\tv1.26.0\th1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=\ndep\tgithub.com\u002Fbwmarrin\u002Fsnowflake\tv0.3.0\th1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=\ndep\tgithub.com\u002Fcaddyserver\u002Fcaddy\u002Fv2\tv2.11.7\th1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=\ndep\tgithub.com\u002Fcaddyserver\u002Fcertmagic\tv0.25.6\th1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=\ndep\tgithub.com\u002Fcaddyserver\u002Fzerossl\tv0.1.6\th1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT\u002F4REW\u002F\u002Flsas=\ndep\tgithub.com\u002Fccoveille\u002Fgo-safecast\u002Fv2\tv2.0.1\th1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=\ndep\tgithub.com\u002Fcenkalti\u002Fbackoff\u002Fv5\tv5.0.3\th1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=\ndep\tgithub.com\u002Fcespare\u002Fxxhash\u002Fv2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=\ndep\tgithub.com\u002Fchzyer\u002Freadline\tv1.5.1\th1:upd\u002F6fQk4src78LMRzh5vItIt361\u002Fo4uq553V8B5sGI=\ndep\tgithub.com\u002Fcloudflare\u002Fcircl\tv1.6.5\th1:O64F26HEqNhznd\u002FhrC5KZXVKYuKM2rx4deZDTc4ihQA=\ndep\tgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fapi\u002Ffrankenphp\u002Fcaddy\u002Fqueryallowlist\tv0.0.0-20261030182155-02ffc5e1e6cc\n=>\t\u002Ftmp\u002Fqueryallowlist\t(devel)\t\n\ndep\tgithub.com\u002Fcoreos\u002Fgo-oidc\u002Fv3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=\ndep\tgithub.com\u002Fcpuguy83\u002Fgo-md2man\u002Fv2\tv2.0.7\th1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\tv1.7.9\n=>\t\u002Ftmp\u002Fsouin\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\u002Fplugins\u002Fcaddy\tv1.7.9\th1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\tv0.0.21\th1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M\u002FJRc+zhN7Wsx0=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\u002Fcaddy\tv0.0.22\th1:4\u002FbyA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fcore\tv0.0.21\th1:zfa0Bqzdm9\u002FoPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\tv0.0.22\n=>\t\u002Ftmp\u002Fstorages-go-redis\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\u002Fcaddy\tv0.0.22\th1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\tv0.0.21\th1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\u002Fcaddy\tv0.0.22\th1:kg\u002FHYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\tv0.0.21\th1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\u002Fcaddy\tv0.0.22\th1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=\ndep\tgithub.com\u002Fdgraph-io\u002Fbadger\u002Fv4\tv4.9.1\th1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=\ndep\tgithub.com\u002Fdgraph-io\u002Fristretto\u002Fv2\tv2.2.0\th1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=\ndep\tgithub.com\u002Fdgryski\u002Fgo-rendezvous\tv0.0.0-20200823014737-9f7001d12a5f\th1:lO4WD4F\u002FrVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=\ndep\tgithub.com\u002Fdlclark\u002Fregexp2\u002Fv2\tv2.10.0\th1:zSNli+yyb7Rg4VzzLiZuJ3eZup\u002FOObARXm\u002Fqs1a2\u002F\u002Fc=\ndep\tgithub.com\u002Fdolthub\u002Fmaphash\tv0.1.0\th1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L\u002FQxPDyQ=\ndep\tgithub.com\u002Fdunglas\u002Fcaddy-cbrotli\tv1.0.1\th1:mkg7EB1GmoyfBt3kY3mq4o\u002F0bfnBeq7ZLQjmVmdBE3Y=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\tv1.13.4\th1:MK45+Ai4Hnd+\u002FV3fpcFNXh5JknkOx+VIbmThLgHiDrw=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\u002Fcaddy\tv1.13.4\th1:PY4Q1l5CJM6ZfWeKU+dTeo4b8DHjoJ923ik+ugHU9NM=\ndep\tgithub.com\u002Fdunglas\u002Fgo-urlpattern\tv1.0.0\th1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=\ndep\tgithub.com\u002Fdunglas\u002Fhttpsfv\tv1.1.2\th1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ\u002FDkmc=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\tv1.1.5\th1:SlEUgMTiQst0zhx4HlPKuo95GRZM6bHCrxH1Me7jQ4M=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\u002Fcaddy\tv1.1.5\th1:Rl1Xh55YwZkFisNnlEZNLpLDL97bfdePSktcbhNb\u002FRU=\ndep\tgithub.com\u002Fdunglas\u002Fskipfilter\tv1.2.0\th1:J7\u002FRXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\tv1.4.5\th1:vO7CS3\u002FKwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\u002Fcaddy\tv1.4.5\th1:2qzg18nEkpsc1QIvpNn\u002FoztSHRxY1\u002FG6xuxylxVobGY=\ndep\tgithub.com\u002Fdustin\u002Fgo-humanize\tv1.1.0\th1:dbKTrvD0klcbBV\u002Fh4AWJdMuZogJACoMlvWIWZ5b2xWg=\ndep\tgithub.com\u002Fe-dant\u002Fwatcher\tv0.0.0-20260223030516-06f84a1314be\th1:vqHrvilasyJcnru\u002F0Z4FoojsQJUIfXGVplte7JtupfY=\ndep\tgithub.com\u002Felnormous\u002Fcontenttype\tv1.0.4\th1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=\ndep\tgithub.com\u002Ffelixge\u002Fhttpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw\u002FQDuVfpNhoA31zeORc=\ndep\tgithub.com\u002Ffxamacker\u002Fcbor\u002Fv2\tv2.9.6\th1:NHZPxuUjJXQjX9itA785y\u002F5NKSlI4HQ+S7noZsmI7hs=\ndep\tgithub.com\u002Fgammazero\u002Fdeque\tv0.2.1\th1:qSdsbG6pgp6nL7A0+K\u002FB7s12mcCY\u002F5l5SIUpMOl+dC0=\ndep\tgithub.com\u002Fgetkin\u002Fkin-openapi\tv0.152.0\th1:XRVo77lMRyOGMHf1paMu9lxX3wzuQDZeprssZJnz\u002Fx8=\ndep\tgithub.com\u002Fgo-chi\u002Fchi\u002Fv5\tv5.5.0\th1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv3\tv3.0.5\th1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv4\tv4.1.6\th1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=\ndep\tgithub.com\u002Fgo-logr\u002Flogr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg\u002F+cPVcbP\u002F8=\ndep\tgithub.com\u002Fgo-logr\u002Fstdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=\ndep\tgithub.com\u002Fgo-openapi\u002Fjsonpointer\tv1.0.2\th1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=\ndep\tgithub.com\u002Fgofrs\u002Fflock\tv0.13.0\th1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ\u002FA8dRYMzw=\ndep\tgithub.com\u002Fgofrs\u002Fuuid\tv4.4.0+incompatible\th1:3qXRTX8\u002FNbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=\ndep\tgithub.com\u002Fgolang-jwt\u002Fjwt\u002Fv5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=\ndep\tgithub.com\u002Fgoogle\u002Fbrotli\u002Fgo\u002Fcbrotli\tv1.2.1\th1:3NEHODycoTQr6cCq\u002FyYNyBqcuk9fKRjSuiADFy2V8h8=\ndep\tgithub.com\u002Fgoogle\u002Fcertificate-transparency-go\tv1.4.0\th1:78uNaR2knzCoKKXXDSAGVkz9XPkDg5xXJRP9tP6+rr0=\ndep\tgithub.com\u002Fgoogle\u002Fflatbuffers\tv25.2.10+incompatible\th1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H\u002FpNX4FP1v0Q=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tpm\tv0.9.8\th1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tspi\tv0.3.0\th1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=\ndep\tgithub.com\u002Fgoogle\u002Fs2a-go\tv0.1.11\th1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=\ndep\tgithub.com\u002Fgoogle\u002Fuuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=\ndep\tgithub.com\u002Fgoogleapis\u002Fenterprise-certificate-proxy\tv0.3.24\th1:G9iCJIY+AYVmUskKdjX8FVy7sG+nbzjOQ41cvlmhcvg=\ndep\tgithub.com\u002Fgoogleapis\u002Fgax-go\u002Fv2\tv2.27.0\th1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc\u002FRRZhKA\u002F2g0=\ndep\tgithub.com\u002Fgorilla\u002Fhandlers\tv1.5.2\th1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=\ndep\tgithub.com\u002Fgorilla\u002Fmux\tv1.8.1\th1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=\ndep\tgithub.com\u002Fgrpc-ecosystem\u002Fgrpc-gateway\u002Fv2\tv2.32.0\th1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=\ndep\tgithub.com\u002Fhuandu\u002Fxstrings\tv1.6.3\th1:7997PcI0mYC9uPNBJ7udg\u002FKrdJh1GhJid8f2tzKFHYQ=\ndep\tgithub.com\u002Fklauspost\u002Fcompress\tv1.20.3\th1:zWNoFqq\u002FlSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=\ndep\tgithub.com\u002Fklauspost\u002Fcpuid\u002Fv2\tv2.4.1\th1:I9KxadAkvo+QjtcEE2f2tyfEvmIla\u002FT0m+14PrZNl0U=\ndep\tgithub.com\u002Flibdns\u002Flibdns\tv1.1.1\th1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS\u002FP\u002FU=\ndep\tgithub.com\u002Fmanifoldco\u002Fpromptui\tv0.9.0\th1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=\ndep\tgithub.com\u002Fmattn\u002Fgo-colorable\tv0.1.16\th1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=\ndep\tgithub.com\u002Fmattn\u002Fgo-isatty\tv0.0.24\th1:tGZZoVgT\u002FKiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\tv1.2.4\th1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\u002Fv2\tv2.4.0\th1:1XpRRWaq9DRIqZV7UtglS4VLzYKSsnFOQmzV+KZxLb0=\ndep\tgithub.com\u002Fmgutz\u002Fansi\tv0.0.0-20200706080929-d51e80ef957d\th1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=\ndep\tgithub.com\u002Fmholt\u002Facmez\u002Fv3\tv3.1.7\th1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=\ndep\tgithub.com\u002Fmholt\u002Fcaddy-ratelimit\tv0.1.0\th1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=\ndep\tgithub.com\u002Fmiekg\u002Fdns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=\ndep\tgithub.com\u002Fmitchellh\u002Fcopystructure\tv1.2.0\th1:vpKXTN4ewci03Vljg\u002Fq9QvCGUDttBOGBIa15WveJJGw=\ndep\tgithub.com\u002Fmitchellh\u002Fgo-ps\tv1.0.0\th1:i6ampVEEF4wQFF+bkYfwYgY+F\u002FuYJDktmvLPf7qIgjc=\ndep\tgithub.com\u002Fmitchellh\u002Freflectwalk\tv1.0.2\th1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=\ndep\tgithub.com\u002Fmunnerz\u002Fgoautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01\u002FOq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=\ndep\tgithub.com\u002Fnlnwa\u002Fwhatwg-url\tv0.6.2\th1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ\u002FQ=\ndep\tgithub.com\u002Fnutsdb\u002Fnutsdb\tv1.0.4\th1:BurzkxijXJY1\u002FAkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=\ndep\tgithub.com\u002Foasdiff\u002Fyaml\tv0.1.1\th1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=\ndep\tgithub.com\u002Foasdiff\u002Fyaml3\tv0.0.14\th1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=\ndep\tgithub.com\u002Fpbnjay\u002Fmemory\tv0.0.0-20210728143218-7b4eea64cf58\th1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=\ndep\tgithub.com\u002Fpierrec\u002Flz4\u002Fv4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=\ndep\tgithub.com\u002Fpires\u002Fgo-proxyproto\tv0.16.0\th1:9KYT\u002FfM3wpjT8bdMEj\u002F7FBcoiUG1KyzEjRYnPu+vz7A=\ndep\tgithub.com\u002Fpkg\u002Ferrors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=\ndep\tgithub.com\u002Fpquerna\u002Fcachecontrol\tv0.2.0\th1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=\ndep\tgithub.com\u002Fprometheus\u002Fclient_golang\tv1.25.0\th1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=\ndep\tgithub.com\u002Fprometheus\u002Fclient_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=\ndep\tgithub.com\u002Fprometheus\u002Fcommon\tv0.72.1\th1:ZAiQed\u002Fnk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=\ndep\tgithub.com\u002Fprometheus\u002Fotlptranslator\tv1.0.0\th1:s0LJW\u002FiN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=\ndep\tgithub.com\u002Fprometheus\u002Fprocfs\tv0.23.0\th1:ad+S6FTkzwaMgacKLM5h6bNKExS+DMH0YiUwXItH\u002Fo4=\ndep\tgithub.com\u002Fquic-go\u002Fqpack\tv0.6.0\th1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=\ndep\tgithub.com\u002Fquic-go\u002Fquic-go\tv0.64.1\th1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=\ndep\tgithub.com\u002Fredis\u002Fgo-redis\u002Fv9\tv9.18.0\th1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=\ndep\tgithub.com\u002Frs\u002Fcors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=\ndep\tgithub.com\u002Frs\u002Fxid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=\ndep\tgithub.com\u002Frussross\u002Fblackfriday\u002Fv2\tv2.1.0\th1:JIOH55\u002F0cWyOuilr9\u002Fqlrm0BSXldqnqwMsf35Ld67mk=\ndep\tgithub.com\u002Fsanthosh-tekuri\u002Fjsonschema\u002Fv6\tv6.0.3\th1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls\u002F28=\ndep\tgithub.com\u002Fshopspring\u002Fdecimal\tv1.6.0\th1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=\ndep\tgithub.com\u002FshurcooL\u002Fsanitized_anchor_name\tv1.0.0\th1:PdmoCO6wvbs+7yrJyMORt4\u002FBmY5IYyJwS\u002FkOiWx8mHo=\ndep\tgithub.com\u002Fsirupsen\u002Flogrus\tv1.10.2\th1:G2SED73\u002FqrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=\ndep\tgithub.com\u002Fslackhq\u002Fnebula\tv1.11.2\th1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=\ndep\tgithub.com\u002Fsmallstep\u002Fcertificates\tv0.30.2\th1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf\u002FiQtA5QlN0Y=\ndep\tgithub.com\u002Fsmallstep\u002Fcli-utils\tv0.12.2\th1:lGzM9PJrH\u002FqawbzMC\u002Fs2SvgLdJPKDWKwKzx9doCVO+k=\ndep\tgithub.com\u002Fsmallstep\u002Fgo-attestation\tv0.4.9\th1:\u002FfVmzB8A8tk7B2PCGPlszWzyl\u002FGDcEQbynqcg2PMaZ0=\ndep\tgithub.com\u002Fsmallstep\u002Flinkedca\tv0.26.0\th1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=\ndep\tgithub.com\u002Fsmallstep\u002Fnosql\tv0.8.0\th1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli\u002FXB4Jp4A=\ndep\tgithub.com\u002Fsmallstep\u002Fpkcs7\tv0.2.3\th1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=\ndep\tgithub.com\u002Fsmallstep\u002Fscep\tv0.0.0-20261014185058-63893dadfda8\th1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=\ndep\tgithub.com\u002Fsmallstep\u002Ftruststore\tv0.13.0\th1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi\u002Fpy4=\ndep\tgithub.com\u002Fspf13\u002Fcast\tv1.10.0\th1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=\ndep\tgithub.com\u002Fspf13\u002Fcobra\tv1.10.2\th1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=\ndep\tgithub.com\u002Fspf13\u002Fpflag\tv1.0.10\th1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=\ndep\tgithub.com\u002Ftailscale\u002Ftscert\tv0.0.0-20251216020129-aea342f6d747\th1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=\ndep\tgithub.com\u002Ftidwall\u002Fbtree\tv1.6.0\th1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=\ndep\tgithub.com\u002Funrolled\u002Fsecure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=\ndep\tgithub.com\u002Furfave\u002Fcli\tv1.22.17\th1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=\ndep\tgithub.com\u002Fx448\u002Ffloat16\tv0.8.4\th1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=\ndep\tgithub.com\u002Fxujiajun\u002Fmmap-go\tv1.0.1\th1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv\u002FWHc=\ndep\tgithub.com\u002Fxujiajun\u002Futils\tv0.0.0-20220904132955-5f7c5b914235\th1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark\tv1.8.6\th1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark-highlighting\u002Fv2\tv2.0.0-20230729083705-37449abec8cc\th1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=\ndep\tgithub.com\u002Fzeebo\u002Fblake3\tv0.2.4\th1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM\u002FyBqhaZI=\ndep\tgo.etcd.io\u002Fbbolt\tv1.5.0\th1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P\u002FbD4lxU=\ndep\tgo.opentelemetry.io\u002Fauto\u002Fsdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ\u002FipaZ64=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fbridges\u002Fprometheus\tv0.72.0\th1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w\u002F1ROwHEM7M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fexporters\u002Fautoexport\tv0.72.0\th1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Finstrumentation\u002Fnet\u002Fhttp\u002Fotelhttp\tv0.72.0\th1:LxwW\u002F9ctSCv+QkE\u002FcLR7M91ZIkXNMqJtEMi1vCw9U8s=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fautoprop\tv0.72.0\th1:\u002FKv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Faws\tv1.47.0\th1:n\u002F2x\u002FvQki1ojD7R2jYHdnNdI74Yx\u002FOFdY4YXFFesm8M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fb3\tv1.47.0\th1:vlKDmtjhe1R0d7kdov\u002F+KVTKWOKeGLyohB+iXoDPRMQ=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fjaeger\tv1.47.0\th1:2lDw6AKPV33\u002F7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fot\tv1.47.0\th1:nZUqh0\u002F8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=\ndep\tgo.opentelemetry.io\u002Fotel\tv1.47.0\th1:j7ALJ\u002FzgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploggrpc\tv0.23.0\th1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploghttp\tv0.23.0\th1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI\u002FnE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetricgrpc\tv1.47.0\th1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetrichttp\tv1.47.0\th1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\tv1.47.0\th1:julhjPeUH\u002Fq\u002F7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracegrpc\tv1.47.0\th1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracehttp\tv1.47.0\th1:aXZXsZ012wOgVkqaiQv+Z\u002Fd8V0xKjmg70F6m4CE94lc=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fprometheus\tv0.69.0\th1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutlog\tv0.23.0\th1:PW\u002FE9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutmetric\tv1.47.0\th1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdouttrace\tv1.47.0\th1:N3YQCxjxQ\u002FbMjyc3heladfRm9t9RTksGQH8z4w6yU\u002F0=\ndep\tgo.opentelemetry.io\u002Fotel\u002Flog\tv1.47.0\th1:cOTS1CcLbSQeZKanGJ+0JpF\u002F+t4PELi3O3bbl2lqCcI=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fmetric\tv1.47.0\th1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\tv1.47.0\th1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Flog\tv1.47.0\th1:W4N\u002FZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Fmetric\tv1.47.0\th1:lfISg2j93VT6yqdk9OfUaZmw\u002FGfcZqCCV3jdXtsPnKw=\ndep\tgo.opentelemetry.io\u002Fotel\u002Ftrace\tv1.47.0\th1:JOjX\u002FOci8K94QHddo+bbfya\u002FAi\u002Fnf6\u002Fdt9ZfrFNWSrM=\ndep\tgo.opentelemetry.io\u002Fproto\u002Fotlp\tv1.11.1\th1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=\ndep\tgo.step.sm\u002Fcrypto\tv0.91.0\th1:0mN0DwVOvUuh7VbyTnxABZuAkxwak\u002FGrp8Y\u002Fb4YaZDU=\ndep\tgo.uber.org\u002Fatomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp\u002FAUETXlHW0DxSjE=\ndep\tgo.uber.org\u002Fautomaxprocs\tv1.6.0\th1:O3y2\u002FQNTOdbF+e\u002FdpXNNW7Rx2hZ4sTIPyybbxyNqTUs=\ndep\tgo.uber.org\u002Fmultierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=\ndep\tgo.uber.org\u002Fzap\tv1.28.0\th1:IZzaP1Fv73\u002FT\u002FpBMLk4VutPl36uNC+OSUh3JLG3FIjo=\ndep\tgo.uber.org\u002Fzap\u002Fexp\tv0.3.0\th1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=\ndep\tgo.yaml.in\u002Fyaml\u002Fv3\tv3.0.5\th1:N6y\u002FpJk8buWs9NY5ERU2HSMfm+IuD\u002FOtfdAnq6kESPw=\ndep\tgolang.org\u002Fx\u002Fcrypto\tv0.58.0\th1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K\u002FM\u002F54=\ndep\tgolang.org\u002Fx\u002Fcrypto\u002Fx509roots\u002Ffallback\tv0.0.0-20261020153306-9f2b28d4331a\th1:V5oicZXS0oqZx30gY\u002FapgSVD7YvNBfrIOdcMnlelJY4=\ndep\tgolang.org\u002Fx\u002Fexp\tv0.0.0-20261014143641-f0251eb4aa3e\th1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI\u002FA=\ndep\tgolang.org\u002Fx\u002Fnet\tv0.61.0\th1:RR+6j\u002FBTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=\ndep\tgolang.org\u002Fx\u002Foauth2\tv0.37.0\th1:JUlcxA8oAtauLfiH8FX2\u002FFkAWHAdi0QtGCGc+hofE98=\ndep\tgolang.org\u002Fx\u002Fsync\tv0.24.0\th1:iqiDrGoDgyuvAKrhLQthUEzU\u002FR378N78gXbBjxed7oA=\ndep\tgolang.org\u002Fx\u002Fsys\tv0.49.0\th1:XbzkgYJHdqh\u002F8m2Uu0W\u002FdQv8nktxx4BFHp1M0gROTXA=\ndep\tgolang.org\u002Fx\u002Fterm\tv0.47.0\th1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ\u002FBM=\ndep\tgolang.org\u002Fx\u002Ftext\tv0.43.0\th1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5\u002FUGUTJVXoWc=\ndep\tgolang.org\u002Fx\u002Ftime\tv0.16.0\th1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q\u002F6gY2hDM6VDE=\ndep\tgoogle.golang.org\u002Fapi\tv0.308.0\th1:iGb+4qT3nVb3uuIzwor3yP2nyu+rMZr31PvLFiRNJQk=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Fapi\tv0.0.0-20261019180522-ce908d29299b\th1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Frpc\tv0.0.0-20261019180522-ce908d29299b\th1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=\ndep\tgoogle.golang.org\u002Fgrpc\tv1.84.0\th1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=\ndep\tgoogle.golang.org\u002Fprotobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o\u002Ffwxc=\ndep\tgopkg.in\u002Fyaml.v3\tv3.0.1\th1:fxVm\u002FGzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=\nbuild\t-buildmode=exe\nbuild\t-compiler=gc\nbuild\t-ldflags=\"-w -s\"\nbuild\t-tags=nobadger,nomysql,nopgx\nbuild\tCGO_ENABLED=1\nbuild\tCGO_CFLAGS=\"-I\u002Fusr\u002Flocal\u002Finclude\u002Fphp -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fmain -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FTSRM -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FZend -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext\u002Fdate\u002Flib\"\nbuild\tCGO_CPPFLAGS=\"-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64\"\nbuild\tCGO_CXXFLAGS=\nbuild\tCGO_LDFLAGS=\"-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto\"\nbuild\tGOARCH=amd64\nbuild\tGOOS=linux\nbuild\tGOAMD64=v1\n\n```\n",{"part":907,"tag":918,"name":918,"publishedAt":919,"url":920,"body":921},"2.0.0-alpha.39","2026-10-30T21:35:23Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.39","### Added\n- `uuid_uri_variables.accept_any_identifier`: resource classes (matched exactly) whose item identifier reaches their own provider when it is not a UUID, as for routes, component groups and forms, e.g. a `Page` looked up by `reference` ([#568](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F568))\n",{"part":885,"tag":923,"name":923,"publishedAt":924,"url":925,"body":926},"v2.0.0-alpha.51","2026-10-30T17:26:26Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.51","## [2.0.0-alpha.51](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.51) - 2026-10-30\n\n### Upgrade notes\n\n- **Bundle 2.0.0-alpha.38 and `@cwa\u002Fnuxt` 2.0.0-alpha.31.** Take `api\u002Fcomposer.json` and `api\u002Fcomposer.lock`, and `app\u002Fpackage.json` and `app\u002Fpnpm-lock.yaml`; no migration, nothing else to change. The bundle answers an item URL whose id isn't a UUID with a 404 instead of a 500; the module's release updates its dependencies. [2b69ad2](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F2b69ad24216875a24368b72b457a796378573767)\n- **A project that fetches a resource by a non-UUID id through its item URL gets a 404 from bundle alpha.38**, before any provider of its own runs (for example a page looked up by `reference` at `\u002F_api\u002F_\u002Fpages\u002F\u003Creference>`). Only routes (by path), component groups (by reference) and forms still accept one. Until the bundle has a supported way to allow it ([api-components-bundle#567](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F567)), such a project decorates `silverback.api_components.api_platform.uuid_uri_variable_transformer` to let its identifier through for that resource only. Search the project's tests and providers for item lookups by anything other than the id before deploying.\n\n### Security\n\n- No new advisories (`pnpm audit` and `composer audit`, 2026-10-30). Still accepted, not in the server output: deepmerge 4.3.1 (GHSA-gcqx-w48m-w2h4, low), @rollup\u002Fplugin-node-resolve's at build only, with no fix released.\n\n### Changed\n\n- Dependencies to their latest versions: API Platform 5.0.5, Symfony 8.1.10, rokka\u002Fimagine-vips 0.42, Nuxt 4.6.3, TipTap 3.32.2, `@nuxt\u002Fdevtools` 4.0.0, satori 0.63, and the browser tests' eslint 10.14.0 and typescript-eslint 8.72.1. TypeScript stays 6.0.3: vue-tsc 3.3.14 still can't run TypeScript 7. [2b69ad2](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F2b69ad24216875a24368b72b457a796378573767)\n\n### cwa-php-base 2.0.0-alpha.51\n\nPin it as `ghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.51@sha256:736c30b572f73804c90a8d64b34780907023b3816ca6ddf481f740d120a7538e`.\n\nVerify it with:\n\n```sh\ngh attestation verify oci:\u002F\u002Fghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.51 --repo components-web-app\u002Fcomponents-web-app \\\n  --signer-workflow components-web-app\u002Fcomponents-web-app\u002F.github\u002Fworkflows\u002Fpublish-php-base.yml --source-ref refs\u002Ftags\u002Fv2.0.0-alpha.51\n```\n\n```\n# Base images (from the build provenance)\npkg:docker\u002Fcaddy@builder?platform=linux%2Famd64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0\npkg:docker\u002Fcaddy@builder?platform=linux%2Farm64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315\npkg:docker\u002Fdocker\u002Fdockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Famd64 sha256:47412b99ece26524ca61b457a1fdf69fc020e66a19eaa6b4165342f1b4dece44\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Farm64 sha256:47412b99ece26524ca61b457a1fdf69fc020e66a19eaa6b4165342f1b4dece44\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Famd64 sha256:c8abcc7925f16b1431f139d0410abe8f48db3fd862bacb646b05a4413337106a\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Farm64 sha256:c8abcc7925f16b1431f139d0410abe8f48db3fd862bacb646b05a4413337106a\n\nPHP 8.5.12 (cli) (built: Oct 28 2026 01:23:40) (ZTS)\nCopyright (c) The PHP Group\nBuilt by https:\u002F\u002Fgithub.com\u002Fdocker-library\u002Fphp\nZend Engine v4.5.12, Copyright (c) Zend Technologies\n    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies\n\n[PHP Modules]\napcu\nbrotli\nCore\nctype\ncurl\ndate\ndom\nexif\nFFI\nfileinfo\nfilter\ngd\nhash\niconv\nintl\njson\nlexbor\nlibxml\nmbstring\nmysqlnd\nopenssl\npcre\nPDO\npdo_pgsql\npdo_sqlite\nPhar\nposix\nrandom\nreadline\nReflection\nsession\nSimpleXML\nsodium\nSPL\nsqlite3\nstandard\ntokenizer\nuri\nxml\nxmlreader\nxmlwriter\nxsl\nZend OPcache\nzip\nzlib\n\n[Zend Modules]\nZend OPcache\n\n\ngo\tgo1.27.3\npath\tcaddy\nmod\tcaddy\t(devel)\t\ndep\tcel.dev\u002Fcel-go\tv0.32.0\th1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=\ndep\tcel.dev\u002Fexpr\tv0.25.3\th1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=\ndep\tcloud.google.com\u002Fgo\u002Fauth\tv0.24.1\th1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=\ndep\tcloud.google.com\u002Fgo\u002Fauth\u002Foauth2adapt\tv0.3.0\th1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=\ndep\tcloud.google.com\u002Fgo\u002Fcompute\u002Fmetadata\tv0.10.0\th1:pyKMUQSwchgkIBBJGdILqQbs\u002FBNJXqwSA7Ej6LAvvtY=\ndep\tdario.cat\u002Fmergo\tv1.0.2\th1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=\ndep\tfilippo.io\u002Fbigmod\tv0.1.0\th1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=\ndep\tfilippo.io\u002Fedwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=\ndep\tgithub.com\u002FBurntSushi\u002Ftoml\tv1.6.0\th1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=\ndep\tgithub.com\u002FDeRuina\u002Ftimberjack\tv1.4.9\th1:9RjDMSkUDQRYzwVNB\u002FFLonXNurcZVEh9sK43m2jw3A4=\ndep\tgithub.com\u002FKimMachineGun\u002Fautomemlimit\tv1.0.1\th1:87PowSIJFht5TmyyZKJNR4y2v7Cm9OdCzsSMR8jXJHM=\ndep\tgithub.com\u002FMasterminds\u002Fgoutils\tv1.1.1\th1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=\ndep\tgithub.com\u002FMasterminds\u002Fsemver\u002Fv3\tv3.5.0\th1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ\u002F2OOE=\ndep\tgithub.com\u002FMasterminds\u002Fsprig\u002Fv3\tv3.3.0\th1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=\ndep\tgithub.com\u002FMauriceGit\u002Fskiplist\tv0.0.0-20211105230623-77f5c8d3e145\th1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=\ndep\tgithub.com\u002FMicahParks\u002Fjwkset\tv0.11.3\th1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=\ndep\tgithub.com\u002FMicahParks\u002Fkeyfunc\u002Fv3\tv3.8.2\th1:eydEwk\u002FpBAVrDIpmFfB\u002FgkCcrp++xQ7YYXirrI2zlWE=\ndep\tgithub.com\u002FRoaringBitmap\u002Froaring\u002Fv2\tv2.30.0\th1:1sD4xsCenNd9n\u002FgOWaExCWanP9WTyiNuqLAvaDQ5jkY=\ndep\tgithub.com\u002Falecthomas\u002Fchroma\u002Fv2\tv2.27.0\th1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v\u002Fr5BXYZs=\ndep\tgithub.com\u002Fantlabs\u002Fstl\tv0.0.1\th1:TRD3csCrjREeLhLoQ\u002FsupaoCvFhNLBTNIwuRGrDIs6Q=\ndep\tgithub.com\u002Fantlabs\u002Ftimer\tv0.0.11\th1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=\ndep\tgithub.com\u002Fantlr4-go\u002Fantlr\u002Fv4\tv4.13.1\th1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=\ndep\tgithub.com\u002Faryann\u002Fdifflib\tv0.0.0-20210328193216-ff5ff6dc229b\th1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=\ndep\tgithub.com\u002Fbeorn7\u002Fperks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=\ndep\tgithub.com\u002Fbits-and-blooms\u002Fbitset\tv1.26.0\th1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=\ndep\tgithub.com\u002Fbwmarrin\u002Fsnowflake\tv0.3.0\th1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=\ndep\tgithub.com\u002Fcaddyserver\u002Fcaddy\u002Fv2\tv2.11.7\th1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=\ndep\tgithub.com\u002Fcaddyserver\u002Fcertmagic\tv0.25.6\th1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=\ndep\tgithub.com\u002Fcaddyserver\u002Fzerossl\tv0.1.6\th1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT\u002F4REW\u002F\u002Flsas=\ndep\tgithub.com\u002Fccoveille\u002Fgo-safecast\u002Fv2\tv2.0.1\th1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=\ndep\tgithub.com\u002Fcenkalti\u002Fbackoff\u002Fv5\tv5.0.3\th1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=\ndep\tgithub.com\u002Fcespare\u002Fxxhash\u002Fv2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=\ndep\tgithub.com\u002Fchzyer\u002Freadline\tv1.5.1\th1:upd\u002F6fQk4src78LMRzh5vItIt361\u002Fo4uq553V8B5sGI=\ndep\tgithub.com\u002Fcloudflare\u002Fcircl\tv1.6.5\th1:O64F26HEqNhznd\u002FhrC5KZXVKYuKM2rx4deZDTc4ihQA=\ndep\tgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fapi\u002Ffrankenphp\u002Fcaddy\u002Fqueryallowlist\tv0.0.0-20261028091931-890ca2faa006\n=>\t\u002Ftmp\u002Fqueryallowlist\t(devel)\t\n\ndep\tgithub.com\u002Fcoreos\u002Fgo-oidc\u002Fv3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=\ndep\tgithub.com\u002Fcpuguy83\u002Fgo-md2man\u002Fv2\tv2.0.7\th1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\tv1.7.9\n=>\t\u002Ftmp\u002Fsouin\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\u002Fplugins\u002Fcaddy\tv1.7.9\th1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\tv0.0.21\th1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M\u002FJRc+zhN7Wsx0=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\u002Fcaddy\tv0.0.22\th1:4\u002FbyA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fcore\tv0.0.21\th1:zfa0Bqzdm9\u002FoPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\tv0.0.22\n=>\t\u002Ftmp\u002Fstorages-go-redis\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\u002Fcaddy\tv0.0.22\th1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\tv0.0.21\th1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\u002Fcaddy\tv0.0.22\th1:kg\u002FHYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\tv0.0.21\th1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\u002Fcaddy\tv0.0.22\th1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=\ndep\tgithub.com\u002Fdgraph-io\u002Fbadger\u002Fv4\tv4.9.1\th1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=\ndep\tgithub.com\u002Fdgraph-io\u002Fristretto\u002Fv2\tv2.2.0\th1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=\ndep\tgithub.com\u002Fdgryski\u002Fgo-rendezvous\tv0.0.0-20200823014737-9f7001d12a5f\th1:lO4WD4F\u002FrVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=\ndep\tgithub.com\u002Fdlclark\u002Fregexp2\u002Fv2\tv2.10.0\th1:zSNli+yyb7Rg4VzzLiZuJ3eZup\u002FOObARXm\u002Fqs1a2\u002F\u002Fc=\ndep\tgithub.com\u002Fdolthub\u002Fmaphash\tv0.1.0\th1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L\u002FQxPDyQ=\ndep\tgithub.com\u002Fdunglas\u002Fcaddy-cbrotli\tv1.0.1\th1:mkg7EB1GmoyfBt3kY3mq4o\u002F0bfnBeq7ZLQjmVmdBE3Y=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\tv1.13.4\th1:MK45+Ai4Hnd+\u002FV3fpcFNXh5JknkOx+VIbmThLgHiDrw=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\u002Fcaddy\tv1.13.4\th1:PY4Q1l5CJM6ZfWeKU+dTeo4b8DHjoJ923ik+ugHU9NM=\ndep\tgithub.com\u002Fdunglas\u002Fgo-urlpattern\tv1.0.0\th1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=\ndep\tgithub.com\u002Fdunglas\u002Fhttpsfv\tv1.1.2\th1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ\u002FDkmc=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\tv1.1.5\th1:SlEUgMTiQst0zhx4HlPKuo95GRZM6bHCrxH1Me7jQ4M=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\u002Fcaddy\tv1.1.5\th1:Rl1Xh55YwZkFisNnlEZNLpLDL97bfdePSktcbhNb\u002FRU=\ndep\tgithub.com\u002Fdunglas\u002Fskipfilter\tv1.2.0\th1:J7\u002FRXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\tv1.4.5\th1:vO7CS3\u002FKwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\u002Fcaddy\tv1.4.5\th1:2qzg18nEkpsc1QIvpNn\u002FoztSHRxY1\u002FG6xuxylxVobGY=\ndep\tgithub.com\u002Fdustin\u002Fgo-humanize\tv1.1.0\th1:dbKTrvD0klcbBV\u002Fh4AWJdMuZogJACoMlvWIWZ5b2xWg=\ndep\tgithub.com\u002Fe-dant\u002Fwatcher\tv0.0.0-20260223030516-06f84a1314be\th1:vqHrvilasyJcnru\u002F0Z4FoojsQJUIfXGVplte7JtupfY=\ndep\tgithub.com\u002Felnormous\u002Fcontenttype\tv1.0.4\th1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=\ndep\tgithub.com\u002Ffelixge\u002Fhttpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw\u002FQDuVfpNhoA31zeORc=\ndep\tgithub.com\u002Ffxamacker\u002Fcbor\u002Fv2\tv2.9.6\th1:NHZPxuUjJXQjX9itA785y\u002F5NKSlI4HQ+S7noZsmI7hs=\ndep\tgithub.com\u002Fgammazero\u002Fdeque\tv0.2.1\th1:qSdsbG6pgp6nL7A0+K\u002FB7s12mcCY\u002F5l5SIUpMOl+dC0=\ndep\tgithub.com\u002Fgetkin\u002Fkin-openapi\tv0.152.0\th1:XRVo77lMRyOGMHf1paMu9lxX3wzuQDZeprssZJnz\u002Fx8=\ndep\tgithub.com\u002Fgo-chi\u002Fchi\u002Fv5\tv5.5.0\th1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv3\tv3.0.5\th1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv4\tv4.1.6\th1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=\ndep\tgithub.com\u002Fgo-logr\u002Flogr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg\u002F+cPVcbP\u002F8=\ndep\tgithub.com\u002Fgo-logr\u002Fstdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=\ndep\tgithub.com\u002Fgo-openapi\u002Fjsonpointer\tv1.0.2\th1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=\ndep\tgithub.com\u002Fgofrs\u002Fflock\tv0.13.0\th1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ\u002FA8dRYMzw=\ndep\tgithub.com\u002Fgofrs\u002Fuuid\tv4.4.0+incompatible\th1:3qXRTX8\u002FNbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=\ndep\tgithub.com\u002Fgolang-jwt\u002Fjwt\u002Fv5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=\ndep\tgithub.com\u002Fgoogle\u002Fbrotli\u002Fgo\u002Fcbrotli\tv1.2.1\th1:3NEHODycoTQr6cCq\u002FyYNyBqcuk9fKRjSuiADFy2V8h8=\ndep\tgithub.com\u002Fgoogle\u002Fcertificate-transparency-go\tv1.4.0\th1:78uNaR2knzCoKKXXDSAGVkz9XPkDg5xXJRP9tP6+rr0=\ndep\tgithub.com\u002Fgoogle\u002Fflatbuffers\tv25.2.10+incompatible\th1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H\u002FpNX4FP1v0Q=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tpm\tv0.9.8\th1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tspi\tv0.3.0\th1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=\ndep\tgithub.com\u002Fgoogle\u002Fs2a-go\tv0.1.11\th1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=\ndep\tgithub.com\u002Fgoogle\u002Fuuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=\ndep\tgithub.com\u002Fgoogleapis\u002Fenterprise-certificate-proxy\tv0.3.24\th1:G9iCJIY+AYVmUskKdjX8FVy7sG+nbzjOQ41cvlmhcvg=\ndep\tgithub.com\u002Fgoogleapis\u002Fgax-go\u002Fv2\tv2.27.0\th1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc\u002FRRZhKA\u002F2g0=\ndep\tgithub.com\u002Fgorilla\u002Fhandlers\tv1.5.2\th1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=\ndep\tgithub.com\u002Fgorilla\u002Fmux\tv1.8.1\th1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=\ndep\tgithub.com\u002Fgrpc-ecosystem\u002Fgrpc-gateway\u002Fv2\tv2.32.0\th1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=\ndep\tgithub.com\u002Fhuandu\u002Fxstrings\tv1.6.3\th1:7997PcI0mYC9uPNBJ7udg\u002FKrdJh1GhJid8f2tzKFHYQ=\ndep\tgithub.com\u002Fklauspost\u002Fcompress\tv1.20.3\th1:zWNoFqq\u002FlSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=\ndep\tgithub.com\u002Fklauspost\u002Fcpuid\u002Fv2\tv2.4.1\th1:I9KxadAkvo+QjtcEE2f2tyfEvmIla\u002FT0m+14PrZNl0U=\ndep\tgithub.com\u002Flibdns\u002Flibdns\tv1.1.1\th1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS\u002FP\u002FU=\ndep\tgithub.com\u002Fmanifoldco\u002Fpromptui\tv0.9.0\th1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=\ndep\tgithub.com\u002Fmattn\u002Fgo-colorable\tv0.1.16\th1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=\ndep\tgithub.com\u002Fmattn\u002Fgo-isatty\tv0.0.24\th1:tGZZoVgT\u002FKiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\tv1.2.4\th1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\u002Fv2\tv2.4.0\th1:1XpRRWaq9DRIqZV7UtglS4VLzYKSsnFOQmzV+KZxLb0=\ndep\tgithub.com\u002Fmgutz\u002Fansi\tv0.0.0-20200706080929-d51e80ef957d\th1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=\ndep\tgithub.com\u002Fmholt\u002Facmez\u002Fv3\tv3.1.7\th1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=\ndep\tgithub.com\u002Fmholt\u002Fcaddy-ratelimit\tv0.1.0\th1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=\ndep\tgithub.com\u002Fmiekg\u002Fdns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=\ndep\tgithub.com\u002Fmitchellh\u002Fcopystructure\tv1.2.0\th1:vpKXTN4ewci03Vljg\u002Fq9QvCGUDttBOGBIa15WveJJGw=\ndep\tgithub.com\u002Fmitchellh\u002Fgo-ps\tv1.0.0\th1:i6ampVEEF4wQFF+bkYfwYgY+F\u002FuYJDktmvLPf7qIgjc=\ndep\tgithub.com\u002Fmitchellh\u002Freflectwalk\tv1.0.2\th1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=\ndep\tgithub.com\u002Fmunnerz\u002Fgoautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01\u002FOq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=\ndep\tgithub.com\u002Fnlnwa\u002Fwhatwg-url\tv0.6.2\th1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ\u002FQ=\ndep\tgithub.com\u002Fnutsdb\u002Fnutsdb\tv1.0.4\th1:BurzkxijXJY1\u002FAkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=\ndep\tgithub.com\u002Foasdiff\u002Fyaml\tv0.1.1\th1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=\ndep\tgithub.com\u002Foasdiff\u002Fyaml3\tv0.0.14\th1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=\ndep\tgithub.com\u002Fpbnjay\u002Fmemory\tv0.0.0-20210728143218-7b4eea64cf58\th1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=\ndep\tgithub.com\u002Fpierrec\u002Flz4\u002Fv4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=\ndep\tgithub.com\u002Fpires\u002Fgo-proxyproto\tv0.16.0\th1:9KYT\u002FfM3wpjT8bdMEj\u002F7FBcoiUG1KyzEjRYnPu+vz7A=\ndep\tgithub.com\u002Fpkg\u002Ferrors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=\ndep\tgithub.com\u002Fpquerna\u002Fcachecontrol\tv0.2.0\th1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=\ndep\tgithub.com\u002Fprometheus\u002Fclient_golang\tv1.25.0\th1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=\ndep\tgithub.com\u002Fprometheus\u002Fclient_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=\ndep\tgithub.com\u002Fprometheus\u002Fcommon\tv0.72.1\th1:ZAiQed\u002Fnk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=\ndep\tgithub.com\u002Fprometheus\u002Fotlptranslator\tv1.0.0\th1:s0LJW\u002FiN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=\ndep\tgithub.com\u002Fprometheus\u002Fprocfs\tv0.23.0\th1:ad+S6FTkzwaMgacKLM5h6bNKExS+DMH0YiUwXItH\u002Fo4=\ndep\tgithub.com\u002Fquic-go\u002Fqpack\tv0.6.0\th1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=\ndep\tgithub.com\u002Fquic-go\u002Fquic-go\tv0.64.1\th1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=\ndep\tgithub.com\u002Fredis\u002Fgo-redis\u002Fv9\tv9.18.0\th1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=\ndep\tgithub.com\u002Frs\u002Fcors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=\ndep\tgithub.com\u002Frs\u002Fxid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=\ndep\tgithub.com\u002Frussross\u002Fblackfriday\u002Fv2\tv2.1.0\th1:JIOH55\u002F0cWyOuilr9\u002Fqlrm0BSXldqnqwMsf35Ld67mk=\ndep\tgithub.com\u002Fsanthosh-tekuri\u002Fjsonschema\u002Fv6\tv6.0.3\th1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls\u002F28=\ndep\tgithub.com\u002Fshopspring\u002Fdecimal\tv1.6.0\th1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=\ndep\tgithub.com\u002FshurcooL\u002Fsanitized_anchor_name\tv1.0.0\th1:PdmoCO6wvbs+7yrJyMORt4\u002FBmY5IYyJwS\u002FkOiWx8mHo=\ndep\tgithub.com\u002Fsirupsen\u002Flogrus\tv1.10.2\th1:G2SED73\u002FqrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=\ndep\tgithub.com\u002Fslackhq\u002Fnebula\tv1.11.2\th1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=\ndep\tgithub.com\u002Fsmallstep\u002Fcertificates\tv0.30.2\th1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf\u002FiQtA5QlN0Y=\ndep\tgithub.com\u002Fsmallstep\u002Fcli-utils\tv0.12.2\th1:lGzM9PJrH\u002FqawbzMC\u002Fs2SvgLdJPKDWKwKzx9doCVO+k=\ndep\tgithub.com\u002Fsmallstep\u002Fgo-attestation\tv0.4.9\th1:\u002FfVmzB8A8tk7B2PCGPlszWzyl\u002FGDcEQbynqcg2PMaZ0=\ndep\tgithub.com\u002Fsmallstep\u002Flinkedca\tv0.26.0\th1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=\ndep\tgithub.com\u002Fsmallstep\u002Fnosql\tv0.8.0\th1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli\u002FXB4Jp4A=\ndep\tgithub.com\u002Fsmallstep\u002Fpkcs7\tv0.2.3\th1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=\ndep\tgithub.com\u002Fsmallstep\u002Fscep\tv0.0.0-20261014185058-63893dadfda8\th1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=\ndep\tgithub.com\u002Fsmallstep\u002Ftruststore\tv0.13.0\th1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi\u002Fpy4=\ndep\tgithub.com\u002Fspf13\u002Fcast\tv1.10.0\th1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=\ndep\tgithub.com\u002Fspf13\u002Fcobra\tv1.10.2\th1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=\ndep\tgithub.com\u002Fspf13\u002Fpflag\tv1.0.10\th1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=\ndep\tgithub.com\u002Ftailscale\u002Ftscert\tv0.0.0-20251216020129-aea342f6d747\th1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=\ndep\tgithub.com\u002Ftidwall\u002Fbtree\tv1.6.0\th1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=\ndep\tgithub.com\u002Funrolled\u002Fsecure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=\ndep\tgithub.com\u002Furfave\u002Fcli\tv1.22.17\th1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=\ndep\tgithub.com\u002Fx448\u002Ffloat16\tv0.8.4\th1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=\ndep\tgithub.com\u002Fxujiajun\u002Fmmap-go\tv1.0.1\th1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv\u002FWHc=\ndep\tgithub.com\u002Fxujiajun\u002Futils\tv0.0.0-20220904132955-5f7c5b914235\th1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark\tv1.8.6\th1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark-highlighting\u002Fv2\tv2.0.0-20230729083705-37449abec8cc\th1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=\ndep\tgithub.com\u002Fzeebo\u002Fblake3\tv0.2.4\th1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM\u002FyBqhaZI=\ndep\tgo.etcd.io\u002Fbbolt\tv1.5.0\th1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P\u002FbD4lxU=\ndep\tgo.opentelemetry.io\u002Fauto\u002Fsdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ\u002FipaZ64=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fbridges\u002Fprometheus\tv0.72.0\th1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w\u002F1ROwHEM7M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fexporters\u002Fautoexport\tv0.72.0\th1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Finstrumentation\u002Fnet\u002Fhttp\u002Fotelhttp\tv0.72.0\th1:LxwW\u002F9ctSCv+QkE\u002FcLR7M91ZIkXNMqJtEMi1vCw9U8s=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fautoprop\tv0.72.0\th1:\u002FKv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Faws\tv1.47.0\th1:n\u002F2x\u002FvQki1ojD7R2jYHdnNdI74Yx\u002FOFdY4YXFFesm8M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fb3\tv1.47.0\th1:vlKDmtjhe1R0d7kdov\u002F+KVTKWOKeGLyohB+iXoDPRMQ=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fjaeger\tv1.47.0\th1:2lDw6AKPV33\u002F7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fot\tv1.47.0\th1:nZUqh0\u002F8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=\ndep\tgo.opentelemetry.io\u002Fotel\tv1.47.0\th1:j7ALJ\u002FzgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploggrpc\tv0.23.0\th1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploghttp\tv0.23.0\th1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI\u002FnE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetricgrpc\tv1.47.0\th1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetrichttp\tv1.47.0\th1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\tv1.47.0\th1:julhjPeUH\u002Fq\u002F7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracegrpc\tv1.47.0\th1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracehttp\tv1.47.0\th1:aXZXsZ012wOgVkqaiQv+Z\u002Fd8V0xKjmg70F6m4CE94lc=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fprometheus\tv0.69.0\th1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutlog\tv0.23.0\th1:PW\u002FE9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutmetric\tv1.47.0\th1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdouttrace\tv1.47.0\th1:N3YQCxjxQ\u002FbMjyc3heladfRm9t9RTksGQH8z4w6yU\u002F0=\ndep\tgo.opentelemetry.io\u002Fotel\u002Flog\tv1.47.0\th1:cOTS1CcLbSQeZKanGJ+0JpF\u002F+t4PELi3O3bbl2lqCcI=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fmetric\tv1.47.0\th1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\tv1.47.0\th1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Flog\tv1.47.0\th1:W4N\u002FZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Fmetric\tv1.47.0\th1:lfISg2j93VT6yqdk9OfUaZmw\u002FGfcZqCCV3jdXtsPnKw=\ndep\tgo.opentelemetry.io\u002Fotel\u002Ftrace\tv1.47.0\th1:JOjX\u002FOci8K94QHddo+bbfya\u002FAi\u002Fnf6\u002Fdt9ZfrFNWSrM=\ndep\tgo.opentelemetry.io\u002Fproto\u002Fotlp\tv1.11.1\th1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=\ndep\tgo.step.sm\u002Fcrypto\tv0.91.0\th1:0mN0DwVOvUuh7VbyTnxABZuAkxwak\u002FGrp8Y\u002Fb4YaZDU=\ndep\tgo.uber.org\u002Fatomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp\u002FAUETXlHW0DxSjE=\ndep\tgo.uber.org\u002Fautomaxprocs\tv1.6.0\th1:O3y2\u002FQNTOdbF+e\u002FdpXNNW7Rx2hZ4sTIPyybbxyNqTUs=\ndep\tgo.uber.org\u002Fmultierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=\ndep\tgo.uber.org\u002Fzap\tv1.28.0\th1:IZzaP1Fv73\u002FT\u002FpBMLk4VutPl36uNC+OSUh3JLG3FIjo=\ndep\tgo.uber.org\u002Fzap\u002Fexp\tv0.3.0\th1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=\ndep\tgo.yaml.in\u002Fyaml\u002Fv3\tv3.0.5\th1:N6y\u002FpJk8buWs9NY5ERU2HSMfm+IuD\u002FOtfdAnq6kESPw=\ndep\tgolang.org\u002Fx\u002Fcrypto\tv0.58.0\th1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K\u002FM\u002F54=\ndep\tgolang.org\u002Fx\u002Fcrypto\u002Fx509roots\u002Ffallback\tv0.0.0-20261020153306-9f2b28d4331a\th1:V5oicZXS0oqZx30gY\u002FapgSVD7YvNBfrIOdcMnlelJY4=\ndep\tgolang.org\u002Fx\u002Fexp\tv0.0.0-20261014143641-f0251eb4aa3e\th1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI\u002FA=\ndep\tgolang.org\u002Fx\u002Fnet\tv0.61.0\th1:RR+6j\u002FBTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=\ndep\tgolang.org\u002Fx\u002Foauth2\tv0.37.0\th1:JUlcxA8oAtauLfiH8FX2\u002FFkAWHAdi0QtGCGc+hofE98=\ndep\tgolang.org\u002Fx\u002Fsync\tv0.24.0\th1:iqiDrGoDgyuvAKrhLQthUEzU\u002FR378N78gXbBjxed7oA=\ndep\tgolang.org\u002Fx\u002Fsys\tv0.49.0\th1:XbzkgYJHdqh\u002F8m2Uu0W\u002FdQv8nktxx4BFHp1M0gROTXA=\ndep\tgolang.org\u002Fx\u002Fterm\tv0.47.0\th1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ\u002FBM=\ndep\tgolang.org\u002Fx\u002Ftext\tv0.43.0\th1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5\u002FUGUTJVXoWc=\ndep\tgolang.org\u002Fx\u002Ftime\tv0.16.0\th1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q\u002F6gY2hDM6VDE=\ndep\tgoogle.golang.org\u002Fapi\tv0.308.0\th1:iGb+4qT3nVb3uuIzwor3yP2nyu+rMZr31PvLFiRNJQk=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Fapi\tv0.0.0-20261019180522-ce908d29299b\th1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Frpc\tv0.0.0-20261019180522-ce908d29299b\th1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=\ndep\tgoogle.golang.org\u002Fgrpc\tv1.84.0\th1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=\ndep\tgoogle.golang.org\u002Fprotobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o\u002Ffwxc=\ndep\tgopkg.in\u002Fyaml.v3\tv3.0.1\th1:fxVm\u002FGzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=\nbuild\t-buildmode=exe\nbuild\t-compiler=gc\nbuild\t-ldflags=\"-w -s\"\nbuild\t-tags=nobadger,nomysql,nopgx\nbuild\tCGO_ENABLED=1\nbuild\tCGO_CFLAGS=\"-I\u002Fusr\u002Flocal\u002Finclude\u002Fphp -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fmain -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FTSRM -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FZend -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext\u002Fdate\u002Flib\"\nbuild\tCGO_CPPFLAGS=\"-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64\"\nbuild\tCGO_CXXFLAGS=\nbuild\tCGO_LDFLAGS=\"-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto\"\nbuild\tGOARCH=amd64\nbuild\tGOOS=linux\nbuild\tGOAMD64=v1\n\n```\n",{"part":901,"tag":928,"name":928,"publishedAt":929,"url":930,"body":931},"v2.0.0-alpha.31","2026-10-30T11:19:31Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.31","- Dependencies updated to their latest versions, including pinia 4.1, `@pinia\u002Fnuxt` 1.0.3, the Nuxt SEO modules and `vuejs-confirm-dialog` 1.1, for the fast-uri, seroval, zod, qs and other advisories; `@nuxt\u002Fkit` and `@nuxt\u002Fschema` still accept 4.6.0 or later ([c5966b1a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fc5966b1a))\n",{"part":907,"tag":933,"name":933,"publishedAt":934,"url":935,"body":936},"2.0.0-alpha.38","2026-10-30T08:24:32Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.38","### Fixed\n- An item URL whose id is not a valid UUID is a 404 instead of a 500 (Doctrine `ValueNotConvertible`, logged at critical); only routes (by path), component groups (by reference) and forms (`password_reset`) still accept an identifier that is not a UUID ([#566](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F566))\n",{"part":885,"tag":938,"name":938,"publishedAt":939,"url":940,"body":941},"v2.0.0-alpha.50","2026-10-28T09:50:40Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.50","## [2.0.0-alpha.50](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.50) - 2026-10-28\n\n### Upgrade notes\n\n- **No bundle or module change:** api-components-bundle stays 2.0.0-alpha.37 and `@cwa\u002Fnuxt` 2.0.0-alpha.30.\n- **Take `app\u002Fpnpm-workspace.yaml`, `app\u002Fpnpm-lock.yaml` and `api\u002Fcomposer.lock`'s phpunit** for the security fixes below. A project with its own overrides or register entries merges them into the file. [!18](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F18)\n\n### Security\n\n- **node-forge 1.4.0 → 1.4.2** for GHSA-86w9-cpqp-85rv (high, CVE-2026-85393). It's fixed in 1.4.1, although GitHub's advisory doesn't list a fixed version yet; 1.4.2 also fixes 1.4.1's `pem.decode()` regression. **postcss-selector-parser 6.0.10 → 6.1.5** for GHSA-rj75-hqrm-r3gf (moderate), and **esbuild 0.27.7 → 0.28.2** for GHSA-g7r4-m6w7-qqqr (low), each by an override. **phpunit 13.4.3 → 13.4.5** for PKSA-qhjm-rpqc-qkn6 (dev only). [!18](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F18)\n- Still accepted, not in the server output: deepmerge 4.3.1 (GHSA-gcqx-w48m-w2h4, low), @rollup\u002Fplugin-node-resolve's at build only, with no fix released. [!18](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F18)\n\n### cwa-php-base 2.0.0-alpha.50\n\nPin it as `ghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.50@sha256:ca9d34837284adba2b65d825f4dc74703093d162f910ed5c65c23c70dc639412`.\n\nVerify it with:\n\n```sh\ngh attestation verify oci:\u002F\u002Fghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.50 --repo components-web-app\u002Fcomponents-web-app \\\n  --signer-workflow components-web-app\u002Fcomponents-web-app\u002F.github\u002Fworkflows\u002Fpublish-php-base.yml --source-ref refs\u002Ftags\u002Fv2.0.0-alpha.50\n```\n\n```\n# Base images (from the build provenance)\npkg:docker\u002Fcaddy@builder?platform=linux%2Famd64 sha256:bf6a7d38add2508b7d2e3e3f40cf2af399214f143c0fa3daa51f254e01f8d293\npkg:docker\u002Fcaddy@builder?platform=linux%2Farm64 sha256:bf6a7d38add2508b7d2e3e3f40cf2af399214f143c0fa3daa51f254e01f8d293\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315\npkg:docker\u002Fdocker\u002Fdockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Famd64 sha256:6d90e9f0adee5750afe75f8ae1568c02295e50bc2148b00e8b99c431470e45f3\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Farm64 sha256:6d90e9f0adee5750afe75f8ae1568c02295e50bc2148b00e8b99c431470e45f3\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Famd64 sha256:ada77754f475352a9105b7961f89ab17ece97048514799532d2d27a1dea2fda7\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Farm64 sha256:ada77754f475352a9105b7961f89ab17ece97048514799532d2d27a1dea2fda7\n\nPHP 8.5.12 (cli) (built: Oct 21 2026 15:49:52) (ZTS)\nCopyright (c) The PHP Group\nBuilt by https:\u002F\u002Fgithub.com\u002Fdocker-library\u002Fphp\nZend Engine v4.5.12, Copyright (c) Zend Technologies\n    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies\n\n[PHP Modules]\napcu\nbrotli\nCore\nctype\ncurl\ndate\ndom\nexif\nFFI\nfileinfo\nfilter\ngd\nhash\niconv\nintl\njson\nlexbor\nlibxml\nmbstring\nmysqlnd\nopenssl\npcre\nPDO\npdo_pgsql\npdo_sqlite\nPhar\nposix\nrandom\nreadline\nReflection\nsession\nSimpleXML\nsodium\nSPL\nsqlite3\nstandard\ntokenizer\nuri\nxml\nxmlreader\nxmlwriter\nxsl\nZend OPcache\nzip\nzlib\n\n[Zend Modules]\nZend OPcache\n\n\ngo\tgo1.27.3\npath\tcaddy\nmod\tcaddy\t(devel)\t\ndep\tcel.dev\u002Fcel-go\tv0.32.0\th1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=\ndep\tcel.dev\u002Fexpr\tv0.25.3\th1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=\ndep\tcloud.google.com\u002Fgo\u002Fauth\tv0.24.1\th1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=\ndep\tcloud.google.com\u002Fgo\u002Fauth\u002Foauth2adapt\tv0.3.0\th1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=\ndep\tcloud.google.com\u002Fgo\u002Fcompute\u002Fmetadata\tv0.10.0\th1:pyKMUQSwchgkIBBJGdILqQbs\u002FBNJXqwSA7Ej6LAvvtY=\ndep\tdario.cat\u002Fmergo\tv1.0.2\th1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=\ndep\tfilippo.io\u002Fbigmod\tv0.1.0\th1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=\ndep\tfilippo.io\u002Fedwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=\ndep\tgithub.com\u002FBurntSushi\u002Ftoml\tv1.6.0\th1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=\ndep\tgithub.com\u002FDeRuina\u002Ftimberjack\tv1.4.9\th1:9RjDMSkUDQRYzwVNB\u002FFLonXNurcZVEh9sK43m2jw3A4=\ndep\tgithub.com\u002FKimMachineGun\u002Fautomemlimit\tv1.0.1\th1:87PowSIJFht5TmyyZKJNR4y2v7Cm9OdCzsSMR8jXJHM=\ndep\tgithub.com\u002FMasterminds\u002Fgoutils\tv1.1.1\th1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=\ndep\tgithub.com\u002FMasterminds\u002Fsemver\u002Fv3\tv3.5.0\th1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ\u002F2OOE=\ndep\tgithub.com\u002FMasterminds\u002Fsprig\u002Fv3\tv3.3.0\th1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=\ndep\tgithub.com\u002FMauriceGit\u002Fskiplist\tv0.0.0-20211105230623-77f5c8d3e145\th1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=\ndep\tgithub.com\u002FMicahParks\u002Fjwkset\tv0.11.3\th1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=\ndep\tgithub.com\u002FMicahParks\u002Fkeyfunc\u002Fv3\tv3.8.2\th1:eydEwk\u002FpBAVrDIpmFfB\u002FgkCcrp++xQ7YYXirrI2zlWE=\ndep\tgithub.com\u002FRoaringBitmap\u002Froaring\u002Fv2\tv2.30.0\th1:1sD4xsCenNd9n\u002FgOWaExCWanP9WTyiNuqLAvaDQ5jkY=\ndep\tgithub.com\u002Falecthomas\u002Fchroma\u002Fv2\tv2.27.0\th1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v\u002Fr5BXYZs=\ndep\tgithub.com\u002Fantlabs\u002Fstl\tv0.0.1\th1:TRD3csCrjREeLhLoQ\u002FsupaoCvFhNLBTNIwuRGrDIs6Q=\ndep\tgithub.com\u002Fantlabs\u002Ftimer\tv0.0.11\th1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=\ndep\tgithub.com\u002Fantlr4-go\u002Fantlr\u002Fv4\tv4.13.1\th1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=\ndep\tgithub.com\u002Faryann\u002Fdifflib\tv0.0.0-20210328193216-ff5ff6dc229b\th1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=\ndep\tgithub.com\u002Fbeorn7\u002Fperks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=\ndep\tgithub.com\u002Fbits-and-blooms\u002Fbitset\tv1.26.0\th1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=\ndep\tgithub.com\u002Fbwmarrin\u002Fsnowflake\tv0.3.0\th1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=\ndep\tgithub.com\u002Fcaddyserver\u002Fcaddy\u002Fv2\tv2.11.7\th1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=\ndep\tgithub.com\u002Fcaddyserver\u002Fcertmagic\tv0.25.6\th1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=\ndep\tgithub.com\u002Fcaddyserver\u002Fzerossl\tv0.1.6\th1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT\u002F4REW\u002F\u002Flsas=\ndep\tgithub.com\u002Fccoveille\u002Fgo-safecast\u002Fv2\tv2.0.1\th1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=\ndep\tgithub.com\u002Fcenkalti\u002Fbackoff\u002Fv5\tv5.0.3\th1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=\ndep\tgithub.com\u002Fcespare\u002Fxxhash\u002Fv2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=\ndep\tgithub.com\u002Fchzyer\u002Freadline\tv1.5.1\th1:upd\u002F6fQk4src78LMRzh5vItIt361\u002Fo4uq553V8B5sGI=\ndep\tgithub.com\u002Fcloudflare\u002Fcircl\tv1.6.5\th1:O64F26HEqNhznd\u002FhrC5KZXVKYuKM2rx4deZDTc4ihQA=\ndep\tgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fapi\u002Ffrankenphp\u002Fcaddy\u002Fqueryallowlist\tv0.0.0-20261028091931-890ca2faa006\n=>\t\u002Ftmp\u002Fqueryallowlist\t(devel)\t\n\ndep\tgithub.com\u002Fcoreos\u002Fgo-oidc\u002Fv3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=\ndep\tgithub.com\u002Fcpuguy83\u002Fgo-md2man\u002Fv2\tv2.0.7\th1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\tv1.7.9\n=>\t\u002Ftmp\u002Fsouin\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\u002Fplugins\u002Fcaddy\tv1.7.9\th1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\tv0.0.21\th1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M\u002FJRc+zhN7Wsx0=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\u002Fcaddy\tv0.0.22\th1:4\u002FbyA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fcore\tv0.0.21\th1:zfa0Bqzdm9\u002FoPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\tv0.0.22\n=>\t\u002Ftmp\u002Fstorages-go-redis\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\u002Fcaddy\tv0.0.22\th1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\tv0.0.21\th1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\u002Fcaddy\tv0.0.22\th1:kg\u002FHYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\tv0.0.21\th1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\u002Fcaddy\tv0.0.22\th1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=\ndep\tgithub.com\u002Fdgraph-io\u002Fbadger\u002Fv4\tv4.9.1\th1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=\ndep\tgithub.com\u002Fdgraph-io\u002Fristretto\u002Fv2\tv2.2.0\th1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=\ndep\tgithub.com\u002Fdgryski\u002Fgo-rendezvous\tv0.0.0-20200823014737-9f7001d12a5f\th1:lO4WD4F\u002FrVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=\ndep\tgithub.com\u002Fdlclark\u002Fregexp2\u002Fv2\tv2.10.0\th1:zSNli+yyb7Rg4VzzLiZuJ3eZup\u002FOObARXm\u002Fqs1a2\u002F\u002Fc=\ndep\tgithub.com\u002Fdolthub\u002Fmaphash\tv0.1.0\th1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L\u002FQxPDyQ=\ndep\tgithub.com\u002Fdunglas\u002Fcaddy-cbrotli\tv1.0.1\th1:mkg7EB1GmoyfBt3kY3mq4o\u002F0bfnBeq7ZLQjmVmdBE3Y=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\tv1.13.4\th1:MK45+Ai4Hnd+\u002FV3fpcFNXh5JknkOx+VIbmThLgHiDrw=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\u002Fcaddy\tv1.13.4\th1:PY4Q1l5CJM6ZfWeKU+dTeo4b8DHjoJ923ik+ugHU9NM=\ndep\tgithub.com\u002Fdunglas\u002Fgo-urlpattern\tv1.0.0\th1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=\ndep\tgithub.com\u002Fdunglas\u002Fhttpsfv\tv1.1.2\th1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ\u002FDkmc=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\tv1.1.5\th1:SlEUgMTiQst0zhx4HlPKuo95GRZM6bHCrxH1Me7jQ4M=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\u002Fcaddy\tv1.1.5\th1:Rl1Xh55YwZkFisNnlEZNLpLDL97bfdePSktcbhNb\u002FRU=\ndep\tgithub.com\u002Fdunglas\u002Fskipfilter\tv1.2.0\th1:J7\u002FRXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\tv1.4.5\th1:vO7CS3\u002FKwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\u002Fcaddy\tv1.4.5\th1:2qzg18nEkpsc1QIvpNn\u002FoztSHRxY1\u002FG6xuxylxVobGY=\ndep\tgithub.com\u002Fdustin\u002Fgo-humanize\tv1.1.0\th1:dbKTrvD0klcbBV\u002Fh4AWJdMuZogJACoMlvWIWZ5b2xWg=\ndep\tgithub.com\u002Fe-dant\u002Fwatcher\tv0.0.0-20260223030516-06f84a1314be\th1:vqHrvilasyJcnru\u002F0Z4FoojsQJUIfXGVplte7JtupfY=\ndep\tgithub.com\u002Felnormous\u002Fcontenttype\tv1.0.4\th1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=\ndep\tgithub.com\u002Ffelixge\u002Fhttpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw\u002FQDuVfpNhoA31zeORc=\ndep\tgithub.com\u002Ffxamacker\u002Fcbor\u002Fv2\tv2.9.6\th1:NHZPxuUjJXQjX9itA785y\u002F5NKSlI4HQ+S7noZsmI7hs=\ndep\tgithub.com\u002Fgammazero\u002Fdeque\tv0.2.1\th1:qSdsbG6pgp6nL7A0+K\u002FB7s12mcCY\u002F5l5SIUpMOl+dC0=\ndep\tgithub.com\u002Fgetkin\u002Fkin-openapi\tv0.152.0\th1:XRVo77lMRyOGMHf1paMu9lxX3wzuQDZeprssZJnz\u002Fx8=\ndep\tgithub.com\u002Fgo-chi\u002Fchi\u002Fv5\tv5.5.0\th1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv3\tv3.0.5\th1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv4\tv4.1.6\th1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=\ndep\tgithub.com\u002Fgo-logr\u002Flogr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg\u002F+cPVcbP\u002F8=\ndep\tgithub.com\u002Fgo-logr\u002Fstdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=\ndep\tgithub.com\u002Fgo-openapi\u002Fjsonpointer\tv1.0.2\th1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=\ndep\tgithub.com\u002Fgofrs\u002Fflock\tv0.13.0\th1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ\u002FA8dRYMzw=\ndep\tgithub.com\u002Fgofrs\u002Fuuid\tv4.4.0+incompatible\th1:3qXRTX8\u002FNbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=\ndep\tgithub.com\u002Fgolang-jwt\u002Fjwt\u002Fv5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=\ndep\tgithub.com\u002Fgoogle\u002Fbrotli\u002Fgo\u002Fcbrotli\tv1.2.1\th1:3NEHODycoTQr6cCq\u002FyYNyBqcuk9fKRjSuiADFy2V8h8=\ndep\tgithub.com\u002Fgoogle\u002Fcertificate-transparency-go\tv1.4.0\th1:78uNaR2knzCoKKXXDSAGVkz9XPkDg5xXJRP9tP6+rr0=\ndep\tgithub.com\u002Fgoogle\u002Fflatbuffers\tv25.2.10+incompatible\th1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H\u002FpNX4FP1v0Q=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tpm\tv0.9.8\th1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tspi\tv0.3.0\th1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=\ndep\tgithub.com\u002Fgoogle\u002Fs2a-go\tv0.1.11\th1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=\ndep\tgithub.com\u002Fgoogle\u002Fuuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=\ndep\tgithub.com\u002Fgoogleapis\u002Fenterprise-certificate-proxy\tv0.3.24\th1:G9iCJIY+AYVmUskKdjX8FVy7sG+nbzjOQ41cvlmhcvg=\ndep\tgithub.com\u002Fgoogleapis\u002Fgax-go\u002Fv2\tv2.27.0\th1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc\u002FRRZhKA\u002F2g0=\ndep\tgithub.com\u002Fgorilla\u002Fhandlers\tv1.5.2\th1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=\ndep\tgithub.com\u002Fgorilla\u002Fmux\tv1.8.1\th1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=\ndep\tgithub.com\u002Fgrpc-ecosystem\u002Fgrpc-gateway\u002Fv2\tv2.32.0\th1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=\ndep\tgithub.com\u002Fhuandu\u002Fxstrings\tv1.6.3\th1:7997PcI0mYC9uPNBJ7udg\u002FKrdJh1GhJid8f2tzKFHYQ=\ndep\tgithub.com\u002Fklauspost\u002Fcompress\tv1.20.3\th1:zWNoFqq\u002FlSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=\ndep\tgithub.com\u002Fklauspost\u002Fcpuid\u002Fv2\tv2.4.1\th1:I9KxadAkvo+QjtcEE2f2tyfEvmIla\u002FT0m+14PrZNl0U=\ndep\tgithub.com\u002Flibdns\u002Flibdns\tv1.1.1\th1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS\u002FP\u002FU=\ndep\tgithub.com\u002Fmanifoldco\u002Fpromptui\tv0.9.0\th1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=\ndep\tgithub.com\u002Fmattn\u002Fgo-colorable\tv0.1.16\th1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=\ndep\tgithub.com\u002Fmattn\u002Fgo-isatty\tv0.0.24\th1:tGZZoVgT\u002FKiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\tv1.2.4\th1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\u002Fv2\tv2.4.0\th1:1XpRRWaq9DRIqZV7UtglS4VLzYKSsnFOQmzV+KZxLb0=\ndep\tgithub.com\u002Fmgutz\u002Fansi\tv0.0.0-20200706080929-d51e80ef957d\th1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=\ndep\tgithub.com\u002Fmholt\u002Facmez\u002Fv3\tv3.1.7\th1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=\ndep\tgithub.com\u002Fmholt\u002Fcaddy-ratelimit\tv0.1.0\th1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=\ndep\tgithub.com\u002Fmiekg\u002Fdns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=\ndep\tgithub.com\u002Fmitchellh\u002Fcopystructure\tv1.2.0\th1:vpKXTN4ewci03Vljg\u002Fq9QvCGUDttBOGBIa15WveJJGw=\ndep\tgithub.com\u002Fmitchellh\u002Fgo-ps\tv1.0.0\th1:i6ampVEEF4wQFF+bkYfwYgY+F\u002FuYJDktmvLPf7qIgjc=\ndep\tgithub.com\u002Fmitchellh\u002Freflectwalk\tv1.0.2\th1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=\ndep\tgithub.com\u002Fmunnerz\u002Fgoautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01\u002FOq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=\ndep\tgithub.com\u002Fnlnwa\u002Fwhatwg-url\tv0.6.2\th1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ\u002FQ=\ndep\tgithub.com\u002Fnutsdb\u002Fnutsdb\tv1.0.4\th1:BurzkxijXJY1\u002FAkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=\ndep\tgithub.com\u002Foasdiff\u002Fyaml\tv0.1.1\th1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=\ndep\tgithub.com\u002Foasdiff\u002Fyaml3\tv0.0.14\th1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=\ndep\tgithub.com\u002Fpbnjay\u002Fmemory\tv0.0.0-20210728143218-7b4eea64cf58\th1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=\ndep\tgithub.com\u002Fpierrec\u002Flz4\u002Fv4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=\ndep\tgithub.com\u002Fpires\u002Fgo-proxyproto\tv0.16.0\th1:9KYT\u002FfM3wpjT8bdMEj\u002F7FBcoiUG1KyzEjRYnPu+vz7A=\ndep\tgithub.com\u002Fpkg\u002Ferrors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=\ndep\tgithub.com\u002Fpquerna\u002Fcachecontrol\tv0.2.0\th1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=\ndep\tgithub.com\u002Fprometheus\u002Fclient_golang\tv1.25.0\th1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=\ndep\tgithub.com\u002Fprometheus\u002Fclient_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=\ndep\tgithub.com\u002Fprometheus\u002Fcommon\tv0.72.1\th1:ZAiQed\u002Fnk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=\ndep\tgithub.com\u002Fprometheus\u002Fotlptranslator\tv1.0.0\th1:s0LJW\u002FiN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=\ndep\tgithub.com\u002Fprometheus\u002Fprocfs\tv0.23.0\th1:ad+S6FTkzwaMgacKLM5h6bNKExS+DMH0YiUwXItH\u002Fo4=\ndep\tgithub.com\u002Fquic-go\u002Fqpack\tv0.6.0\th1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=\ndep\tgithub.com\u002Fquic-go\u002Fquic-go\tv0.64.1\th1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=\ndep\tgithub.com\u002Fredis\u002Fgo-redis\u002Fv9\tv9.18.0\th1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=\ndep\tgithub.com\u002Frs\u002Fcors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=\ndep\tgithub.com\u002Frs\u002Fxid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=\ndep\tgithub.com\u002Frussross\u002Fblackfriday\u002Fv2\tv2.1.0\th1:JIOH55\u002F0cWyOuilr9\u002Fqlrm0BSXldqnqwMsf35Ld67mk=\ndep\tgithub.com\u002Fsanthosh-tekuri\u002Fjsonschema\u002Fv6\tv6.0.3\th1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls\u002F28=\ndep\tgithub.com\u002Fshopspring\u002Fdecimal\tv1.6.0\th1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=\ndep\tgithub.com\u002FshurcooL\u002Fsanitized_anchor_name\tv1.0.0\th1:PdmoCO6wvbs+7yrJyMORt4\u002FBmY5IYyJwS\u002FkOiWx8mHo=\ndep\tgithub.com\u002Fsirupsen\u002Flogrus\tv1.10.2\th1:G2SED73\u002FqrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=\ndep\tgithub.com\u002Fslackhq\u002Fnebula\tv1.11.2\th1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=\ndep\tgithub.com\u002Fsmallstep\u002Fcertificates\tv0.30.2\th1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf\u002FiQtA5QlN0Y=\ndep\tgithub.com\u002Fsmallstep\u002Fcli-utils\tv0.12.2\th1:lGzM9PJrH\u002FqawbzMC\u002Fs2SvgLdJPKDWKwKzx9doCVO+k=\ndep\tgithub.com\u002Fsmallstep\u002Fgo-attestation\tv0.4.9\th1:\u002FfVmzB8A8tk7B2PCGPlszWzyl\u002FGDcEQbynqcg2PMaZ0=\ndep\tgithub.com\u002Fsmallstep\u002Flinkedca\tv0.26.0\th1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=\ndep\tgithub.com\u002Fsmallstep\u002Fnosql\tv0.8.0\th1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli\u002FXB4Jp4A=\ndep\tgithub.com\u002Fsmallstep\u002Fpkcs7\tv0.2.3\th1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=\ndep\tgithub.com\u002Fsmallstep\u002Fscep\tv0.0.0-20261014185058-63893dadfda8\th1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=\ndep\tgithub.com\u002Fsmallstep\u002Ftruststore\tv0.13.0\th1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi\u002Fpy4=\ndep\tgithub.com\u002Fspf13\u002Fcast\tv1.10.0\th1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=\ndep\tgithub.com\u002Fspf13\u002Fcobra\tv1.10.2\th1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=\ndep\tgithub.com\u002Fspf13\u002Fpflag\tv1.0.10\th1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=\ndep\tgithub.com\u002Ftailscale\u002Ftscert\tv0.0.0-20251216020129-aea342f6d747\th1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=\ndep\tgithub.com\u002Ftidwall\u002Fbtree\tv1.6.0\th1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=\ndep\tgithub.com\u002Funrolled\u002Fsecure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=\ndep\tgithub.com\u002Furfave\u002Fcli\tv1.22.17\th1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=\ndep\tgithub.com\u002Fx448\u002Ffloat16\tv0.8.4\th1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=\ndep\tgithub.com\u002Fxujiajun\u002Fmmap-go\tv1.0.1\th1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv\u002FWHc=\ndep\tgithub.com\u002Fxujiajun\u002Futils\tv0.0.0-20220904132955-5f7c5b914235\th1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark\tv1.8.6\th1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark-highlighting\u002Fv2\tv2.0.0-20230729083705-37449abec8cc\th1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=\ndep\tgithub.com\u002Fzeebo\u002Fblake3\tv0.2.4\th1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM\u002FyBqhaZI=\ndep\tgo.etcd.io\u002Fbbolt\tv1.5.0\th1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P\u002FbD4lxU=\ndep\tgo.opentelemetry.io\u002Fauto\u002Fsdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ\u002FipaZ64=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fbridges\u002Fprometheus\tv0.72.0\th1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w\u002F1ROwHEM7M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fexporters\u002Fautoexport\tv0.72.0\th1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Finstrumentation\u002Fnet\u002Fhttp\u002Fotelhttp\tv0.72.0\th1:LxwW\u002F9ctSCv+QkE\u002FcLR7M91ZIkXNMqJtEMi1vCw9U8s=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fautoprop\tv0.72.0\th1:\u002FKv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Faws\tv1.47.0\th1:n\u002F2x\u002FvQki1ojD7R2jYHdnNdI74Yx\u002FOFdY4YXFFesm8M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fb3\tv1.47.0\th1:vlKDmtjhe1R0d7kdov\u002F+KVTKWOKeGLyohB+iXoDPRMQ=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fjaeger\tv1.47.0\th1:2lDw6AKPV33\u002F7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fot\tv1.47.0\th1:nZUqh0\u002F8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=\ndep\tgo.opentelemetry.io\u002Fotel\tv1.47.0\th1:j7ALJ\u002FzgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploggrpc\tv0.23.0\th1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploghttp\tv0.23.0\th1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI\u002FnE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetricgrpc\tv1.47.0\th1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetrichttp\tv1.47.0\th1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\tv1.47.0\th1:julhjPeUH\u002Fq\u002F7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracegrpc\tv1.47.0\th1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracehttp\tv1.47.0\th1:aXZXsZ012wOgVkqaiQv+Z\u002Fd8V0xKjmg70F6m4CE94lc=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fprometheus\tv0.69.0\th1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutlog\tv0.23.0\th1:PW\u002FE9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutmetric\tv1.47.0\th1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdouttrace\tv1.47.0\th1:N3YQCxjxQ\u002FbMjyc3heladfRm9t9RTksGQH8z4w6yU\u002F0=\ndep\tgo.opentelemetry.io\u002Fotel\u002Flog\tv1.47.0\th1:cOTS1CcLbSQeZKanGJ+0JpF\u002F+t4PELi3O3bbl2lqCcI=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fmetric\tv1.47.0\th1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\tv1.47.0\th1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Flog\tv1.47.0\th1:W4N\u002FZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Fmetric\tv1.47.0\th1:lfISg2j93VT6yqdk9OfUaZmw\u002FGfcZqCCV3jdXtsPnKw=\ndep\tgo.opentelemetry.io\u002Fotel\u002Ftrace\tv1.47.0\th1:JOjX\u002FOci8K94QHddo+bbfya\u002FAi\u002Fnf6\u002Fdt9ZfrFNWSrM=\ndep\tgo.opentelemetry.io\u002Fproto\u002Fotlp\tv1.11.1\th1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=\ndep\tgo.step.sm\u002Fcrypto\tv0.91.0\th1:0mN0DwVOvUuh7VbyTnxABZuAkxwak\u002FGrp8Y\u002Fb4YaZDU=\ndep\tgo.uber.org\u002Fatomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp\u002FAUETXlHW0DxSjE=\ndep\tgo.uber.org\u002Fautomaxprocs\tv1.6.0\th1:O3y2\u002FQNTOdbF+e\u002FdpXNNW7Rx2hZ4sTIPyybbxyNqTUs=\ndep\tgo.uber.org\u002Fmultierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=\ndep\tgo.uber.org\u002Fzap\tv1.28.0\th1:IZzaP1Fv73\u002FT\u002FpBMLk4VutPl36uNC+OSUh3JLG3FIjo=\ndep\tgo.uber.org\u002Fzap\u002Fexp\tv0.3.0\th1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=\ndep\tgo.yaml.in\u002Fyaml\u002Fv3\tv3.0.5\th1:N6y\u002FpJk8buWs9NY5ERU2HSMfm+IuD\u002FOtfdAnq6kESPw=\ndep\tgolang.org\u002Fx\u002Fcrypto\tv0.58.0\th1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K\u002FM\u002F54=\ndep\tgolang.org\u002Fx\u002Fcrypto\u002Fx509roots\u002Ffallback\tv0.0.0-20261020153306-9f2b28d4331a\th1:V5oicZXS0oqZx30gY\u002FapgSVD7YvNBfrIOdcMnlelJY4=\ndep\tgolang.org\u002Fx\u002Fexp\tv0.0.0-20261014143641-f0251eb4aa3e\th1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI\u002FA=\ndep\tgolang.org\u002Fx\u002Fnet\tv0.61.0\th1:RR+6j\u002FBTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=\ndep\tgolang.org\u002Fx\u002Foauth2\tv0.37.0\th1:JUlcxA8oAtauLfiH8FX2\u002FFkAWHAdi0QtGCGc+hofE98=\ndep\tgolang.org\u002Fx\u002Fsync\tv0.24.0\th1:iqiDrGoDgyuvAKrhLQthUEzU\u002FR378N78gXbBjxed7oA=\ndep\tgolang.org\u002Fx\u002Fsys\tv0.49.0\th1:XbzkgYJHdqh\u002F8m2Uu0W\u002FdQv8nktxx4BFHp1M0gROTXA=\ndep\tgolang.org\u002Fx\u002Fterm\tv0.47.0\th1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ\u002FBM=\ndep\tgolang.org\u002Fx\u002Ftext\tv0.43.0\th1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5\u002FUGUTJVXoWc=\ndep\tgolang.org\u002Fx\u002Ftime\tv0.16.0\th1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q\u002F6gY2hDM6VDE=\ndep\tgoogle.golang.org\u002Fapi\tv0.308.0\th1:iGb+4qT3nVb3uuIzwor3yP2nyu+rMZr31PvLFiRNJQk=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Fapi\tv0.0.0-20261019180522-ce908d29299b\th1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Frpc\tv0.0.0-20261019180522-ce908d29299b\th1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=\ndep\tgoogle.golang.org\u002Fgrpc\tv1.84.0\th1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=\ndep\tgoogle.golang.org\u002Fprotobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o\u002Ffwxc=\ndep\tgopkg.in\u002Fyaml.v3\tv3.0.1\th1:fxVm\u002FGzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=\nbuild\t-buildmode=exe\nbuild\t-compiler=gc\nbuild\t-ldflags=\"-w -s\"\nbuild\t-tags=nobadger,nomysql,nopgx\nbuild\tCGO_ENABLED=1\nbuild\tCGO_CFLAGS=\"-I\u002Fusr\u002Flocal\u002Finclude\u002Fphp -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fmain -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FTSRM -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FZend -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext\u002Fdate\u002Flib\"\nbuild\tCGO_CPPFLAGS=\"-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64\"\nbuild\tCGO_CXXFLAGS=\nbuild\tCGO_LDFLAGS=\"-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto\"\nbuild\tGOARCH=amd64\nbuild\tGOOS=linux\nbuild\tGOAMD64=v1\n\n```\n",{"part":885,"tag":943,"name":943,"publishedAt":944,"url":945,"body":946},"v2.0.0-alpha.49","2026-10-25T23:38:58Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.49","## [2.0.0-alpha.49](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.49) - 2026-10-25\n\n### Upgrade notes\n\n- **No bundle or module change:** api-components-bundle stays 2.0.0-alpha.37 and `@cwa\u002Fnuxt` 2.0.0-alpha.30.\n- **Delete `app\u002Fapp\u002Fpages\u002Flogin.vue`** unless you've changed it beyond its header: its banner tells every visitor the password is \"admin\", which isn't true for your site. Without the file, `\u002Flogin` is `@cwa\u002Fnuxt`'s own login page. New projects no longer get the file (the preview site keeps it). [779b578](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F779b578c34b953b2c5cb9b61f757d3da9009d0fc)\n- **Copy `api\u002Ffrankenphp\u002FCaddyfile`, and `api\u002Fsrc\u002FHttp\u002FVisitorIp.php` if you need the visitor's address** (#224, #225). A project that capped `Surrogate-Key` itself (a purger extending `SouinPurger`) removes it: `api_platform.yaml`'s purger goes back to `api_platform.http_cache.purger.souin` and its `services.php` entry goes. A project with its own `App\\Http\\VisitorIp` takes the template's, which keeps `of(Request): ?string`. [e8f8cdc](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe8f8cdc091a99bd9d3e7404cebd00b6d854da121)\n\n### Security\n\n- No new npm advisories (`pnpm audit`, 2026-10-25). Still accepted, none shipping in the server output: node-forge 1.4.0 (GHSA-86w9-cpqp-85rv, high), no fix released; postcss-selector-parser 6.0.10 (GHSA-rj75-hqrm-r3gf, moderate), pinned by @tailwindcss\u002Ftypography; esbuild 0.27.7 (GHSA-g7r4-m6w7-qqqr, low), via @nuxt\u002Ffonts.\n\n### Changed\n\n- **An empty commit no longer starts a GitLab pipeline**, a side effect of 2.0.0-alpha.48's Markdown-only rule: to rerun CI, use Run pipeline (Build → Pipelines) or the pipelines API instead of `git commit --allow-empty`. [d17d26a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd17d26a5b99be79e5c971e65f51024cb888eb0cb)\n- The create-cwa smoke job (template CI only) skips, instead of failing, on a release commit whose `cwa-php-base` isn't published yet: orange on GitLab, a warning on GitHub. Re-run it once `publish-php-base.yml` has pushed the image. [64e2c2a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F64e2c2abdcf0dd387576a0527ad6a6c2b48f7c44)\n\n### Added\n\n- **`App\\Http\\VisitorIp`** (#225): the visitor's address for per-visitor limits, inject it instead of trusting `getClientIp()` behind Cloudflare. Caddy passes the address its rate limit counts (`CF-Connecting-IP` only from Cloudflare's ranges, `CLOUDFLARE_IP_RANGES` and `CADDY_TRUSTED_PROXIES` honoured) as the `CWA_VISITOR_IP` server variable, which no request header can set. [e8f8cdc](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe8f8cdc091a99bd9d3e7404cebd00b6d854da121)\n\n### Fixed\n\n- **A large API collection no longer empties the sitemap** (#224): its `Surrogate-Key` (one tag per member: 184 KB for ~1,930 routes) passed Node's and curl's header limits. Caddy now removes the header from SSR's `\u002F_api` responses after Souin has stored the tags, so every purge stays exact; public hosts keep it and `Cache-Tag`. [e8f8cdc](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe8f8cdc091a99bd9d3e7404cebd00b6d854da121)\n\n### cwa-php-base 2.0.0-alpha.49\n\nPin it as `ghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.49@sha256:cb6d66e964b5f04e559e1c49fe385b56101bb5b1dfcab887aa2cc2623378e70a`.\n\nVerify it with:\n\n```sh\ngh attestation verify oci:\u002F\u002Fghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.49 --repo components-web-app\u002Fcomponents-web-app \\\n  --signer-workflow components-web-app\u002Fcomponents-web-app\u002F.github\u002Fworkflows\u002Fpublish-php-base.yml --source-ref refs\u002Ftags\u002Fv2.0.0-alpha.49\n```\n\n```\n# Base images (from the build provenance)\npkg:docker\u002Fcaddy@builder?platform=linux%2Famd64 sha256:c2fc374fd352439d76e1777b28d97d9f6d9c1dd86116db9227460374d46097d5\npkg:docker\u002Fcaddy@builder?platform=linux%2Farm64 sha256:c2fc374fd352439d76e1777b28d97d9f6d9c1dd86116db9227460374d46097d5\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:ae4f3b554449e7e25548e7d8ccc029d17357348e30c6e3df01b92bc93654d6a9\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:ae4f3b554449e7e25548e7d8ccc029d17357348e30c6e3df01b92bc93654d6a9\npkg:docker\u002Fdocker\u002Fdockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Famd64 sha256:6430fbce7a883edee38ed1781497272afff5c352e3bdb3996aec9dbf147324b2\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Farm64 sha256:6430fbce7a883edee38ed1781497272afff5c352e3bdb3996aec9dbf147324b2\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Famd64 sha256:73053ec45f0ad33c8e6f71f60ec3a11133899eecc73d7aa577b6d3a1ff5649c2\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Farm64 sha256:73053ec45f0ad33c8e6f71f60ec3a11133899eecc73d7aa577b6d3a1ff5649c2\n\nPHP 8.5.12 (cli) (built: Oct 21 2026 15:49:52) (ZTS)\nCopyright (c) The PHP Group\nBuilt by https:\u002F\u002Fgithub.com\u002Fdocker-library\u002Fphp\nZend Engine v4.5.12, Copyright (c) Zend Technologies\n    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies\n\n[PHP Modules]\napcu\nbrotli\nCore\nctype\ncurl\ndate\ndom\nexif\nFFI\nfileinfo\nfilter\ngd\nhash\niconv\nintl\njson\nlexbor\nlibxml\nmbstring\nmysqlnd\nopenssl\npcre\nPDO\npdo_pgsql\npdo_sqlite\nPhar\nposix\nrandom\nreadline\nReflection\nsession\nSimpleXML\nsodium\nSPL\nsqlite3\nstandard\ntokenizer\nuri\nxml\nxmlreader\nxmlwriter\nxsl\nZend OPcache\nzip\nzlib\n\n[Zend Modules]\nZend OPcache\n\n\ngo\tgo1.27.3\npath\tcaddy\nmod\tcaddy\t(devel)\t\ndep\tcel.dev\u002Fcel-go\tv0.32.0\th1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=\ndep\tcel.dev\u002Fexpr\tv0.25.3\th1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=\ndep\tcloud.google.com\u002Fgo\u002Fauth\tv0.24.1\th1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=\ndep\tcloud.google.com\u002Fgo\u002Fauth\u002Foauth2adapt\tv0.3.0\th1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=\ndep\tcloud.google.com\u002Fgo\u002Fcompute\u002Fmetadata\tv0.10.0\th1:pyKMUQSwchgkIBBJGdILqQbs\u002FBNJXqwSA7Ej6LAvvtY=\ndep\tdario.cat\u002Fmergo\tv1.0.2\th1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=\ndep\tfilippo.io\u002Fbigmod\tv0.1.0\th1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=\ndep\tfilippo.io\u002Fedwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=\ndep\tgithub.com\u002FBurntSushi\u002Ftoml\tv1.6.0\th1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=\ndep\tgithub.com\u002FDeRuina\u002Ftimberjack\tv1.4.9\th1:9RjDMSkUDQRYzwVNB\u002FFLonXNurcZVEh9sK43m2jw3A4=\ndep\tgithub.com\u002FKimMachineGun\u002Fautomemlimit\tv1.0.1\th1:87PowSIJFht5TmyyZKJNR4y2v7Cm9OdCzsSMR8jXJHM=\ndep\tgithub.com\u002FMasterminds\u002Fgoutils\tv1.1.1\th1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=\ndep\tgithub.com\u002FMasterminds\u002Fsemver\u002Fv3\tv3.5.0\th1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ\u002F2OOE=\ndep\tgithub.com\u002FMasterminds\u002Fsprig\u002Fv3\tv3.3.0\th1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=\ndep\tgithub.com\u002FMauriceGit\u002Fskiplist\tv0.0.0-20211105230623-77f5c8d3e145\th1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=\ndep\tgithub.com\u002FMicahParks\u002Fjwkset\tv0.11.3\th1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=\ndep\tgithub.com\u002FMicahParks\u002Fkeyfunc\u002Fv3\tv3.8.2\th1:eydEwk\u002FpBAVrDIpmFfB\u002FgkCcrp++xQ7YYXirrI2zlWE=\ndep\tgithub.com\u002FRoaringBitmap\u002Froaring\u002Fv2\tv2.30.0\th1:1sD4xsCenNd9n\u002FgOWaExCWanP9WTyiNuqLAvaDQ5jkY=\ndep\tgithub.com\u002Falecthomas\u002Fchroma\u002Fv2\tv2.27.0\th1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v\u002Fr5BXYZs=\ndep\tgithub.com\u002Fantlabs\u002Fstl\tv0.0.1\th1:TRD3csCrjREeLhLoQ\u002FsupaoCvFhNLBTNIwuRGrDIs6Q=\ndep\tgithub.com\u002Fantlabs\u002Ftimer\tv0.0.11\th1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=\ndep\tgithub.com\u002Fantlr4-go\u002Fantlr\u002Fv4\tv4.13.1\th1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=\ndep\tgithub.com\u002Faryann\u002Fdifflib\tv0.0.0-20210328193216-ff5ff6dc229b\th1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=\ndep\tgithub.com\u002Fbeorn7\u002Fperks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=\ndep\tgithub.com\u002Fbits-and-blooms\u002Fbitset\tv1.26.0\th1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=\ndep\tgithub.com\u002Fbwmarrin\u002Fsnowflake\tv0.3.0\th1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=\ndep\tgithub.com\u002Fcaddyserver\u002Fcaddy\u002Fv2\tv2.11.7\th1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=\ndep\tgithub.com\u002Fcaddyserver\u002Fcertmagic\tv0.25.6\th1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=\ndep\tgithub.com\u002Fcaddyserver\u002Fzerossl\tv0.1.6\th1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT\u002F4REW\u002F\u002Flsas=\ndep\tgithub.com\u002Fccoveille\u002Fgo-safecast\u002Fv2\tv2.0.1\th1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=\ndep\tgithub.com\u002Fcenkalti\u002Fbackoff\u002Fv5\tv5.0.3\th1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=\ndep\tgithub.com\u002Fcespare\u002Fxxhash\u002Fv2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=\ndep\tgithub.com\u002Fchzyer\u002Freadline\tv1.5.1\th1:upd\u002F6fQk4src78LMRzh5vItIt361\u002Fo4uq553V8B5sGI=\ndep\tgithub.com\u002Fcloudflare\u002Fcircl\tv1.6.5\th1:O64F26HEqNhznd\u002FhrC5KZXVKYuKM2rx4deZDTc4ihQA=\ndep\tgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fapi\u002Ffrankenphp\u002Fcaddy\u002Fqueryallowlist\tv0.0.0-20261025232455-013e1be6265f\n=>\t\u002Ftmp\u002Fqueryallowlist\t(devel)\t\n\ndep\tgithub.com\u002Fcoreos\u002Fgo-oidc\u002Fv3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=\ndep\tgithub.com\u002Fcpuguy83\u002Fgo-md2man\u002Fv2\tv2.0.7\th1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\tv1.7.9\n=>\t\u002Ftmp\u002Fsouin\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\u002Fplugins\u002Fcaddy\tv1.7.9\th1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\tv0.0.21\th1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M\u002FJRc+zhN7Wsx0=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\u002Fcaddy\tv0.0.22\th1:4\u002FbyA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fcore\tv0.0.21\th1:zfa0Bqzdm9\u002FoPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\tv0.0.22\n=>\t\u002Ftmp\u002Fstorages-go-redis\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\u002Fcaddy\tv0.0.22\th1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\tv0.0.21\th1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\u002Fcaddy\tv0.0.22\th1:kg\u002FHYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\tv0.0.21\th1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\u002Fcaddy\tv0.0.22\th1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=\ndep\tgithub.com\u002Fdgraph-io\u002Fbadger\u002Fv4\tv4.9.1\th1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=\ndep\tgithub.com\u002Fdgraph-io\u002Fristretto\u002Fv2\tv2.2.0\th1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=\ndep\tgithub.com\u002Fdgryski\u002Fgo-rendezvous\tv0.0.0-20200823014737-9f7001d12a5f\th1:lO4WD4F\u002FrVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=\ndep\tgithub.com\u002Fdlclark\u002Fregexp2\u002Fv2\tv2.9.1\th1:q6bZW\u002FNN9VodqMjYXpuic2lZxdHPfFTzGS+MJxIJmKQ=\ndep\tgithub.com\u002Fdolthub\u002Fmaphash\tv0.1.0\th1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L\u002FQxPDyQ=\ndep\tgithub.com\u002Fdunglas\u002Fcaddy-cbrotli\tv1.0.1\th1:mkg7EB1GmoyfBt3kY3mq4o\u002F0bfnBeq7ZLQjmVmdBE3Y=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\tv1.13.3\th1:9fZki1cGNs2AOaj6r0PRnRmXsvv7IyfZNRr+3sMA7qA=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\u002Fcaddy\tv1.13.3\th1:bUF55dsLbDHyA\u002Ff77FVbhXzg1RC6jgMOqFZ2BOmMBVs=\ndep\tgithub.com\u002Fdunglas\u002Fgo-urlpattern\tv1.0.0\th1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=\ndep\tgithub.com\u002Fdunglas\u002Fhttpsfv\tv1.1.2\th1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ\u002FDkmc=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\tv1.1.5\th1:SlEUgMTiQst0zhx4HlPKuo95GRZM6bHCrxH1Me7jQ4M=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\u002Fcaddy\tv1.1.5\th1:Rl1Xh55YwZkFisNnlEZNLpLDL97bfdePSktcbhNb\u002FRU=\ndep\tgithub.com\u002Fdunglas\u002Fskipfilter\tv1.2.0\th1:J7\u002FRXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\tv1.4.5\th1:vO7CS3\u002FKwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\u002Fcaddy\tv1.4.5\th1:2qzg18nEkpsc1QIvpNn\u002FoztSHRxY1\u002FG6xuxylxVobGY=\ndep\tgithub.com\u002Fdustin\u002Fgo-humanize\tv1.1.0\th1:dbKTrvD0klcbBV\u002Fh4AWJdMuZogJACoMlvWIWZ5b2xWg=\ndep\tgithub.com\u002Fe-dant\u002Fwatcher\tv0.0.0-20260223030516-06f84a1314be\th1:vqHrvilasyJcnru\u002F0Z4FoojsQJUIfXGVplte7JtupfY=\ndep\tgithub.com\u002Felnormous\u002Fcontenttype\tv1.0.4\th1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=\ndep\tgithub.com\u002Ffelixge\u002Fhttpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw\u002FQDuVfpNhoA31zeORc=\ndep\tgithub.com\u002Ffxamacker\u002Fcbor\u002Fv2\tv2.9.6\th1:NHZPxuUjJXQjX9itA785y\u002F5NKSlI4HQ+S7noZsmI7hs=\ndep\tgithub.com\u002Fgammazero\u002Fdeque\tv0.2.1\th1:qSdsbG6pgp6nL7A0+K\u002FB7s12mcCY\u002F5l5SIUpMOl+dC0=\ndep\tgithub.com\u002Fgetkin\u002Fkin-openapi\tv0.152.0\th1:XRVo77lMRyOGMHf1paMu9lxX3wzuQDZeprssZJnz\u002Fx8=\ndep\tgithub.com\u002Fgo-chi\u002Fchi\u002Fv5\tv5.5.0\th1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv3\tv3.0.5\th1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv4\tv4.1.6\th1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=\ndep\tgithub.com\u002Fgo-logr\u002Flogr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg\u002F+cPVcbP\u002F8=\ndep\tgithub.com\u002Fgo-logr\u002Fstdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=\ndep\tgithub.com\u002Fgo-openapi\u002Fjsonpointer\tv1.0.2\th1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=\ndep\tgithub.com\u002Fgofrs\u002Fflock\tv0.13.0\th1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ\u002FA8dRYMzw=\ndep\tgithub.com\u002Fgofrs\u002Fuuid\tv4.4.0+incompatible\th1:3qXRTX8\u002FNbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=\ndep\tgithub.com\u002Fgolang-jwt\u002Fjwt\u002Fv5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=\ndep\tgithub.com\u002Fgoogle\u002Fbrotli\u002Fgo\u002Fcbrotli\tv1.1.0\th1:YwHD\u002FrwSgUSL4b2S3ZM2jnNymm+tmwKQqjUIC63nmHU=\ndep\tgithub.com\u002Fgoogle\u002Fcertificate-transparency-go\tv1.4.0\th1:78uNaR2knzCoKKXXDSAGVkz9XPkDg5xXJRP9tP6+rr0=\ndep\tgithub.com\u002Fgoogle\u002Fflatbuffers\tv25.2.10+incompatible\th1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H\u002FpNX4FP1v0Q=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tpm\tv0.9.8\th1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tspi\tv0.3.0\th1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=\ndep\tgithub.com\u002Fgoogle\u002Fs2a-go\tv0.1.11\th1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=\ndep\tgithub.com\u002Fgoogle\u002Fuuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=\ndep\tgithub.com\u002Fgoogleapis\u002Fenterprise-certificate-proxy\tv0.3.24\th1:G9iCJIY+AYVmUskKdjX8FVy7sG+nbzjOQ41cvlmhcvg=\ndep\tgithub.com\u002Fgoogleapis\u002Fgax-go\u002Fv2\tv2.27.0\th1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc\u002FRRZhKA\u002F2g0=\ndep\tgithub.com\u002Fgorilla\u002Fhandlers\tv1.5.2\th1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=\ndep\tgithub.com\u002Fgorilla\u002Fmux\tv1.8.1\th1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=\ndep\tgithub.com\u002Fgrpc-ecosystem\u002Fgrpc-gateway\u002Fv2\tv2.32.0\th1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=\ndep\tgithub.com\u002Fhuandu\u002Fxstrings\tv1.6.3\th1:7997PcI0mYC9uPNBJ7udg\u002FKrdJh1GhJid8f2tzKFHYQ=\ndep\tgithub.com\u002Fklauspost\u002Fcompress\tv1.20.3\th1:zWNoFqq\u002FlSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=\ndep\tgithub.com\u002Fklauspost\u002Fcpuid\u002Fv2\tv2.4.1\th1:I9KxadAkvo+QjtcEE2f2tyfEvmIla\u002FT0m+14PrZNl0U=\ndep\tgithub.com\u002Flibdns\u002Flibdns\tv1.1.1\th1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS\u002FP\u002FU=\ndep\tgithub.com\u002Fmanifoldco\u002Fpromptui\tv0.9.0\th1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=\ndep\tgithub.com\u002Fmattn\u002Fgo-colorable\tv0.1.16\th1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=\ndep\tgithub.com\u002Fmattn\u002Fgo-isatty\tv0.0.24\th1:tGZZoVgT\u002FKiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\tv1.2.4\th1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\u002Fv2\tv2.4.0\th1:1XpRRWaq9DRIqZV7UtglS4VLzYKSsnFOQmzV+KZxLb0=\ndep\tgithub.com\u002Fmgutz\u002Fansi\tv0.0.0-20200706080929-d51e80ef957d\th1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=\ndep\tgithub.com\u002Fmholt\u002Facmez\u002Fv3\tv3.1.7\th1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=\ndep\tgithub.com\u002Fmholt\u002Fcaddy-ratelimit\tv0.1.0\th1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=\ndep\tgithub.com\u002Fmiekg\u002Fdns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=\ndep\tgithub.com\u002Fmitchellh\u002Fcopystructure\tv1.2.0\th1:vpKXTN4ewci03Vljg\u002Fq9QvCGUDttBOGBIa15WveJJGw=\ndep\tgithub.com\u002Fmitchellh\u002Fgo-ps\tv1.0.0\th1:i6ampVEEF4wQFF+bkYfwYgY+F\u002FuYJDktmvLPf7qIgjc=\ndep\tgithub.com\u002Fmitchellh\u002Freflectwalk\tv1.0.2\th1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=\ndep\tgithub.com\u002Fmunnerz\u002Fgoautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01\u002FOq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=\ndep\tgithub.com\u002Fnlnwa\u002Fwhatwg-url\tv0.6.2\th1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ\u002FQ=\ndep\tgithub.com\u002Fnutsdb\u002Fnutsdb\tv1.0.4\th1:BurzkxijXJY1\u002FAkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=\ndep\tgithub.com\u002Foasdiff\u002Fyaml\tv0.1.1\th1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=\ndep\tgithub.com\u002Foasdiff\u002Fyaml3\tv0.0.14\th1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=\ndep\tgithub.com\u002Fpbnjay\u002Fmemory\tv0.0.0-20210728143218-7b4eea64cf58\th1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=\ndep\tgithub.com\u002Fpierrec\u002Flz4\u002Fv4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=\ndep\tgithub.com\u002Fpires\u002Fgo-proxyproto\tv0.16.0\th1:9KYT\u002FfM3wpjT8bdMEj\u002F7FBcoiUG1KyzEjRYnPu+vz7A=\ndep\tgithub.com\u002Fpkg\u002Ferrors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=\ndep\tgithub.com\u002Fpquerna\u002Fcachecontrol\tv0.2.0\th1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=\ndep\tgithub.com\u002Fprometheus\u002Fclient_golang\tv1.25.0\th1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=\ndep\tgithub.com\u002Fprometheus\u002Fclient_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=\ndep\tgithub.com\u002Fprometheus\u002Fcommon\tv0.72.1\th1:ZAiQed\u002Fnk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=\ndep\tgithub.com\u002Fprometheus\u002Fotlptranslator\tv1.0.0\th1:s0LJW\u002FiN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=\ndep\tgithub.com\u002Fprometheus\u002Fprocfs\tv0.23.0\th1:ad+S6FTkzwaMgacKLM5h6bNKExS+DMH0YiUwXItH\u002Fo4=\ndep\tgithub.com\u002Fquic-go\u002Fqpack\tv0.6.0\th1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=\ndep\tgithub.com\u002Fquic-go\u002Fquic-go\tv0.64.1\th1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=\ndep\tgithub.com\u002Fredis\u002Fgo-redis\u002Fv9\tv9.18.0\th1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=\ndep\tgithub.com\u002Frs\u002Fcors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=\ndep\tgithub.com\u002Frs\u002Fxid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=\ndep\tgithub.com\u002Frussross\u002Fblackfriday\u002Fv2\tv2.1.0\th1:JIOH55\u002F0cWyOuilr9\u002Fqlrm0BSXldqnqwMsf35Ld67mk=\ndep\tgithub.com\u002Fsanthosh-tekuri\u002Fjsonschema\u002Fv6\tv6.0.3\th1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls\u002F28=\ndep\tgithub.com\u002Fshopspring\u002Fdecimal\tv1.6.0\th1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=\ndep\tgithub.com\u002FshurcooL\u002Fsanitized_anchor_name\tv1.0.0\th1:PdmoCO6wvbs+7yrJyMORt4\u002FBmY5IYyJwS\u002FkOiWx8mHo=\ndep\tgithub.com\u002Fsirupsen\u002Flogrus\tv1.10.2\th1:G2SED73\u002FqrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=\ndep\tgithub.com\u002Fslackhq\u002Fnebula\tv1.11.2\th1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=\ndep\tgithub.com\u002Fsmallstep\u002Fcertificates\tv0.30.2\th1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf\u002FiQtA5QlN0Y=\ndep\tgithub.com\u002Fsmallstep\u002Fcli-utils\tv0.12.2\th1:lGzM9PJrH\u002FqawbzMC\u002Fs2SvgLdJPKDWKwKzx9doCVO+k=\ndep\tgithub.com\u002Fsmallstep\u002Fgo-attestation\tv0.4.9\th1:\u002FfVmzB8A8tk7B2PCGPlszWzyl\u002FGDcEQbynqcg2PMaZ0=\ndep\tgithub.com\u002Fsmallstep\u002Flinkedca\tv0.26.0\th1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=\ndep\tgithub.com\u002Fsmallstep\u002Fnosql\tv0.8.0\th1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli\u002FXB4Jp4A=\ndep\tgithub.com\u002Fsmallstep\u002Fpkcs7\tv0.2.3\th1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=\ndep\tgithub.com\u002Fsmallstep\u002Fscep\tv0.0.0-20261014185058-63893dadfda8\th1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=\ndep\tgithub.com\u002Fsmallstep\u002Ftruststore\tv0.13.0\th1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi\u002Fpy4=\ndep\tgithub.com\u002Fspf13\u002Fcast\tv1.10.0\th1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=\ndep\tgithub.com\u002Fspf13\u002Fcobra\tv1.10.2\th1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=\ndep\tgithub.com\u002Fspf13\u002Fpflag\tv1.0.10\th1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=\ndep\tgithub.com\u002Ftailscale\u002Ftscert\tv0.0.0-20251216020129-aea342f6d747\th1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=\ndep\tgithub.com\u002Ftidwall\u002Fbtree\tv1.6.0\th1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=\ndep\tgithub.com\u002Funrolled\u002Fsecure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=\ndep\tgithub.com\u002Furfave\u002Fcli\tv1.22.17\th1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=\ndep\tgithub.com\u002Fx448\u002Ffloat16\tv0.8.4\th1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=\ndep\tgithub.com\u002Fxujiajun\u002Fmmap-go\tv1.0.1\th1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv\u002FWHc=\ndep\tgithub.com\u002Fxujiajun\u002Futils\tv0.0.0-20220904132955-5f7c5b914235\th1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark\tv1.8.6\th1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark-highlighting\u002Fv2\tv2.0.0-20230729083705-37449abec8cc\th1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=\ndep\tgithub.com\u002Fzeebo\u002Fblake3\tv0.2.4\th1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM\u002FyBqhaZI=\ndep\tgo.etcd.io\u002Fbbolt\tv1.5.0\th1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P\u002FbD4lxU=\ndep\tgo.opentelemetry.io\u002Fauto\u002Fsdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ\u002FipaZ64=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fbridges\u002Fprometheus\tv0.72.0\th1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w\u002F1ROwHEM7M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fexporters\u002Fautoexport\tv0.72.0\th1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Finstrumentation\u002Fnet\u002Fhttp\u002Fotelhttp\tv0.72.0\th1:LxwW\u002F9ctSCv+QkE\u002FcLR7M91ZIkXNMqJtEMi1vCw9U8s=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fautoprop\tv0.72.0\th1:\u002FKv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Faws\tv1.47.0\th1:n\u002F2x\u002FvQki1ojD7R2jYHdnNdI74Yx\u002FOFdY4YXFFesm8M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fb3\tv1.47.0\th1:vlKDmtjhe1R0d7kdov\u002F+KVTKWOKeGLyohB+iXoDPRMQ=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fjaeger\tv1.47.0\th1:2lDw6AKPV33\u002F7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fot\tv1.47.0\th1:nZUqh0\u002F8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=\ndep\tgo.opentelemetry.io\u002Fotel\tv1.47.0\th1:j7ALJ\u002FzgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploggrpc\tv0.23.0\th1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploghttp\tv0.23.0\th1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI\u002FnE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetricgrpc\tv1.47.0\th1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetrichttp\tv1.47.0\th1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\tv1.47.0\th1:julhjPeUH\u002Fq\u002F7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracegrpc\tv1.47.0\th1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracehttp\tv1.47.0\th1:aXZXsZ012wOgVkqaiQv+Z\u002Fd8V0xKjmg70F6m4CE94lc=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fprometheus\tv0.69.0\th1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutlog\tv0.23.0\th1:PW\u002FE9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutmetric\tv1.47.0\th1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdouttrace\tv1.47.0\th1:N3YQCxjxQ\u002FbMjyc3heladfRm9t9RTksGQH8z4w6yU\u002F0=\ndep\tgo.opentelemetry.io\u002Fotel\u002Flog\tv1.47.0\th1:cOTS1CcLbSQeZKanGJ+0JpF\u002F+t4PELi3O3bbl2lqCcI=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fmetric\tv1.47.0\th1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\tv1.47.0\th1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Flog\tv1.47.0\th1:W4N\u002FZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Fmetric\tv1.47.0\th1:lfISg2j93VT6yqdk9OfUaZmw\u002FGfcZqCCV3jdXtsPnKw=\ndep\tgo.opentelemetry.io\u002Fotel\u002Ftrace\tv1.47.0\th1:JOjX\u002FOci8K94QHddo+bbfya\u002FAi\u002Fnf6\u002Fdt9ZfrFNWSrM=\ndep\tgo.opentelemetry.io\u002Fproto\u002Fotlp\tv1.11.1\th1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=\ndep\tgo.step.sm\u002Fcrypto\tv0.91.0\th1:0mN0DwVOvUuh7VbyTnxABZuAkxwak\u002FGrp8Y\u002Fb4YaZDU=\ndep\tgo.uber.org\u002Fatomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp\u002FAUETXlHW0DxSjE=\ndep\tgo.uber.org\u002Fautomaxprocs\tv1.6.0\th1:O3y2\u002FQNTOdbF+e\u002FdpXNNW7Rx2hZ4sTIPyybbxyNqTUs=\ndep\tgo.uber.org\u002Fmultierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=\ndep\tgo.uber.org\u002Fzap\tv1.28.0\th1:IZzaP1Fv73\u002FT\u002FpBMLk4VutPl36uNC+OSUh3JLG3FIjo=\ndep\tgo.uber.org\u002Fzap\u002Fexp\tv0.3.0\th1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=\ndep\tgo.yaml.in\u002Fyaml\u002Fv3\tv3.0.5\th1:N6y\u002FpJk8buWs9NY5ERU2HSMfm+IuD\u002FOtfdAnq6kESPw=\ndep\tgolang.org\u002Fx\u002Fcrypto\tv0.58.0\th1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K\u002FM\u002F54=\ndep\tgolang.org\u002Fx\u002Fcrypto\u002Fx509roots\u002Ffallback\tv0.0.0-20261020153306-9f2b28d4331a\th1:V5oicZXS0oqZx30gY\u002FapgSVD7YvNBfrIOdcMnlelJY4=\ndep\tgolang.org\u002Fx\u002Fexp\tv0.0.0-20261014143641-f0251eb4aa3e\th1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI\u002FA=\ndep\tgolang.org\u002Fx\u002Fnet\tv0.61.0\th1:RR+6j\u002FBTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=\ndep\tgolang.org\u002Fx\u002Foauth2\tv0.37.0\th1:JUlcxA8oAtauLfiH8FX2\u002FFkAWHAdi0QtGCGc+hofE98=\ndep\tgolang.org\u002Fx\u002Fsync\tv0.24.0\th1:iqiDrGoDgyuvAKrhLQthUEzU\u002FR378N78gXbBjxed7oA=\ndep\tgolang.org\u002Fx\u002Fsys\tv0.49.0\th1:XbzkgYJHdqh\u002F8m2Uu0W\u002FdQv8nktxx4BFHp1M0gROTXA=\ndep\tgolang.org\u002Fx\u002Fterm\tv0.47.0\th1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ\u002FBM=\ndep\tgolang.org\u002Fx\u002Ftext\tv0.43.0\th1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5\u002FUGUTJVXoWc=\ndep\tgolang.org\u002Fx\u002Ftime\tv0.16.0\th1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q\u002F6gY2hDM6VDE=\ndep\tgoogle.golang.org\u002Fapi\tv0.308.0\th1:iGb+4qT3nVb3uuIzwor3yP2nyu+rMZr31PvLFiRNJQk=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Fapi\tv0.0.0-20261019180522-ce908d29299b\th1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Frpc\tv0.0.0-20261019180522-ce908d29299b\th1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=\ndep\tgoogle.golang.org\u002Fgrpc\tv1.84.0\th1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=\ndep\tgoogle.golang.org\u002Fprotobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o\u002Ffwxc=\ndep\tgopkg.in\u002Fyaml.v3\tv3.0.1\th1:fxVm\u002FGzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=\nbuild\t-buildmode=exe\nbuild\t-compiler=gc\nbuild\t-ldflags=\"-w -s\"\nbuild\t-tags=nobadger,nomysql,nopgx\nbuild\tCGO_ENABLED=1\nbuild\tCGO_CFLAGS=\"-I\u002Fusr\u002Flocal\u002Finclude\u002Fphp -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fmain -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FTSRM -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FZend -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext\u002Fdate\u002Flib\"\nbuild\tCGO_CPPFLAGS=\"-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64\"\nbuild\tCGO_CXXFLAGS=\nbuild\tCGO_LDFLAGS=\"-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto\"\nbuild\tGOARCH=amd64\nbuild\tGOOS=linux\nbuild\tGOAMD64=v1\n\n```\n",{"part":885,"tag":948,"name":948,"publishedAt":949,"url":950,"body":951},"v2.0.0-alpha.48","2026-10-24T10:55:29Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.48","## [2.0.0-alpha.48](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.48) - 2026-10-24\n\n### Upgrade notes\n\n- **No bundle or module change:** api-components-bundle stays 2.0.0-alpha.37 and `@cwa\u002Fnuxt` 2.0.0-alpha.30.\n- **Review apps' TLS secrets are now per release** (#221): `letsencrypt-cert-\u003Crelease>-api`. Each review app issues its own certificate on its next deploy; once every review app in a shared namespace has redeployed, delete the old shared secret by hand (`kubectl delete secret letsencrypt-cert-review-api -n \u003Creview namespace>`). A `CWA_CI_TLS_SECRET_NAME` set per branch as a workaround can go. [64d7152](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F64d71523c2a42d8995eafbc13e387adafa7c9964)\n- **Media storage is chosen at runtime by `MEDIA_STORAGE`** (`local` or `gcloud`, #211), so copy `api\u002Fconfig\u002Fservices.php` with the new `api\u002Fsrc\u002FFlysystem\u002FMediaAdapterFactory.php` and `MediaUrlEnvVarProcessor.php`. Kubernetes deploys keep Cloud Storage (the prod default is `gcloud`) and need nothing else. A single-server site already using a bucket with `compose.prod.yaml` sets `MEDIA_STORAGE=gcloud`, because the file now defaults to `local`. A project that edited the storage block of `services.php` merges its change into the new wiring. [f6b8fe8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff6b8fe8f2b2a156577f401bc0a5756c151fe1706)\n- **`bin\u002Fdevops\u002Fk8s.sh` now sources `bin\u002Flib\u002Fsite.sh`** (the sitemap and page-cache warm moved there, #212): copy both, or every deploy fails at its first line. A project with its own `stop review` job adds `bin\u002Flib` to that job's sparse checkout, as `.gitlab-ci.yml` does. [8b4b3e9](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8b4b3e987cd863c8e8692cbc4fcd1e6cf15ac32e)\n- `api\u002Ffrankenphp\u002FCaddyfile` changed (`\u002Fuploads` is static only); copy it. [f6b8fe8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff6b8fe8f2b2a156577f401bc0a5756c151fe1706)\n\n### Security\n\n- **fast-uri 3.1.9 and serialize-javascript 7.1.4** clear GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h, GHSA-333x-w4r6-6crp and GHSA-m5mm-p8h7-m29v (both build-only). The withdrawn braces advisory GHSA-vfj7-8cjw-p6xm leaves `app\u002Fpnpm-workspace.yaml`'s accepted register; still accepted at this release (reviewed 2026-10-24), none shipping in the server output: node-forge 1.4.0 (GHSA-86w9-cpqp-85rv, high), no fix released; postcss-selector-parser 6.0.10 (GHSA-rj75-hqrm-r3gf, moderate), pinned by @tailwindcss\u002Ftypography; esbuild 0.27.7 (GHSA-g7r4-m6w7-qqqr, low), via @nuxt\u002Ffonts. Projects take `app\u002Fpnpm-lock.yaml` and `app\u002Fpnpm-workspace.yaml`. [f204977](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff204977568a1bbef0fd4ce6ebc9baeb62d172939)\n- **`\u002Fuploads` is served as files only, never run as PHP** (#211). The bundle keeps an upload's own extension when it can't tell the type, so a stored `.php` under `public\u002Fuploads` (dev's media folder, and now single-server production's) would have run. [f6b8fe8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff6b8fe8f2b2a156577f401bc0a5756c151fe1706)\n\n### Changed\n\n- **A deploy restarts pods only when their image or settings changed:** the per-deploy `timestamp` pod annotation is gone (the chart's checksum annotations already roll pods on a ConfigMap, Secret or site-settings change). To restart on purpose, `kubectl rollout restart` or `CWA_CI_BUILD_FORCE=\"true\"`. [29d26a2](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F29d26a26f44b63f07890670ce4085dc7fad88772)\n- **An unchanged image isn't built again:** `build api`\u002F`build app` label each image with a hash of its build context's git tree, build options and the ISO week, and reuse the branch's (or default branch's) image when it matches, so the job takes seconds and the deploy keeps the same digest and doesn't restart those pods. Base images still reach a build at least weekly; `CWA_CI_BUILD_FORCE=\"true\"` always builds. The first build after taking this always builds (no label yet). [d17d26a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd17d26a5b99be79e5c971e65f51024cb888eb0cb)\n- **GitLab's build jobs no longer install helm and kubectl**, which they never use (`install_build_dependencies`). [fa8c9bd](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ffa8c9bde77fc6aecc5873def00564a6fdf2f8f3e)\n- **A push that changes only Markdown files at the root (CHANGELOG.md, README.md, …) runs no pipeline**, on GitLab (`workflow:rules`) and GitHub (`paths-ignore`). [d17d26a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd17d26a5b99be79e5c971e65f51024cb888eb0cb)\n- The create-cwa smoke job runs on `main` only when its paths change, like other branches (template CI only). [d17d26a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd17d26a5b99be79e5c971e65f51024cb888eb0cb)\n\n### Added\n\n- **Single-server scripts** (#212): `bin\u002Fserver\u002Finit` writes `.env.prod` (random secrets, a JWT key pair, the host and mail relay); `deploy.sh [--fixtures]` builds, backs up before pending migrations, starts the front end then the API, purges rendered HTML, warms `\u002F_api`, generates image variants in memory-capped one-off containers and warms the sitemap; `backup.sh` keeps the newest 5 database dumps with media and Caddy's certificates in `backups\u002F`; `restore.sh` puts one back under maintenance mode; `cron.example` has the daily backup and orphan scan. Template CI's `server scripts` job runs them end to end. Single-server stays a preview until they've run a production site. [8b4b3e9](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8b4b3e987cd863c8e8692cbc4fcd1e6cf15ac32e)\n- **Single-server production stores media on the server** (#211): `compose.prod.yaml` keeps uploads in a `media_data` volume, served at `https:\u002F\u002F\u003CSITE_HOST>\u002Fuploads\u002F`, and no longer needs a Cloud Storage bucket. The browser tests upload an image and check it and its WebP variants are served, before and after php is recreated (local storage, or `CWA_CI_E2E_STORAGE=\"gcloud\"`). Dev media URLs are now `https:\u002F\u002Flocalhost\u002Fuploads\u002F…` too. [f6b8fe8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff6b8fe8f2b2a156577f401bc0a5756c151fe1706)\n- **`create-cwa` runs unattended:** `--yes` takes every default, `--ci` never prompts (a missing project name is an error, a failed `bin\u002Fup` exits 1), `--template-dir \u003Cpath>` copies a local checkout instead of downloading, and `--pipeline`, `--features`, `--[no-]fixtures`, `--[no-]start` and `--[no-]install-deps` answer their questions. Without flags nothing changes (#215). [24c09d3](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F24c09d3dfdf3d0e2b8d21d1e9a4386ecdd890f2f)\n- **create-cwa smoke job** (template CI only, GitHub and GitLab): creates a project from the pushed ref, starts it through `bin\u002Fup` and signs in, with all features and with none (#215). [593ce7a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F593ce7adcc2f7e895a698d27f169166a020760c9)\n\n### Fixed\n\n- The TipTap editor's bubble and floating menus show again once a component is selected (#222): they stayed on the editor `build()` replaces. Projects copy `app\u002Fapp\u002Fcomponents\u002FTipTapHtmlEditor.vue`. [e82eb69](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe82eb69a14c6ea5bf7fd3ba0641c50613e5931e6)\n- The browser tests no longer fail in a project created without the image feature: `e2e\u002Frun.sh` skips its upload check when there's no `Image` component. [259055c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F259055ccd1282ccc271722b4822978eddd830479)\n- Review apps sharing a namespace no longer share one TLS Certificate, which only the newest app's host matched and which stopping any of them deleted (#221). [64d7152](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F64d71523c2a42d8995eafbc13e387adafa7c9964)\n\n### cwa-php-base 2.0.0-alpha.48\n\nPin it as `ghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.48@sha256:567a4d38c60e7f6fc279be69d485d5008c46c0a2ca976d396e81a696d16c262f`.\n\nVerify it with:\n\n```sh\ngh attestation verify oci:\u002F\u002Fghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.48 --repo components-web-app\u002Fcomponents-web-app \\\n  --signer-workflow components-web-app\u002Fcomponents-web-app\u002F.github\u002Fworkflows\u002Fpublish-php-base.yml --source-ref refs\u002Ftags\u002Fv2.0.0-alpha.48\n```\n\n```\n# Base images (from the build provenance)\npkg:docker\u002Fcaddy@builder?platform=linux%2Famd64 sha256:c2fc374fd352439d76e1777b28d97d9f6d9c1dd86116db9227460374d46097d5\npkg:docker\u002Fcaddy@builder?platform=linux%2Farm64 sha256:c2fc374fd352439d76e1777b28d97d9f6d9c1dd86116db9227460374d46097d5\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:ae4f3b554449e7e25548e7d8ccc029d17357348e30c6e3df01b92bc93654d6a9\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:ae4f3b554449e7e25548e7d8ccc029d17357348e30c6e3df01b92bc93654d6a9\npkg:docker\u002Fdocker\u002Fdockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Famd64 sha256:6430fbce7a883edee38ed1781497272afff5c352e3bdb3996aec9dbf147324b2\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Farm64 sha256:6430fbce7a883edee38ed1781497272afff5c352e3bdb3996aec9dbf147324b2\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Famd64 sha256:73053ec45f0ad33c8e6f71f60ec3a11133899eecc73d7aa577b6d3a1ff5649c2\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Farm64 sha256:73053ec45f0ad33c8e6f71f60ec3a11133899eecc73d7aa577b6d3a1ff5649c2\n\nPHP 8.5.12 (cli) (built: Oct 21 2026 15:49:52) (ZTS)\nCopyright (c) The PHP Group\nBuilt by https:\u002F\u002Fgithub.com\u002Fdocker-library\u002Fphp\nZend Engine v4.5.12, Copyright (c) Zend Technologies\n    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies\n\n[PHP Modules]\napcu\nbrotli\nCore\nctype\ncurl\ndate\ndom\nexif\nFFI\nfileinfo\nfilter\ngd\nhash\niconv\nintl\njson\nlexbor\nlibxml\nmbstring\nmysqlnd\nopenssl\npcre\nPDO\npdo_pgsql\npdo_sqlite\nPhar\nposix\nrandom\nreadline\nReflection\nsession\nSimpleXML\nsodium\nSPL\nsqlite3\nstandard\ntokenizer\nuri\nxml\nxmlreader\nxmlwriter\nxsl\nZend OPcache\nzip\nzlib\n\n[Zend Modules]\nZend OPcache\n\n\ngo\tgo1.27.3\npath\tcaddy\nmod\tcaddy\t(devel)\t\ndep\tcel.dev\u002Fcel-go\tv0.32.0\th1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=\ndep\tcel.dev\u002Fexpr\tv0.25.3\th1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=\ndep\tcloud.google.com\u002Fgo\u002Fauth\tv0.24.1\th1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=\ndep\tcloud.google.com\u002Fgo\u002Fauth\u002Foauth2adapt\tv0.3.0\th1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=\ndep\tcloud.google.com\u002Fgo\u002Fcompute\u002Fmetadata\tv0.10.0\th1:pyKMUQSwchgkIBBJGdILqQbs\u002FBNJXqwSA7Ej6LAvvtY=\ndep\tdario.cat\u002Fmergo\tv1.0.2\th1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=\ndep\tfilippo.io\u002Fbigmod\tv0.1.0\th1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=\ndep\tfilippo.io\u002Fedwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=\ndep\tgithub.com\u002FBurntSushi\u002Ftoml\tv1.6.0\th1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=\ndep\tgithub.com\u002FDeRuina\u002Ftimberjack\tv1.4.9\th1:9RjDMSkUDQRYzwVNB\u002FFLonXNurcZVEh9sK43m2jw3A4=\ndep\tgithub.com\u002FKimMachineGun\u002Fautomemlimit\tv1.0.1\th1:87PowSIJFht5TmyyZKJNR4y2v7Cm9OdCzsSMR8jXJHM=\ndep\tgithub.com\u002FMasterminds\u002Fgoutils\tv1.1.1\th1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=\ndep\tgithub.com\u002FMasterminds\u002Fsemver\u002Fv3\tv3.5.0\th1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ\u002F2OOE=\ndep\tgithub.com\u002FMasterminds\u002Fsprig\u002Fv3\tv3.3.0\th1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=\ndep\tgithub.com\u002FMauriceGit\u002Fskiplist\tv0.0.0-20211105230623-77f5c8d3e145\th1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=\ndep\tgithub.com\u002FMicahParks\u002Fjwkset\tv0.11.3\th1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=\ndep\tgithub.com\u002FMicahParks\u002Fkeyfunc\u002Fv3\tv3.8.2\th1:eydEwk\u002FpBAVrDIpmFfB\u002FgkCcrp++xQ7YYXirrI2zlWE=\ndep\tgithub.com\u002FRoaringBitmap\u002Froaring\u002Fv2\tv2.30.0\th1:1sD4xsCenNd9n\u002FgOWaExCWanP9WTyiNuqLAvaDQ5jkY=\ndep\tgithub.com\u002Falecthomas\u002Fchroma\u002Fv2\tv2.27.0\th1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v\u002Fr5BXYZs=\ndep\tgithub.com\u002Fantlabs\u002Fstl\tv0.0.1\th1:TRD3csCrjREeLhLoQ\u002FsupaoCvFhNLBTNIwuRGrDIs6Q=\ndep\tgithub.com\u002Fantlabs\u002Ftimer\tv0.0.11\th1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=\ndep\tgithub.com\u002Fantlr4-go\u002Fantlr\u002Fv4\tv4.13.1\th1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=\ndep\tgithub.com\u002Faryann\u002Fdifflib\tv0.0.0-20210328193216-ff5ff6dc229b\th1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=\ndep\tgithub.com\u002Fbeorn7\u002Fperks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=\ndep\tgithub.com\u002Fbits-and-blooms\u002Fbitset\tv1.26.0\th1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=\ndep\tgithub.com\u002Fbwmarrin\u002Fsnowflake\tv0.3.0\th1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=\ndep\tgithub.com\u002Fcaddyserver\u002Fcaddy\u002Fv2\tv2.11.7\th1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=\ndep\tgithub.com\u002Fcaddyserver\u002Fcertmagic\tv0.25.6\th1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=\ndep\tgithub.com\u002Fcaddyserver\u002Fzerossl\tv0.1.6\th1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT\u002F4REW\u002F\u002Flsas=\ndep\tgithub.com\u002Fccoveille\u002Fgo-safecast\u002Fv2\tv2.0.1\th1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=\ndep\tgithub.com\u002Fcenkalti\u002Fbackoff\u002Fv5\tv5.0.3\th1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=\ndep\tgithub.com\u002Fcespare\u002Fxxhash\u002Fv2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=\ndep\tgithub.com\u002Fchzyer\u002Freadline\tv1.5.1\th1:upd\u002F6fQk4src78LMRzh5vItIt361\u002Fo4uq553V8B5sGI=\ndep\tgithub.com\u002Fcloudflare\u002Fcircl\tv1.6.5\th1:O64F26HEqNhznd\u002FhrC5KZXVKYuKM2rx4deZDTc4ihQA=\ndep\tgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fapi\u002Ffrankenphp\u002Fcaddy\u002Fqueryallowlist\tv0.0.0-20261024103331-0a561108fbba\n=>\t\u002Ftmp\u002Fqueryallowlist\t(devel)\t\n\ndep\tgithub.com\u002Fcoreos\u002Fgo-oidc\u002Fv3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=\ndep\tgithub.com\u002Fcpuguy83\u002Fgo-md2man\u002Fv2\tv2.0.7\th1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\tv1.7.9\n=>\t\u002Ftmp\u002Fsouin\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\u002Fplugins\u002Fcaddy\tv1.7.9\th1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\tv0.0.21\th1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M\u002FJRc+zhN7Wsx0=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\u002Fcaddy\tv0.0.22\th1:4\u002FbyA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fcore\tv0.0.21\th1:zfa0Bqzdm9\u002FoPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\tv0.0.22\n=>\t\u002Ftmp\u002Fstorages-go-redis\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\u002Fcaddy\tv0.0.22\th1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\tv0.0.21\th1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\u002Fcaddy\tv0.0.22\th1:kg\u002FHYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\tv0.0.21\th1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\u002Fcaddy\tv0.0.22\th1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=\ndep\tgithub.com\u002Fdgraph-io\u002Fbadger\u002Fv4\tv4.9.1\th1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=\ndep\tgithub.com\u002Fdgraph-io\u002Fristretto\u002Fv2\tv2.2.0\th1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=\ndep\tgithub.com\u002Fdgryski\u002Fgo-rendezvous\tv0.0.0-20200823014737-9f7001d12a5f\th1:lO4WD4F\u002FrVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=\ndep\tgithub.com\u002Fdlclark\u002Fregexp2\u002Fv2\tv2.9.1\th1:q6bZW\u002FNN9VodqMjYXpuic2lZxdHPfFTzGS+MJxIJmKQ=\ndep\tgithub.com\u002Fdolthub\u002Fmaphash\tv0.1.0\th1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L\u002FQxPDyQ=\ndep\tgithub.com\u002Fdunglas\u002Fcaddy-cbrotli\tv1.0.1\th1:mkg7EB1GmoyfBt3kY3mq4o\u002F0bfnBeq7ZLQjmVmdBE3Y=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\tv1.13.3\th1:9fZki1cGNs2AOaj6r0PRnRmXsvv7IyfZNRr+3sMA7qA=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\u002Fcaddy\tv1.13.3\th1:bUF55dsLbDHyA\u002Ff77FVbhXzg1RC6jgMOqFZ2BOmMBVs=\ndep\tgithub.com\u002Fdunglas\u002Fgo-urlpattern\tv1.0.0\th1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=\ndep\tgithub.com\u002Fdunglas\u002Fhttpsfv\tv1.1.2\th1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ\u002FDkmc=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\tv1.1.4\th1:CtC2UiHGQQNcKfr6ZLlJTa93AP\u002FXUFdJQJfgfUtvphA=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\u002Fcaddy\tv1.1.4\th1:dKmvgwbRbuM2\u002FjRaIiSmBXYTnVtxQ218\u002FKHqzoeplBU=\ndep\tgithub.com\u002Fdunglas\u002Fskipfilter\tv1.2.0\th1:J7\u002FRXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\tv1.4.5\th1:vO7CS3\u002FKwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\u002Fcaddy\tv1.4.5\th1:2qzg18nEkpsc1QIvpNn\u002FoztSHRxY1\u002FG6xuxylxVobGY=\ndep\tgithub.com\u002Fdustin\u002Fgo-humanize\tv1.1.0\th1:dbKTrvD0klcbBV\u002Fh4AWJdMuZogJACoMlvWIWZ5b2xWg=\ndep\tgithub.com\u002Fe-dant\u002Fwatcher\tv0.0.0-20260223030516-06f84a1314be\th1:vqHrvilasyJcnru\u002F0Z4FoojsQJUIfXGVplte7JtupfY=\ndep\tgithub.com\u002Felnormous\u002Fcontenttype\tv1.0.4\th1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=\ndep\tgithub.com\u002Ffelixge\u002Fhttpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw\u002FQDuVfpNhoA31zeORc=\ndep\tgithub.com\u002Ffxamacker\u002Fcbor\u002Fv2\tv2.9.6\th1:NHZPxuUjJXQjX9itA785y\u002F5NKSlI4HQ+S7noZsmI7hs=\ndep\tgithub.com\u002Fgammazero\u002Fdeque\tv0.2.1\th1:qSdsbG6pgp6nL7A0+K\u002FB7s12mcCY\u002F5l5SIUpMOl+dC0=\ndep\tgithub.com\u002Fgetkin\u002Fkin-openapi\tv0.152.0\th1:XRVo77lMRyOGMHf1paMu9lxX3wzuQDZeprssZJnz\u002Fx8=\ndep\tgithub.com\u002Fgo-chi\u002Fchi\u002Fv5\tv5.5.0\th1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv3\tv3.0.5\th1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv4\tv4.1.6\th1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=\ndep\tgithub.com\u002Fgo-logr\u002Flogr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg\u002F+cPVcbP\u002F8=\ndep\tgithub.com\u002Fgo-logr\u002Fstdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=\ndep\tgithub.com\u002Fgo-openapi\u002Fjsonpointer\tv1.0.2\th1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=\ndep\tgithub.com\u002Fgofrs\u002Fflock\tv0.13.0\th1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ\u002FA8dRYMzw=\ndep\tgithub.com\u002Fgofrs\u002Fuuid\tv4.4.0+incompatible\th1:3qXRTX8\u002FNbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=\ndep\tgithub.com\u002Fgolang-jwt\u002Fjwt\u002Fv5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=\ndep\tgithub.com\u002Fgoogle\u002Fbrotli\u002Fgo\u002Fcbrotli\tv1.1.0\th1:YwHD\u002FrwSgUSL4b2S3ZM2jnNymm+tmwKQqjUIC63nmHU=\ndep\tgithub.com\u002Fgoogle\u002Fcertificate-transparency-go\tv1.4.0\th1:78uNaR2knzCoKKXXDSAGVkz9XPkDg5xXJRP9tP6+rr0=\ndep\tgithub.com\u002Fgoogle\u002Fflatbuffers\tv25.2.10+incompatible\th1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H\u002FpNX4FP1v0Q=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tpm\tv0.9.8\th1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tspi\tv0.3.0\th1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=\ndep\tgithub.com\u002Fgoogle\u002Fs2a-go\tv0.1.11\th1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=\ndep\tgithub.com\u002Fgoogle\u002Fuuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=\ndep\tgithub.com\u002Fgoogleapis\u002Fenterprise-certificate-proxy\tv0.3.24\th1:G9iCJIY+AYVmUskKdjX8FVy7sG+nbzjOQ41cvlmhcvg=\ndep\tgithub.com\u002Fgoogleapis\u002Fgax-go\u002Fv2\tv2.27.0\th1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc\u002FRRZhKA\u002F2g0=\ndep\tgithub.com\u002Fgorilla\u002Fhandlers\tv1.5.2\th1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=\ndep\tgithub.com\u002Fgorilla\u002Fmux\tv1.8.1\th1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=\ndep\tgithub.com\u002Fgrpc-ecosystem\u002Fgrpc-gateway\u002Fv2\tv2.32.0\th1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=\ndep\tgithub.com\u002Fhuandu\u002Fxstrings\tv1.6.3\th1:7997PcI0mYC9uPNBJ7udg\u002FKrdJh1GhJid8f2tzKFHYQ=\ndep\tgithub.com\u002Fklauspost\u002Fcompress\tv1.20.3\th1:zWNoFqq\u002FlSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=\ndep\tgithub.com\u002Fklauspost\u002Fcpuid\u002Fv2\tv2.4.1\th1:I9KxadAkvo+QjtcEE2f2tyfEvmIla\u002FT0m+14PrZNl0U=\ndep\tgithub.com\u002Flibdns\u002Flibdns\tv1.1.1\th1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS\u002FP\u002FU=\ndep\tgithub.com\u002Fmanifoldco\u002Fpromptui\tv0.9.0\th1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=\ndep\tgithub.com\u002Fmattn\u002Fgo-colorable\tv0.1.16\th1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=\ndep\tgithub.com\u002Fmattn\u002Fgo-isatty\tv0.0.24\th1:tGZZoVgT\u002FKiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\tv1.2.4\th1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\u002Fv2\tv2.4.0\th1:1XpRRWaq9DRIqZV7UtglS4VLzYKSsnFOQmzV+KZxLb0=\ndep\tgithub.com\u002Fmgutz\u002Fansi\tv0.0.0-20200706080929-d51e80ef957d\th1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=\ndep\tgithub.com\u002Fmholt\u002Facmez\u002Fv3\tv3.1.7\th1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=\ndep\tgithub.com\u002Fmholt\u002Fcaddy-ratelimit\tv0.1.0\th1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=\ndep\tgithub.com\u002Fmiekg\u002Fdns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=\ndep\tgithub.com\u002Fmitchellh\u002Fcopystructure\tv1.2.0\th1:vpKXTN4ewci03Vljg\u002Fq9QvCGUDttBOGBIa15WveJJGw=\ndep\tgithub.com\u002Fmitchellh\u002Fgo-ps\tv1.0.0\th1:i6ampVEEF4wQFF+bkYfwYgY+F\u002FuYJDktmvLPf7qIgjc=\ndep\tgithub.com\u002Fmitchellh\u002Freflectwalk\tv1.0.2\th1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=\ndep\tgithub.com\u002Fmunnerz\u002Fgoautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01\u002FOq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=\ndep\tgithub.com\u002Fnlnwa\u002Fwhatwg-url\tv0.6.2\th1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ\u002FQ=\ndep\tgithub.com\u002Fnutsdb\u002Fnutsdb\tv1.0.4\th1:BurzkxijXJY1\u002FAkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=\ndep\tgithub.com\u002Foasdiff\u002Fyaml\tv0.1.1\th1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=\ndep\tgithub.com\u002Foasdiff\u002Fyaml3\tv0.0.14\th1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=\ndep\tgithub.com\u002Fpbnjay\u002Fmemory\tv0.0.0-20210728143218-7b4eea64cf58\th1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=\ndep\tgithub.com\u002Fpierrec\u002Flz4\u002Fv4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=\ndep\tgithub.com\u002Fpires\u002Fgo-proxyproto\tv0.16.0\th1:9KYT\u002FfM3wpjT8bdMEj\u002F7FBcoiUG1KyzEjRYnPu+vz7A=\ndep\tgithub.com\u002Fpkg\u002Ferrors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=\ndep\tgithub.com\u002Fpquerna\u002Fcachecontrol\tv0.2.0\th1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=\ndep\tgithub.com\u002Fprometheus\u002Fclient_golang\tv1.25.0\th1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=\ndep\tgithub.com\u002Fprometheus\u002Fclient_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=\ndep\tgithub.com\u002Fprometheus\u002Fcommon\tv0.72.1\th1:ZAiQed\u002Fnk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=\ndep\tgithub.com\u002Fprometheus\u002Fotlptranslator\tv1.0.0\th1:s0LJW\u002FiN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=\ndep\tgithub.com\u002Fprometheus\u002Fprocfs\tv0.22.0\th1:6q9+\u002FJL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=\ndep\tgithub.com\u002Fquic-go\u002Fqpack\tv0.6.0\th1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=\ndep\tgithub.com\u002Fquic-go\u002Fquic-go\tv0.64.1\th1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=\ndep\tgithub.com\u002Fredis\u002Fgo-redis\u002Fv9\tv9.18.0\th1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=\ndep\tgithub.com\u002Frs\u002Fcors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=\ndep\tgithub.com\u002Frs\u002Fxid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=\ndep\tgithub.com\u002Frussross\u002Fblackfriday\u002Fv2\tv2.1.0\th1:JIOH55\u002F0cWyOuilr9\u002Fqlrm0BSXldqnqwMsf35Ld67mk=\ndep\tgithub.com\u002Fsanthosh-tekuri\u002Fjsonschema\u002Fv6\tv6.0.3\th1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls\u002F28=\ndep\tgithub.com\u002Fshopspring\u002Fdecimal\tv1.6.0\th1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=\ndep\tgithub.com\u002FshurcooL\u002Fsanitized_anchor_name\tv1.0.0\th1:PdmoCO6wvbs+7yrJyMORt4\u002FBmY5IYyJwS\u002FkOiWx8mHo=\ndep\tgithub.com\u002Fsirupsen\u002Flogrus\tv1.10.2\th1:G2SED73\u002FqrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=\ndep\tgithub.com\u002Fslackhq\u002Fnebula\tv1.11.2\th1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=\ndep\tgithub.com\u002Fsmallstep\u002Fcertificates\tv0.30.2\th1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf\u002FiQtA5QlN0Y=\ndep\tgithub.com\u002Fsmallstep\u002Fcli-utils\tv0.12.2\th1:lGzM9PJrH\u002FqawbzMC\u002Fs2SvgLdJPKDWKwKzx9doCVO+k=\ndep\tgithub.com\u002Fsmallstep\u002Fgo-attestation\tv0.4.9\th1:\u002FfVmzB8A8tk7B2PCGPlszWzyl\u002FGDcEQbynqcg2PMaZ0=\ndep\tgithub.com\u002Fsmallstep\u002Flinkedca\tv0.26.0\th1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=\ndep\tgithub.com\u002Fsmallstep\u002Fnosql\tv0.8.0\th1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli\u002FXB4Jp4A=\ndep\tgithub.com\u002Fsmallstep\u002Fpkcs7\tv0.2.3\th1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=\ndep\tgithub.com\u002Fsmallstep\u002Fscep\tv0.0.0-20261014185058-63893dadfda8\th1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=\ndep\tgithub.com\u002Fsmallstep\u002Ftruststore\tv0.13.0\th1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi\u002Fpy4=\ndep\tgithub.com\u002Fspf13\u002Fcast\tv1.10.0\th1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=\ndep\tgithub.com\u002Fspf13\u002Fcobra\tv1.10.2\th1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=\ndep\tgithub.com\u002Fspf13\u002Fpflag\tv1.0.10\th1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=\ndep\tgithub.com\u002Ftailscale\u002Ftscert\tv0.0.0-20251216020129-aea342f6d747\th1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=\ndep\tgithub.com\u002Ftidwall\u002Fbtree\tv1.6.0\th1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=\ndep\tgithub.com\u002Funrolled\u002Fsecure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=\ndep\tgithub.com\u002Furfave\u002Fcli\tv1.22.17\th1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=\ndep\tgithub.com\u002Fx448\u002Ffloat16\tv0.8.4\th1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=\ndep\tgithub.com\u002Fxujiajun\u002Fmmap-go\tv1.0.1\th1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv\u002FWHc=\ndep\tgithub.com\u002Fxujiajun\u002Futils\tv0.0.0-20220904132955-5f7c5b914235\th1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark\tv1.8.6\th1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark-highlighting\u002Fv2\tv2.0.0-20230729083705-37449abec8cc\th1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=\ndep\tgithub.com\u002Fzeebo\u002Fblake3\tv0.2.4\th1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM\u002FyBqhaZI=\ndep\tgo.etcd.io\u002Fbbolt\tv1.5.0\th1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P\u002FbD4lxU=\ndep\tgo.opentelemetry.io\u002Fauto\u002Fsdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ\u002FipaZ64=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fbridges\u002Fprometheus\tv0.72.0\th1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w\u002F1ROwHEM7M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fexporters\u002Fautoexport\tv0.72.0\th1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Finstrumentation\u002Fnet\u002Fhttp\u002Fotelhttp\tv0.72.0\th1:LxwW\u002F9ctSCv+QkE\u002FcLR7M91ZIkXNMqJtEMi1vCw9U8s=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fautoprop\tv0.72.0\th1:\u002FKv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Faws\tv1.47.0\th1:n\u002F2x\u002FvQki1ojD7R2jYHdnNdI74Yx\u002FOFdY4YXFFesm8M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fb3\tv1.47.0\th1:vlKDmtjhe1R0d7kdov\u002F+KVTKWOKeGLyohB+iXoDPRMQ=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fjaeger\tv1.47.0\th1:2lDw6AKPV33\u002F7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fot\tv1.47.0\th1:nZUqh0\u002F8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=\ndep\tgo.opentelemetry.io\u002Fotel\tv1.47.0\th1:j7ALJ\u002FzgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploggrpc\tv0.23.0\th1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploghttp\tv0.23.0\th1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI\u002FnE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetricgrpc\tv1.47.0\th1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetrichttp\tv1.47.0\th1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\tv1.47.0\th1:julhjPeUH\u002Fq\u002F7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracegrpc\tv1.47.0\th1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracehttp\tv1.47.0\th1:aXZXsZ012wOgVkqaiQv+Z\u002Fd8V0xKjmg70F6m4CE94lc=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fprometheus\tv0.69.0\th1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutlog\tv0.23.0\th1:PW\u002FE9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutmetric\tv1.47.0\th1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdouttrace\tv1.47.0\th1:N3YQCxjxQ\u002FbMjyc3heladfRm9t9RTksGQH8z4w6yU\u002F0=\ndep\tgo.opentelemetry.io\u002Fotel\u002Flog\tv1.47.0\th1:cOTS1CcLbSQeZKanGJ+0JpF\u002F+t4PELi3O3bbl2lqCcI=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fmetric\tv1.47.0\th1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\tv1.47.0\th1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Flog\tv1.47.0\th1:W4N\u002FZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Fmetric\tv1.47.0\th1:lfISg2j93VT6yqdk9OfUaZmw\u002FGfcZqCCV3jdXtsPnKw=\ndep\tgo.opentelemetry.io\u002Fotel\u002Ftrace\tv1.47.0\th1:JOjX\u002FOci8K94QHddo+bbfya\u002FAi\u002Fnf6\u002Fdt9ZfrFNWSrM=\ndep\tgo.opentelemetry.io\u002Fproto\u002Fotlp\tv1.11.1\th1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=\ndep\tgo.step.sm\u002Fcrypto\tv0.91.0\th1:0mN0DwVOvUuh7VbyTnxABZuAkxwak\u002FGrp8Y\u002Fb4YaZDU=\ndep\tgo.uber.org\u002Fatomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp\u002FAUETXlHW0DxSjE=\ndep\tgo.uber.org\u002Fautomaxprocs\tv1.6.0\th1:O3y2\u002FQNTOdbF+e\u002FdpXNNW7Rx2hZ4sTIPyybbxyNqTUs=\ndep\tgo.uber.org\u002Fmultierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=\ndep\tgo.uber.org\u002Fzap\tv1.28.0\th1:IZzaP1Fv73\u002FT\u002FpBMLk4VutPl36uNC+OSUh3JLG3FIjo=\ndep\tgo.uber.org\u002Fzap\u002Fexp\tv0.3.0\th1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=\ndep\tgo.yaml.in\u002Fyaml\u002Fv3\tv3.0.5\th1:N6y\u002FpJk8buWs9NY5ERU2HSMfm+IuD\u002FOtfdAnq6kESPw=\ndep\tgolang.org\u002Fx\u002Fcrypto\tv0.58.0\th1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K\u002FM\u002F54=\ndep\tgolang.org\u002Fx\u002Fcrypto\u002Fx509roots\u002Ffallback\tv0.0.0-20261020153306-9f2b28d4331a\th1:V5oicZXS0oqZx30gY\u002FapgSVD7YvNBfrIOdcMnlelJY4=\ndep\tgolang.org\u002Fx\u002Fexp\tv0.0.0-20261014143641-f0251eb4aa3e\th1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI\u002FA=\ndep\tgolang.org\u002Fx\u002Fnet\tv0.61.0\th1:RR+6j\u002FBTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=\ndep\tgolang.org\u002Fx\u002Foauth2\tv0.37.0\th1:JUlcxA8oAtauLfiH8FX2\u002FFkAWHAdi0QtGCGc+hofE98=\ndep\tgolang.org\u002Fx\u002Fsync\tv0.24.0\th1:iqiDrGoDgyuvAKrhLQthUEzU\u002FR378N78gXbBjxed7oA=\ndep\tgolang.org\u002Fx\u002Fsys\tv0.49.0\th1:XbzkgYJHdqh\u002F8m2Uu0W\u002FdQv8nktxx4BFHp1M0gROTXA=\ndep\tgolang.org\u002Fx\u002Fterm\tv0.47.0\th1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ\u002FBM=\ndep\tgolang.org\u002Fx\u002Ftext\tv0.43.0\th1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5\u002FUGUTJVXoWc=\ndep\tgolang.org\u002Fx\u002Ftime\tv0.16.0\th1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q\u002F6gY2hDM6VDE=\ndep\tgoogle.golang.org\u002Fapi\tv0.308.0\th1:iGb+4qT3nVb3uuIzwor3yP2nyu+rMZr31PvLFiRNJQk=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Fapi\tv0.0.0-20261019180522-ce908d29299b\th1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Frpc\tv0.0.0-20261019180522-ce908d29299b\th1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=\ndep\tgoogle.golang.org\u002Fgrpc\tv1.84.0\th1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=\ndep\tgoogle.golang.org\u002Fprotobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o\u002Ffwxc=\ndep\tgopkg.in\u002Fyaml.v3\tv3.0.1\th1:fxVm\u002FGzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=\nbuild\t-buildmode=exe\nbuild\t-compiler=gc\nbuild\t-ldflags=\"-w -s\"\nbuild\t-tags=nobadger,nomysql,nopgx\nbuild\tCGO_ENABLED=1\nbuild\tCGO_CFLAGS=\"-I\u002Fusr\u002Flocal\u002Finclude\u002Fphp -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fmain -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FTSRM -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FZend -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext\u002Fdate\u002Flib\"\nbuild\tCGO_CPPFLAGS=\"-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64\"\nbuild\tCGO_CXXFLAGS=\nbuild\tCGO_LDFLAGS=\"-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto\"\nbuild\tGOARCH=amd64\nbuild\tGOOS=linux\nbuild\tGOAMD64=v1\n\n```\n",{"part":885,"tag":953,"name":953,"publishedAt":954,"url":955,"body":956},"v2.0.0-alpha.47","2026-10-23T15:06:14Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.47","## [2.0.0-alpha.47](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.47) - 2026-10-23\n\n### Upgrade notes\n\n- **api-components-bundle 2.0.0-alpha.37 and `@cwa\u002Fnuxt` 2.0.0-alpha.30 go together** (the editor needs `\u002F_\u002Fcollaboration_states` and sends `If-Match`). Update both in the same deploy.\n- **Two bundle migrations:** alpha.36 adds a `resource_version` column to components and page data, alpha.37 a `collaboration_state` table. After `composer update components-web-app\u002Fapi-components-bundle`, run `bin\u002Fconsole doctrine:migrations:diff` once (it covers both), delete the generated `down()`, and commit the migration with the lock. The template's are `api\u002Fmigrations\u002FVersion20261022184324.php` and `Version20261022192418.php`. [ede2e9f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fede2e9f2f59dc917783b2651ea1072543a893991) [e3cda2d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe3cda2d26b32350e76e8955b91aa24bb7ccf3adb)\n- **The TipTap editor is replaced by the module playground's Yjs co-editing editor.** Copy `app\u002Fapp\u002Fcomponents\u002FTipTapHtmlEditor.vue`, `app\u002Fapp\u002Ftiptap\u002F` (`co-editing.ts`, `y-sync.ts`, `y-seed.ts`, `y-session.ts`, `y-state.ts`, `y-cursors.ts`), `app\u002Fapp\u002Fcomposables\u002FuseCustomHtmlComponent.ts` and both HtmlContent components (`app\u002Fapp\u002Fcwa\u002Fcomponents\u002FHtmlContent\u002FHtmlContent.vue`, `ui\u002FAltHtmlContent.vue`). The editor now takes `:model` (the field's `useCwaResourceModel`), `:iri` and `field=\"html\"` instead of `v-model`. Add `yjs`, `@tiptap\u002Fextension-collaboration` (on your other `@tiptap\u002F*` version) and `@tiptap\u002Fy-tiptap` to `dependencies`, and check the lock has exactly one `yjs`. [685dfdf](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F685dfdf2c1d4553daf3495cfba64789d82e38cd6) [92565ad](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F92565ad71a97f13769063d8704345d0d26bed3dc) [3487864](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F34878641f5877421beeaa355f709bd5f99bba923)\n- A site whose API is on another origin than its front end also takes `nelmio_cors.yaml`'s `If-Match` (allowed) and `ETag` (exposed). [ede2e9f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fede2e9f2f59dc917783b2651ea1072543a893991)\n- `api\u002Ffrankenphp\u002FCaddyfile` changed (#216); copy it. [8702196](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F87021963044d24ef4efc47e7adb66e82ba61e781)\n\n### Changed\n\n- **TipTap co-editing** (`@cwa\u002Fnuxt` 2.0.0-alpha.28 to alpha.30; cwa-nuxt-module#429, #439, #440): admins in one field share a Yjs document, so simultaneous typing merges; the field is outlined with the name of another admin in it, their caret shows live, and a remote save keeps your caret and stays out of your undo history. One admin's tab saves the HTML (with `If-Match`) and the Yjs state. Tested with two admins typing at once and one save refused: 9 of 9 runs kept both texts. Selecting a component without typing still saves nothing (#167) (#219). [685dfdf](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F685dfdf2c1d4553daf3495cfba64789d82e38cd6) [92565ad](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F92565ad71a97f13769063d8704345d0d26bed3dc) [3487864](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F34878641f5877421beeaa355f709bd5f99bba923)\n- **api-components-bundle 2.0.0-alpha.36 and alpha.37** (api-components-bundle#561, #564): components and page data are sent with an `ETag`, a write with `If-Match` is refused (412) if someone saved in between, and `\u002F_\u002Fcollaboration_states` stores the collaborative-editing state. [ede2e9f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fede2e9f2f59dc917783b2651ea1072543a893991) [e3cda2d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe3cda2d26b32350e76e8955b91aa24bb7ccf3adb)\n\n### Fixed\n\n- **create-cwa projects that chose GitHub Actions got no workflows**: `.gitattributes` still had the API Platform template's `.github export-ignore`, and GitHub's tarball honours it, so `.github\u002F` never reached a new project (since 2.0.0-alpha.1). A project created that way copies `.github\u002Fworkflows\u002F` from this release (except `publish-create-cwa.yml` and `publish-php-base.yml`). [ac42d4a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fac42d4a3566119ec90e06a3a28104a6f79157d44)\n- Caddy holds page requests for up to 5 s while the app container restarts, instead of answering 502 straight away (`lb_try_duration` on the app proxy). On Kubernetes a request that finds no ready SSR pod fails at most 5 s later (#216). [8702196](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F87021963044d24ef4efc47e7adb66e82ba61e781)\n\n### Security\n\n- **A register of accepted npm advisories** in `app\u002Fpnpm-workspace.yaml` (`auditConfig.ignoreGhsas`), so `pnpm audit` and scans read them as known. Still accepted at this release (reviewed 2026-10-23), none shipping in the server output: node-forge 1.4.0 (GHSA-86w9-cpqp-85rv, high) and braces 3.0.3 (GHSA-vfj7-8cjw-p6xm, high), no fix released; postcss-selector-parser 6.0.10 (GHSA-rj75-hqrm-r3gf, moderate), pinned by @tailwindcss\u002Ftypography; esbuild 0.27.7 (GHSA-g7r4-m6w7-qqqr, low), via @nuxt\u002Ffonts. cwa-deployment-statuses checks the register hourly and opens an issue when an entry becomes fixable; a Composer exception goes in `api\u002Fcomposer.json`'s `config.audit.ignore` with its reason (#220). [146f9ed](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F146f9ed1efdc45fdd143e999e2d1f59fb39773d2) [5c862a6](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5c862a650ff0ccaf5693081b7b4fa34c212b98e8)\n- `fflate` 0.7.5 (GHSA-px8p-9vwx-vf98, moderate: an infinite loop on a crafted ZIP64 archive) through an override in `app\u002Fpnpm-workspace.yaml`; satori's opentype.js locked 0.7.3, the only flagged npm package that ships in the server output, though only its font inflate, not the affected `unzipSync`, is used. [424492f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F424492f849bef71087c5a8b07a47467bd40050bb)\n\n\n### cwa-php-base 2.0.0-alpha.47\n\nPin it as `ghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.47@sha256:a44a75494b70f0c494cca547121b7cb44ff0f35842bd03aaf7685353e9bf9b30`.\n\nVerify it with:\n\n```sh\ngh attestation verify oci:\u002F\u002Fghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.47 --repo components-web-app\u002Fcomponents-web-app \\\n  --signer-workflow components-web-app\u002Fcomponents-web-app\u002F.github\u002Fworkflows\u002Fpublish-php-base.yml --source-ref refs\u002Ftags\u002Fv2.0.0-alpha.47\n```\n\n```\n# Base images (from the build provenance)\npkg:docker\u002Fcaddy@builder?platform=linux%2Famd64 sha256:c2fc374fd352439d76e1777b28d97d9f6d9c1dd86116db9227460374d46097d5\npkg:docker\u002Fcaddy@builder?platform=linux%2Farm64 sha256:c2fc374fd352439d76e1777b28d97d9f6d9c1dd86116db9227460374d46097d5\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:ae4f3b554449e7e25548e7d8ccc029d17357348e30c6e3df01b92bc93654d6a9\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:ae4f3b554449e7e25548e7d8ccc029d17357348e30c6e3df01b92bc93654d6a9\npkg:docker\u002Fdocker\u002Fdockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Famd64 sha256:96145413b41f0a97bee3545ea0a04e077807ed265c5a506fb958311d9b983357\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Farm64 sha256:96145413b41f0a97bee3545ea0a04e077807ed265c5a506fb958311d9b983357\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Famd64 sha256:a3b718823fa7d12a7a2933cb729a70bd642c31c890d9c66702c1a9e49b44f5f6\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Farm64 sha256:a3b718823fa7d12a7a2933cb729a70bd642c31c890d9c66702c1a9e49b44f5f6\n\nPHP 8.5.12 (cli) (built: Oct 21 2026 15:49:52) (ZTS)\nCopyright (c) The PHP Group\nBuilt by https:\u002F\u002Fgithub.com\u002Fdocker-library\u002Fphp\nZend Engine v4.5.12, Copyright (c) Zend Technologies\n    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies\n\n[PHP Modules]\napcu\nbrotli\nCore\nctype\ncurl\ndate\ndom\nexif\nFFI\nfileinfo\nfilter\ngd\nhash\niconv\nintl\njson\nlexbor\nlibxml\nmbstring\nmysqlnd\nopenssl\npcre\nPDO\npdo_pgsql\npdo_sqlite\nPhar\nposix\nrandom\nreadline\nReflection\nsession\nSimpleXML\nsodium\nSPL\nsqlite3\nstandard\ntokenizer\nuri\nxml\nxmlreader\nxmlwriter\nxsl\nZend OPcache\nzip\nzlib\n\n[Zend Modules]\nZend OPcache\n\n\ngo\tgo1.27.3\npath\tcaddy\nmod\tcaddy\t(devel)\t\ndep\tcel.dev\u002Fcel-go\tv0.32.0\th1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=\ndep\tcel.dev\u002Fexpr\tv0.25.3\th1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=\ndep\tcloud.google.com\u002Fgo\u002Fauth\tv0.24.1\th1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=\ndep\tcloud.google.com\u002Fgo\u002Fauth\u002Foauth2adapt\tv0.3.0\th1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=\ndep\tcloud.google.com\u002Fgo\u002Fcompute\u002Fmetadata\tv0.10.0\th1:pyKMUQSwchgkIBBJGdILqQbs\u002FBNJXqwSA7Ej6LAvvtY=\ndep\tdario.cat\u002Fmergo\tv1.0.2\th1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=\ndep\tfilippo.io\u002Fbigmod\tv0.1.0\th1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=\ndep\tfilippo.io\u002Fedwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=\ndep\tgithub.com\u002FBurntSushi\u002Ftoml\tv1.6.0\th1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=\ndep\tgithub.com\u002FDeRuina\u002Ftimberjack\tv1.4.9\th1:9RjDMSkUDQRYzwVNB\u002FFLonXNurcZVEh9sK43m2jw3A4=\ndep\tgithub.com\u002FKimMachineGun\u002Fautomemlimit\tv1.0.1\th1:87PowSIJFht5TmyyZKJNR4y2v7Cm9OdCzsSMR8jXJHM=\ndep\tgithub.com\u002FMasterminds\u002Fgoutils\tv1.1.1\th1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=\ndep\tgithub.com\u002FMasterminds\u002Fsemver\u002Fv3\tv3.5.0\th1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ\u002F2OOE=\ndep\tgithub.com\u002FMasterminds\u002Fsprig\u002Fv3\tv3.3.0\th1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=\ndep\tgithub.com\u002FMauriceGit\u002Fskiplist\tv0.0.0-20211105230623-77f5c8d3e145\th1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=\ndep\tgithub.com\u002FMicahParks\u002Fjwkset\tv0.11.3\th1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=\ndep\tgithub.com\u002FMicahParks\u002Fkeyfunc\u002Fv3\tv3.8.2\th1:eydEwk\u002FpBAVrDIpmFfB\u002FgkCcrp++xQ7YYXirrI2zlWE=\ndep\tgithub.com\u002FRoaringBitmap\u002Froaring\u002Fv2\tv2.30.0\th1:1sD4xsCenNd9n\u002FgOWaExCWanP9WTyiNuqLAvaDQ5jkY=\ndep\tgithub.com\u002Falecthomas\u002Fchroma\u002Fv2\tv2.27.0\th1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v\u002Fr5BXYZs=\ndep\tgithub.com\u002Fantlabs\u002Fstl\tv0.0.1\th1:TRD3csCrjREeLhLoQ\u002FsupaoCvFhNLBTNIwuRGrDIs6Q=\ndep\tgithub.com\u002Fantlabs\u002Ftimer\tv0.0.11\th1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=\ndep\tgithub.com\u002Fantlr4-go\u002Fantlr\u002Fv4\tv4.13.1\th1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=\ndep\tgithub.com\u002Faryann\u002Fdifflib\tv0.0.0-20210328193216-ff5ff6dc229b\th1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=\ndep\tgithub.com\u002Fbeorn7\u002Fperks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=\ndep\tgithub.com\u002Fbits-and-blooms\u002Fbitset\tv1.26.0\th1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=\ndep\tgithub.com\u002Fbwmarrin\u002Fsnowflake\tv0.3.0\th1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=\ndep\tgithub.com\u002Fcaddyserver\u002Fcaddy\u002Fv2\tv2.11.7\th1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=\ndep\tgithub.com\u002Fcaddyserver\u002Fcertmagic\tv0.25.6\th1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=\ndep\tgithub.com\u002Fcaddyserver\u002Fzerossl\tv0.1.6\th1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT\u002F4REW\u002F\u002Flsas=\ndep\tgithub.com\u002Fccoveille\u002Fgo-safecast\u002Fv2\tv2.0.1\th1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=\ndep\tgithub.com\u002Fcenkalti\u002Fbackoff\u002Fv5\tv5.0.3\th1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=\ndep\tgithub.com\u002Fcespare\u002Fxxhash\u002Fv2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=\ndep\tgithub.com\u002Fchzyer\u002Freadline\tv1.5.1\th1:upd\u002F6fQk4src78LMRzh5vItIt361\u002Fo4uq553V8B5sGI=\ndep\tgithub.com\u002Fcloudflare\u002Fcircl\tv1.6.5\th1:O64F26HEqNhznd\u002FhrC5KZXVKYuKM2rx4deZDTc4ihQA=\ndep\tgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fapi\u002Ffrankenphp\u002Fcaddy\u002Fqueryallowlist\tv0.0.0-20261023123817-30f39ed445c2\n=>\t\u002Ftmp\u002Fqueryallowlist\t(devel)\t\n\ndep\tgithub.com\u002Fcoreos\u002Fgo-oidc\u002Fv3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=\ndep\tgithub.com\u002Fcpuguy83\u002Fgo-md2man\u002Fv2\tv2.0.7\th1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\tv1.7.9\n=>\t\u002Ftmp\u002Fsouin\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\u002Fplugins\u002Fcaddy\tv1.7.9\th1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\tv0.0.21\th1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M\u002FJRc+zhN7Wsx0=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\u002Fcaddy\tv0.0.22\th1:4\u002FbyA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fcore\tv0.0.21\th1:zfa0Bqzdm9\u002FoPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\tv0.0.22\n=>\t\u002Ftmp\u002Fstorages-go-redis\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\u002Fcaddy\tv0.0.22\th1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\tv0.0.21\th1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\u002Fcaddy\tv0.0.22\th1:kg\u002FHYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\tv0.0.21\th1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\u002Fcaddy\tv0.0.22\th1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=\ndep\tgithub.com\u002Fdgraph-io\u002Fbadger\u002Fv4\tv4.9.1\th1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=\ndep\tgithub.com\u002Fdgraph-io\u002Fristretto\u002Fv2\tv2.2.0\th1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=\ndep\tgithub.com\u002Fdgryski\u002Fgo-rendezvous\tv0.0.0-20200823014737-9f7001d12a5f\th1:lO4WD4F\u002FrVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=\ndep\tgithub.com\u002Fdlclark\u002Fregexp2\u002Fv2\tv2.9.1\th1:q6bZW\u002FNN9VodqMjYXpuic2lZxdHPfFTzGS+MJxIJmKQ=\ndep\tgithub.com\u002Fdolthub\u002Fmaphash\tv0.1.0\th1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L\u002FQxPDyQ=\ndep\tgithub.com\u002Fdunglas\u002Fcaddy-cbrotli\tv1.0.1\th1:mkg7EB1GmoyfBt3kY3mq4o\u002F0bfnBeq7ZLQjmVmdBE3Y=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\tv1.13.3\th1:9fZki1cGNs2AOaj6r0PRnRmXsvv7IyfZNRr+3sMA7qA=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\u002Fcaddy\tv1.13.3\th1:bUF55dsLbDHyA\u002Ff77FVbhXzg1RC6jgMOqFZ2BOmMBVs=\ndep\tgithub.com\u002Fdunglas\u002Fgo-urlpattern\tv1.0.0\th1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=\ndep\tgithub.com\u002Fdunglas\u002Fhttpsfv\tv1.1.2\th1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ\u002FDkmc=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\tv1.1.4\th1:CtC2UiHGQQNcKfr6ZLlJTa93AP\u002FXUFdJQJfgfUtvphA=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\u002Fcaddy\tv1.1.4\th1:dKmvgwbRbuM2\u002FjRaIiSmBXYTnVtxQ218\u002FKHqzoeplBU=\ndep\tgithub.com\u002Fdunglas\u002Fskipfilter\tv1.2.0\th1:J7\u002FRXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\tv1.4.5\th1:vO7CS3\u002FKwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\u002Fcaddy\tv1.4.5\th1:2qzg18nEkpsc1QIvpNn\u002FoztSHRxY1\u002FG6xuxylxVobGY=\ndep\tgithub.com\u002Fdustin\u002Fgo-humanize\tv1.1.0\th1:dbKTrvD0klcbBV\u002Fh4AWJdMuZogJACoMlvWIWZ5b2xWg=\ndep\tgithub.com\u002Fe-dant\u002Fwatcher\tv0.0.0-20260223030516-06f84a1314be\th1:vqHrvilasyJcnru\u002F0Z4FoojsQJUIfXGVplte7JtupfY=\ndep\tgithub.com\u002Felnormous\u002Fcontenttype\tv1.0.4\th1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=\ndep\tgithub.com\u002Ffelixge\u002Fhttpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw\u002FQDuVfpNhoA31zeORc=\ndep\tgithub.com\u002Ffxamacker\u002Fcbor\u002Fv2\tv2.9.6\th1:NHZPxuUjJXQjX9itA785y\u002F5NKSlI4HQ+S7noZsmI7hs=\ndep\tgithub.com\u002Fgammazero\u002Fdeque\tv0.2.1\th1:qSdsbG6pgp6nL7A0+K\u002FB7s12mcCY\u002F5l5SIUpMOl+dC0=\ndep\tgithub.com\u002Fgetkin\u002Fkin-openapi\tv0.152.0\th1:XRVo77lMRyOGMHf1paMu9lxX3wzuQDZeprssZJnz\u002Fx8=\ndep\tgithub.com\u002Fgo-chi\u002Fchi\u002Fv5\tv5.5.0\th1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv3\tv3.0.5\th1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv4\tv4.1.6\th1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=\ndep\tgithub.com\u002Fgo-logr\u002Flogr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg\u002F+cPVcbP\u002F8=\ndep\tgithub.com\u002Fgo-logr\u002Fstdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=\ndep\tgithub.com\u002Fgo-openapi\u002Fjsonpointer\tv1.0.2\th1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=\ndep\tgithub.com\u002Fgofrs\u002Fflock\tv0.13.0\th1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ\u002FA8dRYMzw=\ndep\tgithub.com\u002Fgofrs\u002Fuuid\tv4.4.0+incompatible\th1:3qXRTX8\u002FNbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=\ndep\tgithub.com\u002Fgolang-jwt\u002Fjwt\u002Fv5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=\ndep\tgithub.com\u002Fgoogle\u002Fbrotli\u002Fgo\u002Fcbrotli\tv1.1.0\th1:YwHD\u002FrwSgUSL4b2S3ZM2jnNymm+tmwKQqjUIC63nmHU=\ndep\tgithub.com\u002Fgoogle\u002Fcertificate-transparency-go\tv1.4.0\th1:78uNaR2knzCoKKXXDSAGVkz9XPkDg5xXJRP9tP6+rr0=\ndep\tgithub.com\u002Fgoogle\u002Fflatbuffers\tv25.2.10+incompatible\th1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H\u002FpNX4FP1v0Q=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tpm\tv0.9.8\th1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tspi\tv0.3.0\th1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=\ndep\tgithub.com\u002Fgoogle\u002Fs2a-go\tv0.1.11\th1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=\ndep\tgithub.com\u002Fgoogle\u002Fuuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=\ndep\tgithub.com\u002Fgoogleapis\u002Fenterprise-certificate-proxy\tv0.3.24\th1:G9iCJIY+AYVmUskKdjX8FVy7sG+nbzjOQ41cvlmhcvg=\ndep\tgithub.com\u002Fgoogleapis\u002Fgax-go\u002Fv2\tv2.27.0\th1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc\u002FRRZhKA\u002F2g0=\ndep\tgithub.com\u002Fgorilla\u002Fhandlers\tv1.5.2\th1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=\ndep\tgithub.com\u002Fgorilla\u002Fmux\tv1.8.1\th1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=\ndep\tgithub.com\u002Fgrpc-ecosystem\u002Fgrpc-gateway\u002Fv2\tv2.32.0\th1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=\ndep\tgithub.com\u002Fhuandu\u002Fxstrings\tv1.6.3\th1:7997PcI0mYC9uPNBJ7udg\u002FKrdJh1GhJid8f2tzKFHYQ=\ndep\tgithub.com\u002Fklauspost\u002Fcompress\tv1.20.3\th1:zWNoFqq\u002FlSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=\ndep\tgithub.com\u002Fklauspost\u002Fcpuid\u002Fv2\tv2.4.1\th1:I9KxadAkvo+QjtcEE2f2tyfEvmIla\u002FT0m+14PrZNl0U=\ndep\tgithub.com\u002Flibdns\u002Flibdns\tv1.1.1\th1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS\u002FP\u002FU=\ndep\tgithub.com\u002Fmanifoldco\u002Fpromptui\tv0.9.0\th1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=\ndep\tgithub.com\u002Fmattn\u002Fgo-colorable\tv0.1.16\th1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=\ndep\tgithub.com\u002Fmattn\u002Fgo-isatty\tv0.0.24\th1:tGZZoVgT\u002FKiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\tv1.2.4\th1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\u002Fv2\tv2.4.0\th1:1XpRRWaq9DRIqZV7UtglS4VLzYKSsnFOQmzV+KZxLb0=\ndep\tgithub.com\u002Fmgutz\u002Fansi\tv0.0.0-20200706080929-d51e80ef957d\th1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=\ndep\tgithub.com\u002Fmholt\u002Facmez\u002Fv3\tv3.1.7\th1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=\ndep\tgithub.com\u002Fmholt\u002Fcaddy-ratelimit\tv0.1.0\th1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=\ndep\tgithub.com\u002Fmiekg\u002Fdns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=\ndep\tgithub.com\u002Fmitchellh\u002Fcopystructure\tv1.2.0\th1:vpKXTN4ewci03Vljg\u002Fq9QvCGUDttBOGBIa15WveJJGw=\ndep\tgithub.com\u002Fmitchellh\u002Fgo-ps\tv1.0.0\th1:i6ampVEEF4wQFF+bkYfwYgY+F\u002FuYJDktmvLPf7qIgjc=\ndep\tgithub.com\u002Fmitchellh\u002Freflectwalk\tv1.0.2\th1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=\ndep\tgithub.com\u002Fmunnerz\u002Fgoautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01\u002FOq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=\ndep\tgithub.com\u002Fnlnwa\u002Fwhatwg-url\tv0.6.2\th1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ\u002FQ=\ndep\tgithub.com\u002Fnutsdb\u002Fnutsdb\tv1.0.4\th1:BurzkxijXJY1\u002FAkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=\ndep\tgithub.com\u002Foasdiff\u002Fyaml\tv0.1.1\th1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=\ndep\tgithub.com\u002Foasdiff\u002Fyaml3\tv0.0.14\th1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=\ndep\tgithub.com\u002Fpbnjay\u002Fmemory\tv0.0.0-20210728143218-7b4eea64cf58\th1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=\ndep\tgithub.com\u002Fpierrec\u002Flz4\u002Fv4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=\ndep\tgithub.com\u002Fpires\u002Fgo-proxyproto\tv0.16.0\th1:9KYT\u002FfM3wpjT8bdMEj\u002F7FBcoiUG1KyzEjRYnPu+vz7A=\ndep\tgithub.com\u002Fpkg\u002Ferrors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=\ndep\tgithub.com\u002Fpquerna\u002Fcachecontrol\tv0.2.0\th1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=\ndep\tgithub.com\u002Fprometheus\u002Fclient_golang\tv1.25.0\th1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=\ndep\tgithub.com\u002Fprometheus\u002Fclient_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=\ndep\tgithub.com\u002Fprometheus\u002Fcommon\tv0.72.1\th1:ZAiQed\u002Fnk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=\ndep\tgithub.com\u002Fprometheus\u002Fotlptranslator\tv1.0.0\th1:s0LJW\u002FiN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=\ndep\tgithub.com\u002Fprometheus\u002Fprocfs\tv0.22.0\th1:6q9+\u002FJL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=\ndep\tgithub.com\u002Fquic-go\u002Fqpack\tv0.6.0\th1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=\ndep\tgithub.com\u002Fquic-go\u002Fquic-go\tv0.64.1\th1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=\ndep\tgithub.com\u002Fredis\u002Fgo-redis\u002Fv9\tv9.18.0\th1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=\ndep\tgithub.com\u002Frs\u002Fcors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=\ndep\tgithub.com\u002Frs\u002Fxid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=\ndep\tgithub.com\u002Frussross\u002Fblackfriday\u002Fv2\tv2.1.0\th1:JIOH55\u002F0cWyOuilr9\u002Fqlrm0BSXldqnqwMsf35Ld67mk=\ndep\tgithub.com\u002Fsanthosh-tekuri\u002Fjsonschema\u002Fv6\tv6.0.3\th1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls\u002F28=\ndep\tgithub.com\u002Fshopspring\u002Fdecimal\tv1.6.0\th1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=\ndep\tgithub.com\u002FshurcooL\u002Fsanitized_anchor_name\tv1.0.0\th1:PdmoCO6wvbs+7yrJyMORt4\u002FBmY5IYyJwS\u002FkOiWx8mHo=\ndep\tgithub.com\u002Fsirupsen\u002Flogrus\tv1.10.2\th1:G2SED73\u002FqrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=\ndep\tgithub.com\u002Fslackhq\u002Fnebula\tv1.11.2\th1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=\ndep\tgithub.com\u002Fsmallstep\u002Fcertificates\tv0.30.2\th1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf\u002FiQtA5QlN0Y=\ndep\tgithub.com\u002Fsmallstep\u002Fcli-utils\tv0.12.2\th1:lGzM9PJrH\u002FqawbzMC\u002Fs2SvgLdJPKDWKwKzx9doCVO+k=\ndep\tgithub.com\u002Fsmallstep\u002Fgo-attestation\tv0.4.9\th1:\u002FfVmzB8A8tk7B2PCGPlszWzyl\u002FGDcEQbynqcg2PMaZ0=\ndep\tgithub.com\u002Fsmallstep\u002Flinkedca\tv0.26.0\th1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=\ndep\tgithub.com\u002Fsmallstep\u002Fnosql\tv0.8.0\th1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli\u002FXB4Jp4A=\ndep\tgithub.com\u002Fsmallstep\u002Fpkcs7\tv0.2.3\th1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=\ndep\tgithub.com\u002Fsmallstep\u002Fscep\tv0.0.0-20261014185058-63893dadfda8\th1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=\ndep\tgithub.com\u002Fsmallstep\u002Ftruststore\tv0.13.0\th1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi\u002Fpy4=\ndep\tgithub.com\u002Fspf13\u002Fcast\tv1.10.0\th1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=\ndep\tgithub.com\u002Fspf13\u002Fcobra\tv1.10.2\th1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=\ndep\tgithub.com\u002Fspf13\u002Fpflag\tv1.0.10\th1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=\ndep\tgithub.com\u002Ftailscale\u002Ftscert\tv0.0.0-20251216020129-aea342f6d747\th1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=\ndep\tgithub.com\u002Ftidwall\u002Fbtree\tv1.6.0\th1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=\ndep\tgithub.com\u002Funrolled\u002Fsecure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=\ndep\tgithub.com\u002Furfave\u002Fcli\tv1.22.17\th1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=\ndep\tgithub.com\u002Fx448\u002Ffloat16\tv0.8.4\th1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=\ndep\tgithub.com\u002Fxujiajun\u002Fmmap-go\tv1.0.1\th1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv\u002FWHc=\ndep\tgithub.com\u002Fxujiajun\u002Futils\tv0.0.0-20220904132955-5f7c5b914235\th1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark\tv1.8.6\th1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark-highlighting\u002Fv2\tv2.0.0-20230729083705-37449abec8cc\th1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=\ndep\tgithub.com\u002Fzeebo\u002Fblake3\tv0.2.4\th1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM\u002FyBqhaZI=\ndep\tgo.etcd.io\u002Fbbolt\tv1.5.0\th1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P\u002FbD4lxU=\ndep\tgo.opentelemetry.io\u002Fauto\u002Fsdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ\u002FipaZ64=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fbridges\u002Fprometheus\tv0.72.0\th1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w\u002F1ROwHEM7M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fexporters\u002Fautoexport\tv0.72.0\th1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Finstrumentation\u002Fnet\u002Fhttp\u002Fotelhttp\tv0.72.0\th1:LxwW\u002F9ctSCv+QkE\u002FcLR7M91ZIkXNMqJtEMi1vCw9U8s=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fautoprop\tv0.72.0\th1:\u002FKv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Faws\tv1.47.0\th1:n\u002F2x\u002FvQki1ojD7R2jYHdnNdI74Yx\u002FOFdY4YXFFesm8M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fb3\tv1.47.0\th1:vlKDmtjhe1R0d7kdov\u002F+KVTKWOKeGLyohB+iXoDPRMQ=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fjaeger\tv1.47.0\th1:2lDw6AKPV33\u002F7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fot\tv1.47.0\th1:nZUqh0\u002F8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=\ndep\tgo.opentelemetry.io\u002Fotel\tv1.47.0\th1:j7ALJ\u002FzgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploggrpc\tv0.23.0\th1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploghttp\tv0.23.0\th1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI\u002FnE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetricgrpc\tv1.47.0\th1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetrichttp\tv1.47.0\th1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\tv1.47.0\th1:julhjPeUH\u002Fq\u002F7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracegrpc\tv1.47.0\th1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracehttp\tv1.47.0\th1:aXZXsZ012wOgVkqaiQv+Z\u002Fd8V0xKjmg70F6m4CE94lc=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fprometheus\tv0.69.0\th1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutlog\tv0.23.0\th1:PW\u002FE9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutmetric\tv1.47.0\th1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdouttrace\tv1.47.0\th1:N3YQCxjxQ\u002FbMjyc3heladfRm9t9RTksGQH8z4w6yU\u002F0=\ndep\tgo.opentelemetry.io\u002Fotel\u002Flog\tv1.47.0\th1:cOTS1CcLbSQeZKanGJ+0JpF\u002F+t4PELi3O3bbl2lqCcI=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fmetric\tv1.47.0\th1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\tv1.47.0\th1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Flog\tv1.47.0\th1:W4N\u002FZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Fmetric\tv1.47.0\th1:lfISg2j93VT6yqdk9OfUaZmw\u002FGfcZqCCV3jdXtsPnKw=\ndep\tgo.opentelemetry.io\u002Fotel\u002Ftrace\tv1.47.0\th1:JOjX\u002FOci8K94QHddo+bbfya\u002FAi\u002Fnf6\u002Fdt9ZfrFNWSrM=\ndep\tgo.opentelemetry.io\u002Fproto\u002Fotlp\tv1.11.1\th1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=\ndep\tgo.step.sm\u002Fcrypto\tv0.91.0\th1:0mN0DwVOvUuh7VbyTnxABZuAkxwak\u002FGrp8Y\u002Fb4YaZDU=\ndep\tgo.uber.org\u002Fatomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp\u002FAUETXlHW0DxSjE=\ndep\tgo.uber.org\u002Fautomaxprocs\tv1.6.0\th1:O3y2\u002FQNTOdbF+e\u002FdpXNNW7Rx2hZ4sTIPyybbxyNqTUs=\ndep\tgo.uber.org\u002Fmultierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=\ndep\tgo.uber.org\u002Fzap\tv1.28.0\th1:IZzaP1Fv73\u002FT\u002FpBMLk4VutPl36uNC+OSUh3JLG3FIjo=\ndep\tgo.uber.org\u002Fzap\u002Fexp\tv0.3.0\th1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=\ndep\tgo.yaml.in\u002Fyaml\u002Fv3\tv3.0.5\th1:N6y\u002FpJk8buWs9NY5ERU2HSMfm+IuD\u002FOtfdAnq6kESPw=\ndep\tgolang.org\u002Fx\u002Fcrypto\tv0.58.0\th1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K\u002FM\u002F54=\ndep\tgolang.org\u002Fx\u002Fcrypto\u002Fx509roots\u002Ffallback\tv0.0.0-20261020153306-9f2b28d4331a\th1:V5oicZXS0oqZx30gY\u002FapgSVD7YvNBfrIOdcMnlelJY4=\ndep\tgolang.org\u002Fx\u002Fexp\tv0.0.0-20261014143641-f0251eb4aa3e\th1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI\u002FA=\ndep\tgolang.org\u002Fx\u002Fnet\tv0.61.0\th1:RR+6j\u002FBTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=\ndep\tgolang.org\u002Fx\u002Foauth2\tv0.37.0\th1:JUlcxA8oAtauLfiH8FX2\u002FFkAWHAdi0QtGCGc+hofE98=\ndep\tgolang.org\u002Fx\u002Fsync\tv0.24.0\th1:iqiDrGoDgyuvAKrhLQthUEzU\u002FR378N78gXbBjxed7oA=\ndep\tgolang.org\u002Fx\u002Fsys\tv0.49.0\th1:XbzkgYJHdqh\u002F8m2Uu0W\u002FdQv8nktxx4BFHp1M0gROTXA=\ndep\tgolang.org\u002Fx\u002Fterm\tv0.47.0\th1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ\u002FBM=\ndep\tgolang.org\u002Fx\u002Ftext\tv0.43.0\th1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5\u002FUGUTJVXoWc=\ndep\tgolang.org\u002Fx\u002Ftime\tv0.16.0\th1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q\u002F6gY2hDM6VDE=\ndep\tgoogle.golang.org\u002Fapi\tv0.308.0\th1:iGb+4qT3nVb3uuIzwor3yP2nyu+rMZr31PvLFiRNJQk=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Fapi\tv0.0.0-20261019180522-ce908d29299b\th1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Frpc\tv0.0.0-20261019180522-ce908d29299b\th1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=\ndep\tgoogle.golang.org\u002Fgrpc\tv1.84.0\th1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=\ndep\tgoogle.golang.org\u002Fprotobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o\u002Ffwxc=\ndep\tgopkg.in\u002Fyaml.v3\tv3.0.1\th1:fxVm\u002FGzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=\nbuild\t-buildmode=exe\nbuild\t-compiler=gc\nbuild\t-ldflags=\"-w -s\"\nbuild\t-tags=nobadger,nomysql,nopgx\nbuild\tCGO_ENABLED=1\nbuild\tCGO_CFLAGS=\"-I\u002Fusr\u002Flocal\u002Finclude\u002Fphp -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fmain -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FTSRM -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FZend -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext\u002Fdate\u002Flib\"\nbuild\tCGO_CPPFLAGS=\"-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64\"\nbuild\tCGO_CXXFLAGS=\nbuild\tCGO_LDFLAGS=\"-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto\"\nbuild\tGOARCH=amd64\nbuild\tGOOS=linux\nbuild\tGOAMD64=v1\n\n```\n",{"part":901,"tag":958,"name":958,"publishedAt":959,"url":960,"body":961},"v2.0.0-alpha.30","2026-10-23T11:53:23Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.30","- A model-bound field (`useCwaResourceModel`) whose Keep mine is chosen while its refused save (a 412) is still settling sends its value again; before, the model dropped it as a duplicate of the refused request and showed the stored value from before the typing, which the TipTap reference then applied, losing every admin's typing for a moment ([e75b4561](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fe75b4561), [#435](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F435))\n- The playground's TipTap reference: on a page showing the same field twice, the second editor no longer applies its own tab's save over what another admin typed meanwhile, which deleted that typing for everyone; an app that copied it should copy `TipTapHtmlEditor.vue` and `tiptap\u002Fy-session.ts` again ([9e2836be](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F9e2836be), [#435](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F435))\n",{"part":901,"tag":963,"name":963,"publishedAt":964,"url":965,"body":966},"v2.0.0-alpha.29","2026-10-23T10:12:40Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.29","- A change typed in any model-bound field (`useCwaResourceModel`) whose resource another window's save moved to a draft before it was sent is no longer sent a second time, to the live resource, when the field returns to it (for example after a publish), which created a stray draft with the old value ([5949d187](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F5949d187), [cc156460](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fcc156460), [#435](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F435))\n- Admin saves and deletes send `If-Match` with the stored `_metadata.version`, one at a time per resource in a tab; a 412 shows the field's Use theirs \u002F Keep mine conflict (moving to the other admin's draft when there is one) for an admin with real-time on, and an error otherwise; Mercure updates with a lower version than the stored copy are dropped. Needs api-components-bundle 2.0.0-alpha.36 or later, whose CORS must allow `If-Match` for a cross-origin app ([460ba188](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F460ba188), [api-components-bundle#561](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F561))\n- `useCwaRealtime(iri).peers` entries carry the window's `clientId` (`RealtimePeer`), so an editor can tell which window joined or left ([8570bf57](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F8570bf57), [#435](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F435))\n- The playground's TipTap reference edits collaboratively with Yjs over `useCwaRealtime`: admins typing in the same field at once merge keystroke by keystroke with live cursors and shared-safe undo, each window saves its own typing (so Publish includes it) while one saves the merge, a change saved from outside is applied for everyone, no event exceeds the API's 16 KB limit, and the Yjs state is kept in the API's `\u002F_\u002Fcollaboration_states` ([8570bf57](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F8570bf57), [#435](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F435))\n- **Upgrade, for an app that copied the TipTap reference:** copy `components\u002FTipTapHtmlEditor.vue` and `tiptap\u002Fco-editing.ts`, `y-sync.ts`, `y-seed.ts`, `y-session.ts`, `y-state.ts` and `y-cursors.ts` again, with their specs; add `yjs`, `@tiptap\u002Fextension-collaboration` (on your other TipTap packages' version) and `@tiptap\u002Fy-tiptap`; pass the editor a `field` (`field=\"html\"`). Needs api-components-bundle 2.0.0-alpha.37 or later ([8570bf57](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F8570bf57), [#435](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F435))\n- A selected component whose draft another admin's first save created is edited as that draft, as the page already shows it; before, the tab kept the live version on screen and its next save overwrote that first save ([b4638e35](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fb4638e35), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- The playground's TipTap reference keeps spaces typed in a row when loading and when another admin's save arrives (`parseOptions: { preserveWhitespace: true }`, passed on to `applyRemoteContent`); an app that copied `TipTapHtmlEditor.vue` and `tiptap\u002Fco-editing.ts` should copy them again ([274b5907](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F274b5907), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n",{"part":907,"tag":968,"name":968,"publishedAt":969,"url":970,"body":971},"2.0.0-alpha.37","2026-10-22T19:23:04Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.37","### Breaking\n- A new table `collaboration_state` for the collaboration state store: run `doctrine:migrations:diff` and migrate before deploying ([#564](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F564))\n\n### Added\n- Collaboration state store for Yjs: `\u002F_\u002Fcollaboration_states` (admin only, `private, no-store`, never on Mercure) keeps a base64 `state` up to 8 MiB and an unchecked `htmlHash` per component or page data and `field`, filtered with `?component=\u003Ciri>&field=…` or `?pageData=\u003Ciri>&field=…`, versioned with `If-Match`\u002F412 like components; a draft of a published component shares its published component's state, and deleting a component or page data deletes its states ([#564](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F564))\n",{"part":907,"tag":973,"name":973,"publishedAt":974,"url":975,"body":976},"2.0.0-alpha.36","2026-10-22T18:42:45Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.36","### Breaking\n- Components and page data have a new Doctrine `#[ORM\\Version]` column `resource_version` on `abstract_component` and `abstract_page_data` (integer, default 1): run `doctrine:migrations:diff` and migrate before deploying ([#562](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F562))\n\n### Added\n- Optimistic concurrency for components and page data: each row's `_metadata.version` rises on every write and is on both Mercure updates, a signed-in response carries it as a strong `ETag` (and is `private, no-store`), and a `PATCH`, `PUT` or `DELETE` with a stale `If-Match`, an `If-Match` on a write redirected from a published IRI to its existing draft, a write that loses a race at commit, or the losing first edit of a published resource is 412 with the current resource as the body. A new draft starts at version 1. The order PATCH and `\u002Fmove` ignore `If-Match`. Cross-origin apps must expose `ETag` and allow `If-Match` in their CORS config ([#562](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F562))\n",{"part":901,"tag":978,"name":978,"publishedAt":979,"url":980,"body":981},"v2.0.0-alpha.28","2026-10-22T12:29:48Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.28","- Presence sends `editing` with the field in focus, and while a save or a group write for the selected component is waiting or in flight ([9b7efa52](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F9b7efa52), [c6655b04](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fc6655b04), [bcca4248](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fbcca4248), [644c3184](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F644c3184), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- `useCwaResourceModel` returns `focus()`, `blur()`, `focusedBy` (the other admins with that field in focus, in their colour, with a display `name` and the `clientIds` of their windows in it; type `FocusedPeer`) and `focusListeners` to `v-bind` on a custom editor's root (focus is also taken on pointerdown, for controls Safari does not focus on click, and kept on a pointerdown outside while focus stays inside, as on an editor's own menus); `CwaUiFormInput`, `CwaUiFormToggle` and `CwaUiSelect` with `:model` bind them, except while disabled ([f7e17d5d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Ff7e17d5d), [fdc5ab72](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Ffdc5ab72), [eaedc95c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Feaedc95c), [e0e38a98](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fe0e38a98), [52ac8f89](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F52ac8f89), [c6655b04](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fc6655b04), [7fa63882](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F7fa63882), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- `useCwaRealtime\u003CEvents>(iri)` returns `send(event, data)` and `on(event, handler)` for an app's own real-time events between admins (TipTap cursors, for example), typed by an `Events` map (`RealtimeEvents`, `RealtimeEventHandler`, `RealtimeMessage`): `send` returns `false` and sends nothing for a visitor or while the real-time connection is down, and a tab sends one real-time request at a time, at most 8 a second, presence first, a waiting send keeping only its newest data per resource and event; `on`'s handler gets one message (`clientId`, `user`, `name`, `isSelf`, `colour`, `event`, `data`, `sentAt`), hears other tabs only, draft and published as one, and a handler that throws is logged without stopping the others; `presence` and `cwa:*` names are reserved ([34651384](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F34651384), [eaedc95c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Feaedc95c), [a705681f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fa705681f), [8ab0f674](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F8ab0f674), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- `useCwaRealtime(iri).peers` lists the other admins on a resource, draft and published as one, with their display `name`, state, field, expiry, presence colour, `idle`, and `isSelf` with `device` for your own other windows ([839902f8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F839902f8), [d1ffb2d7](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fd1ffb2d7), [ef67619f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fef67619f), [95e71525](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F95e71525), [52ac8f89](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F52ac8f89), [c6655b04](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fc6655b04), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- In edit mode, what another admin on the same page has selected or is editing is outlined in their colour with a name flag that fades after 3 seconds and shows again on hover; the header list says \"Editing\" ([93589770](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F93589770), [55091576](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F55091576), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- `CwaUiRemoteChangeConflict` (`:change`, a model's `remoteChange`, which carries who made it as a display `name`) shows the \"Use theirs \u002F Keep mine\" choice beside an app's own editor, as the kit fields do; the playground's HtmlContent is the TipTap reference, with live cursors over `useCwaRealtime`'s `send`\u002F`on` ([839902f8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F839902f8), [6017aacf](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F6017aacf), [dcff94ca](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fdcff94ca), [d557590b](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fd557590b), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- `CwaUiFieldPresence` (`:model`) wraps a field in a thin outline with the name of whoever else has it focused; `CwaUiFormInput`, `CwaUiFormToggle` and `CwaUiSelect` with `:model` use it ([36e143e2](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F36e143e2), [072096e2](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F072096e2), [e050003a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fe050003a), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- The delete confirms say who else is editing the resource ([cacc589b](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fcacc589b), [ec0f83cc](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fec0f83cc), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- Presence goes idle while the tab is hidden or after 5 minutes without input, and carries a device label such as \"Chrome on macOS\"; idle admins are dimmed in the header and not outlined, and your own other windows show as \"You (other window)\" with their device, never counted as another editor ([839902f8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F839902f8), [0f429b8a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F0f429b8a), [68433a2e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F68433a2e), [ef67619f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fef67619f), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- A conflict from your own other window says \"You (other window) changed this\"; `RemoteUser` gains `isSelf` ([0f166f80](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F0f166f80), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- **Upgrade, for an app with its own field editor such as TipTap:** give it the field's `useCwaResourceModel` and wrap it in `\u003CCwaUiFieldPresence :model v-bind=\"model.focusListeners\">`, show `\u003CCwaUiRemoteChangeConflict v-if=\"remoteChange\" :change=\"remoteChange\">` beside it, and apply a remote save without moving the caret or adding to undo history; for live cursors, `send` and `on` a `selection` event through `useCwaRealtime(iri)`. Copy the playground's `components\u002FTipTapHtmlEditor.vue`, `components\u002FTipTap\u002FBubbleMenuButton.vue` and `tiptap\u002Fco-editing.ts`, with their specs. Kit fields with `:model` need nothing, and no bundle beyond 2.0.0-alpha.35 is needed ([d557590b](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fd557590b), [6017aacf](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F6017aacf), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n",{"part":901,"tag":983,"name":983,"publishedAt":984,"url":985,"body":986},"v2.0.0-alpha.27","2026-10-21T20:47:24Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.27","- The admin header shows who else is here: an avatar per admin on this page in their colour, \"+N elsewhere\", and a list of each one's page and what they have selected, linked; \"Live editing paused\" while the real-time connection is down ([b6c735af](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fb6c735af), [416888d1](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F416888d1), [d5165bab](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fd5165bab), [891fa5f5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F891fa5f5), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- A co-editing conflict names the admin who made the change instead of \"Someone\" when they are on the site ([b6c735af](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fb6c735af), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- Admins announce their presence with `POST \u002F_\u002Frealtime` (api-components-bundle 2.0.0-alpha.35 or later); an API with the endpoint turned off gets one warning and no further requests ([b6c735af](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fb6c735af), [274c774a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F274c774a), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n",{"part":885,"tag":988,"name":988,"publishedAt":989,"url":990,"body":991},"v2.0.0-alpha.46","2026-10-21T19:50:11Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.46","### Upgrade notes\n\n- **Take this release promptly: it is the PHP security release.** Its `cwa-php-base:2.0.0-alpha.46` has PHP 8.5.12 (CVE-2026-109618, CVE-2026-109619). Copy `api\u002FDockerfile` (its `CWA_PHP_BASE` default names this release) and redeploy. If you set `CWA_CI_PHP_BASE_IMAGE` to the `2.0.0-alpha.45-r20261021` rebuild in the meantime, delete it so the Dockerfile's default applies.\n- Bundle 2.0.0-alpha.35 and `@cwa\u002Fnuxt` 2.0.0-alpha.26 go together: update both in the same deploy.\n- `JWT_COOKIE_SAMESITE` now defaults to `strict` (`api\u002F.env` and `api\u002Fconfig\u002Fpackages\u002Flexik_jwt_authentication.yaml`). A site whose front end and API are on different registrable domains must set `CWA_API_JWT_COOKIE_SAMESITE=none`; `lax` keeps the old behaviour. [1cf48ad](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1cf48ad1f168d0d7f129f1334fcd639c12784aee)\n- `k8s.sh` now runs the new App command `app:edge-cache:purge-everything` on deploys with Cloudflare: copy `api\u002Fsrc\u002FCommand\u002FPurgeEdgeCacheCommand.php` with it. It uses `api\u002Fsrc\u002FRedisWatch\u002FCloudflareEdgeCache.php` and `EdgeCache.php`, already in alpha.44 and later (#218). [be7c71e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fbe7c71ea80e43fbfabf1eab6de280ac12ec19260)\n\n### Security\n\n- `session.upload_progress.enabled = 0` in `api\u002Ffrankenphp\u002Fconf.d\u002F10-app.ini`: unused by CWA, and one of php2shell's confirmed attack paths; PHP advises keeping it off even after patching. [5e9163c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5e9163c715c9fd0d236d5ead6f267d49fbdd41f8)\n- **The login (`api_component`), Mercure and session cookies are `SameSite=Strict` by default**, so no request another site starts carries them (CSRF hardening). An admin following a link from another site gets the anonymous page and is signed back in by the app's `\u002Fme` call; a browser test checks it. [1cf48ad](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1cf48ad1f168d0d7f129f1334fcd639c12784aee)\n- **PHP 8.5.12 (CVE-2026-109618, CVE-2026-109619, critical RCEs; the second affects long-running workers like FrankenPHP's).** `bin\u002Ftest\u002Fphp-base-smoke.sh` refuses a `cwa-php-base` below 8.5.12, so no release or rebuild can publish an unpatched PHP. [4136243](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F4136243fea7a5a14499ede187ad29244b968b52e)\n\n### Changed\n\n- `@cwa\u002Fnuxt` 2.0.0-alpha.26: co-editing's first slices. An admin sees another admin's saved draft in place, with \"Use theirs \u002F Keep mine\" on a field they're also editing, and components get `onRemoteChange`. Needs bundle 2.0.0-alpha.35 (cwa-nuxt-module#429, #219). [cb0ae4d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fcb0ae4db4be665262dd2acdbf6995035d2873510)\n- Bundle 2.0.0-alpha.35: the admin real-time channel (`POST \u002F_\u002Frealtime`) and `_metadata.lastWrite` on writes that send `X-CWA-Client-Id`; `symfony\u002Frate-limiter` is a new dependency. No migration. Its rate limits are per API pod (`cache.app`) (api-components-bundle#559). [f539463](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff539463ea996aac3fcdc130a4ab859f093b645ab)\n- CORS `allow_headers` adds `X-CWA-Client-Id`, which the module's co-editing will send on every write (cwa-nuxt-module#429). Added ahead of that module version so cross-origin admin writes keep passing their preflight; harmless until then (#219). [aca1900](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Faca1900b94f690afe267ce61cc42df3485ae8682)\n- **Deploys with Cloudflare no longer flush and re-warm the new API pod.** A single-pod deploy purges rendered HTML locally and everything at Cloudflare (new `app:edge-cache:purge-everything`), and keeps the pod's postStart warm; about 5 minutes off cymru-kitchens' production deploy. If the edge purge fails it falls back to the full flush and warm. Scaled mode is unchanged. The job now says the API rollout is waiting for the postStart warm, and for at most how long. (#218). [be7c71e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fbe7c71ea80e43fbfabf1eab6de280ac12ec19260)\n\n### Added\n\n- `cwa-php-base:latest`: an alias that follows the newest release or security rebuild (same digest and attestation; never a test build, never backwards). For trying the image by hand: the Dockerfile still names its release's version. [14a77e8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F14a77e84fccf315d2cf920af8876b35fd45e8f78)\n- `publish-php-base.yml` can run the security rebuild by hand (`-f tag=rebuild`), as `\u003Cnewest release>-rYYYYMMDD`, attested like the weekly one, so a PHP security release reaches downstream sites without a template release. [301d8b0](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F301d8b0b7d0f2bf5c2b7a379465e436bc8b43909)\n\n### Fixed\n\n- `bin\u002Ftest\u002Fcompose-prod-config.sh` finds the required values in `compose.yaml` and `compose.prod.yaml` instead of a fixed list, so a project that adds its own `${NAME:?…}` value (e.g. a Turnstile key) passes, and still fails if one of the template's required values stops being required (#207). [db6f1a0](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fdb6f1a0be3b72d73926ab5dd722d264dc7ed62ae)\n- README's versions table: `@cwa\u002Fnuxt` 2.0.0-alpha.21 recommends bundle 2.0.0-alpha.29 rather than requiring it, and says why bundle alpha.27 and alpha.28 are skipped. [7ef9eba](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F7ef9eba7452dda29edfdaffdbd95203b0f203b67)\n\n### cwa-php-base 2.0.0-alpha.46\n\nPin it as `ghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.46@sha256:bc40c7b43507ab022773692610f5080f10e842273435286de4de5a188f4f4c9f`.\n\nVerify it with:\n\n```sh\ngh attestation verify oci:\u002F\u002Fghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.46 --repo components-web-app\u002Fcomponents-web-app \\\n  --signer-workflow components-web-app\u002Fcomponents-web-app\u002F.github\u002Fworkflows\u002Fpublish-php-base.yml --source-ref refs\u002Ftags\u002Fv2.0.0-alpha.46\n```\n\n```\n# Base images (from the build provenance)\npkg:docker\u002Fcaddy@builder?platform=linux%2Famd64 sha256:8910fe662f448b860e8d16ef1c9a4f8946d3193bdc3e971bf0c55c9a2cf246f6\npkg:docker\u002Fcaddy@builder?platform=linux%2Farm64 sha256:8910fe662f448b860e8d16ef1c9a4f8946d3193bdc3e971bf0c55c9a2cf246f6\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:ae4f3b554449e7e25548e7d8ccc029d17357348e30c6e3df01b92bc93654d6a9\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:ae4f3b554449e7e25548e7d8ccc029d17357348e30c6e3df01b92bc93654d6a9\npkg:docker\u002Fdocker\u002Fdockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Famd64 sha256:55703c24b79df608de6ee8eb1f62e84370265ee5cbc519e3f0d5e867f42be481\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Farm64 sha256:55703c24b79df608de6ee8eb1f62e84370265ee5cbc519e3f0d5e867f42be481\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Famd64 sha256:8a7a935deb33959200628497b8201423c8b777d513a62ac1b69a91c624afdb3d\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Farm64 sha256:8a7a935deb33959200628497b8201423c8b777d513a62ac1b69a91c624afdb3d\n\nPHP 8.5.12 (cli) (built: Oct 21 2026 15:49:52) (ZTS)\nCopyright (c) The PHP Group\nBuilt by https:\u002F\u002Fgithub.com\u002Fdocker-library\u002Fphp\nZend Engine v4.5.12, Copyright (c) Zend Technologies\n    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies\n\n[PHP Modules]\napcu\nbrotli\nCore\nctype\ncurl\ndate\ndom\nexif\nFFI\nfileinfo\nfilter\ngd\nhash\niconv\nintl\njson\nlexbor\nlibxml\nmbstring\nmysqlnd\nopenssl\npcre\nPDO\npdo_pgsql\npdo_sqlite\nPhar\nposix\nrandom\nreadline\nReflection\nsession\nSimpleXML\nsodium\nSPL\nsqlite3\nstandard\ntokenizer\nuri\nxml\nxmlreader\nxmlwriter\nxsl\nZend OPcache\nzip\nzlib\n\n[Zend Modules]\nZend OPcache\n\n\ngo\tgo1.27.3\npath\tcaddy\nmod\tcaddy\t(devel)\t\ndep\tcel.dev\u002Fcel-go\tv0.32.0\th1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=\ndep\tcel.dev\u002Fexpr\tv0.25.3\th1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=\ndep\tcloud.google.com\u002Fgo\u002Fauth\tv0.24.1\th1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=\ndep\tcloud.google.com\u002Fgo\u002Fauth\u002Foauth2adapt\tv0.3.0\th1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=\ndep\tcloud.google.com\u002Fgo\u002Fcompute\u002Fmetadata\tv0.10.0\th1:pyKMUQSwchgkIBBJGdILqQbs\u002FBNJXqwSA7Ej6LAvvtY=\ndep\tdario.cat\u002Fmergo\tv1.0.2\th1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=\ndep\tfilippo.io\u002Fbigmod\tv0.1.0\th1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=\ndep\tfilippo.io\u002Fedwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=\ndep\tgithub.com\u002FBurntSushi\u002Ftoml\tv1.6.0\th1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=\ndep\tgithub.com\u002FDeRuina\u002Ftimberjack\tv1.4.9\th1:9RjDMSkUDQRYzwVNB\u002FFLonXNurcZVEh9sK43m2jw3A4=\ndep\tgithub.com\u002FKimMachineGun\u002Fautomemlimit\tv1.0.0\th1:+MqlvDE\u002FpkJNjk1rU+O14QsH8k10nJAD0frB0lsxyvw=\ndep\tgithub.com\u002FMasterminds\u002Fgoutils\tv1.1.1\th1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=\ndep\tgithub.com\u002FMasterminds\u002Fsemver\u002Fv3\tv3.5.0\th1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ\u002F2OOE=\ndep\tgithub.com\u002FMasterminds\u002Fsprig\u002Fv3\tv3.3.0\th1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=\ndep\tgithub.com\u002FMauriceGit\u002Fskiplist\tv0.0.0-20211105230623-77f5c8d3e145\th1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=\ndep\tgithub.com\u002FMicahParks\u002Fjwkset\tv0.11.3\th1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=\ndep\tgithub.com\u002FMicahParks\u002Fkeyfunc\u002Fv3\tv3.8.2\th1:eydEwk\u002FpBAVrDIpmFfB\u002FgkCcrp++xQ7YYXirrI2zlWE=\ndep\tgithub.com\u002FRoaringBitmap\u002Froaring\u002Fv2\tv2.30.0\th1:1sD4xsCenNd9n\u002FgOWaExCWanP9WTyiNuqLAvaDQ5jkY=\ndep\tgithub.com\u002Falecthomas\u002Fchroma\u002Fv2\tv2.27.0\th1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v\u002Fr5BXYZs=\ndep\tgithub.com\u002Fantlabs\u002Fstl\tv0.0.1\th1:TRD3csCrjREeLhLoQ\u002FsupaoCvFhNLBTNIwuRGrDIs6Q=\ndep\tgithub.com\u002Fantlabs\u002Ftimer\tv0.0.11\th1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=\ndep\tgithub.com\u002Fantlr4-go\u002Fantlr\u002Fv4\tv4.13.1\th1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=\ndep\tgithub.com\u002Faryann\u002Fdifflib\tv0.0.0-20210328193216-ff5ff6dc229b\th1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=\ndep\tgithub.com\u002Fbeorn7\u002Fperks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=\ndep\tgithub.com\u002Fbits-and-blooms\u002Fbitset\tv1.26.0\th1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=\ndep\tgithub.com\u002Fbwmarrin\u002Fsnowflake\tv0.3.0\th1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=\ndep\tgithub.com\u002Fcaddyserver\u002Fcaddy\u002Fv2\tv2.11.7\th1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=\ndep\tgithub.com\u002Fcaddyserver\u002Fcertmagic\tv0.25.6\th1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=\ndep\tgithub.com\u002Fcaddyserver\u002Fzerossl\tv0.1.6\th1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT\u002F4REW\u002F\u002Flsas=\ndep\tgithub.com\u002Fccoveille\u002Fgo-safecast\u002Fv2\tv2.0.1\th1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=\ndep\tgithub.com\u002Fcenkalti\u002Fbackoff\u002Fv5\tv5.0.3\th1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=\ndep\tgithub.com\u002Fcespare\u002Fxxhash\u002Fv2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=\ndep\tgithub.com\u002Fchzyer\u002Freadline\tv1.5.1\th1:upd\u002F6fQk4src78LMRzh5vItIt361\u002Fo4uq553V8B5sGI=\ndep\tgithub.com\u002Fcloudflare\u002Fcircl\tv1.6.5\th1:O64F26HEqNhznd\u002FhrC5KZXVKYuKM2rx4deZDTc4ihQA=\ndep\tgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fapi\u002Ffrankenphp\u002Fcaddy\u002Fqueryallowlist\tv0.0.0-20261021191111-0ef804abb9df\n=>\t\u002Ftmp\u002Fqueryallowlist\t(devel)\t\n\ndep\tgithub.com\u002Fcoreos\u002Fgo-oidc\u002Fv3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=\ndep\tgithub.com\u002Fcpuguy83\u002Fgo-md2man\u002Fv2\tv2.0.7\th1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\tv1.7.9\n=>\t\u002Ftmp\u002Fsouin\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\u002Fplugins\u002Fcaddy\tv1.7.9\th1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\tv0.0.21\th1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M\u002FJRc+zhN7Wsx0=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\u002Fcaddy\tv0.0.22\th1:4\u002FbyA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fcore\tv0.0.21\th1:zfa0Bqzdm9\u002FoPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\tv0.0.22\n=>\t\u002Ftmp\u002Fstorages-go-redis\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\u002Fcaddy\tv0.0.22\th1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\tv0.0.21\th1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\u002Fcaddy\tv0.0.22\th1:kg\u002FHYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\tv0.0.21\th1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\u002Fcaddy\tv0.0.22\th1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=\ndep\tgithub.com\u002Fdgraph-io\u002Fbadger\u002Fv4\tv4.9.1\th1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=\ndep\tgithub.com\u002Fdgraph-io\u002Fristretto\u002Fv2\tv2.2.0\th1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=\ndep\tgithub.com\u002Fdgryski\u002Fgo-rendezvous\tv0.0.0-20200823014737-9f7001d12a5f\th1:lO4WD4F\u002FrVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=\ndep\tgithub.com\u002Fdlclark\u002Fregexp2\u002Fv2\tv2.9.1\th1:q6bZW\u002FNN9VodqMjYXpuic2lZxdHPfFTzGS+MJxIJmKQ=\ndep\tgithub.com\u002Fdolthub\u002Fmaphash\tv0.1.0\th1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L\u002FQxPDyQ=\ndep\tgithub.com\u002Fdunglas\u002Fcaddy-cbrotli\tv1.0.1\th1:mkg7EB1GmoyfBt3kY3mq4o\u002F0bfnBeq7ZLQjmVmdBE3Y=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\tv1.13.2\th1:topp3lawUpnxdzS3k4MLYFmNWatcUDo54iwDNlCj2Ro=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\u002Fcaddy\tv1.13.2\th1:t3zGHRiWXb9PkiKJX3wGDNGilvPU8SlkYWmfgiFILtI=\ndep\tgithub.com\u002Fdunglas\u002Fgo-urlpattern\tv1.0.0\th1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=\ndep\tgithub.com\u002Fdunglas\u002Fhttpsfv\tv1.1.2\th1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ\u002FDkmc=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\tv1.1.4\th1:CtC2UiHGQQNcKfr6ZLlJTa93AP\u002FXUFdJQJfgfUtvphA=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\u002Fcaddy\tv1.1.4\th1:dKmvgwbRbuM2\u002FjRaIiSmBXYTnVtxQ218\u002FKHqzoeplBU=\ndep\tgithub.com\u002Fdunglas\u002Fskipfilter\tv1.2.0\th1:J7\u002FRXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\tv1.4.5\th1:vO7CS3\u002FKwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\u002Fcaddy\tv1.4.5\th1:2qzg18nEkpsc1QIvpNn\u002FoztSHRxY1\u002FG6xuxylxVobGY=\ndep\tgithub.com\u002Fdustin\u002Fgo-humanize\tv1.1.0\th1:dbKTrvD0klcbBV\u002Fh4AWJdMuZogJACoMlvWIWZ5b2xWg=\ndep\tgithub.com\u002Fe-dant\u002Fwatcher\tv0.0.0-20260223030516-06f84a1314be\th1:vqHrvilasyJcnru\u002F0Z4FoojsQJUIfXGVplte7JtupfY=\ndep\tgithub.com\u002Felnormous\u002Fcontenttype\tv1.0.4\th1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=\ndep\tgithub.com\u002Ffelixge\u002Fhttpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw\u002FQDuVfpNhoA31zeORc=\ndep\tgithub.com\u002Ffxamacker\u002Fcbor\u002Fv2\tv2.9.6\th1:NHZPxuUjJXQjX9itA785y\u002F5NKSlI4HQ+S7noZsmI7hs=\ndep\tgithub.com\u002Fgammazero\u002Fdeque\tv0.2.1\th1:qSdsbG6pgp6nL7A0+K\u002FB7s12mcCY\u002F5l5SIUpMOl+dC0=\ndep\tgithub.com\u002Fgetkin\u002Fkin-openapi\tv0.151.0\th1:p8NIstL53h620DnlO9R4pR4QRkEzJ3jbw9flb4kc1hg=\ndep\tgithub.com\u002Fgo-chi\u002Fchi\u002Fv5\tv5.5.0\th1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv3\tv3.0.5\th1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv4\tv4.1.6\th1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=\ndep\tgithub.com\u002Fgo-logr\u002Flogr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg\u002F+cPVcbP\u002F8=\ndep\tgithub.com\u002Fgo-logr\u002Fstdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=\ndep\tgithub.com\u002Fgo-openapi\u002Fjsonpointer\tv1.0.2\th1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=\ndep\tgithub.com\u002Fgofrs\u002Fflock\tv0.13.0\th1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ\u002FA8dRYMzw=\ndep\tgithub.com\u002Fgofrs\u002Fuuid\tv4.4.0+incompatible\th1:3qXRTX8\u002FNbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=\ndep\tgithub.com\u002Fgolang-jwt\u002Fjwt\u002Fv5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=\ndep\tgithub.com\u002Fgoogle\u002Fbrotli\u002Fgo\u002Fcbrotli\tv1.1.0\th1:YwHD\u002FrwSgUSL4b2S3ZM2jnNymm+tmwKQqjUIC63nmHU=\ndep\tgithub.com\u002Fgoogle\u002Fcertificate-transparency-go\tv1.4.0\th1:78uNaR2knzCoKKXXDSAGVkz9XPkDg5xXJRP9tP6+rr0=\ndep\tgithub.com\u002Fgoogle\u002Fflatbuffers\tv25.2.10+incompatible\th1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H\u002FpNX4FP1v0Q=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tpm\tv0.9.8\th1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tspi\tv0.3.0\th1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=\ndep\tgithub.com\u002Fgoogle\u002Fs2a-go\tv0.1.11\th1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=\ndep\tgithub.com\u002Fgoogle\u002Fuuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=\ndep\tgithub.com\u002Fgoogleapis\u002Fenterprise-certificate-proxy\tv0.3.23\th1:J+VGF1wjAM2dU2kKUXZxJdDppRLReWP7KWcclfngQhc=\ndep\tgithub.com\u002Fgoogleapis\u002Fgax-go\u002Fv2\tv2.26.2\th1:ydkmNXxj7bEmmeK5AihkKnWxyOyBR9TDebvp5L5izk8=\ndep\tgithub.com\u002Fgorilla\u002Fhandlers\tv1.5.2\th1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=\ndep\tgithub.com\u002Fgorilla\u002Fmux\tv1.8.1\th1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=\ndep\tgithub.com\u002Fgrpc-ecosystem\u002Fgrpc-gateway\u002Fv2\tv2.32.0\th1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=\ndep\tgithub.com\u002Fhuandu\u002Fxstrings\tv1.6.3\th1:7997PcI0mYC9uPNBJ7udg\u002FKrdJh1GhJid8f2tzKFHYQ=\ndep\tgithub.com\u002Fklauspost\u002Fcompress\tv1.20.3\th1:zWNoFqq\u002FlSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=\ndep\tgithub.com\u002Fklauspost\u002Fcpuid\u002Fv2\tv2.4.1\th1:I9KxadAkvo+QjtcEE2f2tyfEvmIla\u002FT0m+14PrZNl0U=\ndep\tgithub.com\u002Flibdns\u002Flibdns\tv1.1.1\th1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS\u002FP\u002FU=\ndep\tgithub.com\u002Fmanifoldco\u002Fpromptui\tv0.9.0\th1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=\ndep\tgithub.com\u002Fmattn\u002Fgo-colorable\tv0.1.16\th1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=\ndep\tgithub.com\u002Fmattn\u002Fgo-isatty\tv0.0.24\th1:tGZZoVgT\u002FKiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\tv1.2.4\th1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\u002Fv2\tv2.4.0\th1:1XpRRWaq9DRIqZV7UtglS4VLzYKSsnFOQmzV+KZxLb0=\ndep\tgithub.com\u002Fmgutz\u002Fansi\tv0.0.0-20200706080929-d51e80ef957d\th1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=\ndep\tgithub.com\u002Fmholt\u002Facmez\u002Fv3\tv3.1.7\th1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=\ndep\tgithub.com\u002Fmholt\u002Fcaddy-ratelimit\tv0.1.0\th1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=\ndep\tgithub.com\u002Fmiekg\u002Fdns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=\ndep\tgithub.com\u002Fmitchellh\u002Fcopystructure\tv1.2.0\th1:vpKXTN4ewci03Vljg\u002Fq9QvCGUDttBOGBIa15WveJJGw=\ndep\tgithub.com\u002Fmitchellh\u002Fgo-ps\tv1.0.0\th1:i6ampVEEF4wQFF+bkYfwYgY+F\u002FuYJDktmvLPf7qIgjc=\ndep\tgithub.com\u002Fmitchellh\u002Freflectwalk\tv1.0.2\th1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=\ndep\tgithub.com\u002Fmunnerz\u002Fgoautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01\u002FOq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=\ndep\tgithub.com\u002Fnlnwa\u002Fwhatwg-url\tv0.6.2\th1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ\u002FQ=\ndep\tgithub.com\u002Fnutsdb\u002Fnutsdb\tv1.0.4\th1:BurzkxijXJY1\u002FAkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=\ndep\tgithub.com\u002Foasdiff\u002Fyaml\tv0.1.1\th1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=\ndep\tgithub.com\u002Foasdiff\u002Fyaml3\tv0.0.14\th1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=\ndep\tgithub.com\u002Fpbnjay\u002Fmemory\tv0.0.0-20210728143218-7b4eea64cf58\th1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=\ndep\tgithub.com\u002Fpierrec\u002Flz4\u002Fv4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=\ndep\tgithub.com\u002Fpires\u002Fgo-proxyproto\tv0.16.0\th1:9KYT\u002FfM3wpjT8bdMEj\u002F7FBcoiUG1KyzEjRYnPu+vz7A=\ndep\tgithub.com\u002Fpkg\u002Ferrors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=\ndep\tgithub.com\u002Fpquerna\u002Fcachecontrol\tv0.2.0\th1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=\ndep\tgithub.com\u002Fprometheus\u002Fclient_golang\tv1.25.0\th1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=\ndep\tgithub.com\u002Fprometheus\u002Fclient_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=\ndep\tgithub.com\u002Fprometheus\u002Fcommon\tv0.72.1\th1:ZAiQed\u002Fnk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=\ndep\tgithub.com\u002Fprometheus\u002Fotlptranslator\tv1.0.0\th1:s0LJW\u002FiN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=\ndep\tgithub.com\u002Fprometheus\u002Fprocfs\tv0.22.0\th1:6q9+\u002FJL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=\ndep\tgithub.com\u002Fquic-go\u002Fqpack\tv0.6.0\th1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=\ndep\tgithub.com\u002Fquic-go\u002Fquic-go\tv0.64.1\th1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=\ndep\tgithub.com\u002Fredis\u002Fgo-redis\u002Fv9\tv9.18.0\th1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=\ndep\tgithub.com\u002Frs\u002Fcors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=\ndep\tgithub.com\u002Frs\u002Fxid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=\ndep\tgithub.com\u002Frussross\u002Fblackfriday\u002Fv2\tv2.1.0\th1:JIOH55\u002F0cWyOuilr9\u002Fqlrm0BSXldqnqwMsf35Ld67mk=\ndep\tgithub.com\u002Fsanthosh-tekuri\u002Fjsonschema\u002Fv6\tv6.0.3\th1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls\u002F28=\ndep\tgithub.com\u002Fshopspring\u002Fdecimal\tv1.6.0\th1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=\ndep\tgithub.com\u002FshurcooL\u002Fsanitized_anchor_name\tv1.0.0\th1:PdmoCO6wvbs+7yrJyMORt4\u002FBmY5IYyJwS\u002FkOiWx8mHo=\ndep\tgithub.com\u002Fsirupsen\u002Flogrus\tv1.10.2\th1:G2SED73\u002FqrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=\ndep\tgithub.com\u002Fslackhq\u002Fnebula\tv1.11.2\th1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=\ndep\tgithub.com\u002Fsmallstep\u002Fcertificates\tv0.30.2\th1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf\u002FiQtA5QlN0Y=\ndep\tgithub.com\u002Fsmallstep\u002Fcli-utils\tv0.12.2\th1:lGzM9PJrH\u002FqawbzMC\u002Fs2SvgLdJPKDWKwKzx9doCVO+k=\ndep\tgithub.com\u002Fsmallstep\u002Fgo-attestation\tv0.4.9\th1:\u002FfVmzB8A8tk7B2PCGPlszWzyl\u002FGDcEQbynqcg2PMaZ0=\ndep\tgithub.com\u002Fsmallstep\u002Flinkedca\tv0.26.0\th1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=\ndep\tgithub.com\u002Fsmallstep\u002Fnosql\tv0.8.0\th1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli\u002FXB4Jp4A=\ndep\tgithub.com\u002Fsmallstep\u002Fpkcs7\tv0.2.3\th1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=\ndep\tgithub.com\u002Fsmallstep\u002Fscep\tv0.0.0-20261014185058-63893dadfda8\th1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=\ndep\tgithub.com\u002Fsmallstep\u002Ftruststore\tv0.13.0\th1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi\u002Fpy4=\ndep\tgithub.com\u002Fspf13\u002Fcast\tv1.10.0\th1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=\ndep\tgithub.com\u002Fspf13\u002Fcobra\tv1.10.2\th1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=\ndep\tgithub.com\u002Fspf13\u002Fpflag\tv1.0.10\th1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=\ndep\tgithub.com\u002Ftailscale\u002Ftscert\tv0.0.0-20251216020129-aea342f6d747\th1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=\ndep\tgithub.com\u002Ftidwall\u002Fbtree\tv1.6.0\th1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=\ndep\tgithub.com\u002Funrolled\u002Fsecure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=\ndep\tgithub.com\u002Furfave\u002Fcli\tv1.22.17\th1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=\ndep\tgithub.com\u002Fx448\u002Ffloat16\tv0.8.4\th1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=\ndep\tgithub.com\u002Fxujiajun\u002Fmmap-go\tv1.0.1\th1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv\u002FWHc=\ndep\tgithub.com\u002Fxujiajun\u002Futils\tv0.0.0-20220904132955-5f7c5b914235\th1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark\tv1.8.6\th1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark-highlighting\u002Fv2\tv2.0.0-20230729083705-37449abec8cc\th1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=\ndep\tgithub.com\u002Fzeebo\u002Fblake3\tv0.2.4\th1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM\u002FyBqhaZI=\ndep\tgo.etcd.io\u002Fbbolt\tv1.5.0\th1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P\u002FbD4lxU=\ndep\tgo.opentelemetry.io\u002Fauto\u002Fsdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ\u002FipaZ64=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fbridges\u002Fprometheus\tv0.72.0\th1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w\u002F1ROwHEM7M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fexporters\u002Fautoexport\tv0.72.0\th1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Finstrumentation\u002Fnet\u002Fhttp\u002Fotelhttp\tv0.72.0\th1:LxwW\u002F9ctSCv+QkE\u002FcLR7M91ZIkXNMqJtEMi1vCw9U8s=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fautoprop\tv0.72.0\th1:\u002FKv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Faws\tv1.47.0\th1:n\u002F2x\u002FvQki1ojD7R2jYHdnNdI74Yx\u002FOFdY4YXFFesm8M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fb3\tv1.47.0\th1:vlKDmtjhe1R0d7kdov\u002F+KVTKWOKeGLyohB+iXoDPRMQ=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fjaeger\tv1.47.0\th1:2lDw6AKPV33\u002F7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fot\tv1.47.0\th1:nZUqh0\u002F8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=\ndep\tgo.opentelemetry.io\u002Fotel\tv1.47.0\th1:j7ALJ\u002FzgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploggrpc\tv0.23.0\th1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploghttp\tv0.23.0\th1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI\u002FnE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetricgrpc\tv1.47.0\th1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetrichttp\tv1.47.0\th1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\tv1.47.0\th1:julhjPeUH\u002Fq\u002F7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracegrpc\tv1.47.0\th1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracehttp\tv1.47.0\th1:aXZXsZ012wOgVkqaiQv+Z\u002Fd8V0xKjmg70F6m4CE94lc=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fprometheus\tv0.69.0\th1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutlog\tv0.23.0\th1:PW\u002FE9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutmetric\tv1.47.0\th1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdouttrace\tv1.47.0\th1:N3YQCxjxQ\u002FbMjyc3heladfRm9t9RTksGQH8z4w6yU\u002F0=\ndep\tgo.opentelemetry.io\u002Fotel\u002Flog\tv1.47.0\th1:cOTS1CcLbSQeZKanGJ+0JpF\u002F+t4PELi3O3bbl2lqCcI=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fmetric\tv1.47.0\th1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\tv1.47.0\th1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Flog\tv1.47.0\th1:W4N\u002FZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Fmetric\tv1.47.0\th1:lfISg2j93VT6yqdk9OfUaZmw\u002FGfcZqCCV3jdXtsPnKw=\ndep\tgo.opentelemetry.io\u002Fotel\u002Ftrace\tv1.47.0\th1:JOjX\u002FOci8K94QHddo+bbfya\u002FAi\u002Fnf6\u002Fdt9ZfrFNWSrM=\ndep\tgo.opentelemetry.io\u002Fproto\u002Fotlp\tv1.11.1\th1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=\ndep\tgo.step.sm\u002Fcrypto\tv0.91.0\th1:0mN0DwVOvUuh7VbyTnxABZuAkxwak\u002FGrp8Y\u002Fb4YaZDU=\ndep\tgo.uber.org\u002Fatomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp\u002FAUETXlHW0DxSjE=\ndep\tgo.uber.org\u002Fautomaxprocs\tv1.6.0\th1:O3y2\u002FQNTOdbF+e\u002FdpXNNW7Rx2hZ4sTIPyybbxyNqTUs=\ndep\tgo.uber.org\u002Fmultierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=\ndep\tgo.uber.org\u002Fzap\tv1.28.0\th1:IZzaP1Fv73\u002FT\u002FpBMLk4VutPl36uNC+OSUh3JLG3FIjo=\ndep\tgo.uber.org\u002Fzap\u002Fexp\tv0.3.0\th1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=\ndep\tgo.yaml.in\u002Fyaml\u002Fv3\tv3.0.5\th1:N6y\u002FpJk8buWs9NY5ERU2HSMfm+IuD\u002FOtfdAnq6kESPw=\ndep\tgolang.org\u002Fx\u002Fcrypto\tv0.58.0\th1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K\u002FM\u002F54=\ndep\tgolang.org\u002Fx\u002Fcrypto\u002Fx509roots\u002Ffallback\tv0.0.0-20261020153306-9f2b28d4331a\th1:V5oicZXS0oqZx30gY\u002FapgSVD7YvNBfrIOdcMnlelJY4=\ndep\tgolang.org\u002Fx\u002Fexp\tv0.0.0-20261014143641-f0251eb4aa3e\th1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI\u002FA=\ndep\tgolang.org\u002Fx\u002Fnet\tv0.61.0\th1:RR+6j\u002FBTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=\ndep\tgolang.org\u002Fx\u002Foauth2\tv0.37.0\th1:JUlcxA8oAtauLfiH8FX2\u002FFkAWHAdi0QtGCGc+hofE98=\ndep\tgolang.org\u002Fx\u002Fsync\tv0.24.0\th1:iqiDrGoDgyuvAKrhLQthUEzU\u002FR378N78gXbBjxed7oA=\ndep\tgolang.org\u002Fx\u002Fsys\tv0.49.0\th1:XbzkgYJHdqh\u002F8m2Uu0W\u002FdQv8nktxx4BFHp1M0gROTXA=\ndep\tgolang.org\u002Fx\u002Fterm\tv0.47.0\th1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ\u002FBM=\ndep\tgolang.org\u002Fx\u002Ftext\tv0.43.0\th1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5\u002FUGUTJVXoWc=\ndep\tgolang.org\u002Fx\u002Ftime\tv0.16.0\th1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q\u002F6gY2hDM6VDE=\ndep\tgoogle.golang.org\u002Fapi\tv0.306.0\th1:jbakJtAJAO1d8PUFandqfYHuf\u002FecaeTgoas7+hpXLHc=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Fapi\tv0.0.0-20261019180522-ce908d29299b\th1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Frpc\tv0.0.0-20261019180522-ce908d29299b\th1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=\ndep\tgoogle.golang.org\u002Fgrpc\tv1.84.0\th1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=\ndep\tgoogle.golang.org\u002Fprotobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o\u002Ffwxc=\ndep\tgopkg.in\u002Fyaml.v3\tv3.0.1\th1:fxVm\u002FGzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=\nbuild\t-buildmode=exe\nbuild\t-compiler=gc\nbuild\t-ldflags=\"-w -s\"\nbuild\t-tags=nobadger,nomysql,nopgx\nbuild\tCGO_ENABLED=1\nbuild\tCGO_CFLAGS=\"-I\u002Fusr\u002Flocal\u002Finclude\u002Fphp -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fmain -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FTSRM -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FZend -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext\u002Fdate\u002Flib\"\nbuild\tCGO_CPPFLAGS=\"-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64\"\nbuild\tCGO_CXXFLAGS=\nbuild\tCGO_LDFLAGS=\"-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto\"\nbuild\tGOARCH=amd64\nbuild\tGOOS=linux\nbuild\tGOAMD64=v1\n\n```\n",{"part":901,"tag":993,"name":993,"publishedAt":994,"url":995,"body":996},"v2.0.0-alpha.26","2026-10-21T19:14:22Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.26","- Real-time co-editing for admins: another admin's saved draft appears in place, and a field you are changing offers \"Use theirs \u002F Keep mine\"; visitors keep the outdated notice ([937a73db](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F937a73db), [ecbd27ae](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fecbd27ae), [ec646400](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fec646400), [94908ae2](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F94908ae2), [33c11503](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F33c11503), [7dcc4138](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F7dcc4138), [ff435de8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fff435de8), [b9a31a33](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fb9a31a33), [2371595e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F2371595e), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- A component removed by someone else is deselected, and unsaved edits to a draft published elsewhere go to a new draft ([937a73db](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F937a73db), [94908ae2](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F94908ae2), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- **Breaking:** admin writes send `X-CWA-Client-Id`, so the API's CORS `allow_headers` must include it; `cwa.realtime.enabled: false` turns co-editing off. Needs api-components-bundle 2.0.0-alpha.35 or later (`_metadata.lastWrite`) ([#559](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F559), [#560](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F560)) ([937a73db](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F937a73db), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- `onRemoteChange(iri, handler)` tells a component when another admin's saved draft of that resource arrives, with the changed fields and an `accept()` ([20bd455f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F20bd455f), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n- `CwaUiFormInput`, `CwaUiFormToggle` and `CwaUiSelect` take `:model` (the return of `useCwaResourceModel`), which shows a co-editing conflict beside the control; `useCwaResourceModel` also returns `remoteChange` ([8eee851a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F8eee851a), [7dcc4138](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F7dcc4138), [#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F429))\n",{"part":907,"tag":998,"name":998,"publishedAt":999,"url":1000,"body":1001},"2.0.0-alpha.35","2026-10-21T19:07:49Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.35","### Added\n- `POST \u002F_\u002Frealtime`, an admin real-time channel: an admin's `{clientId, event, iri?, data?}` (16 KB at most) is published privately, with no SSE type, as a `CwaRealtimeEvent` with `\"v\": 1` on one site-wide topic that only admins' subscriber cookies grant; nothing is stored. JSON accepts any event, `text\u002Fplain` (`navigator.sendBeacon`) only a presence event whose `data.state` is `left`, anything else is 415; 422 per invalid field, 413 over 16 KB, 403 for a cross-site `text\u002Fplain` body (`Sec-Fetch-Site`; a cross-site JSON body is left to CORS), 429 with `Retry-After` (the longer wait) past either limit: a burst of 20 or 10 a second per user and client, and 60 or 30 a second per user across their clients. The publish is bounded at 1 s with no retries on a copy of the hub's own HTTP client, and a failed or timed-out publish is logged and still 202. `realtime.enabled: false` removes the endpoint (404) and its subscriber grant; it must be a literal boolean, not an env var. Its limiters' pool is a `framework.cache.pools` entry an application can point at another adapter. A write carrying `X-CWA-Client-Id` echoes `_metadata.lastWrite: {clientId, userId, at}` (`at` the server's time with milliseconds) in the writer's response and the private `?draft=1` update, never the public one ([#560](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F560))\n\n### Changed\n- `symfony\u002Frate-limiter` (`^7.4 || ^8.1`) is now a runtime requirement, for the real-time channel's limit ([#560](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F560))\n",{"part":885,"tag":1003,"name":1003,"publishedAt":1004,"url":815,"body":1005},"v2.0.0-alpha.45","2026-10-20T23:30:55Z","## [2.0.0-alpha.45](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.45) - 2026-10-21\n\n### Upgrade notes\n\n- `CWA_CI_MIGRATIONS_JOB_PRODUCTION` is no longer read: production always migrates in a Job. Delete the variable. Only if that Job can't run on your cluster, set `CWA_CI_MIGRATIONS_JOB_DISABLED=\"true\"`. `CWA_CI_MIGRATIONS_JOB_STAGING`\u002F`_CANARY`\u002F`_REVIEW` are unchanged (#180). [407aa51](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F407aa51e459184c7af03078484a8d9a366eb88f2)\n- **`compose.prod.yaml` (single-server, preview) takes `SITE_HOST` (one host) and `SITE_ALIASES` (optional, space-separated) instead of `SERVER_NAME`, and now requires `MAILER_DSN` and `GCLOUD_BUCKET`.** Rename `SERVER_NAME` in the `.env` a single-server deploy uses and add the two values. Copy together: `compose.prod.yaml`, `api\u002Ffrankenphp\u002Fdocker-entrypoint.sh`, `api\u002Ffrankenphp\u002Fsite-hosts.sh` (new), `api\u002FDockerfile`; a project that copied `e2e\u002F` takes `e2e\u002Fcompose.yaml`, `e2e\u002Fcompose.scaled.yaml`, `e2e\u002Frun.sh` and `e2e\u002Fcache-checks.sh` (new) together (#207). [5bfc71f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5bfc71f4d89fdccb5fce3578f1c23eab69f7cabd)\n\n### Changed\n\n- `@cwa\u002Fnuxt` 2.0.0-alpha.25 (same bundle as alpha.24, 2.0.0-alpha.32 or later): Clone and Move outline the target and open a menu at the click point, with a reason on each disabled option; the clone and shared outlines no longer show above the admin header; the package ships its MIT licence. [eb31f50](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Feb31f5068c0550edb5a87755ac6306eebc42b99d)\n- **Production deploys always plan migrations, and run pending ones in a Job from the new image before the rollout**, so a failing migration stops the deploy while the old pods keep serving. It adds ~20-30 s to a production deploy; nothing else runs when nothing is pending. Pods still migrate at startup behind the lock (a no-op after the Job; it covers first deploys and rollbacks) (#180). [407aa51](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F407aa51e459184c7af03078484a8d9a366eb88f2)\n- The README now gives CWA's status, requirements, a quick start to the login, a screenshot of inline editing, the demo site, deploy options as they stand (Kubernetes supported, single server preview), a versions and support policy with the bundle and module pairs, and a no-telemetry statement. The S3 claim and the stray Blackfire image are gone (#209). [49dc263](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F49dc26367faa2406371ddecda54955036a15c5de)\n- **Staging and review apps no longer warm `\u002F_api`** (the postStart warm and the warm after a full flush), since nobody visits them: Cymru Kitchens' staging job spent most of its 12.5 min on warms. `CWA_CI_API_WARM_HTTP_CACHE_MAX_TIME_\u003CTRACK>` (`_PRODUCTION`, `_CANARY`, `_STAGING`, `_REVIEW`) sets a track's time; production and canary still fall back to `CWA_CI_API_WARM_HTTP_CACHE_MAX_TIME`, then 60 (#217). [1824cfb](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1824cfbd18d837ceb414a3ddfea01ff1af148517)\n- Single-server production (`compose.prod.yaml`, preview: media still needs a bucket, #211; no deploy script yet, #212) sets what the Kubernetes deploy sets for its hosts: anchored, escaped `TRUSTED_HOSTS`, `CORS_ALLOW_ORIGIN` and `MERCURE_CORS_ORIGIN` (built by the php entrypoint from `SITE_HOST`\u002F`SITE_ALIASES`; a value you set wins), `NUXT_SITE_URL`, `CWA_ENVIRONMENT`, log rotation, restart policies and a healthy-database dependency. Its `MERCURE_PUBLIC_URL` and `BROWSER_SERVER_NAME` no longer break with more than one host. The browser tests now boot `compose.yaml` + `compose.prod.yaml` with CI stand-ins and run cache checks before Playwright (stored then hit, a tag purge drops only its page, admin port closed); a new `compose config` CI job checks the required values (#207). [5bfc71f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5bfc71f4d89fdccb5fce3578f1c23eab69f7cabd)\n\n### Fixed\n\n- Single-server: a comma-separated `SITE_ALIASES` stops the php entrypoint with a clear message (Caddy refuses commas in `SERVER_NAME`), and the browser tests' cache checks run on a site whose sitemap lists one page (they skip the tag-isolation check) (#207). [d6acdee](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd6acdeea7095f00093dc5241ecc6686e46495acf)\n- `bin\u002Fup --skip-fixtures` no longer says the admin is unchanged on a database that has none (#206). [be18f08](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fbe18f085c15f67bdae587782eab74e9bf1c406a9)\n\n## php base image\n\n### cwa-php-base 2.0.0-alpha.45\n\nPin it as `ghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.45@sha256:5b4368c41a1b663d87e0491eda4bb2576e4f162a55ab9170bcb46c7ef8ec40a4`.\n\nVerify it with:\n\n```sh\ngh attestation verify oci:\u002F\u002Fghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.45 --repo components-web-app\u002Fcomponents-web-app \\\n  --signer-workflow components-web-app\u002Fcomponents-web-app\u002F.github\u002Fworkflows\u002Fpublish-php-base.yml --source-ref refs\u002Ftags\u002Fv2.0.0-alpha.45\n```\n\n```\n# Base images (from the build provenance)\npkg:docker\u002Fcaddy@builder?platform=linux%2Famd64 sha256:8910fe662f448b860e8d16ef1c9a4f8946d3193bdc3e971bf0c55c9a2cf246f6\npkg:docker\u002Fcaddy@builder?platform=linux%2Farm64 sha256:8910fe662f448b860e8d16ef1c9a4f8946d3193bdc3e971bf0c55c9a2cf246f6\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:ae4f3b554449e7e25548e7d8ccc029d17357348e30c6e3df01b92bc93654d6a9\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:ae4f3b554449e7e25548e7d8ccc029d17357348e30c6e3df01b92bc93654d6a9\npkg:docker\u002Fdocker\u002Fdockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Famd64 sha256:b8111ac35949fc6377db7af69bbfe0acdd226dcd09d886799476f0cdee226b5a\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Farm64 sha256:b8111ac35949fc6377db7af69bbfe0acdd226dcd09d886799476f0cdee226b5a\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Famd64 sha256:4a8eebee6b3bed92d01ffa6ec5b1bc2cb9c2ab7eeb546027a3f7e6a52937ebbb\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Farm64 sha256:4a8eebee6b3bed92d01ffa6ec5b1bc2cb9c2ab7eeb546027a3f7e6a52937ebbb\n\nPHP 8.5.11 (cli) (built: Oct  6 2026 01:23:29) (ZTS)\nCopyright (c) The PHP Group\nBuilt by https:\u002F\u002Fgithub.com\u002Fdocker-library\u002Fphp\nZend Engine v4.5.11, Copyright (c) Zend Technologies\n    with Zend OPcache v8.5.11, Copyright (c), by Zend Technologies\n\n[PHP Modules]\napcu\nbrotli\nCore\nctype\ncurl\ndate\ndom\nexif\nFFI\nfileinfo\nfilter\ngd\nhash\niconv\nintl\njson\nlexbor\nlibxml\nmbstring\nmysqlnd\nopenssl\npcre\nPDO\npdo_pgsql\npdo_sqlite\nPhar\nposix\nrandom\nreadline\nReflection\nsession\nSimpleXML\nsodium\nSPL\nsqlite3\nstandard\ntokenizer\nuri\nxml\nxmlreader\nxmlwriter\nxsl\nZend OPcache\nzip\nzlib\n\n[Zend Modules]\nZend OPcache\n\n\ngo\tgo1.27.2\npath\tcaddy\nmod\tcaddy\t(devel)\t\ndep\tcel.dev\u002Fcel-go\tv0.32.0\th1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=\ndep\tcel.dev\u002Fexpr\tv0.25.3\th1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=\ndep\tcloud.google.com\u002Fgo\u002Fauth\tv0.24.1\th1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=\ndep\tcloud.google.com\u002Fgo\u002Fauth\u002Foauth2adapt\tv0.3.0\th1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=\ndep\tcloud.google.com\u002Fgo\u002Fcompute\u002Fmetadata\tv0.10.0\th1:pyKMUQSwchgkIBBJGdILqQbs\u002FBNJXqwSA7Ej6LAvvtY=\ndep\tdario.cat\u002Fmergo\tv1.0.2\th1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=\ndep\tfilippo.io\u002Fbigmod\tv0.1.0\th1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=\ndep\tfilippo.io\u002Fedwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=\ndep\tgithub.com\u002FBurntSushi\u002Ftoml\tv1.6.0\th1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=\ndep\tgithub.com\u002FDeRuina\u002Ftimberjack\tv1.4.9\th1:9RjDMSkUDQRYzwVNB\u002FFLonXNurcZVEh9sK43m2jw3A4=\ndep\tgithub.com\u002FKimMachineGun\u002Fautomemlimit\tv1.0.0\th1:+MqlvDE\u002FpkJNjk1rU+O14QsH8k10nJAD0frB0lsxyvw=\ndep\tgithub.com\u002FMasterminds\u002Fgoutils\tv1.1.1\th1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=\ndep\tgithub.com\u002FMasterminds\u002Fsemver\u002Fv3\tv3.5.0\th1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ\u002F2OOE=\ndep\tgithub.com\u002FMasterminds\u002Fsprig\u002Fv3\tv3.3.0\th1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=\ndep\tgithub.com\u002FMauriceGit\u002Fskiplist\tv0.0.0-20211105230623-77f5c8d3e145\th1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=\ndep\tgithub.com\u002FMicahParks\u002Fjwkset\tv0.11.3\th1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=\ndep\tgithub.com\u002FMicahParks\u002Fkeyfunc\u002Fv3\tv3.8.2\th1:eydEwk\u002FpBAVrDIpmFfB\u002FgkCcrp++xQ7YYXirrI2zlWE=\ndep\tgithub.com\u002FRoaringBitmap\u002Froaring\u002Fv2\tv2.29.0\th1:jSjxqZEqiF9W5dHUFsemupb9bnLaQJwZVe5yMetbsZg=\ndep\tgithub.com\u002Falecthomas\u002Fchroma\u002Fv2\tv2.27.0\th1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v\u002Fr5BXYZs=\ndep\tgithub.com\u002Fantlabs\u002Fstl\tv0.0.1\th1:TRD3csCrjREeLhLoQ\u002FsupaoCvFhNLBTNIwuRGrDIs6Q=\ndep\tgithub.com\u002Fantlabs\u002Ftimer\tv0.0.11\th1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=\ndep\tgithub.com\u002Fantlr4-go\u002Fantlr\u002Fv4\tv4.13.1\th1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=\ndep\tgithub.com\u002Faryann\u002Fdifflib\tv0.0.0-20210328193216-ff5ff6dc229b\th1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=\ndep\tgithub.com\u002Fbeorn7\u002Fperks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=\ndep\tgithub.com\u002Fbits-and-blooms\u002Fbitset\tv1.26.0\th1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=\ndep\tgithub.com\u002Fbwmarrin\u002Fsnowflake\tv0.3.0\th1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=\ndep\tgithub.com\u002Fcaddyserver\u002Fcaddy\u002Fv2\tv2.11.7\th1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=\ndep\tgithub.com\u002Fcaddyserver\u002Fcertmagic\tv0.25.6\th1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=\ndep\tgithub.com\u002Fcaddyserver\u002Fzerossl\tv0.1.6\th1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT\u002F4REW\u002F\u002Flsas=\ndep\tgithub.com\u002Fccoveille\u002Fgo-safecast\u002Fv2\tv2.0.1\th1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=\ndep\tgithub.com\u002Fcenkalti\u002Fbackoff\u002Fv5\tv5.0.3\th1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=\ndep\tgithub.com\u002Fcespare\u002Fxxhash\u002Fv2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=\ndep\tgithub.com\u002Fchzyer\u002Freadline\tv1.5.1\th1:upd\u002F6fQk4src78LMRzh5vItIt361\u002Fo4uq553V8B5sGI=\ndep\tgithub.com\u002Fcloudflare\u002Fcircl\tv1.6.5\th1:O64F26HEqNhznd\u002FhrC5KZXVKYuKM2rx4deZDTc4ihQA=\ndep\tgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fapi\u002Ffrankenphp\u002Fcaddy\u002Fqueryallowlist\tv0.0.0-20261020231609-97e2d1396021\n=>\t\u002Ftmp\u002Fqueryallowlist\t(devel)\t\n\ndep\tgithub.com\u002Fcoreos\u002Fgo-oidc\u002Fv3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=\ndep\tgithub.com\u002Fcpuguy83\u002Fgo-md2man\u002Fv2\tv2.0.7\th1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\tv1.7.9\n=>\t\u002Ftmp\u002Fsouin\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\u002Fplugins\u002Fcaddy\tv1.7.9\th1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\tv0.0.21\th1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M\u002FJRc+zhN7Wsx0=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\u002Fcaddy\tv0.0.22\th1:4\u002FbyA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fcore\tv0.0.21\th1:zfa0Bqzdm9\u002FoPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\tv0.0.22\n=>\t\u002Ftmp\u002Fstorages-go-redis\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\u002Fcaddy\tv0.0.22\th1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\tv0.0.21\th1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\u002Fcaddy\tv0.0.22\th1:kg\u002FHYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\tv0.0.21\th1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\u002Fcaddy\tv0.0.22\th1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=\ndep\tgithub.com\u002Fdgraph-io\u002Fbadger\u002Fv4\tv4.9.1\th1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=\ndep\tgithub.com\u002Fdgraph-io\u002Fristretto\u002Fv2\tv2.2.0\th1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=\ndep\tgithub.com\u002Fdgryski\u002Fgo-rendezvous\tv0.0.0-20200823014737-9f7001d12a5f\th1:lO4WD4F\u002FrVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=\ndep\tgithub.com\u002Fdlclark\u002Fregexp2\u002Fv2\tv2.9.1\th1:q6bZW\u002FNN9VodqMjYXpuic2lZxdHPfFTzGS+MJxIJmKQ=\ndep\tgithub.com\u002Fdolthub\u002Fmaphash\tv0.1.0\th1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L\u002FQxPDyQ=\ndep\tgithub.com\u002Fdunglas\u002Fcaddy-cbrotli\tv1.0.1\th1:mkg7EB1GmoyfBt3kY3mq4o\u002F0bfnBeq7ZLQjmVmdBE3Y=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\tv1.13.1\th1:TaYlWf8lFW5Kc9dorlqytvM6zEEdywk\u002FHwOmfpzhi5Y=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\u002Fcaddy\tv1.13.1\th1:pRZMmvSLaBaVocyblRad4+IFYTR2F\u002Fjuo576a25yIW0=\ndep\tgithub.com\u002Fdunglas\u002Fgo-urlpattern\tv1.0.0\th1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=\ndep\tgithub.com\u002Fdunglas\u002Fhttpsfv\tv1.1.2\th1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ\u002FDkmc=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\tv1.1.4\th1:CtC2UiHGQQNcKfr6ZLlJTa93AP\u002FXUFdJQJfgfUtvphA=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\u002Fcaddy\tv1.1.4\th1:dKmvgwbRbuM2\u002FjRaIiSmBXYTnVtxQ218\u002FKHqzoeplBU=\ndep\tgithub.com\u002Fdunglas\u002Fskipfilter\tv1.2.0\th1:J7\u002FRXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\tv1.4.5\th1:vO7CS3\u002FKwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\u002Fcaddy\tv1.4.5\th1:2qzg18nEkpsc1QIvpNn\u002FoztSHRxY1\u002FG6xuxylxVobGY=\ndep\tgithub.com\u002Fdustin\u002Fgo-humanize\tv1.1.0\th1:dbKTrvD0klcbBV\u002Fh4AWJdMuZogJACoMlvWIWZ5b2xWg=\ndep\tgithub.com\u002Fe-dant\u002Fwatcher\tv0.0.0-20260223030516-06f84a1314be\th1:vqHrvilasyJcnru\u002F0Z4FoojsQJUIfXGVplte7JtupfY=\ndep\tgithub.com\u002Felnormous\u002Fcontenttype\tv1.0.4\th1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=\ndep\tgithub.com\u002Ffelixge\u002Fhttpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw\u002FQDuVfpNhoA31zeORc=\ndep\tgithub.com\u002Ffxamacker\u002Fcbor\u002Fv2\tv2.9.6\th1:NHZPxuUjJXQjX9itA785y\u002F5NKSlI4HQ+S7noZsmI7hs=\ndep\tgithub.com\u002Fgammazero\u002Fdeque\tv0.2.1\th1:qSdsbG6pgp6nL7A0+K\u002FB7s12mcCY\u002F5l5SIUpMOl+dC0=\ndep\tgithub.com\u002Fgetkin\u002Fkin-openapi\tv0.149.0\th1:ZbhmVJ4yq5RZDUsyP8lcBcGMsjsaTqXEFt6isdtMDfA=\ndep\tgithub.com\u002Fgo-chi\u002Fchi\u002Fv5\tv5.5.0\th1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv3\tv3.0.5\th1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv4\tv4.1.6\th1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=\ndep\tgithub.com\u002Fgo-logr\u002Flogr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg\u002F+cPVcbP\u002F8=\ndep\tgithub.com\u002Fgo-logr\u002Fstdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=\ndep\tgithub.com\u002Fgo-openapi\u002Fjsonpointer\tv1.0.2\th1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=\ndep\tgithub.com\u002Fgofrs\u002Fflock\tv0.13.0\th1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ\u002FA8dRYMzw=\ndep\tgithub.com\u002Fgofrs\u002Fuuid\tv4.4.0+incompatible\th1:3qXRTX8\u002FNbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=\ndep\tgithub.com\u002Fgolang-jwt\u002Fjwt\u002Fv5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=\ndep\tgithub.com\u002Fgoogle\u002Fbrotli\u002Fgo\u002Fcbrotli\tv1.1.0\th1:YwHD\u002FrwSgUSL4b2S3ZM2jnNymm+tmwKQqjUIC63nmHU=\ndep\tgithub.com\u002Fgoogle\u002Fcertificate-transparency-go\tv1.3.3\th1:hq\u002FrSxztSkXN2tx\u002F3jQqF6Xc0O565UQPdHrOWvZwybo=\ndep\tgithub.com\u002Fgoogle\u002Fflatbuffers\tv25.2.10+incompatible\th1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H\u002FpNX4FP1v0Q=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tpm\tv0.9.8\th1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tspi\tv0.3.0\th1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=\ndep\tgithub.com\u002Fgoogle\u002Fs2a-go\tv0.1.11\th1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=\ndep\tgithub.com\u002Fgoogle\u002Fuuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=\ndep\tgithub.com\u002Fgoogleapis\u002Fenterprise-certificate-proxy\tv0.3.23\th1:J+VGF1wjAM2dU2kKUXZxJdDppRLReWP7KWcclfngQhc=\ndep\tgithub.com\u002Fgoogleapis\u002Fgax-go\u002Fv2\tv2.26.2\th1:ydkmNXxj7bEmmeK5AihkKnWxyOyBR9TDebvp5L5izk8=\ndep\tgithub.com\u002Fgorilla\u002Fhandlers\tv1.5.2\th1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=\ndep\tgithub.com\u002Fgorilla\u002Fmux\tv1.8.1\th1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=\ndep\tgithub.com\u002Fgrpc-ecosystem\u002Fgrpc-gateway\u002Fv2\tv2.32.0\th1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=\ndep\tgithub.com\u002Fhuandu\u002Fxstrings\tv1.6.2\th1:+X5X6N46b40cmDw7FFJFU6Eoq0yJS8lbYigT2EFau4c=\ndep\tgithub.com\u002Fklauspost\u002Fcompress\tv1.20.3\th1:zWNoFqq\u002FlSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=\ndep\tgithub.com\u002Fklauspost\u002Fcpuid\u002Fv2\tv2.4.1\th1:I9KxadAkvo+QjtcEE2f2tyfEvmIla\u002FT0m+14PrZNl0U=\ndep\tgithub.com\u002Flibdns\u002Flibdns\tv1.1.1\th1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS\u002FP\u002FU=\ndep\tgithub.com\u002Fmanifoldco\u002Fpromptui\tv0.9.0\th1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=\ndep\tgithub.com\u002Fmattn\u002Fgo-colorable\tv0.1.16\th1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=\ndep\tgithub.com\u002Fmattn\u002Fgo-isatty\tv0.0.24\th1:tGZZoVgT\u002FKiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\tv1.2.4\th1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\u002Fv2\tv2.3.0\th1:8H8AVVFUSzJwIegKwv1uF5aGitTY+AIrtktg7OcLs8w=\ndep\tgithub.com\u002Fmgutz\u002Fansi\tv0.0.0-20200706080929-d51e80ef957d\th1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=\ndep\tgithub.com\u002Fmholt\u002Facmez\u002Fv3\tv3.1.7\th1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=\ndep\tgithub.com\u002Fmholt\u002Fcaddy-ratelimit\tv0.1.0\th1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=\ndep\tgithub.com\u002Fmiekg\u002Fdns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=\ndep\tgithub.com\u002Fmitchellh\u002Fcopystructure\tv1.2.0\th1:vpKXTN4ewci03Vljg\u002Fq9QvCGUDttBOGBIa15WveJJGw=\ndep\tgithub.com\u002Fmitchellh\u002Fgo-ps\tv1.0.0\th1:i6ampVEEF4wQFF+bkYfwYgY+F\u002FuYJDktmvLPf7qIgjc=\ndep\tgithub.com\u002Fmitchellh\u002Freflectwalk\tv1.0.2\th1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=\ndep\tgithub.com\u002Fmunnerz\u002Fgoautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01\u002FOq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=\ndep\tgithub.com\u002Fnlnwa\u002Fwhatwg-url\tv0.6.2\th1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ\u002FQ=\ndep\tgithub.com\u002Fnutsdb\u002Fnutsdb\tv1.0.4\th1:BurzkxijXJY1\u002FAkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=\ndep\tgithub.com\u002Foasdiff\u002Fyaml\tv0.1.1\th1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=\ndep\tgithub.com\u002Foasdiff\u002Fyaml3\tv0.0.14\th1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=\ndep\tgithub.com\u002Fpbnjay\u002Fmemory\tv0.0.0-20210728143218-7b4eea64cf58\th1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=\ndep\tgithub.com\u002Fpierrec\u002Flz4\u002Fv4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=\ndep\tgithub.com\u002Fpires\u002Fgo-proxyproto\tv0.15.0\th1:dTshmNbFm\u002FD+0+sbrxUuddPOZ5Y0B7c5NhtsBkm6LqI=\ndep\tgithub.com\u002Fpkg\u002Ferrors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=\ndep\tgithub.com\u002Fpquerna\u002Fcachecontrol\tv0.2.0\th1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=\ndep\tgithub.com\u002Fprometheus\u002Fclient_golang\tv1.25.0\th1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=\ndep\tgithub.com\u002Fprometheus\u002Fclient_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=\ndep\tgithub.com\u002Fprometheus\u002Fcommon\tv0.72.1\th1:ZAiQed\u002Fnk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=\ndep\tgithub.com\u002Fprometheus\u002Fotlptranslator\tv1.0.0\th1:s0LJW\u002FiN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=\ndep\tgithub.com\u002Fprometheus\u002Fprocfs\tv0.22.0\th1:6q9+\u002FJL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=\ndep\tgithub.com\u002Fquic-go\u002Fqpack\tv0.6.0\th1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=\ndep\tgithub.com\u002Fquic-go\u002Fquic-go\tv0.64.1\th1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=\ndep\tgithub.com\u002Fredis\u002Fgo-redis\u002Fv9\tv9.18.0\th1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=\ndep\tgithub.com\u002Frs\u002Fcors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=\ndep\tgithub.com\u002Frs\u002Fxid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=\ndep\tgithub.com\u002Frussross\u002Fblackfriday\u002Fv2\tv2.1.0\th1:JIOH55\u002F0cWyOuilr9\u002Fqlrm0BSXldqnqwMsf35Ld67mk=\ndep\tgithub.com\u002Fsanthosh-tekuri\u002Fjsonschema\u002Fv6\tv6.0.3\th1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls\u002F28=\ndep\tgithub.com\u002Fshopspring\u002Fdecimal\tv1.6.0\th1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=\ndep\tgithub.com\u002FshurcooL\u002Fsanitized_anchor_name\tv1.0.0\th1:PdmoCO6wvbs+7yrJyMORt4\u002FBmY5IYyJwS\u002FkOiWx8mHo=\ndep\tgithub.com\u002Fsirupsen\u002Flogrus\tv1.10.2\th1:G2SED73\u002FqrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=\ndep\tgithub.com\u002Fslackhq\u002Fnebula\tv1.11.2\th1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=\ndep\tgithub.com\u002Fsmallstep\u002Fcertificates\tv0.30.2\th1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf\u002FiQtA5QlN0Y=\ndep\tgithub.com\u002Fsmallstep\u002Fcli-utils\tv0.12.2\th1:lGzM9PJrH\u002FqawbzMC\u002Fs2SvgLdJPKDWKwKzx9doCVO+k=\ndep\tgithub.com\u002Fsmallstep\u002Fgo-attestation\tv0.4.9\th1:\u002FfVmzB8A8tk7B2PCGPlszWzyl\u002FGDcEQbynqcg2PMaZ0=\ndep\tgithub.com\u002Fsmallstep\u002Flinkedca\tv0.26.0\th1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=\ndep\tgithub.com\u002Fsmallstep\u002Fnosql\tv0.8.0\th1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli\u002FXB4Jp4A=\ndep\tgithub.com\u002Fsmallstep\u002Fpkcs7\tv0.2.3\th1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=\ndep\tgithub.com\u002Fsmallstep\u002Fscep\tv0.0.0-20261014185058-63893dadfda8\th1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=\ndep\tgithub.com\u002Fsmallstep\u002Ftruststore\tv0.13.0\th1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi\u002Fpy4=\ndep\tgithub.com\u002Fspf13\u002Fcast\tv1.10.0\th1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=\ndep\tgithub.com\u002Fspf13\u002Fcobra\tv1.10.2\th1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=\ndep\tgithub.com\u002Fspf13\u002Fpflag\tv1.0.10\th1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=\ndep\tgithub.com\u002Fstretchr\u002Ftestify\tv1.12.1\th1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=\ndep\tgithub.com\u002Ftailscale\u002Ftscert\tv0.0.0-20251216020129-aea342f6d747\th1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=\ndep\tgithub.com\u002Ftidwall\u002Fbtree\tv1.6.0\th1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=\ndep\tgithub.com\u002Funrolled\u002Fsecure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=\ndep\tgithub.com\u002Furfave\u002Fcli\tv1.22.17\th1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=\ndep\tgithub.com\u002Fx448\u002Ffloat16\tv0.8.4\th1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=\ndep\tgithub.com\u002Fxujiajun\u002Fmmap-go\tv1.0.1\th1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv\u002FWHc=\ndep\tgithub.com\u002Fxujiajun\u002Futils\tv0.0.0-20220904132955-5f7c5b914235\th1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark\tv1.8.6\th1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark-highlighting\u002Fv2\tv2.0.0-20230729083705-37449abec8cc\th1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=\ndep\tgithub.com\u002Fzeebo\u002Fblake3\tv0.2.4\th1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM\u002FyBqhaZI=\ndep\tgo.etcd.io\u002Fbbolt\tv1.5.0\th1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P\u002FbD4lxU=\ndep\tgo.opentelemetry.io\u002Fauto\u002Fsdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ\u002FipaZ64=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fbridges\u002Fprometheus\tv0.72.0\th1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w\u002F1ROwHEM7M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fexporters\u002Fautoexport\tv0.72.0\th1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Finstrumentation\u002Fnet\u002Fhttp\u002Fotelhttp\tv0.72.0\th1:LxwW\u002F9ctSCv+QkE\u002FcLR7M91ZIkXNMqJtEMi1vCw9U8s=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fautoprop\tv0.72.0\th1:\u002FKv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Faws\tv1.47.0\th1:n\u002F2x\u002FvQki1ojD7R2jYHdnNdI74Yx\u002FOFdY4YXFFesm8M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fb3\tv1.47.0\th1:vlKDmtjhe1R0d7kdov\u002F+KVTKWOKeGLyohB+iXoDPRMQ=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fjaeger\tv1.47.0\th1:2lDw6AKPV33\u002F7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fot\tv1.47.0\th1:nZUqh0\u002F8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=\ndep\tgo.opentelemetry.io\u002Fotel\tv1.47.0\th1:j7ALJ\u002FzgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploggrpc\tv0.23.0\th1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploghttp\tv0.23.0\th1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI\u002FnE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetricgrpc\tv1.47.0\th1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetrichttp\tv1.47.0\th1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\tv1.47.0\th1:julhjPeUH\u002Fq\u002F7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracegrpc\tv1.47.0\th1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracehttp\tv1.47.0\th1:aXZXsZ012wOgVkqaiQv+Z\u002Fd8V0xKjmg70F6m4CE94lc=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fprometheus\tv0.69.0\th1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutlog\tv0.23.0\th1:PW\u002FE9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutmetric\tv1.47.0\th1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdouttrace\tv1.47.0\th1:N3YQCxjxQ\u002FbMjyc3heladfRm9t9RTksGQH8z4w6yU\u002F0=\ndep\tgo.opentelemetry.io\u002Fotel\u002Flog\tv1.47.0\th1:cOTS1CcLbSQeZKanGJ+0JpF\u002F+t4PELi3O3bbl2lqCcI=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fmetric\tv1.47.0\th1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\tv1.47.0\th1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Flog\tv1.47.0\th1:W4N\u002FZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Fmetric\tv1.47.0\th1:lfISg2j93VT6yqdk9OfUaZmw\u002FGfcZqCCV3jdXtsPnKw=\ndep\tgo.opentelemetry.io\u002Fotel\u002Ftrace\tv1.47.0\th1:JOjX\u002FOci8K94QHddo+bbfya\u002FAi\u002Fnf6\u002Fdt9ZfrFNWSrM=\ndep\tgo.opentelemetry.io\u002Fproto\u002Fotlp\tv1.11.1\th1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=\ndep\tgo.step.sm\u002Fcrypto\tv0.91.0\th1:0mN0DwVOvUuh7VbyTnxABZuAkxwak\u002FGrp8Y\u002Fb4YaZDU=\ndep\tgo.uber.org\u002Fatomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp\u002FAUETXlHW0DxSjE=\ndep\tgo.uber.org\u002Fautomaxprocs\tv1.6.0\th1:O3y2\u002FQNTOdbF+e\u002FdpXNNW7Rx2hZ4sTIPyybbxyNqTUs=\ndep\tgo.uber.org\u002Fmultierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=\ndep\tgo.uber.org\u002Fzap\tv1.28.0\th1:IZzaP1Fv73\u002FT\u002FpBMLk4VutPl36uNC+OSUh3JLG3FIjo=\ndep\tgo.uber.org\u002Fzap\u002Fexp\tv0.3.0\th1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=\ndep\tgo.yaml.in\u002Fyaml\u002Fv3\tv3.0.5\th1:N6y\u002FpJk8buWs9NY5ERU2HSMfm+IuD\u002FOtfdAnq6kESPw=\ndep\tgolang.org\u002Fx\u002Fcrypto\tv0.58.0\th1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K\u002FM\u002F54=\ndep\tgolang.org\u002Fx\u002Fcrypto\u002Fx509roots\u002Ffallback\tv0.0.0-20261016151342-0ae6809b7559\th1:M68k3yCPiXhrSyh9Twe3Kv7nOsvUumZDN\u002F3kdSwUqw0=\ndep\tgolang.org\u002Fx\u002Fexp\tv0.0.0-20261014143641-f0251eb4aa3e\th1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI\u002FA=\ndep\tgolang.org\u002Fx\u002Fnet\tv0.61.0\th1:RR+6j\u002FBTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=\ndep\tgolang.org\u002Fx\u002Foauth2\tv0.37.0\th1:JUlcxA8oAtauLfiH8FX2\u002FFkAWHAdi0QtGCGc+hofE98=\ndep\tgolang.org\u002Fx\u002Fsync\tv0.24.0\th1:iqiDrGoDgyuvAKrhLQthUEzU\u002FR378N78gXbBjxed7oA=\ndep\tgolang.org\u002Fx\u002Fsys\tv0.49.0\th1:XbzkgYJHdqh\u002F8m2Uu0W\u002FdQv8nktxx4BFHp1M0gROTXA=\ndep\tgolang.org\u002Fx\u002Fterm\tv0.47.0\th1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ\u002FBM=\ndep\tgolang.org\u002Fx\u002Ftext\tv0.43.0\th1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5\u002FUGUTJVXoWc=\ndep\tgolang.org\u002Fx\u002Ftime\tv0.16.0\th1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q\u002F6gY2hDM6VDE=\ndep\tgoogle.golang.org\u002Fapi\tv0.304.0\th1:2R1dYSiIVQRGcKN901u9yPFEdJu5h90oGY5X4TcgbmA=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Fapi\tv0.0.0-20261012220534-4341edf3f941\th1:DS\u002Fw3N8rsfrwxwgGSj6WhMsPo7aNQGmDx74J81zd0NQ=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Frpc\tv0.0.0-20261012220534-4341edf3f941\th1:QG6hS4zFplRZvOQedzei4t2pT\u002FzkQc3VR1u+S9\u002FrcAw=\ndep\tgoogle.golang.org\u002Fgrpc\tv1.84.0\th1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=\ndep\tgoogle.golang.org\u002Fprotobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o\u002Ffwxc=\ndep\tgopkg.in\u002Fyaml.v3\tv3.0.1\th1:fxVm\u002FGzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=\nbuild\t-buildmode=exe\nbuild\t-compiler=gc\nbuild\t-ldflags=\"-w -s\"\nbuild\t-tags=nobadger,nomysql,nopgx\nbuild\tCGO_ENABLED=1\nbuild\tCGO_CFLAGS=\"-I\u002Fusr\u002Flocal\u002Finclude\u002Fphp -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fmain -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FTSRM -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FZend -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext\u002Fdate\u002Flib\"\nbuild\tCGO_CPPFLAGS=\"-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64\"\nbuild\tCGO_CXXFLAGS=\nbuild\tCGO_LDFLAGS=\"-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto\"\nbuild\tGOARCH=amd64\nbuild\tGOOS=linux\nbuild\tGOAMD64=v1\n\n```\n",{"part":901,"tag":1007,"name":1007,"publishedAt":1008,"url":1009,"body":1010},"v2.0.0-alpha.25","2026-10-20T23:04:19Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.25","- Clone and Move: clicking a target outlines it blue dashed and opens a menu at the click point instead of a dialog; a disabled option's reasons are behind its ⓘ, \"Nothing can be placed here\" when nothing is allowed, notes on one muted line, and \"Edit the shared layout?\" \u002F \"Edit the page?\" is asked once an option in the other scope is picked ([#427](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fpull\u002F427), [#426](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F426))\n- The yellow clone highlight and the shared outline no longer show above the admin header when the page scrolls ([67fe3e1e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F67fe3e1e))\n- The package now ships its MIT licence text (`LICENSE`) ([360ec7af](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F360ec7af), [#425](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F425))\n",{"part":885,"tag":1012,"name":1012,"publishedAt":1013,"url":831,"body":1014},"v2.0.0-alpha.44","2026-10-20T20:11:48Z","## [2.0.0-alpha.44](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.44) - 2026-10-20\n\n### Fixed\n\n- php image: the builder stage's Go module downloads and `xcaddy build` run through `retry-fetch`, with a time limit and up to three attempts, after uncached downstream builds failed on a sum.golang.org stream error and slowed to about 2 minutes per `go get` on GitLab SaaS runners; Go also fetches over HTTP\u002F1.1 there, since sum.golang.org kept resetting HTTP\u002F2 streams (#213). [21abfb0](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F21abfb0efb54666e5b773c8e404143f116aa4f5e), [d1241a9](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd1241a9386b7e979abdcd1a442f9c6c2515ede4d)\n- The \"maintenance mode is on\" notice no longer names `CWA_CI_MAINTENANCE_DURING_MIGRATIONS` when a later deploy found the window left on without it (#182). [4fd54e2](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F4fd54e2d8bb64caf98b4c61d04de95ba497f0069)\n\n### Upgrade notes\n\n- **The default admin email is now `admin@example.com`** (was `hello@cwa.rocks`) in `UsersFixture`, `k8s.sh` and the chart's values. A site with no `ADMIN_EMAIL` gets its admin's email rewritten on the next fixtures load (`UsersFixture` overwrites the existing admin), and on Kubernetes the chart's admin Secret changes on the next deploy. Set `ADMIN_EMAIL` to keep a real address. In dev, php's `MAILER_DSN` now comes from `compose.override.yaml` (Mailpit), so a `MAILER_DSN` in `api\u002F.env.local` is ignored in dev; set it in the root `.env` instead. To take `bin\u002Fup`, copy `bin\u002Fup`, `compose.override.yaml` and `README.md`'s local section (#206). [8e07ddd](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8e07dddbe541c8fee79d83732be2737e8f7fbf0b), [aa8334a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Faa8334af89406b6694b3b68de8b961510e37f788)\n- **#208 (the prebuilt php base): take it at a release tag, not from main commits**, and copy these together: `api\u002FDockerfile`, `bin\u002Ftest\u002Fphp-base-version.sh`, `.gitlab-ci.yml` or `.github\u002Fworkflows\u002Fci.yml` (the unit-test step that runs it), `bin\u002Fdevops\u002Fk8s.sh`, `compose.override.yaml`, `compose.prod.yaml`, `.env.dist`. `.github\u002Fworkflows\u002Fpublish-php-base.yml` and `.github\u002Fphp-base\u002F` are template-only. Custom apt packages or extensions move below `FROM ${CWA_PHP_BASE} AS frankenphp_base`. A pulling site stays on its release's base until it upgrades, or sets `CWA_CI_PHP_BASE_IMAGE` to a rebuild (#208). [bbc0c74](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fbbc0c74220244919c3d8823e8462975fe775ee34), [1517c94](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1517c9434b6b9e3e0d195a075ffac3870828d60e), [cb2db5c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fcb2db5c77cab694e6d5056fd20abdfb26800bdad), [1b27aa6](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1b27aa64c7de812c4db23b314e950081ad4d08d9), [732ac45](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F732ac4589b25856692054f17435c8b60a8e6c41d), [08a339f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F08a339f874c7ecff6224f8c13d3183de693766cc)\n- **Copy the Caddyfile and both Dockerfiles together** for the new Docker healthchecks: php's `HEALTHCHECK` calls a loopback-only health site (`http:\u002F\u002F127.0.0.1:2080`) that the Caddyfile now adds, so the healthcheck without the site leaves php permanently unhealthy. Locally, run `docker compose build php app` to pick them up (#205). [8c771f5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8c771f5f42384d950b76e0707f5d122a3c4ddf27)\n- Deploys and fixture loads now warn when `ADMIN_PASSWORD` is unset or `admin` (the public admin\u002Fadmin super-admin login, which every fixture load resets): set it as a masked CI variable or secret. The deploy still runs. `compose.prod.yaml` now requires `ADMIN_PASSWORD` (#203). [80f63f3](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F80f63f3758d6951c4e26ed9eddcf7a095ce5f4fc)\n\n### Added\n\n- `bin\u002Fup`: one command to a signed-in-ready dev site. It runs `docker compose up -d --wait`, loads the fixtures with `--append`, waits for the first pages to compile, and prints the login. It has a 15-minute budget (`CWA_UP_TIMEOUT`), names a failed phase with its services' last log lines, and is safe to run again (`--skip-fixtures` skips the load). The dev stack also gets Mailpit: dev emails show at http:\u002F\u002Flocalhost:8025. `create-cwa` runs `bin\u002Fup` after starting Docker, checks port 8025, and its generated README points at it (#206). [8e07ddd](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8e07dddbe541c8fee79d83732be2737e8f7fbf0b), [aa8334a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Faa8334af89406b6694b3b68de8b961510e37f788)\n- The template's own demo site (preview.cwa.rocks) reloads its scaffold every day from a GitLab pipeline schedule, through `.gitlab\u002Fci\u002Ftemplate-only.yml`, which `.gitlab-ci.yml` includes only when the file exists. The file is template-only: `create-cwa` leaves it out and downstream sites don't copy it (copying the `include:` block is harmless) (#181). [8f41b00](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8f41b0018ce246b3ad098e55c1344fa8e11fe6f2)\n- A prebuilt php base image, `ghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:\u003Cversion>`: FrankenPHP with the template's Souin, storages and `queryallowlist` patches and Caddy plugins, the apt packages and the PHP extensions (xdebug is installed but disabled, so production images now carry its unloaded `.so`; dev enables it without a network fetch). `publish-php-base.yml` builds it for amd64 and arm64 from each release tag and tests it before pushing, with weekly `\u003Cversion>-rYYYYMMDD` security rebuilds; releases are attested and tags are never overwritten. **From this release** `api\u002FDockerfile` pulls `cwa-php-base:2.0.0-alpha.44`, so project builds stop compiling Go (#213) and installing PHP extensions (#176). `CWA_CI_PHP_IMAGE_FROM_SOURCE=\"true\"` builds from source (for sites that change the patches; not Protected), `CWA_CI_PHP_BASE_IMAGE` takes a rebuild tag or `X@sha256:…` pin, and `CWA_PHP_BASE=cwa_php_base` in `.env` builds from source locally. The template's own CI always builds from source (#208). [bbc0c74](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fbbc0c74220244919c3d8823e8462975fe775ee34), [1517c94](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1517c9434b6b9e3e0d195a075ffac3870828d60e), [cb2db5c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fcb2db5c77cab694e6d5056fd20abdfb26800bdad), [1b27aa6](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1b27aa64c7de812c4db23b314e950081ad4d08d9), [732ac45](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F732ac4589b25856692054f17435c8b60a8e6c41d), [08a339f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F08a339f874c7ecff6224f8c13d3183de693766cc)\n- Docker readiness checks: php checks `\u002F_api\u002F_\u002Fhealth` (PHP and the database) through a loopback-only Caddy site, app checks `\u002F_cwa\u002Fhealthcheck`, and the health endpoint is never cached, so `docker compose up -d --wait` waits until the site is ready. app gets `restart: unless-stopped`, and the browser tests use `--wait`. Kubernetes probes are unchanged (#205). [8c771f5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8c771f5f42384d950b76e0707f5d122a3c4ddf27)\n- An MIT `LICENSE` (Silverback Internet Services Limited, as the bundle's), `SECURITY.md` (private reporting through GitHub, no warranty or guaranteed response), `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, and GitHub issue and PR templates; `.all-contributorsrc` is removed. Projects made with `create-cwa` get none of them: a client site chooses its own licence (#202). [031b006](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F031b006d18c7372e8b5dc9cb4fd0d1dfd1683bd3)\n\n### Changed\n\n- **Scaled mode is ready to turn on** (`CWA_CI_API_SCALED_\u003CTRACK>`), rehearsed on preview.cwa.rocks on 2026-10-20 (#85's rehearsal comment). After a scaled deploy's flush and warm, the deploy checks the API cache is a Redis hit through the API service and prints a loud error (`::error` on GitHub) if it isn't, without failing the live deploy. The deploy also prints the database connections the API pods may open (peak pods × `CWA_CI_API_WORKERS` + 5) and warns past the in-cluster PostgreSQL's limit. There's no manual scale job: for a planned spike, raise `CWA_CI_API_AUTOSCALE_MIN` and deploy (#193). [683634b](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F683634bf51f680b81cca64eb9aac3c0a1e967b2b), [5c33656](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5c3365685b0a8696a0314ec7ffe6a4d167701fe7)\n- `create-cwa` checks Docker, ports 80\u002F443\u002F3001\u002F5432 and Docker's memory before downloading, offers the host `pnpm install` only when the stack isn't started (it crashed a running dev server), validates the project name and an empty target directory up front, shows the manifest's hints, fixes the generated README's links, prints a prerelease and no-telemetry notice, and has an npm README; `api\u002FREADME.md` documents `user:create --admin` (#204). [5847944](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5847944625b125026fc43414f3fe9d573af85110)\n\n## php base image\n\n### cwa-php-base 2.0.0-alpha.44\n\nPin it as `ghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.44@sha256:55178c48f840a23e26887b66ca52f75d46387fe41b75c2d5bc3b1f503ba1639c`.\n\nVerify it with:\n\n```sh\ngh attestation verify oci:\u002F\u002Fghcr.io\u002Fcomponents-web-app\u002Fcwa-php-base:2.0.0-alpha.44 --repo components-web-app\u002Fcomponents-web-app \\\n  --signer-workflow components-web-app\u002Fcomponents-web-app\u002F.github\u002Fworkflows\u002Fpublish-php-base.yml --source-ref refs\u002Ftags\u002Fv2.0.0-alpha.44\n```\n\n```\n# Base images (from the build provenance)\npkg:docker\u002Fcaddy@builder?platform=linux%2Famd64 sha256:8910fe662f448b860e8d16ef1c9a4f8946d3193bdc3e971bf0c55c9a2cf246f6\npkg:docker\u002Fcaddy@builder?platform=linux%2Farm64 sha256:8910fe662f448b860e8d16ef1c9a4f8946d3193bdc3e971bf0c55c9a2cf246f6\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:ae4f3b554449e7e25548e7d8ccc029d17357348e30c6e3df01b92bc93654d6a9\npkg:docker\u002Fdocker\u002Fbuildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:ae4f3b554449e7e25548e7d8ccc029d17357348e30c6e3df01b92bc93654d6a9\npkg:docker\u002Fdocker\u002Fdockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Famd64 sha256:b8111ac35949fc6377db7af69bbfe0acdd226dcd09d886799476f0cdee226b5a\npkg:docker\u002Fdunglas\u002Ffrankenphp@builder?platform=linux%2Farm64 sha256:b8111ac35949fc6377db7af69bbfe0acdd226dcd09d886799476f0cdee226b5a\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Famd64 sha256:4a8eebee6b3bed92d01ffa6ec5b1bc2cb9c2ab7eeb546027a3f7e6a52937ebbb\npkg:docker\u002Fdunglas\u002Ffrankenphp@latest?platform=linux%2Farm64 sha256:4a8eebee6b3bed92d01ffa6ec5b1bc2cb9c2ab7eeb546027a3f7e6a52937ebbb\n\nPHP 8.5.11 (cli) (built: Oct  6 2026 01:23:29) (ZTS)\nCopyright (c) The PHP Group\nBuilt by https:\u002F\u002Fgithub.com\u002Fdocker-library\u002Fphp\nZend Engine v4.5.11, Copyright (c) Zend Technologies\n    with Zend OPcache v8.5.11, Copyright (c), by Zend Technologies\n\n[PHP Modules]\napcu\nbrotli\nCore\nctype\ncurl\ndate\ndom\nexif\nFFI\nfileinfo\nfilter\ngd\nhash\niconv\nintl\njson\nlexbor\nlibxml\nmbstring\nmysqlnd\nopenssl\npcre\nPDO\npdo_pgsql\npdo_sqlite\nPhar\nposix\nrandom\nreadline\nReflection\nsession\nSimpleXML\nsodium\nSPL\nsqlite3\nstandard\ntokenizer\nuri\nxml\nxmlreader\nxmlwriter\nxsl\nZend OPcache\nzip\nzlib\n\n[Zend Modules]\nZend OPcache\n\n\ngo\tgo1.27.2\npath\tcaddy\nmod\tcaddy\t(devel)\t\ndep\tcel.dev\u002Fcel-go\tv0.32.0\th1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=\ndep\tcel.dev\u002Fexpr\tv0.25.3\th1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=\ndep\tcloud.google.com\u002Fgo\u002Fauth\tv0.24.1\th1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=\ndep\tcloud.google.com\u002Fgo\u002Fauth\u002Foauth2adapt\tv0.3.0\th1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=\ndep\tcloud.google.com\u002Fgo\u002Fcompute\u002Fmetadata\tv0.10.0\th1:pyKMUQSwchgkIBBJGdILqQbs\u002FBNJXqwSA7Ej6LAvvtY=\ndep\tdario.cat\u002Fmergo\tv1.0.2\th1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=\ndep\tfilippo.io\u002Fbigmod\tv0.1.0\th1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=\ndep\tfilippo.io\u002Fedwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=\ndep\tgithub.com\u002FBurntSushi\u002Ftoml\tv1.6.0\th1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=\ndep\tgithub.com\u002FDeRuina\u002Ftimberjack\tv1.4.9\th1:9RjDMSkUDQRYzwVNB\u002FFLonXNurcZVEh9sK43m2jw3A4=\ndep\tgithub.com\u002FKimMachineGun\u002Fautomemlimit\tv1.0.0\th1:+MqlvDE\u002FpkJNjk1rU+O14QsH8k10nJAD0frB0lsxyvw=\ndep\tgithub.com\u002FMasterminds\u002Fgoutils\tv1.1.1\th1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=\ndep\tgithub.com\u002FMasterminds\u002Fsemver\u002Fv3\tv3.5.0\th1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ\u002F2OOE=\ndep\tgithub.com\u002FMasterminds\u002Fsprig\u002Fv3\tv3.3.0\th1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=\ndep\tgithub.com\u002FMauriceGit\u002Fskiplist\tv0.0.0-20211105230623-77f5c8d3e145\th1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=\ndep\tgithub.com\u002FMicahParks\u002Fjwkset\tv0.11.3\th1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=\ndep\tgithub.com\u002FMicahParks\u002Fkeyfunc\u002Fv3\tv3.8.2\th1:eydEwk\u002FpBAVrDIpmFfB\u002FgkCcrp++xQ7YYXirrI2zlWE=\ndep\tgithub.com\u002FRoaringBitmap\u002Froaring\u002Fv2\tv2.29.0\th1:jSjxqZEqiF9W5dHUFsemupb9bnLaQJwZVe5yMetbsZg=\ndep\tgithub.com\u002Falecthomas\u002Fchroma\u002Fv2\tv2.27.0\th1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v\u002Fr5BXYZs=\ndep\tgithub.com\u002Fantlabs\u002Fstl\tv0.0.1\th1:TRD3csCrjREeLhLoQ\u002FsupaoCvFhNLBTNIwuRGrDIs6Q=\ndep\tgithub.com\u002Fantlabs\u002Ftimer\tv0.0.11\th1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=\ndep\tgithub.com\u002Fantlr4-go\u002Fantlr\u002Fv4\tv4.13.1\th1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=\ndep\tgithub.com\u002Faryann\u002Fdifflib\tv0.0.0-20210328193216-ff5ff6dc229b\th1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=\ndep\tgithub.com\u002Fbeorn7\u002Fperks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=\ndep\tgithub.com\u002Fbits-and-blooms\u002Fbitset\tv1.26.0\th1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=\ndep\tgithub.com\u002Fbwmarrin\u002Fsnowflake\tv0.3.0\th1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=\ndep\tgithub.com\u002Fcaddyserver\u002Fcaddy\u002Fv2\tv2.11.7\th1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=\ndep\tgithub.com\u002Fcaddyserver\u002Fcertmagic\tv0.25.6\th1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=\ndep\tgithub.com\u002Fcaddyserver\u002Fzerossl\tv0.1.6\th1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT\u002F4REW\u002F\u002Flsas=\ndep\tgithub.com\u002Fccoveille\u002Fgo-safecast\u002Fv2\tv2.0.1\th1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=\ndep\tgithub.com\u002Fcenkalti\u002Fbackoff\u002Fv5\tv5.0.3\th1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=\ndep\tgithub.com\u002Fcespare\u002Fxxhash\u002Fv2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=\ndep\tgithub.com\u002Fchzyer\u002Freadline\tv1.5.1\th1:upd\u002F6fQk4src78LMRzh5vItIt361\u002Fo4uq553V8B5sGI=\ndep\tgithub.com\u002Fcloudflare\u002Fcircl\tv1.6.5\th1:O64F26HEqNhznd\u002FhrC5KZXVKYuKM2rx4deZDTc4ihQA=\ndep\tgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fapi\u002Ffrankenphp\u002Fcaddy\u002Fqueryallowlist\tv0.0.0-20261020193414-83a54850ad3c\n=>\t\u002Ftmp\u002Fqueryallowlist\t(devel)\t\n\ndep\tgithub.com\u002Fcoreos\u002Fgo-oidc\u002Fv3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=\ndep\tgithub.com\u002Fcpuguy83\u002Fgo-md2man\u002Fv2\tv2.0.7\th1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\tv1.7.9\n=>\t\u002Ftmp\u002Fsouin\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fsouin\u002Fplugins\u002Fcaddy\tv1.7.9\th1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\tv0.0.21\th1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M\u002FJRc+zhN7Wsx0=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fbadger\u002Fcaddy\tv0.0.22\th1:4\u002FbyA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fcore\tv0.0.21\th1:zfa0Bqzdm9\u002FoPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\tv0.0.22\n=>\t\u002Ftmp\u002Fstorages-go-redis\t(devel)\t\n\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fgo-redis\u002Fcaddy\tv0.0.22\th1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\tv0.0.21\th1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fnuts\u002Fcaddy\tv0.0.22\th1:kg\u002FHYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\tv0.0.21\th1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=\ndep\tgithub.com\u002Fdarkweak\u002Fstorages\u002Fotter\u002Fcaddy\tv0.0.22\th1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=\ndep\tgithub.com\u002Fdgraph-io\u002Fbadger\u002Fv4\tv4.9.1\th1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=\ndep\tgithub.com\u002Fdgraph-io\u002Fristretto\u002Fv2\tv2.2.0\th1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=\ndep\tgithub.com\u002Fdgryski\u002Fgo-rendezvous\tv0.0.0-20200823014737-9f7001d12a5f\th1:lO4WD4F\u002FrVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=\ndep\tgithub.com\u002Fdlclark\u002Fregexp2\u002Fv2\tv2.9.1\th1:q6bZW\u002FNN9VodqMjYXpuic2lZxdHPfFTzGS+MJxIJmKQ=\ndep\tgithub.com\u002Fdolthub\u002Fmaphash\tv0.1.0\th1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L\u002FQxPDyQ=\ndep\tgithub.com\u002Fdunglas\u002Fcaddy-cbrotli\tv1.0.1\th1:mkg7EB1GmoyfBt3kY3mq4o\u002F0bfnBeq7ZLQjmVmdBE3Y=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\tv1.13.1\th1:TaYlWf8lFW5Kc9dorlqytvM6zEEdywk\u002FHwOmfpzhi5Y=\ndep\tgithub.com\u002Fdunglas\u002Ffrankenphp\u002Fcaddy\tv1.13.1\th1:pRZMmvSLaBaVocyblRad4+IFYTR2F\u002Fjuo576a25yIW0=\ndep\tgithub.com\u002Fdunglas\u002Fgo-urlpattern\tv1.0.0\th1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=\ndep\tgithub.com\u002Fdunglas\u002Fhttpsfv\tv1.1.2\th1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ\u002FDkmc=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\tv1.1.4\th1:CtC2UiHGQQNcKfr6ZLlJTa93AP\u002FXUFdJQJfgfUtvphA=\ndep\tgithub.com\u002Fdunglas\u002Fmercure\u002Fcaddy\tv1.1.4\th1:dKmvgwbRbuM2\u002FjRaIiSmBXYTnVtxQ218\u002FKHqzoeplBU=\ndep\tgithub.com\u002Fdunglas\u002Fskipfilter\tv1.2.0\th1:J7\u002FRXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\tv1.4.5\th1:vO7CS3\u002FKwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=\ndep\tgithub.com\u002Fdunglas\u002Fvulcain\u002Fcaddy\tv1.4.5\th1:2qzg18nEkpsc1QIvpNn\u002FoztSHRxY1\u002FG6xuxylxVobGY=\ndep\tgithub.com\u002Fdustin\u002Fgo-humanize\tv1.1.0\th1:dbKTrvD0klcbBV\u002Fh4AWJdMuZogJACoMlvWIWZ5b2xWg=\ndep\tgithub.com\u002Fe-dant\u002Fwatcher\tv0.0.0-20260223030516-06f84a1314be\th1:vqHrvilasyJcnru\u002F0Z4FoojsQJUIfXGVplte7JtupfY=\ndep\tgithub.com\u002Felnormous\u002Fcontenttype\tv1.0.4\th1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=\ndep\tgithub.com\u002Ffelixge\u002Fhttpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw\u002FQDuVfpNhoA31zeORc=\ndep\tgithub.com\u002Ffxamacker\u002Fcbor\u002Fv2\tv2.9.6\th1:NHZPxuUjJXQjX9itA785y\u002F5NKSlI4HQ+S7noZsmI7hs=\ndep\tgithub.com\u002Fgammazero\u002Fdeque\tv0.2.1\th1:qSdsbG6pgp6nL7A0+K\u002FB7s12mcCY\u002F5l5SIUpMOl+dC0=\ndep\tgithub.com\u002Fgetkin\u002Fkin-openapi\tv0.149.0\th1:ZbhmVJ4yq5RZDUsyP8lcBcGMsjsaTqXEFt6isdtMDfA=\ndep\tgithub.com\u002Fgo-chi\u002Fchi\u002Fv5\tv5.5.0\th1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv3\tv3.0.5\th1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=\ndep\tgithub.com\u002Fgo-jose\u002Fgo-jose\u002Fv4\tv4.1.6\th1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=\ndep\tgithub.com\u002Fgo-logr\u002Flogr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg\u002F+cPVcbP\u002F8=\ndep\tgithub.com\u002Fgo-logr\u002Fstdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=\ndep\tgithub.com\u002Fgo-openapi\u002Fjsonpointer\tv1.0.2\th1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=\ndep\tgithub.com\u002Fgofrs\u002Fflock\tv0.13.0\th1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ\u002FA8dRYMzw=\ndep\tgithub.com\u002Fgofrs\u002Fuuid\tv4.4.0+incompatible\th1:3qXRTX8\u002FNbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=\ndep\tgithub.com\u002Fgolang-jwt\u002Fjwt\u002Fv5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=\ndep\tgithub.com\u002Fgoogle\u002Fbrotli\u002Fgo\u002Fcbrotli\tv1.1.0\th1:YwHD\u002FrwSgUSL4b2S3ZM2jnNymm+tmwKQqjUIC63nmHU=\ndep\tgithub.com\u002Fgoogle\u002Fcertificate-transparency-go\tv1.3.3\th1:hq\u002FrSxztSkXN2tx\u002F3jQqF6Xc0O565UQPdHrOWvZwybo=\ndep\tgithub.com\u002Fgoogle\u002Fflatbuffers\tv25.2.10+incompatible\th1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H\u002FpNX4FP1v0Q=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tpm\tv0.9.8\th1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=\ndep\tgithub.com\u002Fgoogle\u002Fgo-tspi\tv0.3.0\th1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=\ndep\tgithub.com\u002Fgoogle\u002Fs2a-go\tv0.1.11\th1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=\ndep\tgithub.com\u002Fgoogle\u002Fuuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=\ndep\tgithub.com\u002Fgoogleapis\u002Fenterprise-certificate-proxy\tv0.3.23\th1:J+VGF1wjAM2dU2kKUXZxJdDppRLReWP7KWcclfngQhc=\ndep\tgithub.com\u002Fgoogleapis\u002Fgax-go\u002Fv2\tv2.26.2\th1:ydkmNXxj7bEmmeK5AihkKnWxyOyBR9TDebvp5L5izk8=\ndep\tgithub.com\u002Fgorilla\u002Fhandlers\tv1.5.2\th1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=\ndep\tgithub.com\u002Fgorilla\u002Fmux\tv1.8.1\th1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=\ndep\tgithub.com\u002Fgrpc-ecosystem\u002Fgrpc-gateway\u002Fv2\tv2.32.0\th1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=\ndep\tgithub.com\u002Fhuandu\u002Fxstrings\tv1.6.2\th1:+X5X6N46b40cmDw7FFJFU6Eoq0yJS8lbYigT2EFau4c=\ndep\tgithub.com\u002Fklauspost\u002Fcompress\tv1.20.3\th1:zWNoFqq\u002FlSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=\ndep\tgithub.com\u002Fklauspost\u002Fcpuid\u002Fv2\tv2.4.1\th1:I9KxadAkvo+QjtcEE2f2tyfEvmIla\u002FT0m+14PrZNl0U=\ndep\tgithub.com\u002Flibdns\u002Flibdns\tv1.1.1\th1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS\u002FP\u002FU=\ndep\tgithub.com\u002Fmanifoldco\u002Fpromptui\tv0.9.0\th1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=\ndep\tgithub.com\u002Fmattn\u002Fgo-colorable\tv0.1.16\th1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=\ndep\tgithub.com\u002Fmattn\u002Fgo-isatty\tv0.0.24\th1:tGZZoVgT\u002FKiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\tv1.2.4\th1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=\ndep\tgithub.com\u002Fmaypok86\u002Fotter\u002Fv2\tv2.3.0\th1:8H8AVVFUSzJwIegKwv1uF5aGitTY+AIrtktg7OcLs8w=\ndep\tgithub.com\u002Fmgutz\u002Fansi\tv0.0.0-20200706080929-d51e80ef957d\th1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=\ndep\tgithub.com\u002Fmholt\u002Facmez\u002Fv3\tv3.1.7\th1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=\ndep\tgithub.com\u002Fmholt\u002Fcaddy-ratelimit\tv0.1.0\th1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=\ndep\tgithub.com\u002Fmiekg\u002Fdns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=\ndep\tgithub.com\u002Fmitchellh\u002Fcopystructure\tv1.2.0\th1:vpKXTN4ewci03Vljg\u002Fq9QvCGUDttBOGBIa15WveJJGw=\ndep\tgithub.com\u002Fmitchellh\u002Fgo-ps\tv1.0.0\th1:i6ampVEEF4wQFF+bkYfwYgY+F\u002FuYJDktmvLPf7qIgjc=\ndep\tgithub.com\u002Fmitchellh\u002Freflectwalk\tv1.0.2\th1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=\ndep\tgithub.com\u002Fmunnerz\u002Fgoautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01\u002FOq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=\ndep\tgithub.com\u002Fnlnwa\u002Fwhatwg-url\tv0.6.2\th1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ\u002FQ=\ndep\tgithub.com\u002Fnutsdb\u002Fnutsdb\tv1.0.4\th1:BurzkxijXJY1\u002FAkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=\ndep\tgithub.com\u002Foasdiff\u002Fyaml\tv0.1.1\th1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=\ndep\tgithub.com\u002Foasdiff\u002Fyaml3\tv0.0.14\th1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=\ndep\tgithub.com\u002Fpbnjay\u002Fmemory\tv0.0.0-20210728143218-7b4eea64cf58\th1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=\ndep\tgithub.com\u002Fpierrec\u002Flz4\u002Fv4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=\ndep\tgithub.com\u002Fpires\u002Fgo-proxyproto\tv0.15.0\th1:dTshmNbFm\u002FD+0+sbrxUuddPOZ5Y0B7c5NhtsBkm6LqI=\ndep\tgithub.com\u002Fpkg\u002Ferrors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=\ndep\tgithub.com\u002Fpquerna\u002Fcachecontrol\tv0.2.0\th1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=\ndep\tgithub.com\u002Fprometheus\u002Fclient_golang\tv1.25.0\th1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=\ndep\tgithub.com\u002Fprometheus\u002Fclient_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=\ndep\tgithub.com\u002Fprometheus\u002Fcommon\tv0.72.1\th1:ZAiQed\u002Fnk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=\ndep\tgithub.com\u002Fprometheus\u002Fotlptranslator\tv1.0.0\th1:s0LJW\u002FiN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=\ndep\tgithub.com\u002Fprometheus\u002Fprocfs\tv0.22.0\th1:6q9+\u002FJL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=\ndep\tgithub.com\u002Fquic-go\u002Fqpack\tv0.6.0\th1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=\ndep\tgithub.com\u002Fquic-go\u002Fquic-go\tv0.64.1\th1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=\ndep\tgithub.com\u002Fredis\u002Fgo-redis\u002Fv9\tv9.18.0\th1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=\ndep\tgithub.com\u002Frs\u002Fcors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=\ndep\tgithub.com\u002Frs\u002Fxid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=\ndep\tgithub.com\u002Frussross\u002Fblackfriday\u002Fv2\tv2.1.0\th1:JIOH55\u002F0cWyOuilr9\u002Fqlrm0BSXldqnqwMsf35Ld67mk=\ndep\tgithub.com\u002Fsanthosh-tekuri\u002Fjsonschema\u002Fv6\tv6.0.3\th1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls\u002F28=\ndep\tgithub.com\u002Fshopspring\u002Fdecimal\tv1.6.0\th1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=\ndep\tgithub.com\u002FshurcooL\u002Fsanitized_anchor_name\tv1.0.0\th1:PdmoCO6wvbs+7yrJyMORt4\u002FBmY5IYyJwS\u002FkOiWx8mHo=\ndep\tgithub.com\u002Fsirupsen\u002Flogrus\tv1.10.2\th1:G2SED73\u002FqrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=\ndep\tgithub.com\u002Fslackhq\u002Fnebula\tv1.11.2\th1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=\ndep\tgithub.com\u002Fsmallstep\u002Fcertificates\tv0.30.2\th1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf\u002FiQtA5QlN0Y=\ndep\tgithub.com\u002Fsmallstep\u002Fcli-utils\tv0.12.2\th1:lGzM9PJrH\u002FqawbzMC\u002Fs2SvgLdJPKDWKwKzx9doCVO+k=\ndep\tgithub.com\u002Fsmallstep\u002Fgo-attestation\tv0.4.9\th1:\u002FfVmzB8A8tk7B2PCGPlszWzyl\u002FGDcEQbynqcg2PMaZ0=\ndep\tgithub.com\u002Fsmallstep\u002Flinkedca\tv0.26.0\th1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=\ndep\tgithub.com\u002Fsmallstep\u002Fnosql\tv0.8.0\th1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli\u002FXB4Jp4A=\ndep\tgithub.com\u002Fsmallstep\u002Fpkcs7\tv0.2.3\th1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=\ndep\tgithub.com\u002Fsmallstep\u002Fscep\tv0.0.0-20261014185058-63893dadfda8\th1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=\ndep\tgithub.com\u002Fsmallstep\u002Ftruststore\tv0.13.0\th1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi\u002Fpy4=\ndep\tgithub.com\u002Fspf13\u002Fcast\tv1.10.0\th1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=\ndep\tgithub.com\u002Fspf13\u002Fcobra\tv1.10.2\th1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=\ndep\tgithub.com\u002Fspf13\u002Fpflag\tv1.0.10\th1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=\ndep\tgithub.com\u002Fstretchr\u002Ftestify\tv1.12.1\th1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=\ndep\tgithub.com\u002Ftailscale\u002Ftscert\tv0.0.0-20251216020129-aea342f6d747\th1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=\ndep\tgithub.com\u002Ftidwall\u002Fbtree\tv1.6.0\th1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=\ndep\tgithub.com\u002Funrolled\u002Fsecure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=\ndep\tgithub.com\u002Furfave\u002Fcli\tv1.22.17\th1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=\ndep\tgithub.com\u002Fx448\u002Ffloat16\tv0.8.4\th1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=\ndep\tgithub.com\u002Fxujiajun\u002Fmmap-go\tv1.0.1\th1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv\u002FWHc=\ndep\tgithub.com\u002Fxujiajun\u002Futils\tv0.0.0-20220904132955-5f7c5b914235\th1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark\tv1.8.6\th1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=\ndep\tgithub.com\u002Fyuin\u002Fgoldmark-highlighting\u002Fv2\tv2.0.0-20230729083705-37449abec8cc\th1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=\ndep\tgithub.com\u002Fzeebo\u002Fblake3\tv0.2.4\th1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM\u002FyBqhaZI=\ndep\tgo.etcd.io\u002Fbbolt\tv1.5.0\th1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P\u002FbD4lxU=\ndep\tgo.opentelemetry.io\u002Fauto\u002Fsdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ\u002FipaZ64=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fbridges\u002Fprometheus\tv0.72.0\th1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w\u002F1ROwHEM7M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fexporters\u002Fautoexport\tv0.72.0\th1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Finstrumentation\u002Fnet\u002Fhttp\u002Fotelhttp\tv0.72.0\th1:LxwW\u002F9ctSCv+QkE\u002FcLR7M91ZIkXNMqJtEMi1vCw9U8s=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fautoprop\tv0.72.0\th1:\u002FKv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Faws\tv1.47.0\th1:n\u002F2x\u002FvQki1ojD7R2jYHdnNdI74Yx\u002FOFdY4YXFFesm8M=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fb3\tv1.47.0\th1:vlKDmtjhe1R0d7kdov\u002F+KVTKWOKeGLyohB+iXoDPRMQ=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fjaeger\tv1.47.0\th1:2lDw6AKPV33\u002F7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=\ndep\tgo.opentelemetry.io\u002Fcontrib\u002Fpropagators\u002Fot\tv1.47.0\th1:nZUqh0\u002F8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=\ndep\tgo.opentelemetry.io\u002Fotel\tv1.47.0\th1:j7ALJ\u002FzgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploggrpc\tv0.23.0\th1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlplog\u002Fotlploghttp\tv0.23.0\th1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI\u002FnE=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetricgrpc\tv1.47.0\th1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlpmetric\u002Fotlpmetrichttp\tv1.47.0\th1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\tv1.47.0\th1:julhjPeUH\u002Fq\u002F7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracegrpc\tv1.47.0\th1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fotlp\u002Fotlptrace\u002Fotlptracehttp\tv1.47.0\th1:aXZXsZ012wOgVkqaiQv+Z\u002Fd8V0xKjmg70F6m4CE94lc=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fprometheus\tv0.69.0\th1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutlog\tv0.23.0\th1:PW\u002FE9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdoutmetric\tv1.47.0\th1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fexporters\u002Fstdout\u002Fstdouttrace\tv1.47.0\th1:N3YQCxjxQ\u002FbMjyc3heladfRm9t9RTksGQH8z4w6yU\u002F0=\ndep\tgo.opentelemetry.io\u002Fotel\u002Flog\tv1.47.0\th1:cOTS1CcLbSQeZKanGJ+0JpF\u002F+t4PELi3O3bbl2lqCcI=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fmetric\tv1.47.0\th1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\tv1.47.0\th1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Flog\tv1.47.0\th1:W4N\u002FZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=\ndep\tgo.opentelemetry.io\u002Fotel\u002Fsdk\u002Fmetric\tv1.47.0\th1:lfISg2j93VT6yqdk9OfUaZmw\u002FGfcZqCCV3jdXtsPnKw=\ndep\tgo.opentelemetry.io\u002Fotel\u002Ftrace\tv1.47.0\th1:JOjX\u002FOci8K94QHddo+bbfya\u002FAi\u002Fnf6\u002Fdt9ZfrFNWSrM=\ndep\tgo.opentelemetry.io\u002Fproto\u002Fotlp\tv1.11.1\th1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=\ndep\tgo.step.sm\u002Fcrypto\tv0.91.0\th1:0mN0DwVOvUuh7VbyTnxABZuAkxwak\u002FGrp8Y\u002Fb4YaZDU=\ndep\tgo.uber.org\u002Fatomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp\u002FAUETXlHW0DxSjE=\ndep\tgo.uber.org\u002Fautomaxprocs\tv1.6.0\th1:O3y2\u002FQNTOdbF+e\u002FdpXNNW7Rx2hZ4sTIPyybbxyNqTUs=\ndep\tgo.uber.org\u002Fmultierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=\ndep\tgo.uber.org\u002Fzap\tv1.28.0\th1:IZzaP1Fv73\u002FT\u002FpBMLk4VutPl36uNC+OSUh3JLG3FIjo=\ndep\tgo.uber.org\u002Fzap\u002Fexp\tv0.3.0\th1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=\ndep\tgo.yaml.in\u002Fyaml\u002Fv3\tv3.0.5\th1:N6y\u002FpJk8buWs9NY5ERU2HSMfm+IuD\u002FOtfdAnq6kESPw=\ndep\tgolang.org\u002Fx\u002Fcrypto\tv0.58.0\th1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K\u002FM\u002F54=\ndep\tgolang.org\u002Fx\u002Fcrypto\u002Fx509roots\u002Ffallback\tv0.0.0-20261016151342-0ae6809b7559\th1:M68k3yCPiXhrSyh9Twe3Kv7nOsvUumZDN\u002F3kdSwUqw0=\ndep\tgolang.org\u002Fx\u002Fexp\tv0.0.0-20261014143641-f0251eb4aa3e\th1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI\u002FA=\ndep\tgolang.org\u002Fx\u002Fnet\tv0.61.0\th1:RR+6j\u002FBTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=\ndep\tgolang.org\u002Fx\u002Foauth2\tv0.37.0\th1:JUlcxA8oAtauLfiH8FX2\u002FFkAWHAdi0QtGCGc+hofE98=\ndep\tgolang.org\u002Fx\u002Fsync\tv0.24.0\th1:iqiDrGoDgyuvAKrhLQthUEzU\u002FR378N78gXbBjxed7oA=\ndep\tgolang.org\u002Fx\u002Fsys\tv0.49.0\th1:XbzkgYJHdqh\u002F8m2Uu0W\u002FdQv8nktxx4BFHp1M0gROTXA=\ndep\tgolang.org\u002Fx\u002Fterm\tv0.47.0\th1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ\u002FBM=\ndep\tgolang.org\u002Fx\u002Ftext\tv0.43.0\th1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5\u002FUGUTJVXoWc=\ndep\tgolang.org\u002Fx\u002Ftime\tv0.16.0\th1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q\u002F6gY2hDM6VDE=\ndep\tgoogle.golang.org\u002Fapi\tv0.304.0\th1:2R1dYSiIVQRGcKN901u9yPFEdJu5h90oGY5X4TcgbmA=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Fapi\tv0.0.0-20261012220534-4341edf3f941\th1:DS\u002Fw3N8rsfrwxwgGSj6WhMsPo7aNQGmDx74J81zd0NQ=\ndep\tgoogle.golang.org\u002Fgenproto\u002Fgoogleapis\u002Frpc\tv0.0.0-20261012220534-4341edf3f941\th1:QG6hS4zFplRZvOQedzei4t2pT\u002FzkQc3VR1u+S9\u002FrcAw=\ndep\tgoogle.golang.org\u002Fgrpc\tv1.84.0\th1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=\ndep\tgoogle.golang.org\u002Fprotobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o\u002Ffwxc=\ndep\tgopkg.in\u002Fyaml.v3\tv3.0.1\th1:fxVm\u002FGzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=\nbuild\t-buildmode=exe\nbuild\t-compiler=gc\nbuild\t-ldflags=\"-w -s\"\nbuild\t-tags=nobadger,nomysql,nopgx\nbuild\tCGO_ENABLED=1\nbuild\tCGO_CFLAGS=\"-I\u002Fusr\u002Flocal\u002Finclude\u002Fphp -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fmain -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FTSRM -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002FZend -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext -I\u002Fusr\u002Flocal\u002Finclude\u002Fphp\u002Fext\u002Fdate\u002Flib\"\nbuild\tCGO_CPPFLAGS=\"-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64\"\nbuild\tCGO_CXXFLAGS=\nbuild\tCGO_LDFLAGS=\"-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto\"\nbuild\tGOARCH=amd64\nbuild\tGOOS=linux\nbuild\tGOAMD64=v1\n\n```\n",{"part":885,"tag":1016,"name":1016,"publishedAt":1017,"url":1018,"body":1019},"v2.0.0-alpha.43","2026-10-20T17:51:46Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.43","## [2.0.0-alpha.43](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.43) - 2026-10-20\n\n### Upgrade notes\n\n\n- `CWA_CI_API_WARM_CONCURRENCY` is now per API pod (default 2), multiplied by the pods during the warm, warm surge included; a project that set a total divides it by its pod count. Review apps must have their own database: a review deploy whose `DATABASE_URL` is production's is refused (production is looked up as `RELEASE_PRODUCTION`, default `production`, in `KUBE_NAMESPACE_PRODUCTION`, default `\u003Cproject>-production`; set it where yours differs) (#195, #197). [fa94640](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ffa946403dfebb701b1948f683304c824cc9f74dc), [95ce541](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F95ce541d61e89815bcf4ea5a10fc20f6535fce34)\n- Database backups (`CWA_CI_DATABASE_BACKUP_\u003CTRACK>=\"true\"`) use their own key and bucket folder: run `bin\u002Fdevops\u002Fbackup-bucket.sh project \u003CCI_PROJECT_PATH_SLUG>` (once per project, with an authenticated `gcloud`), set the base64 line it prints as the project's masked `CWA_CI_DATABASE_BACKUP_GCLOUD_JSON` (GitHub: a repository secret), not Protected unless the branch that deploys is protected ([0921e60](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F0921e60972524b5127437e38cf6019995925825a)), and `CWA_CI_DATABASE_BACKUP_BUCKET=silverback-db-backups` on the group. Backups go to `\u003Cproject slug>\u002F\u003Ctrack>\u002F\u003Crelease>\u002F` and never use `GCLOUD_JSON` (#180). [724f51d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F724f51de3c16a079d4b548887699a8cf9fe1455f)\n- Bundle 2.0.0-alpha.33: `route_security` patterns match byte for byte (case and accents matter), on top of alpha.32's whole-path matching; check your own `route` patterns. A rule on the route list refuses databases other than PostgreSQL, MySQL, MariaDB and SQLite. [f188089](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff1880899fe4b5c09ca7cf58e48cc58f8955e91f9)\n- **Copy `api\u002Ffrankenphp\u002Fmercure-hub.caddy` (and `mercure-hub.Caddyfile`) with the Caddyfile**, which now imports the hub settings from it; without it php doesn't start. A project that changed the hub settings in its Caddyfile moves the change there. In scaled mode (still being built) the hub runs in its own pod and php forwards `\u002F.well-known\u002Fmercure` to it (#85). [d51851c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd51851c8fecb429aca2702c871198eec9c663cb6), [eca4d2b](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Feca4d2bdd92e21a671f99d19552d97adcf7c67e0)\n\n### Fixed\n\n- A migration that writes from `up()`\u002F`postUp()` no longer fails the read-only migrations plan and blocks guarded deploys: the plan lists it without SQL and warns. The backup Job's dump space is limited (`CWA_CI_DATABASE_BACKUP_STORAGE`, default 5Gi) (#183). [e8952d5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe8952d5acaa65799482945ce26295987bc756eea)\n- A maintenance window left on by a failed deploy is ended by the next production deploy, with or without `CWA_CI_MAINTENANCE_DURING_MIGRATIONS` (marker ConfigMap `\u003Cfullname>-maintenance-window`; maintenance an admin turned on is left alone), and the printed by-hand command uses a ready pod (#182). [abcc4a1](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fabcc4a116c518c493b192c70294e21ab558be7f9)\n- `check_api_scaling` counts `CWA_CI_API_REPLICA_COUNT` only with the autoscaler off, and min\u002Fmax only with it on, as the chart does (#184). [32e9199](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F32e919996cb78408e822fddffe46877ac6a22ad8)\n- The Redis watch retries a \"Redis is back\" email that failed to send (migration `Version20261020172842`) (#194). [e0e30c8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe0e30c8d1b3fc6554fa813a592b6d46bba932c15)\n- The deploy refuses a `CWA_API_DATABASE_BACKUP_GCLOUD_JSON` site setting, which would have put the backup key into every API pod (#180). [705d5a7](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F705d5a744499c69b9893fa6587db695d6d4394d4)\n- API pods stop cleanly (Completed, not Error): preStop only waits for the ingress, and Caddy's new `grace_period 15s` finishes in-flight requests and cuts open SSE subscriptions instead of `kill -QUIT` (#85). [9ce62c0](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F9ce62c012508bde3cc9c0aea77598d294eba05b6)\n- Scaled mode's Mercure hub pod stops cleanly (Completed, not Error) with subscribers connected: a 5 s Caddy grace period instead of waiting forever for SSE connections (#85). [05090d5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F05090d5850f1fe2d3e78e3422e6299b27c10fb10)\n- php image: a sixth Souin patch gives its buffering writer a no-op `Flush()`, so a PHP `flush()` behind the cache (every dev request; a streamed response in prod) no longer logs \"responseWriter is not a flusher\". Nothing behaved differently; the body was always buffered (#185). [45c3e2f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F45c3e2fa170e32c4f1880dc52bfb6aafdc60fa9d)\n- Staging or a canary whose external `DATABASE_URL` is production's database no longer migrates it (review apps: #197): its pods skip migrations, and with migrations pending it isn't deployed (a canary fails), leaving them to the production deploy's plan, backup and window (#180). [724f51d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F724f51de3c16a079d4b548887699a8cf9fe1455f)\n- Scaled deploys flush and warm only once the old API pods are gone (warm requests failed on terminating pods), and the warm surge raises the autoscaler's maximum along with its minimum (Kubernetes refused a minimum above the maximum) (#85). [4d2ad50](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F4d2ad505bdc724992f1cad89677c52f8533a4245)\n- Deploys run their commands in the API (the flush and warm, fixtures, image variants) in a ready pod, not `kubectl exec deploy\u002F…`, which straight after a rollout could pick the old pod while it terminated. In scaled mode that flushed the old pod's own cache instead of the shared Redis (#85). [ba19fb4](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fba19fb47c8ead79cc55c2b291bac596279f0a895)\n- Browser tests: the password reset test waits for `\u002Fforgot-password` and the reset page to hydrate before filling them, as `logIn` does (#179). [b09d62b](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fb09d62b92ed5286a31413c1b76df626bdf886aeb)\n- Browser tests: `e2e\u002Frun.sh` names its compose stack `cwa-e2e-\u003Ccheckout directory>` (`COMPOSE_PROJECT_NAME` overrides) and its tests container after it, so two projects' local runs on one machine no longer join or tear down each other's (#178). [21a3745](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F21a3745552ac615fad28aea8df53ee105a1b9b85)\n\n### Changed\n\n- Scaled mode's warms through the API Service pass `--requests-per-connection=1`, so they spread across the pods (#196). [4779237](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F47792375ded99d08a1f201832cdd6a112db3f058)\n- Bundle 2.0.0-alpha.34: `warm-http-cache --requests-per-connection=N`, to spread a warm across the pods behind a Service (#196), and resource manifests whose query count no longer grows with publishable components or drafts. No migration. [1cb14d7](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1cb14d7035c43ef1a51f611342466260336e18f6)\n- Scaled mode (still being built): a Redis watch CronJob (`app:redis-watch`, every 2 minutes) notices when php can't reach Redis, emails `MAILER_EMAIL` once, and once Redis is back flushes the cache (and, with a Cloudflare CDN config, the zone), then emails again; a Redis restart only emails, and a restart a deploy caused sends nothing. State is kept in the database (migrations `Version20261020162222`, `Version20261020171138`). On in scaled mode unless `CWA_CI_API_REDIS_WATCH=\"false\"`; `CWA_CI_API_REDIS_WATCH_SCHEDULE` overrides the schedule (#85). [0d9f9d5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F0d9f9d519b18e2e24bebec06fc2d090b4edd6ee3), [230869d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F230869d0464fc5743b15f4c7267a3709e672ee8f)\n- A database backup on demand, e.g. before risky manual work: the manual `database backup production` job (GitLab, when `CWA_CI_DATABASE_BACKUP_BUCKET` is set) or `production.yml`'s `database-backup` action (#180). [c0a0545](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fc0a05455556e170236dcb8a529c8a24cf0546e15)\n- The track image tag (`:production`, `:staging`, `:canary`) is copied only after the migrations and both rollouts succeeded, so a failed deploy leaves the last good build tagged; a deploy whose rollouts don't finish within `CWA_CI_DEPLOY_ROLLOUT_TIMEOUT` (900 s) now fails. `bin\u002Fdevops\u002Fbackup-bucket.sh` (`init`, `project`, `verify`) sets up the shared private backup bucket, one folder and service account per project (#164, #180). [724f51d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F724f51de3c16a079d4b548887699a8cf9fe1455f)\n- GitLab: the staging and production deploy jobs retry once only when CI itself failed (runner, timeout, API, scheduler), no longer when the deploy failed, so a failed maintenance window isn't backed up and migrated again (#180). [3d8d9fd](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3d8d9fd688f2a005de51cecc48e8e46c840c4210)\n- Bundle 2.0.0-alpha.33: `silverback:api-components:maintenance on|off|status`, which the maintenance window uses (#180), and faster cold resource manifests. No migration. [f188089](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff1880899fe4b5c09ca7cf58e48cc58f8955e91f9)\n- Deploys can show production's pending migrations and their SQL before you press the production deploy (`migrations plan production`, read-only, with this pipeline's image; on unless `CWA_CI_MIGRATIONS_PLAN_PRODUCTION=\"false\"`), back the database up first (`CWA_CI_DATABASE_BACKUP_\u003CTRACK>=\"true\"` with a private `CWA_CI_DATABASE_BACKUP_BUCKET`, never the media bucket; keeps `CWA_CI_DATABASE_BACKUP_KEEP`, 5), migrate in a Job before the rollout (`CWA_CI_MIGRATIONS_JOB_\u003CTRACK>`), and, for large or breaking changes, run that pipeline with `CWA_CI_MAINTENANCE_DURING_MIGRATIONS=\"true\"`: maintenance on, back up, migrate, roll out, flush, warm, maintenance off; a failure leaves maintenance on and prints how to restore and turn it off. All off by default; the window needs a bundle with the maintenance command (api-components-bundle#549) on the live site; a window without a backup runs with a warning (#180). [ebbb6ed](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Febbb6ed5cc9a1fe3d1194725a75663d61501c2b4), [0f417a8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F0f417a8a34eaa01812995565a6a5dacd62f66e06), [03cc5f5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F03cc5f580fa79121fc25b3acdf206b8e3520e110), [d8a2384](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd8a2384f5f4b2b883bdeb42b980f8573e8db1367), [6bc3ac7](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F6bc3ac7a4810764154b74e4a24e380abb3c461cb)\n- Browser tests: `E2E_SCALED=true` (CI: `CWA_CI_E2E_SCALED=\"true\"`) runs them against two php replicas sharing scaled mode's Redis cache and Mercure hub (#85). [dd7ffe9](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fdd7ffe950768ea4e09746b20ef8f6003639ade3e)\n- Scaled mode (still being built): `CWA_CI_API_WARM_SURGE` runs that many extra API pods for a deploy's flush and warm, then lets them go; warms after a flush go through the API service so every pod renders a share (`CWA_CI_API_WARM_CONCURRENCY`, default 2 per pod) (#85). [a4bd818](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fa4bd81836fcb436a220cbd09985eac0bd1fb2243)\n- Scaled mode (still being built): API pods get a PDB (`maxUnavailable: 1`), spread across nodes, and an autoscaler on CPU only that removes pods after ten minutes; the chart refuses more than one API pod without it (#85). [9959bf3](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F9959bf387d9813d01587e9972e1545c51282a81f)\n- Deploys refuse more than one API pod (`CWA_CI_API_AUTOSCALE_MIN`\u002F`_MAX` or `CWA_CI_API_REPLICA_COUNT` above 1) unless scaled mode is on for that track, since a second pod's cache is never purged. Scaled mode (`CWA_CI_API_SCALED_PRODUCTION`, `_STAGING`, `_CANARY`, `_REVIEW`) is being built and isn't ready to turn on: so far it starts a Redis per release as the shared cache and flushes on every deploy (#85). [62bfeb9](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F62bfeb928ad665d29666e4569507f1f79c47172a)\n- php entrypoint: migrations and `ANALYZE` run through `app:database:migrate`, under a Postgres advisory lock, so pods and CronJob pods starting together (a deploy beside the 03:00 orphan scan, or several API pods) run them once; the others wait up to 600 s (#85). [77617ca](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F77617ca22aabb871c6a2db27e1748df4d70984d5)\n",{"part":907,"tag":821,"name":821,"publishedAt":1021,"url":1022,"body":1023},"2026-10-20T17:28:59Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.34","### Added\n- `warm-http-cache --requests-per-connection=N` and `http_cache.warm_after_flush.requests_per_connection` send `Connection: close` on every Nth warm request, so a warm through a Kubernetes Service spreads across its pods instead of staying on a few keep-alive connections; off by default ([#554](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F554))\n\n### Changed\n- A resource manifest preloads each publishable component's draft link and a swapped-in draft's groups with its component tree: its query count no longer grows with the number of publishable components or drafts (one id and type query per owner level and one query per publishable class present, instead of one per component and per draft) ([#555](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F555))\n",{"part":907,"tag":1025,"name":1025,"publishedAt":1026,"url":1027,"body":1028},"2.0.0-alpha.33","2026-10-20T14:12:29Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.33","### Breaking\n- A `route_security` `route` pattern matches letters only in the same case and every other character byte for byte, in `RouteVoter` and the route list alike: `\u002FUser-Area*` no longer restricts `\u002Fuser-area\u002Fx`; a database other than PostgreSQL, MySQL, MariaDB or SQLite is refused when the list applies a rule ([#546](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F546))\n\n### Added\n- `silverback:api-components:maintenance on|off|status` turns the `maintenanceModeEnabled` site config on or off for deploys, then purges `cwa-html` and the site config tags explicitly (exit 1 when the purge or the database fails, 2 for an invalid state); it touches only the site config table, and a site config write no longer looks up `Collection` components ([#550](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F550))\n\n### Changed\n- A resource manifest loads its component tree before normalizing it, one fetch-joined query per owner level (pages, layouts, then each level of components) instead of one query per group, position and component ([#548](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F548))\n- A resource manifest neither counts each publishable component's locations nor validates it for publishing, since neither reaches its body: no `COUNT` per component and page data property and no published-group validation while building one ([#551](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F551))\n- A stored imagine variant costs one storage check, not two: `ImagineFilterGenerator` resolves it through the cache manager instead of liip's `FilterService::getUrlOfFilteredImage()`, which checked `isStored()` again, and generates an unstored one with a forced `warmUpCache()` ([#545](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F545))\n- Reading an uploadable resource queries its stored file's file info once per path, the original and every imagine variant together, instead of once for the original and once per filter; `ImagineFilterResult::$generated` tells a variant generated in the call, whose row is then read again ([#547](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F547))\n- A resource manifest builds no media objects for uploadable resources, since none reach its body: no storage call and no file info query per image or imagine variant while building one, and no file info row or variant written as a side effect ([#544](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F544))\n\n### Fixed\n- The route list and `RouteVoter` agree on `route_security` for every path on PostgreSQL, MySQL and MariaDB: the list compared through `LOWER()` and the column collation, so it hid routes such as `\u002Füser-area\u002Fx` (MySQL folds accents) or a path with the Kelvin sign that the voter still served by IRI ([#546](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F546))\n- `GET {component}\u002Fusage` lists in `renderedOn` only the page data where a dynamic position's fallback renders: a page data whose property for that position (or one on the way up a nested chain) holds a component is left out, and `renderedOnCount` follows ([#543](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F543))\n\n### Tooling\n- A CI job runs `RouteExtensionTest` on PostgreSQL 16, MySQL 8.0 and MariaDB 10.11 (`ROUTE_EXTENSION_DATABASE_URL`) ([#546](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F546))\n",{"part":885,"tag":1030,"name":1030,"publishedAt":1031,"url":1032,"body":1033},"v2.0.0-alpha.42","2026-10-19T21:16:16Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.42","## [2.0.0-alpha.42](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.42) - 2026-10-19\n\n### Upgrade notes\n\n- Bundle 2.0.0-alpha.32: `route_security` patterns now match the whole path (case-insensitive, `*` the only wildcard). Check any `route` your project adds still matches what you mean: `\u002Fx*` is a prefix, `*\u002Fx*` matches anywhere. [d816382](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd816382770e6d7ca034d97dcb5f24bdf715abd11)\n- Behind Google Cloud CDN, set each media backend bucket's caps to a year, or the long `Cache-Control` from bundle 2.0.0-alpha.15's `uploadable.cache_control` (and alpha.25's back-fill) reaches browsers as `max-age=3600`: `gcloud compute backend-buckets update \u003Cbackend-bucket> --max-ttl=31536000 --client-ttl=31536000`, then `gcloud compute url-maps invalidate-cdn-cache \u003Curl-map> --host \u003Ccdn host> --path \"\u002F*\"`. New sites: create the bucket with both caps. [#154](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F154)\n\n### Fixed\n\n- php image: every step that fetches from Debian (base packages, `install-php-extensions`) runs through `retry-fetch`, a hard time limit with up to three attempts, and apt fetches deb.debian.org over HTTPS; apt also retries with 30 s timeouts and no pipelining. Uncached builds hung on plain HTTP until the 1 h job limit, or were killed, on GitLab SaaS small runners (#176). [841ea0f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F841ea0f6416e421253c11059f23cc2ec517b7c05), [7fc4ac5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F7fc4ac58a1cbef543d97886410fed8262d31b6b6), [48b5c7c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F48b5c7c21e3d50f3deb3a3048f15ab04dffaa3f3)\n\n### Changed\n\n- Module 2.0.0-alpha.24 (needs bundle 2.0.0-alpha.32): Move goes through `POST {component}\u002Fmove`, page-data slots included; a shared component shows a \"Shared · N places\" badge by its publish button with the list of places, and its other copies on the page are outlined; Clone and Move usability fixes. [773ae69](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F773ae694d086204c3f31501564aeec6f0510c2c3)\n- Bundle 2.0.0-alpha.32: `POST {component}\u002Fmove` and the locations list on `GET {component}\u002Fusage`, which is now admin only. `route_security` patterns match the whole path, case-insensitive, with `*` the only wildcard; the template's `\u002Fuser-area*` is a prefix, as intended. No migration. [d816382](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd816382770e6d7ca034d97dcb5f24bdf715abd11)\n- Browser tests: `logIn` waits for `\u002Flogin` to hydrate before filling the form. [5b6a605](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5b6a6058fb59fc4f8c618f6ecf6f3b558d71e63c)\n- Browser tests assume only what every project has, the admin user and the sitemap's pages, so they pass on a site without the sample content. The 308 redirect and the text and image publish tests are removed; the cache-hit, loading-bar and OG image tests use sitemap pages (#177). [5db12c9](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5db12c9e9992a1f02eaaf187f36ed56db965c13e)\n- `create-cwa`: dependencies updated (`@clack\u002Fprompts` 1, `giget` 3, TypeScript 7); a generated project is unchanged. [bc477e8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fbc477e83122fa90287f4e013c0eb4a25d03c2ee3)\n- Module 2.0.0-alpha.23: Move, in a component's menu, relocates a position through the clone workflow (not yet for page-data slots); clone-mode fixes. [5c5d873](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5c5d87372634ad1d18f94053d9043e5802b5f3a6)\n- Bundle 2.0.0-alpha.31: publishing a draft of a published component no longer empties its positions or orphans its groups, and a component PATCH adding an embedded position no longer 500s. No config or migration. [8125a75](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8125a7511596c1b707d3ef87e371f1aec84a2de4)\n- Helm chart: no API HPA while `autoscaling.maxReplicas` is 1 (the default); it couldn't scale and showed memory over target permanently. The next deploy removes it; raising the max brings it back. [7e0e4d2](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F7e0e4d23ae5de5ea194e65c0533499ae3724f56f)\n- A fixture load's full flush is followed by the same `\u002F_api` warm as a deploy's (`warm_api_cache`). [02f653d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F02f653d7d74f2a01ea08e687a383334faa41269c)\n- `liip_imagine.yaml` has a commented `driver: gd` line. gd keeps AVIF, as vips does through libheif, so switching needs no image rebuild. [4341396](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F434139660c906afbc2a4a46474bef38e79fc2fa7)\n",{"part":901,"tag":1035,"name":1035,"publishedAt":1036,"url":1037,"body":1038},"v2.0.0-alpha.24","2026-10-19T19:45:27Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.24","- No more \"No Mercure rel in link header\" error for resource manifest responses, which never carry one; a hub that is never found is still reported when Mercure starts ([3cf6de94](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F3cf6de94))\n- Clicking **Shared · N places** lists where the component is used: the layout, or each page it shows on, linked (marking this page), with \"and N more\"; links work while editing. Needs api-components-bundle 2.0.0-alpha.32 or later (api-components-bundle [#531](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F531)); before it the badge stays a count ([#420](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fpull\u002F420), [#416](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F416))\n- Move goes through the API's atomic `POST {component}\u002Fmove`, also into an empty page-data slot, out of one, and into the same slot on another page-data page; an occupied slot is a disabled target. **Move now needs api-components-bundle 2.0.0-alpha.32 or later** (#526) ([#421](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fpull\u002F421), [#415](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F415))\n- A shared component shows **Shared · N places** beside the publish button, and its other copies on the page get a faint outline while it is selected ([#418](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fpull\u002F418), [#416](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F416))\n- Cloning a component deleted elsewhere now ends clone mode with \"no longer exists\" when the API answers 400 \"Item not found\", as it does, not only 404 ([cdd23c41](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fcdd23c41), [#411](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F411))\n- Clone and Move: the placed instance flashes and is selected; the instance started from is outlined solid; the dialog names the anchor and the bar names the content; the scope question (\"Edit the shared layout?\" \u002F Edit layout) is asked only when something can be placed, and shared reasons are said once by display name; enabled options look different from disabled ones; the ⋮ button is named \"More actions\"; \"Use here\" on an occupied page-data slot warns \"This replaces …\"; \"Remove from this location only\" deletes through the group's write queue ([#417](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fpull\u002F417), [#414](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F414), [#415](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F415))\n",{"part":907,"tag":1040,"name":1040,"publishedAt":1041,"url":1042,"body":1043},"2.0.0-alpha.32","2026-10-19T15:48:53Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.32","### Breaking\n- `GET {component}\u002Fusage` is `ROLE_ADMIN` only: anonymous callers get 401 and other users 403, where anyone who could read the component used to get the counts ([#539](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F539))\n- A `route_security` `route` pattern matches the whole path, with `*` as its only wildcard, in `RouteVoter` and the route list alike: a pattern without a leading `*` no longer matches mid-path (add one to keep the old behaviour, e.g. `*\u002Fuser-area*`), `%` and `_` are literal in the list too, and ASCII letters match regardless of case ([#538](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F538))\n\n### Added\n- `GET {component}\u002Fusage` lists, for admins, where the component is used: one location per counted position or page data property, with the layout it is in or the pages and page data it renders on through templates and nested components, capped at 50 locations and 20 pages each with exact counts; the response is never stored by a shared cache ([#535](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F535))\n- `POST {component IRI}\u002Fmove` moves a component between component positions and page data component properties in one request and one flush, with the same validation and security as the separate writes; a moved position keeps its IRI and a position moved into a property is removed without deleting its component ([#533](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F533))\n\n### Fixed\n- `generate-fixtures` exits 1 naming the path, instead of reporting success, when its output directory is missing or not writable (checked before anything is exported) or when the class, the asset manifest or a readable asset copy cannot be written ([#536](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F536))\n\n### Tooling\n- Tests pin the upload, orphaned file, imagine variant and stored-file constraint behaviours and the fixture load, `generate-fixtures` option and `make:rename-component` console behaviours that #516 lists as unasserted; `MockClientCallback` records PURGE requests for console runs ([#534](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F534))\n- Tests pin the security, publishable and route behaviour no test asserted (#516): unit tests for `RouteVoter`'s literal `route_security` matching, `RouteExtension` and `PublishableExtension` on a real query, `RouteLiveResolver`'s per-request memo, `ComponentVoter`'s fall-through and `RouteNormalizer`'s redirect reflection and pruning; functional tests for `route_security` on the route collection, the `\u002Fme` cookies, the go-live cache cap's lower bound and a collection default reaching a `QueryParameter` filter ([#532](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F532))\n- Tests pin the page, layout and manifest behaviour #516 listed as unasserted: the case-insensitive `isTemplate` filter, the cache caps' lower bounds and `max-age`, the emptied OpenAPI paths, the manifest's tree shape, a static position's metadata and `Vary`, the cycle guard on manifest purges, and every page data resolution outcome the profiler records ([#529](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F529))\n- Functional and unit tests pin user and cookie behaviour no test asserted: each login cookie's own attributes, both cookies cleared on an expired token, `refresh-tokens:expire` per user and for all, `user:create` options, the user `PUT` response and its notifications, and the JWT listeners' profiler records ([#528](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F528))\n- Ported functional tests are named for what they do, the security test for a component in a restricted static route and a public page data route places the same component in both, and the max-components edit and move tests assert the result as well as the status ([#527](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F527))\n- Tests pin behaviour no test asserted yet: orphan liveness through a placed owner and deduplicated delete lists, Mercure publish failures from the HTTP client (logged) and from an invalid JWT (thrown), the warm's request headers, combined purge options, the order endpoint's cache tags and 422 messages, draft usage counts, delete cascades for group owners and routables, and the usage and order as request data ([#530](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F530))\n",{"part":901,"tag":1045,"name":1045,"publishedAt":1046,"url":1047,"body":1048},"v2.0.0-alpha.23","2026-10-19T09:22:00Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.23","- Move: a component's ⋮ menu offers Move, which works like Clone but relocates the clicked instance's position (`PATCH` with `componentGroup` and `after`\u002F`before`); page-data slots are not supported yet ([#413](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fpull\u002F413), [#409](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F409))\n- Clone mode: fixes to navigation, redirects, the scope confirm, right-clicks, the overlay and highlights; no `?published=` when deleting a resource that is not publishable; a confirm closed with Escape counts as Cancel; clone mode starts with Enable Navigation on and turns it off on arriving at another page, and the Cloning bar says what to do next; the highlight is redrawn after a page is shown from the route cache; the shared delete dialog focuses Remove from this location only, styles Delete from all as a danger, and counts Escape as Cancel; a clone into the layout always says it appears on every page ([#410](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fpull\u002F410), [#157](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F157))\n",{"part":907,"tag":1050,"name":1050,"publishedAt":1051,"url":1052,"body":1053},"2.0.0-alpha.31","2026-10-19T08:05:25Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.31","### Fixed\n- A position or page data component property written with a draft that has a published version (by any client, fixture or Doctrine write) stores the published component, so publishing the draft no longer empties it; a never-published draft is stored as it is, and `generate-fixtures` reads such a reference in an older database as the published component and reports it ([#523](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F523))\n- A component `PATCH` that adds a new embedded component position no longer fails with a 500 for a missing `createdAt` ([#523](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F523))\n- A component group given a draft of a published component as its owner (including an admin's published IRI that resolves to the draft) is owned by the published component, a component field written with such a draft stores the published component, publishing a draft keeps the groups its published component owns and adds the draft's own instead of orphaning them, and the fixture builder and `generate-fixtures` follow the same rule ([#524](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F524))\n\n### Tooling\n- Infection mutates against the `unit` testsuite only again, collecting its own unit-only coverage, so the full run on `main` finishes with nothing skipped for time; Codecov still gets both suites' coverage. The Imagine memory-limit tests set limits above the memory already in use, so they hold in Infection's random-order initial run, and a unit test pins `DataUriFile`'s temporary path, whose escaped mutants wrote `.png` into the checkout ([#525](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F525))\n- Both PHPUnit suites run in parallel with `brianium\u002Fparatest`, locally and in every CI test step but the coverage leg (4 processes), each process with its own test app cache and log directory; `simple-phpunit` is no longer used ([#522](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F522))\n- `justinrainbow\u002Fjson-schema` `^6.4` for the functional tests' schema checks, which now enforce `const`; the boilerplate `$id`s that broke `$ref` resolution are removed from the schema files, and the validation error schema expects API Platform's `ConstraintViolation` type ([#519](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F519))\n- Functional tests pin what the module's clone and \"Delete from all locations\" rely on: a clone is the same component IRI in a new position, validated like any placement, and `GET {component}\u002Fusage` counts positions across groups plus page data properties, a published component and its draft as one ([#523](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F523))\n",{"part":885,"tag":1055,"name":1055,"publishedAt":1056,"url":1057,"body":1058},"v2.0.0-alpha.41","2026-10-18T20:31:42Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.41","## [2.0.0-alpha.41](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.41) - 2026-10-18\n\n### Changed\n\n- Bundle 2.0.0-alpha.30 (placing a component that would create a cycle is a 422, api-components-bundle#503) and `@cwa\u002Fnuxt` 2.0.0-alpha.22 (clone a component into other positions, cwa-nuxt-module#157; faster navigation with many cached pages, cwa-nuxt-module#259). Update `api\u002Fcomposer.lock`, `app\u002Fpackage.json` and `app\u002Fpnpm-lock.yaml`; no migration. [52552d8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F52552d8a94849bca15b7e4962c7aa80e29be6d78)\n- Dependencies: pnpm 12.14.0 (`packageManager` and the app Dockerfile's `PNPM_VERSION`), Guzzle 8.3, the app's other in-range updates, and for tests Playwright 1.64.1 (`e2e\u002FDockerfile` image and package), eslint 10.13.0, redis 8.10.2 and mailpit v1.31.6. [52552d8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F52552d8a94849bca15b7e4962c7aa80e29be6d78)\n- CLAUDE.md: TypeScript stays pinned to 6.0.3 until vue-tsc supports TypeScript 7, now tracked by vuejs\u002Flanguage-tools#6170 (vue-tsc v4, a draft); every TypeScript 7 issue there is closed. [c3fc4d1](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fc3fc4d14cc5dbb5568cfca438431d794448dc57b)\n",{"part":907,"tag":1060,"name":1060,"publishedAt":1061,"url":1062,"body":1063},"2.0.0-alpha.30","2026-10-18T19:43:02Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.30","### Fixed\n- A component can no longer be placed inside its own subtree: a position whose component would contain its own group, at any depth (a published component and its draft counting as one), is a 422 on `component`, and giving a component group an owner from inside it is a 422 on `components`; `ComponentVoter` no longer recurses forever on such a cycle already in the database ([#503](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F503))\n\n### Tooling\n- PHPUnit functional tests on API Platform's `ApiTestCase` (`tests\u002FFunctional`, testsuite `functional`) with an in-memory SQLite database per process and a debug-kernel group; `health.feature` and the HTTP cache and rendered HTML purge operation features ported from Behat; both PHPUnit configs fail on Risky; the functional suite runs on every Behat CI leg and in Infection ([#505](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F505))\n- Behat is removed: every feature is a PHPUnit functional test, CI runs PHPUnit only and Codecov waits for the one coverage upload; the assets and the golden scaffold moved from `features\u002F` to `tests\u002FFunctional\u002Fassets` and `tests\u002FFunctional\u002FFixture\u002Fscaffolds` ([#517](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F517))\n- The test environment resolves Symfony 8.1 on the 8.1 legs, no longer capped at 7.4 by Behat's dependencies; `symfony\u002Fyaml` and `symfony\u002Ftranslation` are now direct dev dependencies ([#517](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F517))\n",{"part":901,"tag":1065,"name":1065,"publishedAt":1066,"url":1067,"body":1068},"v2.0.0-alpha.22","2026-10-18T16:39:06Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.22","- The route cache keeps 200 routes by default instead of 50, so more pages revisit instantly; set `cwa.routeCacheLimit` to change it ([#259](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F259), [2c125fcb](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F2c125fcb))\n- Each `\u003CCwaComponentGroup>` finds its group by reference in constant time, instead of the lookup being rebuilt over every stored group whenever a group is saved, so a navigation no longer slows down as more pages are cached. The resources store's `componentGroupByReference` getter is now a function of the reference rather than a `Map`; `$cwa.resources.getComponentGroupByReference` is unchanged ([#259](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F259), [a8529041](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fa8529041))\n- Storing a resource the store has not seen yet no longer slows down as the store grows: the store checks its list of IRIs through a `Set` ([#259](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F259), [37b94f16](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F37b94f16))\n- Evicting a route from the route cache costs only the resources it evicts: each resource counts the cached routes that list it, so a `routeCacheLimit` of about 200 stays fast ([#259](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F259), [e5abadbe](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fe5abadbe))\n- **Clone a component** ([#157](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F157)): the same component, with the same IRI, shown in another position, so an edit or a publish applies everywhere. The manager bar's dots menu offers **Clone** for a saved component, even when its own group is full ([4b2bfceb](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F4b2bfceb))\n- Clone mode shows a \"Cloning\" bar with Cancel under the admin header, and the header's Enable Navigation toggle; it stays on across navigation, and ends on Cancel, Escape, leaving edit mode or signing out ([#157](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F157), [07b39ad1](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F07b39ad1))\n- Every on-screen instance of a selected component is outlined, and in clone mode every instance of the component being cloned is highlighted ([#157](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F157), [a3c96253](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fa3c96253), [12fa5c38](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F12fa5c38))\n- In clone mode a click opens a dialog offering what adding a component offers there (Add before\u002Fafter, Add to Start\u002FEnd, Add here, Use here on a page-data slot), with every refused option disabled and its reasons, and names the layout or page scope. A container can't be offered inside itself; the server-side refusal of cycles needs api-components-bundle [#502](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F502), and cloning works without it ([#157](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F157), [048dacbe](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F048dacbe), [12fa5c38](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F12fa5c38))\n- A clone posts the position through the group's write queue and reads the group order once; a refusal (422) is shown and keeps clone mode on, and a source that no longer exists ends it ([#157](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F157), [82d6f222](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F82d6f222), [12fa5c38](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F12fa5c38))\n- Deleting a component used in several locations asks whether to delete it from all of them or remove it from this location only, and the Info tab shows \"Used in X locations\" ([#157](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F157), [1619af74](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F1619af74))\n- The resources store's `resourcesByType` getter is removed; nothing read it but a position delete, which now falls back to the component groups index ([#259](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F259), [acd9c97e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Facd9c97e))\n- A Mercure update that arrives during a navigation no longer slows it down as more pages are cached: it waits only for the resources on screen, not every stored one ([#259](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F259), [4dfac773](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F4dfac773))\n- Each `\u003CCwaComponentGroup>` finds its group without scanning every stored resource on each response, and deleting a position edits only its own group ([#259](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F259), [19940eb7](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F19940eb7))\n- Resources are stored without the JSON-LD `@context` embedded in their `_metadata`, about a fifth smaller in memory and in the SSR payload ([#259](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F259), [3b5ac5be](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F3b5ac5be))\n",{"part":885,"tag":1070,"name":1070,"publishedAt":1071,"url":1072,"body":1073},"v2.0.0-alpha.40","2026-10-18T14:08:06Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.40","## [2.0.0-alpha.40](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.40) - 2026-10-18\n\n### Upgrade notes\n\n- Bundle 2.0.0-alpha.29 and `@cwa\u002Fnuxt` 2.0.0-alpha.21 go together (alpha.27 and alpha.28 500 when publishing in functional tests): update `api\u002Fcomposer.lock`, `app\u002Fpackage.json` and `app\u002Fpnpm-lock.yaml` in one deploy (no migration). Public Mercure updates are now the anonymous view, anonymous visitors get no Mercure cookie from `\u002Fme` (the template's hub already allows anonymous subscribers), and the subscriber cookie and its token expire after `refresh_token.ttl` instead of `mercure.default_cookie_lifetime`. A site routing `Symfony\\Component\\Mercure\\Update` to an async transport must also route `Silverback\\ApiComponentsBundle\\Message\\PublishMercureUpdatesMessage`. [0dab19c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F0dab19ca6f3ce8817614ca1f4b85ed8732745e52)\n\n### Changed\n\n- Dependencies: API Platform 5.0.4 (includes the genid fix, api-platform\u002Fcore#8681, #161), Symfony 8.1.9, Nuxt 4.6.2, `@nuxt\u002Fui` 4.12.0, satori 0.62.0. [0dab19c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F0dab19ca6f3ce8817614ca1f4b85ed8732745e52)\n- Bundle 2.0.0-alpha.26: a `br` warm without the brotli extension now fails instead of warming only routes, and a body it can't decode counts as failed (api-components-bundle#488, #175). Update `api\u002Fcomposer.lock`; no migration. [cb79664](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fcb7966404fe4b6750eff8f03c424875a0d9f834b)\n\n### Fixed\n\n- Bundle 2.0.0-alpha.29: publishing no longer 500s (\"Event api_platform.processor.write is not started\") under a debug kernel whose profiler doesn't collect, as in functional tests (api-components-bundle#501); the bundle's skolem hotfix is gone now that API Platform 5.0.4 has the fix, and it requires `api-platform\u002Fcore` ^5.0.4 (#161). Update `api\u002Fcomposer.lock`; no migration. [f85d1a0](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff85d1a0aa791c95739d8bd577c5d907cc86f6d92)\n",{"part":907,"tag":1075,"name":1075,"publishedAt":1076,"url":1077,"body":1078},"2.0.0-alpha.29","2026-10-18T13:52:29Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.29","### Breaking\n- `ComponentVoter` and `AnonymousResourceReader` take the new `SubRequestKernel` (`silverback.api_components.helper.sub_request_kernel`) instead of the HTTP kernel, and `AnonymousResourceReader` no longer takes the stopwatch ([#501](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F501))\n\n### Changed\n- Requires `api-platform\u002Fcore` `^4.4.5 || ^5.0.4`, which reset the skolem IRI converter between requests themselves ([api-platform\u002Fcore#8681](https:\u002F\u002Fgithub.com\u002Fapi-platform\u002Fcore\u002Fpull\u002F8681)); `ApiPlatformCompilerPass` no longer adds that `kernel.reset` tag ([#500](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F500))\n\n### Fixed\n- With a debug stopwatch (dev and test), a write whose Mercure update makes an anonymous read no longer fails with a 500 \"Event \\\"api_platform.processor.write\\\" is not started\": a sub-request whose stopwatch section is left open, because it threw, or because the profiler reported itself disabled partway through it (`framework.profiler.collect: false`), now has that section closed ([#501](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F501))\n",{"part":907,"tag":1080,"name":1080,"publishedAt":1081,"url":1082,"body":1083},"2.0.0-alpha.28","2026-10-18T13:19:42Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.28","### Changed\n- The Mercure subscriber cookie and the token in it both expire after `refresh_token.ttl`, instead of a 10-year cookie carrying a token of `mercure.default_cookie_lifetime` (usually one hour), which no longer applies to the cookie the bundle builds ([#499](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F499))\n",{"part":901,"tag":1085,"name":1085,"publishedAt":1086,"url":1087,"body":1088},"v2.0.0-alpha.21","2026-10-18T13:02:20Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.21","- Dependencies updated to Nuxt 4.6.2 and Vue 3.5.44; `@nuxt\u002Fkit` and `@nuxt\u002Fschema` still accept 4.6.0 or later ([4eb12643](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F4eb12643))\n- **For api-components-bundle [2.0.0-alpha.27](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.27) ([#492](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F492)); also safe with older bundles.** A visitor sees a component appear live when it is published into a static position: the position's Mercure update now also fetches the component it points to ([#402](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fpull\u002F402))\n- A browser whose admin session expires during a navigation reconnects Mercure, so it no longer keeps a connection authorised with the admin's grants while signed out. Safe with any bundle version; the full fix needs api-components-bundle [2.0.0-alpha.27](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.27), which expires the Mercure cookie on logout and on a failed `\u002Fme` (with an older bundle the reconnect re-sends the same cookie, so nothing gets worse) ([api-components-bundle#494](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F494), [be1d52e9](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fbe1d52e9))\n",{"part":907,"tag":1090,"name":1090,"publishedAt":1091,"url":1092,"body":1093},"2.0.0-alpha.27","2026-10-18T12:56:29Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.27","### Breaking\n- Admins (the publishable permission) are now granted `\u003Cpattern>\\?draft=1` for every Mercure resource class, which carries the writer's view privately; an application routing `Symfony\\Component\\Mercure\\Update` to an async transport must also route `Silverback\\ApiComponentsBundle\\Message\\PublishMercureUpdatesMessage`, which carries a resource's public and private updates in order ([#497](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F497))\n\n### Changed\n- Requires `symfony\u002Fexpression-language` `^7.4.21 || ^8.1.9`, the releases that fix CVE-2026-109449 ([#496](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F496))\n\n### Fixed\n- A component position, its `_metadata.staticComponent` and the manifest no longer expose a publishable component that is not published yet to a caller who cannot see drafts (the `component` key is absent); the response still carries the component's cache tag, expires when a scheduled component goes live, and a change to the component's publication date purges and publishes the positions holding it and the manifests placing it ([#493](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F493))\n- Logout, an invalid or expired JWT and a failed `\u002Fme` expire the Mercure subscriber cookie instead of issuing a new one; a failed `\u002Fme` expires it whenever the request carries it, and sets no Mercure cookie when the request carries none ([#495](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F495))\n- A Mercure update no longer publishes the writer's view on the public topic: the public payload is an anonymous `GET` of the resource, and the writer's view follows privately on `?draft=1`; when anonymous callers cannot read the resource, a public delete `{\"@id\"}` goes out only if the write itself hid it (a publication date or a route's `liveAt` moved to the future or cleared, a page's route unset or its parent changed), otherwise nothing is published publicly ([#497](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F497))\n- A JWT refreshed on a request that makes a sub-request is set on the main response, not on the sub-request's, and normalizing a component position no longer leaves the draft on the managed entity ([#497](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F497))\n",{"part":907,"tag":1095,"name":1095,"publishedAt":1096,"url":1097,"body":1098},"2.0.0-alpha.26","2026-10-18T10:26:51Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.26","### Fixed\n- `generate-fixtures` into a local fixture asset store keeps an asset its previous manifest listed while another manifest in the same directory still lists it, and deletes nothing when such a manifest is invalid ([#490](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F490))\n- `warm-http-cache --accept-encoding=br` exits 2 and a `br` warm after a flush logs an error and requests nothing when the brotli PHP extension is missing, and a route or manifest body the warm cannot decode counts as failed with its reason instead of being skipped silently ([#491](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F491))\n",{"part":885,"tag":1100,"name":1100,"publishedAt":1101,"url":1102,"body":1103},"v2.0.0-alpha.39","2026-10-17T21:29:50Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.39","## [2.0.0-alpha.39](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.39) - 2026-10-17\n\n### Upgrade notes\n\n- Copy `api\u002FDockerfile` and `api\u002Ftests\u002FUnit\u002FBrotliExtensionTest.php`: the php image gets the `brotli` extension, without which the postStart `br` warm only warmed route responses, never their manifests or components (#175). [c52bb7a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fc52bb7a95a52dd6a90668456f4b08e031221990b)\n- Copy `bin\u002Fdevops\u002Fk8s.sh`: after a deploy's full flush (sites with `provider cloudflare` in `CADDY_CACHE_CDN_CONFIG`, and after new image variants) the API pod's `\u002F_api` is warmed again, gzip then br, so those jobs take up to 2 x `CWA_CI_API_WARM_HTTP_CACHE_MAX_TIME` (60 s) longer (#175). A large site may need a higher value: on cymru-kitchens (111 routes) 60 s didn't cover one pass. [1818110](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F18181102a41d844bda3240cdc83fd1b46f4c7b9b)\n\n### Fixed\n\n- The deploy's Cloudflare flush emptied a new php pod's warm cache moments before visitors arrived, so the first visitor's component requests were load-shed (#175). [1818110](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F18181102a41d844bda3240cdc83fd1b46f4c7b9b)\n",{"part":885,"tag":1105,"name":1105,"publishedAt":1106,"url":1107,"body":1108},"v2.0.0-alpha.38","2026-10-17T09:33:43Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.38","## [2.0.0-alpha.38](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.38) - 2026-10-17\n\n### Upgrade notes\n\n- Update api-components-bundle to 2.0.0-alpha.25 and `@cwa\u002Fnuxt` to 2.0.0-alpha.20 together (`api\u002Fcomposer.lock`, `app\u002Fpackage.json`, `app\u002Fpnpm-lock.yaml`): the module's new \"Purge this page\" needs the bundle's scoped purge, and an older bundle would flush everything instead. No migration. [388425e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F388425e968d28f485c470efc1aed7a69f6d46911)\n- Souin's store and backend timeout are their own settings (#170): `CADDY_CACHE_STORAGE` (default `otter`) and `CADDY_CACHE_BACKEND_TIMEOUT` (default `30s`), set on deploys as `CWA_API_CADDY_CACHE_STORAGE` \u002F `CWA_API_CADDY_CACHE_BACKEND_TIMEOUT`. `CADDY_CACHE_EXTRA_CONFIG` is now for other directives only and no longer defaults to `otter`: **delete a `CADDY_CACHE_EXTRA_CONFIG` CI variable that only restates `otter` or a `timeout` block in the same deploy**, because the deploy now refuses a store or `timeout` there (`check_cache_config`). Copy `api\u002Ffrankenphp\u002FCaddyfile`, `api\u002Ffrankenphp\u002Fworker.Caddyfile`, `compose.yaml`, `bin\u002Fdevops\u002Fk8s.sh`, `helm\u002Fcwa\u002Ftemplates\u002F_helpers.tpl`, `secrets.yaml`, `values.yaml`, `bin\u002Ftest\u002Fsouin-backend-timeout.sh`, `bin\u002Ftest\u002Fcache-encoding.sh` and the unit-tests steps of `.gitlab-ci.yml` and `.github\u002Fworkflows\u002Fci.yml`. The chart's `php.caddy.storageConfig` and secret key `caddy-cache-storage-config` are renamed `php.caddy.extraConfig` and `caddy-cache-extra-config`. Local dev now uses otter too. [a728acb](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fa728acbb28ddc12e9e91cb8b0b7fe362e0ae3b52)\n- Copy `helm\u002Fcwa\u002Ftemplates\u002Fdeployment.yaml`: a new php pod's postStart warm runs a second, `br` pass for browsers and Cloudflare, so a pod can take up to `CWA_CI_API_WARM_HTTP_CACHE_MAX_TIME` (60 s) longer to become ready (#170). [3d90f34](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3d90f348e732bbb3e5af886a53cf2c287f4f2147)\n- The deploy tidies `GCLOUD_PATH_PREFIX` exactly as php does and fails before touching the cluster on a `.`, `..` or `review` segment (#168). Rename such a prefix first, moving its objects with it. Copy `bin\u002Fdevops\u002Fk8s.sh` and `bin\u002Ftest\u002Fstorage-prefix-parity.sh` (and its unit-tests steps). [82438ab](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F82438ab5e5f00716c94b6ab66499d0b4fa4207f7)\n- Review apps deployed before 2.0.0-alpha.37 keep their uploads at the bucket root, so after their next deploy those uploads are missing and the orphan scan no longer sees them (#169). Reload their fixtures with `CWA_CI_FIXTURES_PURGE=true`, or recreate them, then delete the root objects by hand. [a354f48](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fa354f4809d27a41b1f567618d8ca729f204ade96)\n- The bucket lifecycle rule behind stop review needs one rule per prefixed app, `matchesPrefix: [\"\u003CGCLOUD_PATH_PREFIX>review\u002F\"]`, and its `age` counts from each object's upload, so pick one longer than your review apps live (#169). [a354f48](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fa354f4809d27a41b1f567618d8ca729f204ade96)\n- Review apps store under `\u003CGCLOUD_PATH_PREFIX>review\u002F\u003Cslug>\u002F` without the slug's own `review-`, so `review\u002Freview-feat-x\u002F` is now `review\u002Ffeat-x\u002F` (#173). A review app deployed on 2.0.0-alpha.37 moves path on its next deploy and its earlier uploads go missing, as in #169: reload its fixtures with `CWA_CI_FIXTURES_PURGE=true` or recreate it; its old path is then left to the lifecycle rule. One left as it is still deletes its own path when stopped, since the delete runs with the pod's prefix. Copy `bin\u002Fdevops\u002Fk8s.sh` and `bin\u002Ftest\u002Fstorage-prefix-parity.sh`. [1a98d54](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1a98d54ac752bf23e787ffd5fa63c27f740733b3)\n- GitLab: copy the `stop review` job from `.gitlab-ci.yml` (#165). It no longer checks out its branch, so merging with *Delete source branch* stops the review app instead of leaving it running. It fetches `bin\u002Fdevops` from your default branch, so the stop runs that branch's `k8s.sh` and `project.sh`. An environment already stuck in *stopping* still needs the manual cleanup in #165. [e3286b4](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe3286b4a9f8f2c12faa713c7e595506bfdd66c36)\n\n### Changed\n\n- Bundle 2.0.0-alpha.25 and module 2.0.0-alpha.20: the admin can purge one page from the cache instead of everything, and the admin purge endpoint takes `paths` or `tags`. [388425e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F388425e968d28f485c470efc1aed7a69f6d46911)\n- Souin waits 30 s for a cold render instead of 10 s, so a slow cold CMS page after a full flush or a rollout is served and cached instead of returning a 504 (#170). [a728acb](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fa728acbb28ddc12e9e91cb8b0b7fe362e0ae3b52)\n- The cache store is its own setting, so overriding `CADDY_CACHE_EXTRA_CONFIG` can no longer drop otter (#170). [a728acb](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fa728acbb28ddc12e9e91cb8b0b7fe362e0ae3b52)\n- A new php pod's postStart warm also warms the `br` keys browsers and Cloudflare use, after SSR's `gzip` ones (#170). [3d90f34](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3d90f348e732bbb3e5af886a53cf2c287f4f2147)\n\n### Fixed\n\n- The reserved-name error for `CWA_API_CADDY_CACHE_CDN_CONFIG` and `CWA_API_CADDY_CACHE_EXTRA_CONFIG` names the plain CI variable to set (#170). [a728acb](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fa728acbb28ddc12e9e91cb8b0b7fe362e0ae3b52)\n- The deploy and php now tidy `GCLOUD_PATH_PREFIX` the same way, so `site-a\u002F\u002F` gives review apps `site-a\u002Freview\u002F\u003Cslug>\u002F` (#168). [82438ab](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F82438ab5e5f00716c94b6ab66499d0b4fa4207f7)\n- Stop review's storage warning names the app's real path (#169). [a354f48](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fa354f4809d27a41b1f567618d8ca729f204ade96)\n- A review app's storage path no longer says \"review\" twice (#173). [1a98d54](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1a98d54ac752bf23e787ffd5fa63c27f740733b3)\n- `stop review` failed in `get_sources` once its branch was deleted, leaving the review app, its database volume and stored files behind (#165). [e3286b4](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe3286b4a9f8f2c12faa713c7e595506bfdd66c36)\n",{"part":901,"tag":1110,"name":1110,"publishedAt":1111,"url":1112,"body":1113},"v2.0.0-alpha.20","2026-10-17T08:53:41Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.20","- **Needs api-components-bundle [2.0.0-alpha.25](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.25) ([#484](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F484)); do not pair it with an older bundle, which ignores the request body and flushes everything.** The page settings modal's Info tab can purge the cache of the page on screen alone: its route, every resource it is built from, and its manifest, in one request. Purging all cached data is now presented as a last resort ([cdcd3c82](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fcdcd3c82))\n- A server render is no longer cached when a component fetch still fails with a 5xx or a network error after its retry, or the wait for a resource times out: the page went out with components missing and a long `s-maxage` during a cold-cache load ([#401](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F401), [98767885](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F98767885))\n",{"part":907,"tag":824,"name":824,"publishedAt":1115,"url":1116,"body":1117},"2026-10-17T08:48:10Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.25","### Added\n- `POST \u002F_\u002Fhttp_cache\u002Fpurge` takes an optional body `{\"paths\": [...], \"tags\": [...]}` (either or both) and purges only those tags, as `purge-http-cache --path\u002F--tag` does; only a request with no body flushes, and any other body is a 422 ([#487](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F487))\n- `http_cache.warm_after_flush` (off by default): after a successful full flush, dispatch a bounded warm of the public routes for `gzip` and `br` as `WarmHttpCacheMessage`s on `messenger.default_bus`; route the message to an async transport ([#487](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F487))\n\n### Changed\n- `purge-http-cache`'s description presents the full flush as a last resort and points at `--path` and `--tag` ([#487](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F487))\n\n### Fixed\n- `redirectTo()` on a scaffold page or page data refuses a redirect to the page's own route, naming the page and the route ([#485](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F485))\n- `prune-fixture-assets` reports a storage error from listing or deleting, with the assets it had already deleted, and exits 1 instead of crashing ([#485](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F485))\n- `generate-fixtures` into a local fixture asset store deletes only the assets the same scaffold's previous manifest listed and the new one does not, so scaffolds sharing a folder no longer delete each other's assets ([#486](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F486))\n",{"part":885,"tag":1119,"name":1119,"publishedAt":1120,"url":1121,"body":1122},"v2.0.0-alpha.37","2026-10-16T23:59:49Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.37","### Upgrade notes\n\n- Bundle 2.0.0-alpha.24 and `@cwa\u002Fnuxt` 2.0.0-alpha.19 must be deployed together (api-components-bundle#480, cwa-nuxt-module#400): the API now orders component positions and ignores a `sortValue` in a request, which is how older modules reorder. Copy `api\u002Fcomposer.lock`, `app\u002Fpackage.json` and `app\u002Fpnpm-lock.yaml`, or run `composer update components-web-app\u002Fapi-components-bundle` in the php container and set `@cwa\u002Fnuxt` to `^2.0.0-alpha.19`. [da2f00a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fda2f00a750b8f41b8b389798c9abffe119c98d34)\n- Migration: bundle 2.0.0-alpha.23 adds `max_components` to `_acb_component_group` (api-components-bundle#467). Copy `api\u002Fmigrations\u002FVersion20261016233432.php`, or generate your own with `doctrine:migrations:diff` (delete its `down()`). [da2f00a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fda2f00a750b8f41b8b389798c9abffe119c98d34)\n- Bundle breaking changes, none of which the template uses; check your own code: `sortValue` is read-only on the API (`after`\u002F`before` anchors and `PATCH \u003Cgroup>\u002Forder` replace it); `ComponentPositionSortValueHelper` and `ComponentPosition::getSortCollection()` are removed; `UploadedDataUriFile`, `OrphanedFileDetector`, `ComponentPositionValidator`, `ComponentGroupNormalizer`, `ComponentPositionNormalizer` and `GenerateFixturesCommand` take different constructor arguments. `CwaFixtureBuilder` now numbers sort values 0, 1, 2… instead of 10, 20, 30…: only scaffold code that relies on the old numbers needs a change. [da2f00a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fda2f00a750b8f41b8b389798c9abffe119c98d34)\n- Storage path prefix (#166): copy `api\u002Fconfig\u002Fservices.php`, `api\u002Fsrc\u002FFlysystem\u002F`, the `GCLOUD_PATH_PREFIX` lines of `api\u002F.env`, `bin\u002Fdevops\u002Fk8s.sh` and `helm\u002Fcwa\u002Ftemplates\u002F` and `values.yaml`. Review apps then store their uploads under `review\u002F\u003Cslug>\u002F` (inside `GCLOUD_PATH_PREFIX` if you set one), and stopping a review app deletes them (the bundle's `delete-stored-files`, api-components-bundle#477, bundle 2.0.0-alpha.24). Existing review apps' objects stay at the bucket root until you remove them. Production is unchanged while `GCLOUD_PATH_PREFIX` is unset. **Several apps on one bucket should each set a prefix** (as a CI variable), or each app's orphaned-file scan lists the others' files and \"delete all\" removes them. Before setting one on a live app, copy its objects under the new prefix, because the paths stored in the database are relative to it. Optionally add a bucket lifecycle rule deleting `review\u002F` objects after about 90 days, in case a stop job fails. [!15](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F15)\n\n### Changed\n\n- Bundle 2.0.0-alpha.24 and `@cwa\u002Fnuxt` 2.0.0-alpha.19: the server places added and moved components, a reorder is one request, and a component group can take a `max-components` limit; plus `delete-stored-files`, fixture asset stores and `#[UploadedImage]` (bundle alpha.23 and alpha.24 release notes). [da2f00a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fda2f00a750b8f41b8b389798c9abffe119c98d34)\n\n### Added\n\n- `GCLOUD_PATH_PREFIX`: an app's uploads, image variants and orphaned-file scan stay in one path of the bucket, and media URLs include it once. Review apps get their own path automatically and empty it when stopped (the bundle's `delete-stored-files`, guarded on the pod's prefix). The browser tests run under a prefix (#166). [!15](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F15)\n\n### Fixed\n\n- Selecting a component edited with `TipTapHtmlEditor` no longer saves TipTap's re-serialised HTML as a draft (#167). [9c91f6e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F9c91f6ebb6c20b719f862996d9414198f42bfd54)\n",{"part":901,"tag":1124,"name":1124,"publishedAt":1125,"url":1126,"body":1127},"v2.0.0-alpha.19","2026-10-16T23:37:00Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.19","- **Breaking: needs api-components-bundle [2.0.0-alpha.24](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.24) (#475), and that bundle needs this release; do not pair it with an older bundle, or bundle alpha.24 with an older module.** The API now orders component positions: adding a component sends `after`\u002F`before` the position it was placed next to instead of a sort value, and a reorder is one `PATCH \u003Cgroup>\u002Forder` with the new order instead of one request per moved position. Moves show at once and the Order controls are no longer disabled while requests run; the order is reconciled from the API's complete response, so it never depends on Mercure ([#400](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F400), [4e4a769f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F4e4a769f), [73219b19](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F73219b19))\n",{"part":907,"tag":838,"name":838,"publishedAt":1129,"url":1130,"body":1131},"2026-10-16T23:31:54Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.24","### Breaking\n- Requires `@cwa\u002Fnuxt` 2.0.0-alpha.19, which includes [cwa-nuxt-module#400](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F400): an earlier module reorders by writing `sortValue`, which is now ignored ([#480](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F480))\n- `sortValue` on a component position is read-only on the API: a value in a request body is ignored, and with `after`\u002F`before` it is a 422; the server places every insert, move and reorder by one rule that keeps the most values it can and leaves every value unique ([#480](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F480))\n- `ComponentPositionSortValueHelper` (`silverback.helper.component_position_sort_value`) and `ComponentPosition::getSortCollection()` are removed; `ComponentPositionOrderer` replaces the helper, and `ComponentPositionNormalizer` no longer takes it. `ComponentPositionValidator` takes the new `ComponentPositionIriResolver` ([#480](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F480))\n\n### Added\n- `after`\u002F`before` (a position IRI) on a component position created on its own, embedded in a component write, or patched into or within a group: it goes right after or before that position, and an anchor that is not a position of the group is a 422 on that field ([#480](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F480))\n- `PATCH \u002F_\u002Fcomponent_groups\u002F{id}\u002Forder` (`application\u002Fmerge-patch+json`) with `{\"componentPositions\": [iri, …]}` reorders a group in one request (positions left out follow their predecessor), and it and `GET` on the same path return `{componentGroup, componentPositions: [iri, …], sortValues: {iri: int}}` for every position the group lists, in order ([#480](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F480))\n- `silverback:api-components:delete-stored-files \u003Cfilesystem> [\u003Cpath>]` deletes every stored file under a path of a filesystem (`--all` for the whole filesystem, `--dry-run`); `--only-if-value` with `--matching` runs it only when a caller-supplied value, such as the adapter's path prefix, matches a pattern ([#478](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F478))\n\n### Changed\n- `CwaFixtureBuilder` gives positions sort values from 0 in steps of 1, as the API does, instead of from 10 in steps of 10 ([#479](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F479))\n- Positions sharing a `sortValue` are ordered by id ([#480](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F480))\n",{"part":901,"tag":1133,"name":1133,"publishedAt":1134,"url":1135,"body":1136},"v2.0.0-alpha.18","2026-10-16T22:22:14Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.18","- `\u003CCwaComponentGroup>` takes a `max-components` prop that limits how many components a group holds: the admin offers no add for a full group and warns about one over its limit, removing nothing. Needs an api-components-bundle release with [#467](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F467) ([#398](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F398), [6789579f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F6789579f))\n- The component group sync no longer tries to create a group that already exists when a navigation is interrupted, e.g. by Back (\"reference already exists\"); a create rejected as a duplicate attaches the existing group without showing an error ([#399](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F399), [0af4ec09](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F0af4ec09))\n",{"part":907,"tag":1138,"name":1138,"publishedAt":1139,"url":1140,"body":1141},"2.0.0-alpha.23","2026-10-16T21:43:54Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.23","### Breaking\n- `UploadedDataUriFile`'s constructor no longer takes `$error` and `$test`: a decoded data URI is always a valid upload ([#459](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F459))\n- `OrphanedFileDetector` takes the `PublishableAttributeReader` (`$publishableAttributeReader`) ([#459](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F459))\n- `ComponentPositionValidator` and `ComponentGroupNormalizer` take the new `ListedComponentPositions` helper (`silverback.api_components.helper.listed_component_positions`) ([#467](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F467))\n- `GenerateFixturesCommand` takes the `FixtureAssetStoreFactory` (`silverback.api_components.fixture.asset_store_factory`) as its second argument ([#466](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F466))\n\n### Added\n- `maxComponents` on a component group (`null`, the default, is unlimited; otherwise a positive integer), read and written with `allowedComponents`: a position created in, or moved into, a group that already lists that many positions is refused with a 422 on `componentGroup` naming the limit, also when the position is created inside a component write. A dynamic page data position counts as one, a published component with its draft as one, and a position hidden by `allowedComponents` not at all. Setting a limit below what a group holds removes nothing; the group takes no more until it is under the limit, and its positions can still be moved within it. `group(..., max: n)` in `CwaFixtureBuilder`, and `generate-fixtures` writes it. Upgrade step: new `max_components` column on `component_group`; generate and run a migration ([#467](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F467))\n- `#[UploadedImage]`, an `Assert\\Image` for upload fields that skips the image checks for an SVG (`allowSvg: false` refuses one), takes its `maxPixels` from the new `uploadable.image_max_pixels` (default 30,000,000) when it sets none, and says the limit with an approximate width x height; the orphaned files report checks it the same way ([#456](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F456))\n- A fixture asset store for `generate-fixtures` (`fixtures.assets`: a `local` folder or a `flysystem` adapter and prefix, or `--assets-store`\u002F`--assets-dir` for one run): each uploaded file is stored once under its SHA-256, listed in a `\u003CScaffold>.assets.json` manifest beside the class, and loaded with `$cwa->asset('\u003Chash>')` through the same store, so a large site's files can stay out of the repository; with nothing configured the scaffold keeps readable copies beside it as before ([#466](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F466))\n- Generating into a local asset store deletes the assets its manifest no longer lists; `silverback:api-components:prune-fixture-assets \u003Cmanifest>...` (`--dry-run`) deletes from any store the assets that none of the given manifests lists ([#466](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F466))\n- `redirectTo(routeName)` on a scaffold's page or page data makes its own route redirect to a named route, resolved after route generation and before the callbacks; an `--append` load never changes the redirect of a route that already exists ([#468](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F468))\n- `CwaFixtureBuilder` takes a `PageBuilder` or `PageDataBuilder` as a route target: `linkRoute(property, page:)`, `redirect(path, to:)` and `linkIri()`'s `route:`, `page:` and `pageData:` ([#474](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F474))\n\n### Changed\n- `generate-fixtures` writes byte-identical stored files once in its default `assets\u002F` output, under the name of the first, and every `new File(...)` for them names that asset ([#470](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F470))\n\n### Fixed\n- A component written with a new position inside it (`\"componentPositions\": [{\"componentGroup\": …}]`, as the module adds a component) is checked against the group's `allowedComponents` and `#[ExplicitAllowOnly]`, as a position created on its own is ([#467](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F467))\n- A base64 or data-URI upload to a field with a `File` or `Image` constraint was refused with \"The file could not be uploaded.\" instead of being validated ([#459](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F459))\n- The orphaned files scan reads an SVG's size as Symfony's `Image` constraint does (`viewBox` fallback, length units), also when file info is cached ([#459](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F459))\n- The orphaned files scan checks a row with a publication date against its field's publish-group constraints too (`{ShortName}:published` or the class's `validationGroups`), as publishing does ([#459](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F459))\n- A `#[Timestamped]` entity a scaffold saved only through `$cwa->persist()`, or that a page data or component field held, was inserted with no `createdAt`\u002F`modifiedAt`, failing the load on a NOT NULL column ([#463](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F463))\n- `doctrine:fixtures:load` generated every imagine variant of every loaded image in one process (5.5 GB for 710 images), because each flush serialized the new resources for Mercure; a fixture load now propagates no update, flushes the HTTP cache once at the end, and says to run `silverback:api-components:imagine:generate` ([#465](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F465))\n- `generate-fixtures` left out, without a report, the redirect of a route that belongs to a page or page data; it is now written as `->redirectTo()`, or reported when its target is not part of the site ([#468](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F468))\n\n### Tooling\n- Codecov waits for both coverage uploads (`phpunit` and `behat`) before posting its statuses and comment, so `codecov\u002Fproject` no longer fails on partial coverage mid-run ([#473](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F473))\n",{"part":885,"tag":1143,"name":1143,"publishedAt":1144,"url":1145,"body":1146},"v2.0.0-alpha.36","2026-10-16T10:33:45Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.36","### Upgrade notes\n- Bundle 2.0.0-alpha.22 (api-components-bundle#453): copy `api\u002Fcomposer.lock`, or run `composer update components-web-app\u002Fapi-components-bundle` in the php container. No migration. Its three breaking changes are in the fixture builder; the template's scaffold needs none of these changes, but check your own scaffold and fixtures code. Run a fresh load and a second `--append` on a throwaway database and compare row counts with the previous bundle. [1b348c3](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1b348c3482c788b9177bfb60155efe1549dbfaf8)\n  - **`nested()` on a page or page data adds a closure instead of replacing the last one.** If one builder calls `nested()` more than once (a later call meant to override an earlier one), every closure now runs, and the children of each are created. Keep one call per builder. `PageBuilder::nested()` now returns the builder, so it can be chained.\n  - **Persist order changed.** A component builder with no groups and a draft is persisted with the positions, not in the first phase. A component builder with groups is persisted after the `nested()` closures whenever the scaffold has one. Code that reads a component's id, IRI or route in an earlier callback (between the first phase and the positions) may now see it unpersisted. Use `linkIri()`\u002F`linkRoute()`, or read it in `onRoutesCreated()`.\n  - **`GenerateFixturesCommand` takes the `ScaffoldGenerator` service** (`silverback.api_components.fixture.scaffold_generator`) instead of its six old collaborators. Only a project that decorates, extends or builds the command by hand must change; inject the generator instead.\n  - Optional: re-run `generate-fixtures` for the new readable output, which uses named methods and variables, `linkRoute()`, `publish()` and `draft()`. A previously generated scaffold still loads.\n\n### Security\n- symfony\u002Fexpression-language 8.1.9 (CVE-2026-109449: unbounded nesting in the expression parser could crash the process). Copy `api\u002Fcomposer.lock`. [1b348c3](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1b348c3482c788b9177bfb60155efe1549dbfaf8)\n\n### Changed\n- Bundle 2.0.0-alpha.22: `generate-fixtures` writes a scaffold you could maintain by hand; adds `linkIri()`, `linkRoute()`, `publish()`, `draft()` and `reachableWithoutRoute()`; fixes `--append` duplicates and a `nested()` inside a nested closure that never ran (api-components-bundle#453). The template's scaffold loads identically. [1b348c3](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1b348c3482c788b9177bfb60155efe1549dbfaf8)\n- The browser tests are type-checked before they run (strict `e2e\u002Ftsconfig.json`), use a `visitor` fixture that closes its own context, and find fields by label ([43ece66d7a6a2c6e478904d45b2312a248fd634b](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F43ece66d7a6a2c6e478904d45b2312a248fd634b)).\n- The browser tests are linted before they run: the module's style, eslint-plugin-playwright and typescript-eslint's `no-floating-promises`, all as errors ([08b40db59ffd6f41fbdb3c716d5190bbbcd0a871](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F08b40db59ffd6f41fbdb3c716d5190bbbcd0a871)).\n- The browser tests' run options and the ARM Mac note moved from script comments to `e2e\u002FREADME.md` ([8949efe89eb2ac19319fbc1278227fbd9d3c2610](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8949efe89eb2ac19319fbc1278227fbd9d3c2610)).\n\n",{"part":907,"tag":1148,"name":1148,"publishedAt":1149,"url":1150,"body":1151},"2.0.0-alpha.22","2026-10-16T07:48:03Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.22","### Breaking\n- `GenerateFixturesCommand` takes the new `ScaffoldGenerator` service (`silverback.api_components.fixture.scaffold_generator`) instead of the six collaborators it used to build the scaffold itself ([#453](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F453))\n- `nested()` on a page or page data adds a closure instead of replacing the previous one, and `PageBuilder::nested()` returns the builder ([#453](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F453))\n- A component builder with no groups, and a draft, is persisted with the positions instead of in the first phase; a component builder with groups is persisted after the `nested()` closures whenever the scaffold has one ([#453](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F453))\n\n### Added\n- `ComponentBuilder`\u002F`PageDataBuilder::linkIri()` writes the IRI of a page, layout, page data or route of the scaffold into a field, or a key of an array field, at load time; `generate-fixtures` emits it for such IRIs instead of copying an id that will not exist after the reload ([#453](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F453))\n- `CwaFixtureBuilder::publish()`, `ComponentBuilder::draft()`, `ComponentBuilder`\u002F`PageDataBuilder::linkRoute()` and `PageBuilder::reachableWithoutRoute()` for hand-written and generated scaffolds (`linkRoute()` also inside `afterRoutes()` and `onRoutesCreated()`); every route the builder creates or keeps can be named in `getRoute()` and `redirect(to:)`; `generate-fixtures --keep-timestamps` writes every publish and go-live date exactly ([#453](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F453))\n\n### Changed\n- `generate-fixtures` writes the scaffold a developer would write by hand: a method per layout, page and page data (children called from their parent's `nested()`), named variables and properties instead of `$c[]`\u002F`$g[]`, `linkRoute()` next to each component, a named `uiComponent:`, variables named from the first heading of a component with no label, `publish()` instead of a past date, `draft()` instead of `afterRoutes()`, long HTML split at block tags or written as a nowdoc without changing a byte, and plain lists ([#453](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F453))\n- The `make:cwa-scaffold` skeleton is written in the same style, with a navigation link (`--link-class`, default `App\\Entity\\NavigationLink`) linked to the home route, left out when the class is not a component with a writable `label` (a public property or `setLabel()`) and `route`, and published only when it is publishable ([#453](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F453))\n- An `--append` load summary counts the scaffold positions of kept groups, and a route name the builder cannot resolve names the `linkRoute()` owner or redirect and the routes of the load ([#453](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F453))\n\n### Fixed\n- A kept route with no `routeName:` is also registered under the name derived from its path, so a generated scaffold's `linkRoute()` resolves in an `--append` load ([#453](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F453))\n- A `nested()` declared inside a nested closure was never run ([#453](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F453))\n- An `--append` load created a duplicate of a component with its own group declared outside a `nested()` closure and placed only in a kept group of a nested page ([#453](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F453))\n- `generate-fixtures` exports a stored file under the name its reload is stored under (lowercase, extension from the content type), so a file uploaded under a PHP temp name such as `phpGPCPOl` no longer changes name between generations ([#453](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F453))\n- `generate-fixtures` wrote two `use` lines with the same short name (a fatal error) for two classes sharing one, and dropped a group owned by a draft without reporting it ([#453](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F453))\n",{"part":885,"tag":1153,"name":1153,"publishedAt":1154,"url":1155,"body":1156},"v2.0.0-alpha.35","2026-10-15T09:42:55Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.35","### Upgrade notes\n- Pinned deploys (#164): copy `bin\u002Fdevops\u002Fk8s.sh`, `.gitlab-ci.yml` (or `.github\u002Fworkflows\u002Fci.yml` and `production.yml`) and `.gitignore`. The first deploy of each track creates its `:staging`, `:canary` or `:production` tag in your registry and rolls every pod onto the pinned image. On GitHub the deploy jobs now ask for `packages: write`. [e5b2a29](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe5b2a291f7702d1723e5891026944c0fc9ee080e)\n\n### Changed\n- @cwa\u002Fnuxt 2.0.0-alpha.17: `\u003CCwaLoadingIndicator>`'s bar no longer goes back when the page load finds more resources (cwa-nuxt-module#397). Copy `app\u002Fpackage.json` and `app\u002Fpnpm-lock.yaml`. [303fa05](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F303fa05c9424916eb4d5657d13892a00cd610a1c)\n\n### Fixed\n- Production pods no longer run the moving `:main` tag with `pullPolicy: Always` (#164). A restart, eviction or scale-up, or the nightly orphan scan (which migrates on start), could run an undeployed build against the live database. Deploys now run `\u003Ctrack tag>@\u003Cdigest>` of the pipeline's own build: staging, canary and production each get one tag, moved only by a deploy, so no per-commit tags pile up. [e5b2a29](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe5b2a291f7702d1723e5891026944c0fc9ee080e)\n",{"part":901,"tag":1158,"name":1158,"publishedAt":1159,"url":1160,"body":1161},"v2.0.0-alpha.17","2026-10-15T08:15:31Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.17","- `\u003CCwaLoadingIndicator>`'s bar no longer goes back when the page load finds more resources, such as a route's page data ([#397](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F397), [994b87a7](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F994b87a7))\n",{"part":885,"tag":1163,"name":1163,"publishedAt":1164,"url":1165,"body":1166},"v2.0.0-alpha.34","2026-10-15T00:47:01Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.34","### Upgrade notes\n- @cwa\u002Fnuxt 2.0.0-alpha.16 (#163): bump `@cwa\u002Fnuxt` and `@nuxtjs\u002Fsitemap` (to `^9.1.0`) in `app\u002Fpackage.json`, and move any other Nuxt SEO module you list yourself to its v6-family major (cwa-nuxt-module#392). Put `\u003CCwaLoadingIndicator \u002F>` in `app\u002Fapp\u002Fapp.vue`, and remove `CwaUiProgressBar` and its `percent` computeds from your layouts, or two bars show. Copy `bin\u002Fdevops\u002Fk8s.sh`: OG images are now signed with `NUXT_APP_SECRET` and return 500 without it. The deploy keeps one for you (generated on the first deploy, then read back from the live PWA Secret); set a CI variable of at least 32 characters only if you want to choose it. `compose.prod.yaml` now requires it. [f93a7fa](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff93a7fa12333aa5ac0fcbfefba0866218e2e6386)\n- Logging (#162): copy `api\u002Fconfig\u002Fpackages\u002Fprod\u002Fmonolog.yaml`, `api\u002Fsrc\u002FMonolog\u002FErrorMailHandler.php`, `api\u002Ftests\u002FUnit\u002FMonolog\u002F`, and the `ERROR_MAIL_TO` line of `api\u002F.env`. prod no longer writes `var\u002Flog\u002Fprod.log`; read the logs with `kubectl logs` or the cluster's log explorer. For an email on each new 5xx, set the CI variable `CWA_API_ERROR_MAIL_TO` (and a working `MAILER_DSN`). [59929e3](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F59929e36166dca7543dfeab19234f32f9c4abbf9)\n- Optional browser tests (#157): copy `e2e\u002F`, `.gitlab-ci.yml` (or `.github\u002Fworkflows\u002Fci.yml`, `production.yml` and the new `browser-tests.yml`), `bin\u002Fdevops\u002Fk8s.sh`, `api\u002Fconfig\u002Fservices.php` and `api\u002Fsrc\u002FFlysystem\u002FGoogleCloudStorageFactory.php`. Nothing runs until you set the CI variable `CWA_CI_E2E_ENABLED=\"true\"`; then review, staging, canary and production wait for the tests. Add project-specific flows under `e2e\u002Ftests\u002F` (see `e2e\u002FREADME.md`). [3fd2c01](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3fd2c01237578dd0f009de10699402b257f5bf7c) [8c36f8c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8c36f8c89f9176495fc02f8f9480531c71eb4613)\n\n### Changed\n- @cwa\u002Fnuxt 2.0.0-alpha.16: one loading bar, `\u003CCwaLoadingIndicator>` (Nuxt's own, driven by the CWA page load), covers CWA and plain Nuxt pages, and the scroll to top waits for the new page (cwa-nuxt-module#396). Publishing straight after typing keeps the last edit (#394), and the first publish no longer leaves a \"has not been requested\" box (#395). Nuxt SEO v6, with `@nuxtjs\u002Fsitemap` 9 (#392). The browser tests now publish straight after typing, and check the loading bar and a page's OG image. [f93a7fa](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff93a7fa12333aa5ac0fcbfefba0866218e2e6386)\n\n### Added\n- prod logs go to stderr as JSON in Google's structured logging shape, redacted (emails, tokens, JWTs, DSN credentials, password hashes), not to a file inside the container that every restart lost. An optional error mail sends one email per unique 5xx per hour to `ERROR_MAIL_TO`. The browser tests fail if a run sends one (#162). [59929e3](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F59929e36166dca7543dfeab19234f32f9c4abbf9)\n- Opt-in Playwright browser tests that gate deploys (#157). They run this commit's production images in a throwaway stack (Postgres on tmpfs, a Cloud Storage emulator, Mailpit) and cover: public pages hydrate, the page cache, the redirect, log in and out, editing and publishing text, uploading and publishing an image, and the password-reset email link. A fixture fails any test whose API write gets a 405, 406 or 415, timeouts are bounded, and the run fails unless every listed test ran. The Playwright report, traces and videos are kept for 14 days. `GoogleCloudStorageFactory` takes an optional `GCLOUD_API_ENDPOINT` (an emulator); empty is unchanged. [3fd2c01](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3fd2c01237578dd0f009de10699402b257f5bf7c) [8c36f8c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8c36f8c89f9176495fc02f8f9480531c71eb4613)\n",{"part":901,"tag":1168,"name":1168,"publishedAt":1169,"url":1170,"body":1171},"v2.0.0-alpha.16","2026-10-15T00:20:01Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.16","- Nuxt's loading bar and the scroll to top now wait until the new CWA page shows, where the page jumped to the top while the old one was still on screen. The new `\u003CCwaLoadingIndicator>` wraps `\u003CNuxtLoadingIndicator>` and shows CWA's page load percentage; put it in `app.vue` in place of `CwaUiProgressBar` ([#396](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F396), [1ed92548](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F1ed92548))\n\n- Publishing straight after typing publishes the last edit: Publish sends the editor's waiting save first, where the edit was lost ([#394](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F394), [4c10fb30](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F4c10fb30))\n\n- Publishing a draft that sits in its own position no longer leaves a \"has not been requested\" box in its place ([#395](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F395), [4c10fb30](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F4c10fb30))\n\n- View in the admin's Routes list opens a page data route's page data (and a redirect's target), where it did nothing ([#393](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F393), [2c02280d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F2c02280d))\n\n- **Breaking:** the module now needs the Nuxt SEO v6 family (`@nuxtjs\u002Fsitemap` 9, `@nuxtjs\u002Frobots` 7, `nuxt-site-config` 5, `nuxt-seo-utils` 9, `nuxt-schema-org` 7, `nuxt-link-checker` 6, `nuxt-og-image` 7); the optional renderer peers now need `satori` 0.47.1 and `@resvg\u002Fresvg-js` 2.6.2 or later. An app that registers `@nuxtjs\u002Fsitemap` or `@nuxtjs\u002Fseo` itself must move to v9 \u002F v6 too, and `@nuxtjs\u002Fseo` 6 also enables `nuxt-skew-protection` and `nuxt-ai-ready` (opt out with `skewProtection: { enabled: false }` and `aiReady: { enabled: false }`). `h3` is now a declared dependency ([#392](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F392), [2b694b80](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F2b694b80))\n",{"part":885,"tag":1173,"name":1173,"publishedAt":1174,"url":1175,"body":1176},"v2.0.0-alpha.33","2026-10-14T08:16:48Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.33","### Changed\n- Dependency updates: TipTap 3.32, `satori` 0.56 (OG images checked), vue 3.5.44, vite 8.3.4, `vue-tsc` 3.3.13, `@nuxt\u002Fdevtools` 4.0.0-beta.5, `nuxt-og-image` 6.10.4, `@nuxtjs\u002Fsitemap` 8.6.2; composer: doctrine\u002Fpersistence 4.2.1, google\u002Fcloud-storage 2.6.0. Copy `app\u002Fpackage.json`, `app\u002Fpnpm-lock.yaml` and `api\u002Fcomposer.lock`. TypeScript stays 6.0.3 (no TS 7 support in `vue-tsc` yet); `@nuxtjs\u002Fsitemap` 9 needs the module first. [e5cc3cc](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe5cc3cc13ae5b6020fcdc993ad4773ffe8be59cd)\n\n",{"part":885,"tag":902,"name":902,"publishedAt":1178,"url":1179,"body":1180},"2026-10-13T17:55:21Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.32","### Upgrade notes\n- Update api-components-bundle to 2.0.0-alpha.21 (copy `api\u002Fcomposer.lock`); no migration. Optionally copy `api\u002Ftests\u002FUnit\u002FSkolemIriConverterResetTest.php`. A project that read `ResourceMetadataProvider::$metadatas` or `getMetadatas()` must stop: both are removed ([api-components-bundle#449](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F449)). [09f55bd](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F09f55bd51d63c536443710468ebbdd46dfbc064f) [32c6a7c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F32c6a7ceaa6a9ca53b0905313c45de24c5497a35)\n\n### Fixed\n- php memory no longer grows request after request in a FrankenPHP worker. API Platform's genid IRI map ([api-platform\u002Fcore#8680](https:\u002F\u002Fgithub.com\u002Fapi-platform\u002Fcore\u002Fissues\u002F8680)) and the bundle's resource metadata map each kept the other's objects alive; api-components-bundle 2.0.0-alpha.21 resets both. Measured over 300 requests to a form component: 41 → 125 MB before, 44.5 → 44.6 MB after (#161). [09f55bd](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F09f55bd51d63c536443710468ebbdd46dfbc064f) [32c6a7c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F32c6a7ceaa6a9ca53b0905313c45de24c5497a35)\n- A component on a live routed page is readable anonymously when it is also placed on an unrouted page; it was a 401 (api-components-bundle#447). [09f55bd](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F09f55bd51d63c536443710468ebbdd46dfbc064f)\n\n### Changed\n- `@cwa\u002Fnuxt` 2.0.0-alpha.15: a server-side redirect no longer fetches the target page's resources in the background (cwa-nuxt-module#389, #160); the admin's parent page, template, layout and parent page data selects list every item, not just the first 30; a link can pre-fill the add page data form (`?parentPage=`, `?parentPageData=`, `?template=`). [131ef26](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F131ef26b3429c83cd223a2737fb08b53b5e7a6b0)\n\n",{"part":907,"tag":1182,"name":1182,"publishedAt":1183,"url":1184,"body":1185},"2.0.0-alpha.21","2026-10-13T17:01:08Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.21","### Breaking\n- `ResourceMetadataProvider` no longer has the public `$metadatas` property or `getMetadatas()`: it keeps each resource's metadata in a `WeakMap` and is reset between requests (see Fixed) ([#449](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F449))\n\n### Fixed\n- Memory no longer grows request after request in a worker (FrankenPHP worker mode). `ResourceMetadataProvider` kept every serialised resource and its `_metadata`, and API Platform's skolem IRI converter, which is not tagged `kernel.reset` (api-platform\u002Fcore#8681), kept every `_metadata` object it gave a `\u002F.well-known\u002Fgenid\u002F` IRI, each keeping the other's objects alive. Both are now reset between requests. `PropagateUpdatesListener` is reset too, so a flush that fails no longer leaves its entities to be purged and published by the next request's flush, and the user email factories no longer keep the last user they emailed ([#449](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F449))\n- A component on a live routed page is readable anonymously when it is also placed on an unrouted page. `ComponentVoter` collected the component's pages with `iterator_to_array()`, which kept the repeated keys of the collections it `yield from`s, so a later page replaced the routed one and the visitor got a 401 ([#450](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F450))\n",{"part":885,"tag":928,"name":928,"publishedAt":1187,"url":1188,"body":1189},"2026-10-13T15:54:00Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.31","### Upgrade notes\n- Update api-components-bundle to 2.0.0-alpha.20 (copy `api\u002Fcomposer.lock`); no migration. [6f0c756](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F6f0c756026f57df58a9eaa64358ffadf4248fd5f)\n- Copy `helm\u002Fcwa\u002Ftemplates\u002Fdeployment.yaml`, `helm\u002Fcwa\u002Fvalues.yaml` and `bin\u002Fdevops\u002Fk8s.sh` (with the bundle update, which adds the command): a new php pod now warms its `\u002F_api` cache before it takes traffic. `CWA_CI_API_WARM_HTTP_CACHE_MAX_TIME` (seconds, default 60) bounds it; `0` turns it off. No resource requests change (#160). [81c1f35](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F81c1f355f676c23fb5614e30c0c687f26ec2d7a2)\n- GitLab: copy `.gitlab-ci.yml` and `bin\u002Fdevops\u002Fk8s.sh`. The `image variants \u003Ctrack>` and `warm cache \u003Ctrack>` jobs are now one `image variants and warm \u003Ctrack>` job; the `CWA_CI_IMAGE_VARIANTS_*` and `CWA_CI_WARM_CACHE_*` switches are unchanged. A project job that `needs:` either old name must use the new one (#160). [5f987be](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5f987be09ccf7ecfda261be61662020f7d72ea67)\n\n### Added\n- A new php pod warms the API cache before its probes start: a `postStart` hook waits for Caddy, then runs `warm-http-cache` for up to 60s (`CWA_CI_API_WARM_HTTP_CACHE_MAX_TIME`), never failing the container. With one replica the old pod keeps serving meanwhile, so visitors and monitors no longer meet a cold pod after a deploy or restart (#160). [81c1f35](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F81c1f355f676c23fb5614e30c0c687f26ec2d7a2)\n\n### Changed\n- api-components-bundle 2.0.0-alpha.20: adds `warm-http-cache`; a redirecting route's `resource_manifest` no longer lists its `redirectPath`, so rendering a redirect no longer requests it from the API and gets a 404 (api-components-bundle#444). [6f0c756](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F6f0c756026f57df58a9eaa64358ffadf4248fd5f)\n- `@cwa\u002Fnuxt` 2.0.0-alpha.14: a route redirect rendered on the server sends its 308 at once, instead of loading the whole target page first (cwa-nuxt-module#389, #160). [91b583f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F91b583f32a1932112d54ba4a147de33351437084)\n- GitLab runs the cache warm in the same job as the image variants, straight after them, so new pods are warmed about 50 s sooner after each deploy (a separate job waited for a runner). The order is unchanged: variants first (#153) (#160). [5f987be](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5f987be09ccf7ecfda261be61662020f7d72ea67)\n\n",{"part":901,"tag":1191,"name":1191,"publishedAt":1192,"url":1193,"body":1194},"v2.0.0-alpha.15","2026-10-13T15:14:05Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.15","- A link can open the add page data form with its parent page or parent page data and its template filled in, through `?parentPage=`, `?parentPageData=` and `?template=` ([#390](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F390), [066433f6](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F066433f6))\n\n- The admin's parent page, template, layout and parent page data selects list every item, where they stopped at the API's first 30 ([#391](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F391), [810e17ee](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F810e17ee))\n\n- A route redirect rendered on the server no longer fetches the target page's resources in the background, which only loaded a cold API ([#389](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F389), [f420b74a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Ff420b74a))\n",{"part":907,"tag":1196,"name":1196,"publishedAt":1197,"url":1198,"body":1199},"2.0.0-alpha.20","2026-10-13T15:04:51Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.20","### Added\n- `silverback:api-components:warm-http-cache` requests, through the HTTP cache, the API responses server-side rendering fetches for each public route (the route, its `resource_manifest` and every resource the manifest lists, or only the route lookup for a redirect), anonymously and with the module's `Accept`, `preload` and `path` headers and an `Accept-Encoding` of `gzip`, so the cache stores them under the keys SSR asks for. Run it before a new pod takes traffic. Options: `--base-url` (default `http:\u002F\u002Flocalhost`), `--path`, `--limit` (shortest paths first), `--concurrency` (default 2), `--max-time`, `--timeout` and `--accept-encoding`. It always exits 0 once it has started, and prints requests, hits, misses, failures and the slowest requests ([#443](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F443))\n\n### Fixed\n- The `resource_manifest` of a redirecting route no longer lists its `redirectPath` (a front-end path) among its IRIs, so the module no longer requests it from the API and gets a 404 each time the redirect is rendered. `GET \u002F_\u002Froutes\u002F{path}` still returns `redirectPath` ([#445](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F445))\n",{"part":901,"tag":1201,"name":1201,"publishedAt":1202,"url":1203,"body":1204},"v2.0.0-alpha.14","2026-10-13T13:50:20Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.14","- A route redirect rendered on the server sends its 308 at once, where it used to load the whole target page first ([#389](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F389), [0e56674e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F0e56674e))\n",{"part":885,"tag":958,"name":958,"publishedAt":1206,"url":1207,"body":1208},"2026-10-13T12:44:28Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.30","### Upgrade notes\n- Update api-components-bundle to 2.0.0-alpha.19 (copy `api\u002Fcomposer.lock`) and copy the migration `Version20261013121254`: it makes page data's `title` nullable and clears the old `'Unnamed Page'` default from pages and page data. A page or page data with no title now gets no generated route (`POST \u002F_\u002Froutes\u002Fgenerate` is a 422), and a fixture page with no title and no `route:` is left without one ([api-components-bundle#440](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F440)). [e5aaa47](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe5aaa47c866994c99a47c11789b99a3e971f9879)\n- Optional: delete `import tailwindcss from '@tailwindcss\u002Fvite'` and `tailwindcss()` in `vite.plugins` from `app\u002Fnuxt.config.ts`; `@nuxt\u002Fui` registers the plugin itself. A project without `@nuxt\u002Fui` keeps both (#159). [e78d6f4](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe78d6f44c3f2e2bf49e15e9ef54b07c58c457633)\n\n### Changed\n- `@cwa\u002Fnuxt` 2.0.0-alpha.13: page titles skip the old `Unnamed Page` default and untitled page data falls back to its page's title (cwa-nuxt-module#388); the admin manager panel stays fixed to the bottom of the viewport whatever the app's CSS (cwa-nuxt-module#387). [b138d14](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fb138d14c59f506fa3db69399977287be12b2ac48)\n- api-components-bundle 2.0.0-alpha.19: page and page data titles default to `null`; renaming a route whose path is 254 or 255 characters no longer 500s; `nested()` fixture content is saved on an `--append` load where nothing else is new. [e5aaa47](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe5aaa47c866994c99a47c11789b99a3e971f9879)\n- Tailwind's Vite plugin is registered once, by `@nuxt\u002Fui`, not again by the template; the built CSS is unchanged (#159). [e78d6f4](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe78d6f44c3f2e2bf49e15e9ef54b07c58c457633)\n\n### Fixed\n- `@tailwindcss\u002Fvite` is declared in the app's devDependencies: `nuxt.config.ts` imports it, but it was installed only through `@nuxt\u002Fui`, so a project without `@nuxt\u002Fui` failed with a missing module (#158). [67eebe5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F67eebe53541fb6f57d7a6d7a30874cb691357bc2)\n\n",{"part":901,"tag":1210,"name":1210,"publishedAt":1211,"url":1212,"body":1213},"v2.0.0-alpha.13","2026-10-13T12:21:33Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.13","- A page's `\u003Ctitle>` skips the API's default `Unnamed Page`, so nested pages no longer show it and untitled page data falls back to its page's title ([#388](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F388), [4efeae0f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F4efeae0f))\n- The admin's last unprefixed Tailwind classes are prefixed, so the manager panel stays fixed to the bottom of the viewport and admin spacing no longer depends on the host app's CSS ([#387](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F387), [2632d36e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F2632d36e))\n",{"part":907,"tag":1215,"name":1215,"publishedAt":1216,"url":1217,"body":1218},"2.0.0-alpha.19","2026-10-13T11:59:32Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.19","### Breaking\n- A page's and a page data's `title` defaults to `null` instead of `'Unnamed Page'`, and page data's `title` column is nullable like the page's. `POST \u002F_\u002Froutes\u002Fgenerate` (and `RouteGenerator::create()`) refuses a page or page data with no title, or one that gives no slug, with a 422 and a `title` violation, creating nothing; `RouteGeneratorInterface::generatePath()` returns `null` for it. `CwaFixtureBuilder` leaves an untitled page or page data with no `route:` without a route, and treats untitled page data like `withoutRoute()` page data in an `--append` load. Upgrade step: generate and run a migration (it makes `_acb_abstract_page_data.title` nullable), then clear the old default with `UPDATE _acb_page SET title = NULL WHERE title = 'Unnamed Page';` and `UPDATE _acb_abstract_page_data SET title = NULL WHERE title = 'Unnamed Page';` (with your `table_prefix` if it is not `_acb_`) ([#440](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F440))\n\n### Fixed\n- Renaming a route whose path is 254 or 255 characters and whose name is taken (it is still named after its old path, as routes created with `name` = `path` are) no longer fails with a 500 from MySQL or PostgreSQL after the rename was written: the redirect's name is shortened to fit its `-N` suffix in 255 characters, and its path stays the old path. `CwaFixtureBuilder::redirect()` shortens a suffixed derived name the same way ([#438](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F438))\n- `CwaFixtureBuilder` saves what a `nested()` closure declares when nothing else in the load is new: a component, or an existing group linked to a component, was persisted but never flushed, so an `--append` load could drop it while its summary reported it created ([#437](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F437))\n",{"part":901,"tag":1220,"name":1220,"publishedAt":1221,"url":1222,"body":1223},"v2.0.0-alpha.12","2026-10-13T02:33:11Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.12","- Login details a password manager fills in before the page hydrates are kept, where hydration used to clear them ([#386](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F386), [699326b1](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F699326b1))\n- Dependencies updated to their latest versions, including Nuxt 4.6.1, the Nuxt SEO modules and reka-ui 2.11; the optional `satori` peer now needs 0.33.5 or later, as nuxt-og-image 6.10 does ([ce2e5f24](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fce2e5f24))\n- `@vueuse\u002Fcore` 15, which drops Node.js 20 ([32b00703](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F32b00703))\n- `vuejs-confirm-dialog` 1.0: admin dialogs mount in their own root in `\u003Cbody>` with the app's context, and the library still loads only when the first dialog opens ([b4483dd7](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fb4483dd7))\n- The page admin saves a page's UI as the full `CwaPage\u003CName>` component name and selects it whether stored full or short, and the pages and layouts lists show the configured UI name ([#384](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F384), [12530643](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F12530643), [5db632cc](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F5db632cc))\n",{"part":907,"tag":1225,"name":1225,"publishedAt":1226,"url":1227,"body":1228},"2.0.0-alpha.18","2026-10-13T01:22:37Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.18","### Breaking\n- `RouteGenerator` takes a `ValidatorInterface` ([#433](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F433))\n- A page's `uiComponent` is stored as the full component name, `CwaPage\u003CName>`: a POST or PATCH sending the short name (`PrimaryPageTemplate`, as the admin's page modals do) stores and returns `CwaPagePrimaryPageTemplate`, so pages written through the API and through `CwaFixtureBuilder` agree and `generate-fixtures` reloads them unchanged. Layouts are unchanged. Upgrade step: run `silverback:api-components:prefix-page-ui-components` once to prefix pages already stored with the short name; it is safe to run again ([#431](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F431))\n\n### Fixed\n- `POST \u002F_\u002Froutes\u002Fgenerate` is a 422 with a `path` violation, and creates nothing, when the parent's path and the title slug together are longer than 255 characters; `RouteGenerator::create()` throws the same `ValidationException` for fixtures. `PATCH \u002F_\u002Froutes\u002F{id}` with `cascadeChildPaths` checks every descendant's new path before writing anything, so a rename that would push one over 255 characters is a 422 naming that descendant instead of a 500 after the route and part of the tree were already moved. A cascade to a path under the route's own path no longer recurses without end when an unrouted child page loops back to it ([#433](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F433))\n- A value longer than its `VARCHAR(255)` column (a page's `title` or `metaDescription`, any `reference`, `uiComponent`, route `path`\u002F`name`, component position `pageDataProperty`\u002F`pageDataClass`, site config `key`, form `formType`, collection `resourceIri`, user `username`\u002F`emailAddress`\u002F`newEmailAddress`) is a 422 with a field violation instead of a 500 from MySQL or PostgreSQL ([#430](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F430))\n- A `PUT` to a user resource updates only the fields it sends. API Platform's default `standard_put` (on 4.x and 5.x) built a new user from the body, so a `PUT` returned 200 after blanking the password hash and resetting roles, `enabled` and email verification, or failed with 422\u002F500 when it sent no email address. The bundle sets `standard_put: false` on every `Put` of an `AbstractUser` resource ([#429](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F429))\n- `CwaFixtureBuilder` creates the groups of components declared inside a `nested()` closure, with their positions, so a scaffold generated from a site with nested pages no longer reloads those pages emptied below their first component ([#428](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F428))\n",{"part":885,"tag":978,"name":978,"publishedAt":1230,"url":1231,"body":1232},"2026-10-12T22:22:11Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.28","### Upgrade notes\n- Update api-components-bundle to 2.0.0-alpha.17 (`composer update components-web-app\u002Fapi-components-bundle`, or copy `api\u002Fcomposer.lock`) and copy the migration `Version20261012160000`, which drops variant file info written before alpha.17 (api-components-bundle#421); each row is read again from its stored variant on the next render. Nothing to run by hand: the deploy's new API pod starts with an empty cache, and a Cloudflare site's deploy already purges everything. Locally, run `bin\u002Fconsole silverback:api-components:purge-http-cache` after migrating. [c754732](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fc754732709ae8e6b81967715cdbb93a075a5fcf7) [55e6beb](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F55e6beb6f660d16e567479159a49557c7c5fbdf6)\n- Copy `app\u002Fnuxt.config.ts`'s `precompressBuildAssets` helper and the module that calls it, and delete `compressPublicAssets` from its `nitro` block: `\u002F_nuxt` assets are still precompressed, but files in `public\u002F` no longer are, so a large file there no longer adds minutes to every app build (#155). [c9da319](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fc9da31999e01bd848cd179d03ecd8aa9ac2b186f)\n\n### Fixed\n- api-components-bundle 2.0.0-alpha.17: storing an imagine variant again replaces its file info, so `_metadata.mediaObjects` reports the variant actually stored (api-components-bundle#421). [c754732](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fc754732709ae8e6b81967715cdbb93a075a5fcf7)\n- App builds no longer brotli-compress everything in `public\u002F`: only `\u002F_nuxt` assets are precompressed. A 178 MB PDF in `public\u002F` had made a downstream site's app build take ~7 minutes instead of about one (#155). [c9da319](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fc9da31999e01bd848cd179d03ecd8aa9ac2b186f)\n",{"part":907,"tag":1234,"name":1234,"publishedAt":1235,"url":1236,"body":1237},"2.0.0-alpha.17","2026-10-12T22:10:38Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.17","### Fixed\n- Storing an imagine variant again replaces its file info, so `_metadata.mediaObjects` reports the variant actually stored after a filter's format, quality or size changes. Variant rows written before this fix stay stale: delete them with `DELETE FROM _acb_imagine_cached_file_metadata WHERE filter \u003C> '';`, then purge the HTTP cache, and each row is read again from its stored variant on the next render ([#421](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F421), [#422](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F422))\n",{"part":885,"tag":983,"name":983,"publishedAt":1239,"url":1240,"body":1241},"2026-10-12T02:56:21Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.27","### Upgrade notes\n- Copy `helm\u002Fcwa\u002Ftemplates\u002Fimage-variants-cronjob.yaml`, the `cronjobs.imageVariants` block of `helm\u002Fcwa\u002Fvalues.yaml` and `bin\u002Fdevops\u002Fk8s.sh`: the image variants job now generates in its own Kubernetes Jobs (#153). It runs on production by default again; set `CWA_CI_IMAGE_VARIANTS_PRODUCTION=\"false\"` to turn it off, and delete a `\"true\"` you set for alpha.26. [1c4b9f6](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1c4b9f6a89ff9a032b41a5548e331b7076d90c8f) [d400d1e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd400d1ea431cf94f80b679c19a2da465ac7c99da) [27141f0](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F27141f017e7a0348fc721617e8b769930fd8be12)\n\n### Changed\n- The image variants job generates in one-off Kubernetes Jobs with their own memory limit (`CWA_CI_IMAGE_VARIANTS_MEMORY`, default 1536Mi), repeating with `--max-memory` until nothing is missing, so it can no longer run the serving API pod out of memory (#153). [1c4b9f6](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1c4b9f6a89ff9a032b41a5548e331b7076d90c8f)\n",{"part":885,"tag":993,"name":993,"publishedAt":1243,"url":1244,"body":1245},"2026-10-12T02:05:06Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.26","### Upgrade notes\n- Update api-components-bundle to 2.0.0-alpha.16 (`composer update components-web-app\u002Fapi-components-bundle`, or copy `api\u002Fcomposer.lock`). No migration, no config change. [30673ac](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F30673ac2e83a57176a09551c59de415994ec2d07)\n- **The `image variants` job is now opt-in on production** (`CWA_CI_IMAGE_VARIANTS_PRODUCTION=\"true\"`). Its first production run ran out of memory in the serving API pod and the site returned 503s (#153). Leave it off on a site with many or large images until it runs as its own Kubernetes Job. Copy `bin\u002Fdevops\u002Fk8s.sh`, `.gitlab-ci.yml` and `.github\u002Fworkflows\u002Fproduction.yml`. If alpha.25's job already failed on your site there's nothing to undo: missing variants are generated on their first read, as before. [ab86132](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fab86132f6f5a0400330ec2ef007e4f0db04ae816)\n- **Corrections to alpha.25's upgrade notes:** don't run `imagine:generate` by hand in the API pod of a site with many or large images either (the same out-of-memory risk). And to delete the old variants, remove every file under the bucket's `cache\u002F` folder that doesn't end in `.webp`, which also covers stored names without an extension: `gcloud storage ls \"gs:\u002F\u002F\u003Cbucket>\u002Fcache\u002F**\" | grep -v '\\.webp$' | gcloud storage rm -I`. Do it after the alpha.25 deploy, whose purge makes pages render with the WebP variants (#153). [ab86132](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fab86132f6f5a0400330ec2ef007e4f0db04ae816)\n\n### Changed\n- api-components-bundle 2.0.0-alpha.16: `imagine:generate --limit` and `--max-memory` stop a run with exit 3 while variants are still missing, so it can be re-run in fresh processes until done; `--max-memory` counts libvips's native memory (#153). [30673ac](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F30673ac2e83a57176a09551c59de415994ec2d07)\n\n### Fixed\n- The `image variants` job reports an out-of-memory kill (exit 137) as such, instead of as a failed variant (#153). [ab86132](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fab86132f6f5a0400330ec2ef007e4f0db04ae816)\n",{"part":907,"tag":1247,"name":1247,"publishedAt":1248,"url":1249,"body":1250},"2.0.0-alpha.16","2026-10-12T01:56:26Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.16","### Added\n- `imagine:generate --limit=N` and `--max-memory=768M` stop a run cleanly with exit 3, meaning variants are still missing: run it again in a fresh process until it exits 0. `--max-memory` checks the process's resident memory (`VmRSS`), which counts libvips's native allocations that `memory_limit` cannot see, and every run generates at least one variant. The libvips operation cache is switched off for the run ([#418](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F418), [#419](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F419))\n",{"part":885,"tag":1007,"name":1007,"publishedAt":1252,"url":1253,"body":1254},"2026-10-12T00:56:57Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.25","> **⚠ Before deploying alpha.25:** set `CWA_CI_IMAGE_VARIANTS_PRODUCTION=\"false\"` on a site with many or large images, and don't run `imagine:generate` by hand in its API pod. The new `image variants` job generates in the serving API pod, and on its first production run it ran out of memory and the site returned 503s ([#153](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F153)). To delete the old variants, remove every file under `cache\u002F` that doesn't end in `.webp`, rather than only `.png`\u002F`.jpg` files. The next release makes the job opt-in.\n\n### Upgrade notes\n- Update api-components-bundle to 2.0.0-alpha.15 (`composer update components-web-app\u002Fapi-components-bundle`, or copy `api\u002Fcomposer.lock`). No migration, no config change. A project's own `#[UploadableField]` can override the new bucket `Cache-Control` with `cacheControl:`\u002F`imagineCacheControl:`, or send none with `false`; the defaults suit tokenised uploads (#151). [5e91c95](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5e91c95c93f320341f2c8c6e61457054c38b8d2b)\n- Copy `api\u002Fconfig\u002Fpackages\u002Fliip_imagine.yaml` (or add `format: webp` and `quality: 80` to each filter set of your own), so every image variant is WebP (#149), and the new post-deploy job: `generate_image_variants` in `bin\u002Fdevops\u002Fk8s.sh` plus the `image variants \u003Ctrack>` jobs and the warm jobs' `needs` in `.gitlab-ci.yml`, or the \"Generate image variants\" steps in `.github\u002Fworkflows\u002Fci.yml` and `production.yml` (#152). The next production deploy then generates every image's WebP variants in the API pod and purges the HTTP cache by itself. Without the job, run it by hand after the deploy, in the API pod: `bin\u002Fconsole silverback:api-components:imagine:generate --dry-run` (how many are missing), `bin\u002Fconsole silverback:api-components:imagine:generate` (exit code 1 means a variant failed; `-v` lists which; on a large site `--filter=general` or `--class='App\\Entity\\Image'` narrows a run), then `bin\u002Fconsole silverback:api-components:purge-http-cache`. [4d36b95](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F4d36b95cd2d5b55b95d2d44fde65e5bfd4dc2e6a) [eef09ea](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Feef09ea786f06db0c264ccddc3a6db03f956ad35)\n- Then delete the old variants: only the `.png`\u002F`.jpg`\u002F`.jpeg`\u002F`.gif` files under the bucket's `cache\u002F` folder (`liip:imagine:cache:remove` would also delete the new WebP ones). [4d36b95](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F4d36b95cd2d5b55b95d2d44fde65e5bfd4dc2e6a)\n- Then back-fill `Cache-Control` on the files already in the bucket, which keep GCS's one-hour default (only new writes get the header). With gcloud, in this order so variants end with the 30-day value: `gcloud storage objects update \"gs:\u002F\u002F\u003Cbucket>\u002F**\" --cache-control=\"public, max-age=31536000, immutable\"`, then `gcloud storage objects update \"gs:\u002F\u002F\u003Cbucket>\u002Fcache\u002F**\" --cache-control=\"public, max-age=2592000\"`. A CDN in front of the bucket (the `GCLOUD_PUBLIC_URL` host) keeps its copies until they expire or are purged (#151). [5e91c95](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5e91c95c93f320341f2c8c6e61457054c38b8d2b)\n\n### Added\n- After each production deploy, a new `image variants` job generates any image variants not stored yet (a new filter, or #149's WebP) in the API pod, before the cache warm, and purges the HTTP cache only if it made any, so visitors' requests no longer generate them. `CWA_CI_IMAGE_VARIANTS_PRODUCTION` is on unless `\"false\"`; `CWA_CI_IMAGE_VARIANTS_STAGING`, `_REVIEW` and `_CANARY` are off unless `\"true\"`. A failure never fails the deploy (#152). [eef09ea](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Feef09ea786f06db0c264ccddc3a6db03f956ad35)\n\n### Changed\n- CI image builds keep their whole build cache (`mode=max`), so an app build with an unchanged lockfile skips `pnpm fetch` and the base setup, and a new branch's first build reuses the default branch's cache instead of starting cold. Projects get it by copying `bin\u002Fdevops\u002Fk8s.sh`. [9dd4d2b](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F9dd4d2bdeff09e1c4cd9f0c75e2697f009a5f5d0)\n- @cwa\u002Fnuxt 2.0.0-alpha.11: the confirm dialog library, the orphan report requests, the page cache warm reader and the Mercure client no longer load in every visitor's entry, visitors' pages stop preloading admin-only components, and the default OG image's logo is white and no longer cut off. [f5b719d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff5b719d52124d3b8495affeb8d4280ab7bda8a87)\n- api-components-bundle 2.0.0-alpha.15: uploads and image variants in the bucket get a long `Cache-Control` (a year for originals, 30 days for variants), and `silverback:api-components:imagine:generate` builds missing variants ahead of time (#151). [5e91c95](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5e91c95c93f320341f2c8c6e61457054c38b8d2b)\n- Every image variant (`thumbnail`, `general`, `large`) is WebP, whatever the upload's format, so PNG logos and screenshots are no longer served as PNG (a 128 KB logo variant is now 41.5 KB) (#149). [4d36b95](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F4d36b95cd2d5b55b95d2d44fde65e5bfd4dc2e6a)\n\n### Fixed\n- App image builds no longer hang when Alpine's package mirror stalls: `apk add` is time-limited and retried, with a fallback mirror (copy `app\u002FDockerfile`). [265fa3b](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F265fa3bc7efd16d0cff924247d9bd157e0cf7af7)\n",{"part":901,"tag":1256,"name":1256,"publishedAt":1257,"url":1258,"body":1259},"v2.0.0-alpha.11","2026-10-11T23:56:47Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.11","- The confirm dialog library is loaded only when a dialog is shown, not for every visitor ([#382](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F382), [6b3be663](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F6b3be663))\n- The orphan report requests and the page cache warm reader load on first use, out of every visitor's entry ([#382](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F382), [70d3fc5e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F70d3fc5e))\n- The Mercure client loads once the page has hydrated instead of in every visitor's entry; visitors' live updates are unchanged ([#382](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F382), [bc72d93b](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fbc72d93b))\n- Anonymous visitors' pages no longer preload the admin's per-component manager or the empty-position placeholder ([#382](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F382), [a6689f7d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fa6689f7d))\n- The default OG image shows the CWA logo in white instead of black, and is rendered 630px high so the site name at the bottom is no longer cut off ([#372](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F372), [01e03ccb](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F01e03ccb))\n",{"part":907,"tag":1261,"name":1261,"publishedAt":1262,"url":1263,"body":1264},"2.0.0-alpha.15","2026-10-11T22:56:29Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.15","### Breaking\n- Uploads and imagine variants on Google Cloud Storage and S3 are written with a `Cache-Control`: `public, max-age=31536000, immutable` for originals and `public, max-age=2592000` for variants, configured by `silverback_api_components.uploadable.cache_control.original`\u002F`.imagine` (`null` for none) and per field by `#[UploadableField(cacheControl:, imagineCacheControl:)]` (`false` for none). Files stored earlier keep theirs until updated in the bucket. `UploadableFileManager` takes an `UploadableCacheControl` ([#414](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F414), [#415](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F415))\n\n### Added\n- `silverback:api-components:imagine:generate` generates every imagine variant not stored yet, one image at a time, so adding a filter no longer makes visitors' requests generate them, with the field's `imagineCacheControl`: run it as a one-off Job after the deploy, then purge the HTTP cache. `--filter` and `--class` narrow it (an unknown one exits 2), `--dry-run` counts what is missing, `-v` lists each variant; it exits 1 if a variant failed. `ImagineFilterGenerator::filter()` reports whether a filter was resolved, skipped over the memory budget or failed ([#413](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F413), [#416](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F416))\n",{"part":885,"tag":1035,"name":1035,"publishedAt":1266,"url":1267,"body":1268},"2026-10-11T13:04:44Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.24","### Upgrade notes\n- Copy `helm\u002Fcwa\u002Ftemplates\u002Fpwa-deployment.yaml` and `helm\u002Fcwa\u002Ftemplates\u002Fdeployment.yaml` (or just their `lifecycle.preStop` blocks) and deploy, to stop 502s during deploys. The first deploy with them still rolls the old pods without the fix; every deploy after it is clean. [4932989](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F4932989bca167be2102adce72655f14e4523417d)\n\n### Fixed\n- Deploys no longer give 502s while pods roll: the PWA holds 5s in a preStop before Nitro closes its listener, and the API's preStop waits 5s instead of 1s, so neither stops serving while it is still an endpoint (#148). [4932989](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F4932989bca167be2102adce72655f14e4523417d)\n",{"part":885,"tag":1045,"name":1045,"publishedAt":1270,"url":1271,"body":1272},"2026-10-11T01:47:11Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.23","### Upgrade notes\n- Update api-components-bundle to 2.0.0-alpha.14 (`composer update components-web-app\u002Fapi-components-bundle`, or copy `api\u002Fcomposer.lock`); no migration. Only a site with AVIF, HEIC or HEIF uploads is affected: their variants are generated again as WebP on first read, and the old `.avif`\u002F`.heic`\u002F`.heif` variant files are left in the bucket unused. To delete them, run `bin\u002Fconsole liip:imagine:cache:remove` in the API pod, which removes every filter's variants, so each image is regenerated on its next read (expect a burst, as after the `large` filter in alpha.22). Leaving them costs only storage. [f238cbe](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff238cbe17964c8f667c627217b0afee14d55b19a)\n\n### Added\n- The API image also builds Souin's Redis store (go-redis, patched with darkweak\u002Fstorages#65 so pods sharing Redis purge every page under a tag), ready for scaled mode; nothing uses it yet, and `bin\u002Ftest\u002Fsouin-redis-shared-purge.sh` runs in the unit-tests job with a Redis service (#85). [70943ad](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F70943ad3d95e7fc9eda84708ec3a1d6b0bdd9084)\n\n### Changed\n- api-components-bundle 2.0.0-alpha.14: variants of AVIF, HEIC and HEIF originals are WebP (vips can't encode those formats). [f238cbe](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff238cbe17964c8f667c627217b0afee14d55b19a)\n\n### Fixed\n- An image whose filter fails to generate (a codec the driver lacks, a corrupt file) is served as the original and logged, instead of a 500 for the image and every page containing it; such uploads no longer fail either (api-components-bundle#410). [f238cbe](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff238cbe17964c8f667c627217b0afee14d55b19a)\n- The `Image` placeholder fades for an image that loaded before hydration, instead of covering it (#146). [fc67690](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ffc67690a353c7ceee6b8184eedf92b8e29f37f80)\n",{"part":907,"tag":1274,"name":1274,"publishedAt":1275,"url":1276,"body":1277},"2.0.0-alpha.14","2026-10-11T01:36:55Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.14","### Breaking\n- Imagine variants of an AVIF, HEIC or HEIF original are saved as WebP (`cache\u002F\u003Cfilter>\u002Fphoto-1a2b3c4d.webp`) unless the filter set has a `format`, on every driver: vips cannot encode them and other drivers often cannot. Variants an earlier version stored for such originals under `.avif`\u002F`.heic`\u002F`.heif` are no longer used and are generated again as WebP; remove the old files with `bin\u002Fconsole liip:imagine:cache:remove` (or `--filter=\u003Cfilter>` for each filter used on such images). The bundle replaces `liip_imagine.filter.manager`'s class with `Silverback\\ApiComponentsBundle\\Imagine\\FilterManager` unless the application set its own. `MediaObjectFactory` no longer takes a logger ([#410](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F410), [#411](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F411))\n\n### Fixed\n- An imagine filter that fails to generate (a codec the driver lacks, a corrupt image) is skipped and logged at error, and the original is served, instead of a 500 for the resource holding the image and every page manifest containing it. Uploads of such images no longer fail either ([#410](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F410), [#411](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F411))\n",{"part":885,"tag":1065,"name":1065,"publishedAt":1279,"url":1280,"body":1281},"2026-10-10T23:10:57Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.22","### Upgrade notes\n- Update @cwa\u002Fnuxt to 2.0.0-alpha.10 and api-components-bundle to 2.0.0-alpha.13 in the same deploy: the module's \"Publish now\" sends `publishedAt: \"now\"`, which older bundles refuse. [5766b27](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5766b27554c931f0a2c4ccda27c1799dff52f369)\n- The new `large` imagine filter is generated for each existing image the first time it's read without one, so expect a burst of generation after the deploy. A project with its own image fields adds `'large'` to their `imagineFilters` to get the same `srcset`. [1af82fa](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1af82fafc23b07ef40aa82c349e56e73e6c09500)\n\n### Added\n- The `Image` component serves a responsive `srcset` (the module's, from 2.0.0-alpha.10) with `sizes`, and a `large` filter (2400 px) so retina screens don't fetch the original upload. [1af82fa](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1af82fafc23b07ef40aa82c349e56e73e6c09500)\n\n### Changed\n- @cwa\u002Fnuxt 2.0.0-alpha.10: \"Publish now\" publishes by the API's clock (needs bundle 2.0.0-alpha.13, so update both together), `srcset` on `useCwaFile`\u002F`withFile`\u002F`useCwaFileField`, and admin fixes. [5766b27](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5766b27554c931f0a2c4ccda27c1799dff52f369)\n- api-components-bundle 2.0.0-alpha.13: imagine variants with a `format` get that format's extension, an upload is stored with its content's extension, `publishedAt: \"now\"` publishes by the server's clock, and `liip:imagine:cache:remove` no longer throws. [82ae211](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F82ae211d18d27cd8d08fb9eb892d3ccaeed5004b)\n- Cached pages are stored compressed: the cache sits outside `encode` and keys on `Accept-Encoding` normalised to br, gzip or none, so a hit is never recompressed (brotli capped a php pod at ~110 page views\u002Fs); zstd is no longer offered (#145). [3add461](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3add4619edd1e7949b3baadc09e3a8abbe9a942a)\n",{"part":901,"tag":1283,"name":1283,"publishedAt":1284,"url":1285,"body":1286},"v2.0.0-alpha.10","2026-10-10T22:51:55Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.10","- **Breaking:** immediate publishing (the Publish button, Publish now, a schedule time already past, and adding a component published) sends `\"publishedAt\": \"now\"` so the API publishes by its own clock; needs api-components-bundle 2.0.0-alpha.13 or later ([#381](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F381), [98659370](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F98659370))\n- `useCwaFile`, `withFile` and `useCwaFileField` expose `srcset`: each sized variant of the field (original and imagine filters), ascending by width with the endpoint's `?published=` query, for a responsive `\u003Cimg>` ([#377](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F377), [797a8ff1](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F797a8ff1))\n- A component added with `instantAdd` is selected even while text in the previously selected component is still highlighted; a user click during a text selection is still ignored ([#379](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F379), [c5031fa4](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fc5031fa4))\n- A route whose parent's go-live date has already passed no longer says \"A parent route holds this page back\" in the Routes tab ([#378](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F378), [7e1e434f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F7e1e434f))\n- Clicks inside the stranded component groups modal no longer reach the page behind it, which hid the manager and left draft view ([#380](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F380), [eb9940b1](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Feb9940b1))\n- Publishing a draft from a browser whose clock is ahead of the API no longer leaves the component showing \"Resource … has not been requested\": a publish is decided from the API's response, not the browser clock, so a draft the API saved as scheduled stays loaded ([#373](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F373), [9e25d3f3](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F9e25d3f3))\n",{"part":907,"tag":1288,"name":1288,"publishedAt":1289,"url":1290,"body":1291},"2.0.0-alpha.13","2026-10-10T22:43:39Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.13","### Breaking\n- Imagine variants of a filter set with a `format` are stored with that format's extension (`cache\u002F\u003Cfilter>\u002Fphoto-1a2b3c4d.webp`, not `.png`), so they are served with the right `Content-Type`. Existing variants for those filters are generated again under the new name; clear them with `bin\u002Fconsole liip:imagine:cache:remove --filter=\u003Cfilter>` for each such filter, as nothing else removes the old files ([#404](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F404))\n- `ImagineRemoveEvent::$paths` is always an array (empty for every path), and `FileInfoCacheManager::deleteCaches()` with `null` filters deletes only variant rows, keeping the original's row, as the cache resolver only removes variants ([#406](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F406))\n\n### Added\n- `\"publishedAt\": \"now\"` on a publishable POST, PUT or PATCH publishes by the server's clock, so a browser whose clock is ahead of the server no longer leaves \"Publish now\" as a draft scheduled a moment ahead. Only the exact string `now` is resolved; a caller who may not publish still cannot set it, and it is a 422 on `?published=true` like any publication date change ([#408](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F408))\n\n### Fixed\n- `liip:imagine:cache:remove --filter=\u003Cfilter>` and `liip:imagine:cache:remove` no longer fail with a `TypeError` after deleting the files: the file info rows of those filters are deleted for every path, and the originals' rows kept ([#405](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F405), [#406](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F406))\n- `CacheManager::remove()` accepts a single path or filter as a string, as liip's signature allows, instead of throwing a `TypeError` ([#403](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F403), [#406](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F406))\n- An upload is stored with the extension of its content: a PNG uploaded as `holiday.jpg` is stored as `.png`, and one with no extension gets `.png`. A valid extension (`.jpeg`) is kept, and plain text or an unrecognised type keeps the client's extension ([#404](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F404))\n- An imagine variant with no file info row (rows lost, or a bucket shared with another database) reports its real type, size and dimensions instead of `-1` and an empty type: the stored variant is read through `FlysystemCacheResolver` and its row saved ([#404](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F404))\n",{"part":885,"tag":1085,"name":1085,"publishedAt":1293,"url":1294,"body":1295},"2026-10-10T22:18:03Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.21","### Upgrade notes\n- Remove every `generate_jwt_keys` line from your `.gitlab-ci.yml` and GitHub workflows: `deploy` now handles the secrets itself, and the function is gone. On GitHub, map an optional `APP_SECRET` secret into the deploy jobs as the template does. [816997e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F816997eaebb7cfb167172e38065042ee5a42f710)\n\n### Fixed\n- Deploys keep `APP_SECRET`, `MERCURE_JWT_SECRET` and the JWT key pair from the live Secret instead of generating new ones, so logins, signed URLs and Mercure cookies survive a deploy; `APP_SECRET` can now be set as a CI variable (#144). [816997e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F816997eaebb7cfb167172e38065042ee5a42f710)\n",{"part":885,"tag":1110,"name":1110,"publishedAt":1297,"url":1298,"body":1299},"2026-10-10T20:35:31Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.20","\n### Upgrade notes\n- Copy `liip_imagine.yaml`, `api\u002Fsrc\u002FEntity\u002FImage.php` and the `Image` component (`app\u002Fapp\u002Fcwa\u002Fcomponents\u002FImage\u002FImage.vue`). No regenerate step: each existing image gets its `general` file on the first read after the deploy (about 0.2 s for 12 MP, up to 1 s for a 30 MP PNG, within the imagine budget), and the deploy's cache warm usually does that. Existing thumbnails keep their old, bigger encoding; delete the bucket's `cache\u002Fthumbnail\u002F` folder to have them re-encoded the same way. A published image with no file is left as it is until it is next published or edited. ([#143](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F143), [de6075a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fde6075a46ec1c1d81f6dce7dff349b919f8cc465))\n- **Lower your image upload caps to fit the memory budget:** set `Assert\\Image(maxPixels: …)` on `Image::$file`, and on any other uploadable image field your project adds, to **30 MP** with the vips driver or **20 MP** if you stay on GD (was 40 MP). Larger images no longer fit the 320M imagine budget: they'd be stored with no thumbnails (the original served, a warning logged). The module downscales above 20 MP in the browser, so this mainly affects direct API uploads. ([#136](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F136), [#141](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F141))\n- Imagine now uses libvips: copy `api\u002FDockerfile` (libvips, `ffi`, the `VIPS_*`\u002F`MALLOC_*` ENVs), `conf.d\u002F10-app.ini` and `20-app.dev.ini`, `api\u002Fconfig\u002Fpreload.php` and `preload_vips.php`, `liip_imagine.yaml`, and `composer require rokka\u002Fimagine-vips jcupitt\u002Fvips:^2.6 ext-ffi:*`; rebuild the dev php image. Keep `preload_vips.php` while the driver is vips, or concurrent uploads segfault in worker mode. ([#141](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F141), [8255e8c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8255e8c72529a20dcd0d5106a5fa1cf7cb9b97f4))\n- Bundle 2.0.0-alpha.12: take the migration `Version20261010134316`. It does what `silverback:api-components:deduplicate-file-info` does (originals get an empty filter, duplicate file-info rows are removed) before adding the unique `(path, filter)` index, so no manual step is needed; running the command first is harmless. Remove any `imagine.memory_limit: 320M` you copied from the template: it's now the bundle's default. With GD, sources over about 23 MP get no thumbnails (the original is served and a warning logged). ([11e5c7a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F11e5c7a74af4e0d7668a071462f8ed9a39923b5a))\n- Copy `api\u002Ffrankenphp\u002FCaddyfile`, `conf.d\u002F10-app.ini`, `api\u002Fconfig\u002Fpackages\u002Fsilverback_api_components.yaml` (`imagine.memory_limit`, needs bundle 2.0.0-alpha.11), `api\u002Fsrc\u002FEntity\u002FImage.php`, `bin\u002Fdevops\u002Fk8s.sh` and the chart's `values.yaml`, `_helpers.tpl` and `deployment.yaml`. Replace a `CWA_API_FRANKENPHP_WORKER_NUM` CI variable with `CWA_CI_API_WORKERS` (deploys now refuse it), and check the budget fits any `CWA_CI_API_MEMORY_LIMIT` you set. ([#136](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F136), [1868035](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1868035b41a4edd48d42b84c2de736026c8f5ce6))\n- Bundle 2.0.0-alpha.11 adds `invalid_files` to `_acb_orphaned_file_report`: take the migration `Version20261010125853` (existing report rows get `[]`). ([84de158](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F84de158ea8e8054b10714717028a56f549075e9f))\n- Delete any `NUXT_SITE_URL` CI variable: deploys now set it to `https:\u002F\u002F$DOMAIN` and refuse a CI variable of that name. ([#140](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F140), [45a3794](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F45a379404852fc164b15f706d0aac3479c61b6ab))\n- Copy `api\u002Ffrankenphp\u002Fsouin\u002Fv1.7.9-singleflight-5xx.patch` with its `COPY` and `patch` lines in `api\u002FDockerfile` (after the singleflight patch), and `bin\u002Ftest\u002Fsouin-coalesced-5xx.sh` with its line in the unit-tests job. ([#137](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F137), [6df1b15](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F6df1b15050970bbc45e8348d10d0a9787477365c))\n- The per-visitor rate limit needs the ingress to keep the client address (`externalTrafficPolicy: Local`); the GKE cluster's controller now does, with 2 replicas and a PDB. A project on another cluster must set the same, or the limit never applies. ([#135](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F135), [85f9c28](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F85f9c286d7fc0da9610a3764623baa4f51c28800))\n\n### Fixed\n- `create-cwa`: declining fixtures removes only the sample content (`AppScaffold.php`, `Parts\u002F`) and keeps `UsersFixture.php`, so `doctrine:fixtures:load` (and the deploy's fixtures job) still creates the admin from `ADMIN_*`. The README and closing message say so. ([#142](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F142), [bc55a2f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fbc55a2fe539379c1e7b2b57e5b7aead5033aba12))\n- Cached pages' canonical URL and `og:url` use the site's host, not whichever host rendered the page: deploys set `NUXT_SITE_URL` from `DOMAIN` (so `project.sh` sites and staging get their own). ([#140](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F140), [45a3794](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F45a379404852fc164b15f706d0aac3479c61b6ab))\n- `PURGE`\u002F`BAN` sent to the site return 405 instead of a misleading 200 (they never purged anything; the `CACHE_ACL` clause they passed through was unreachable and is gone). Purge one page by tag through Souin's admin API; see CLAUDE.md. ([#138](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F138), [1c87cc0](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1c87cc0e0ea92b26c16bb846df36b5e659ca8f93))\n- Requests Souin coalesces onto an upstream 5xx get that 5xx instead of an empty 200 (a new Souin patch, `v1.7.9-singleflight-5xx.patch`). ([#137](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F137), [6df1b15](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F6df1b15050970bbc45e8348d10d0a9787477365c))\n\n### Changed\n- Images: a `general` filter (1200 px) that the `Image` component renders (it showed the 500 px thumbnail, at most 300 px wide); filters encode JPEG at quality 82 (was 90) and PNG at level 9 (was 0, uncompressed), so a 12 MP photo's display file is 91 KB, not 172 KB; publishing an image without a file is refused (`requiredOnPublish`). ([#143](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F143), [de6075a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fde6075a46ec1c1d81f6dce7dff349b919f8cc465))\n- `app\u002F.dockerignore` also leaves out local env files (`.env`, `.env.local`, `.env.*.local`, which `nuxt build` would read), `.pnpm-store\u002F`, `node-compile-cache\u002F`, logs, OS files, the Dockerfile and compose files, so local builds match CI's. ([#139](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F139), [2e2ae16](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F2e2ae160dee8e8834dc99038062b9004b494a369))\n- The imagine driver is libvips (FFI, `ffi.enable = true`, untrusted loaders blocked) instead of GD: a 12 MP thumbnail takes ~200 ms and ~50 MB instead of ~320 ms and 140 MB, and large originals no longer exhaust `memory_limit`. Image uploads are accepted up to 30 MP. `driver: gd` in `liip_imagine.yaml` switches back (then lower the cap to 20 MP). ([#141](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F141), [8255e8c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8255e8c72529a20dcd0d5106a5fa1cf7cb9b97f4), [903b0a3](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F903b0a3d06bcb93d838382ff1fb7d2e82a3eb873))\n- `.gitignore` ignores `.claude` (Claude Code's local settings and worktrees). ([3cd1e20](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3cd1e20f4e3e80a057d52ab5fc527141c13f9b7c))\n- `@cwa\u002Fnuxt` 2.0.0-alpha.9 (admin): reordering applies once per move even if a component group is mounted twice; the orphaned files page shows invalid files (needs bundle 2.0.0-alpha.11+); a failed background refresh no longer turns on-screen components into error notices; the Info tab's delete button says Delete Draft \u002F Delete Live. ([fc37313](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ffc37313f933c6b101fe67ed100349107b91f03c9))\n- Bundle 2.0.0-alpha.12: a unique index on imagine file info, and `imagine.memory_limit` defaults to 320M, so the template no longer sets it. ([11e5c7a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F11e5c7a74af4e0d7668a071462f8ed9a39923b5a))\n- php requests run under `memory_limit` 128M (`FRANKENPHP_MEMORY_LIMIT`; console commands 256M), imagine filters under 320M, and `GOMEMLIMIT` is what that budget leaves Go (160MiB of 1Gi) instead of 80% of the limit. `values.yaml` states the budget; `CWA_CI_API_WORKERS`, `CWA_CI_API_PHP_MEMORY_LIMIT`, `CWA_CI_API_IMAGINE_MEMORY_LIMIT` and `CWA_CI_API_RESERVED_MEMORY` set it, and the deploy fails before the cluster when it doesn't fit. ([#136](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F136), [1868035](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1868035b41a4edd48d42b84c2de736026c8f5ce6))\n- `Image::$file` accepts up to 30 MP (was 40): what the 320M imagine budget can thumbnail with vips (20 MP with GD). ([#136](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F136), [1868035](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1868035b41a4edd48d42b84c2de736026c8f5ce6))\n- Bundle 2.0.0-alpha.11: imagine filters are generated within a memory budget (oversized ones skipped, not fatal), uploadables no longer save `NULL` filenames, the orphan report lists invalid files, and `purge-http-cache --path`\u002F`--tag` purge one page or tag. ([84de158](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F84de158ea8e8054b10714717028a56f549075e9f))\n",{"part":901,"tag":1301,"name":1301,"publishedAt":1302,"url":1303,"body":1304},"v2.0.0-alpha.9","2026-10-10T13:49:02Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.9","- Move up \u002F Move down move a component one place even when its component group is on screen more than once: the reorder queue is held once per group instead of per mounted group, so each move is applied and sent once ([#374](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F374), [d2aa2579](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fd2aa2579))\n- The orphaned files page lists **Invalid files**: files in use that break their upload field's current rules, each with a link to its resource, the field, path, adapter and every violation. They are report-only and never deleted, and the settings notice counts them. Needs api-components-bundle 2.0.0-alpha.11 or later ([#376](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F376), [09450e77](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F09450e77))\n- A failed background re-fetch (after a Mercure reconnect or an update message) no longer turns on-screen components into \"Error loading resource … Unknown error\" notices: a loaded resource keeps its last data unless the API answers 4xx ([#375](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F375), [d998476a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fd998476a))\n- The manager's Info tab names the version a delete removes: **Delete Draft** for a draft and **Delete Live** for the live version of a publishable component; other resources still say **Delete** ([#371](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F371), [fd3b4d97](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Ffd3b4d97))\n",{"part":907,"tag":1306,"name":1306,"publishedAt":1307,"url":1308,"body":1309},"2.0.0-alpha.12","2026-10-10T13:29:56Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.12","### Breaking\n- Upgrade step: the imagine file info table (`_acb_imagine_cached_file_metadata`) gets its `unique_cache_item` index on `(path, filter)` and a `NOT NULL DEFAULT ''` `filter` column. Run `silverback:api-components:deduplicate-file-info` first (gives originals an empty filter and removes duplicate rows; safe to run again), then generate and run a migration ([#399](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F399))\n\n### Changed\n- `silverback_api_components.imagine.memory_limit` defaults to `320M` instead of `512M`. With GD, sources over about 23 MP now get no imagine filters (the original is served and a warning logged); set it higher, or use the vips driver, to filter larger images ([#400](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F400))\n\n### Fixed\n- The file info table's unique index on path and filter now exists: it was declared where Doctrine ignores it, and originals are stored with an empty filter so the index covers them on every database. Caching file info a concurrent request already saved keeps that row ([#399](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F399))\n",{"part":907,"tag":1311,"name":1311,"publishedAt":1312,"url":1313,"body":1314},"2.0.0-alpha.11","2026-10-10T12:55:05Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.11","### Breaking\n- `MediaObjectFactory` and `UploadableFileManager` take an `ImagineFilterGenerator` (`$imagineFilterGenerator`) instead of liip's `FilterService`; an application that constructs or decorates them must pass the generator ([#397](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F397))\n\n### Added\n- `silverback_api_components.imagine.memory_limit` (default `512M`, `null` to disable): imagine filters are generated with `memory_limit` raised to it and restored afterwards, so an application can run its workers with a lower global `memory_limit` ([#397](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F397))\n- `silverback:api-components:purge-http-cache --tag \u003Ctag> --path \u003C\u002Fpath>` (both repeatable) purges only those tags through the configured purger, never a full flush: `--path` purges the tag a write to the route at that path purges (`\u003Croute import prefix>\u002F_\u002Froutes\u002F\u003Cpath>`), whether or not a route exists there. With Souin that is a surrogate-key purge, which also reaches a CDN that purges by tag. Exits 1 when the purge fails, 2 for a tag containing a space or comma, and 0 with nothing purged when no purger is configured ([#396](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F396))\n- Invalid files in the orphaned file report: `invalidFiles` lists each referenced stored file that breaks its uploadable field's current `File`\u002F`Image` constraints (`Default` group, composites such as `When` honoured) with its resource, field, path and violation messages, checked from cached file info or, without a row, from the object without decoding it; report only, never modified or deleted. Upgrade step: new `invalid_files` column on `_acb_orphaned_file_report`; generate and run a migration ([#391](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F391))\n\n### Fixed\n- An imagine filter whose source is too large to generate within the memory budget is skipped and logged instead of exhausting PHP's memory, on read and on upload; the response still carries the original. The estimate uses the measured cost of the configured driver (GD, Imagick, vips) ([#397](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F397))\n- Reading uploadables no longer saves `NULL` filenames: the uploadable normalizer stopped nulling the file fields on the entity, and caching file info (for a file seen for the first time, or an imagine filter generated on read) inserts only its own row instead of flushing every pending change. A page whose request generated a filter or cached file info lost the images of the components serialised before it ([#393](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F393))\n",{"part":885,"tag":1124,"name":1124,"publishedAt":1316,"url":1317,"body":1318},"2026-10-10T10:13:19Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.19","\n### Upgrade notes\n- Copy `bin\u002Fdevops\u002Fsetup.sh`, `k8s.sh`, the warm cache and performance audit jobs in `.gitlab-ci.yml` (they pass no URL now) and, on GitHub, `performance-audit.yml`. A deploy job with neither an environment url nor a `DOMAIN` now fails instead of deploying to `test-domain.com`. ([#132](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F132), [#134](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F134), [7b26140](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F7b26140895c524ad5083e48470883bffd99d3410))\n\n### Changed\n- The bundle's `website_name` (the name in emails) comes from `WEBSITE_NAME`, default `New Website` in `api\u002F.env`; set `CWA_API_WEBSITE_NAME` on deploys, or export it per site from `bin\u002Fdevops\u002Fproject.sh`. ([GitLab #6](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fissues\u002F6), [c1a3201](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fc1a3201e24378ef54e7bd64393110bb6b1a0cfce))\n\n### Added\n- `bin\u002Fdevops\u002Fproject.sh` can add reserved names (ones its own chart values set) with `SITE_ENV_RESERVED_API_EXTRA` \u002F `SITE_ENV_RESERVED_PWA_EXTRA`. ([#133](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F133), [7b26140](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F7b26140895c524ad5083e48470883bffd99d3410))\n\n### Fixed\n- `.gitlab-ci.yml` loses comments the comment trim left pointing at nothing. ([a628710](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fa6287100e0c3b9dee2330c6590c07c5f6d2cee7c))\n- The warm cache and performance audit use `https:\u002F\u002F$DOMAIN`, so they follow a `DOMAIN` set in `project.sh`. ([#132](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F132), [7b26140](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F7b26140895c524ad5083e48470883bffd99d3410))\n- `check_kube_domain` can fail: no `test-domain.com` fallback, and an empty `DOMAIN` or one with a leading or trailing dot (an empty `KUBE_INGRESS_BASE_DOMAIN`) stops the deploy. ([#134](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F134), [7b26140](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F7b26140895c524ad5083e48470883bffd99d3410))\n",{"part":885,"tag":1133,"name":1133,"publishedAt":1320,"url":1321,"body":1322},"2026-10-10T00:08:28Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.18","\n### Changed\n- Bundle 2.0.0-alpha.10, `symfony\u002Fmercure-bundle` 0.6 and `symfony\u002Fmercure` 0.9 ([api-components-bundle#384](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F384)). `mercure.yaml` pins `cookie_name: '__Secure-mercure_access_token'`: mercure-bundle 0.6 drops the prefix when `kernel.debug` is on, and the hub wouldn't read it. ([b71fd4d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fb71fd4d1f6193ab6c80fd05c07a9cb3e576414fe))\n- Comments are one or two lines; the reasoning lives in issues, this changelog and CLAUDE.md. Comment lines only, so downstream copies can take the files as they are. ([#131](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F131), [5f81e4c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5f81e4c6b80fc68f98f6e5464dbac52ce612e65e), [42b2163](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F42b21638d481b87918959f85a83af4716a432f4e), [f7dfc96](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff7dfc9646db57f8c6a2bbe3dbbaf23147aa65fb5), [ac49bda](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fac49bda4657cc4ecf17bd3f53a1729e9af61fc6c), [90ca38d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F90ca38d75185d37aa47c90e5d5d587428ad13131), [a76d7a4](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fa76d7a4f5e2073aae835908c17d7d5f14f9ce316))\n- API Platform 5.0.3, Doctrine ORM 3.7.5, liip\u002Fimagine-bundle 2.18.1, Nuxt 4.6.1, satori 0.47 (for nuxt-og-image), `@nuxt\u002Fdevtools` 4.0.0-beta.4 and patch updates. ([30ef432](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F30ef432becfe328d9c57357aecf2fbca1005974b))\n\n### Added\n- Load test: `page_views` (a page load or a client-side navigation), the resource manifest's resources fetched on each navigation (`MAX_RESOURCES`, default 20), a Cloudflare `cf-cache-status` line, `RANDOM_SEED` for repeatable runs, and `ORIGIN_IP` to measure the origin without the CDN. ([!13](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F13))\n- Deploy hooks, so a project keeps `bin\u002Fdevops\u002Fsetup.sh` and `k8s.sh` unedited: an optional `bin\u002Fdevops\u002Fproject.sh` (sourced by `setup.sh`; it can set `DOMAIN` and site settings) and its `project_values \u003Ctrack>` (chart values, applied last). `check_kube_domain` and `persist_environment_url` work from `DOMAIN`, and the latter also writes `environment_url.env` (`SITE_ENVIRONMENT_URL`). ([!14](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F14))\n",{"part":907,"tag":1324,"name":1324,"publishedAt":1325,"url":1326,"body":1327},"2.0.0-alpha.10","2026-10-09T23:28:58Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.10","### Changed\n- `symfony\u002Fmercure` ^0.9 and `symfony\u002Fmercure-bundle` ^0.6 are allowed alongside ^0.8 and ^0.5 ([#385](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F385))\n",{"part":885,"tag":1158,"name":1158,"publishedAt":1329,"url":1330,"body":1331},"2026-10-09T22:50:45Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.17","\n### Upgrade notes\n- Copy `run_test_functional` again: it unsets `JWT_SECRET_KEY`, `JWT_PUBLIC_KEY` and `JWT_PASSPHRASE`, whose CI values (key contents) failed the functional tests and printed the encrypted key in the log. If that happened, erase the job log, or rotate the keypair. ([#130](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F130), [c1d2581](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fc1d2581a2c1478d618765474b5d5808857b98868))\n",{"part":885,"tag":1168,"name":1168,"publishedAt":1333,"url":1334,"body":1335},"2026-10-09T16:15:59Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.16","\n### Upgrade notes\n- **Rename your CI variables before or with the next deploy: the old names are no longer read.** ([3a4ab9a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3a4ab9a2996c7b2639c93fa3f2afd9d90c157185), [1960c43](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1960c431e3688591ce1d87e5f11d6ffdb541c9c4), [151fa6f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F151fa6fb4e46b62fe711783f7f078f4064183d64), [d64c278](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd64c278997770b07fb0c2d04ed2fa7383059ab03))\n  - `CWA_CI_` + the same name: `BUILD_DISABLED`, `TEST_DISABLED`, `REVIEW_DISABLED`, `STAGING_ENABLED`, `CANARY_ENABLED`, `FIXTURES_PURGE`, `RESET_DATABASE`, `HELM_UNINSTALL`, `DEPLOYMENT_BRANCH`, `TRACE`, `INGRESS_ENABLED`, `CLUSTER_ISSUER`, `TLS_CERTIFICATE_TIMEOUT`, `INGRESS_RATE_LIMIT_*`, `PWA_*` (sizing), `ORPHAN_SCAN*`, `WARM_CACHE_*`, `PERFORMANCE_AUDIT_*`.\n  - `CWA_CI_API_` + the same name: `REPLICA_COUNT`, `AUTOSCALE`, `AUTOSCALE_*`.\n  - `PHP_CPU_REQUEST`, `PHP_MEMORY_REQUEST`, `PHP_MEMORY_LIMIT`, `PHP_GOMEMLIMIT` → `CWA_CI_API_CPU_REQUEST`, `_MEMORY_REQUEST`, `_MEMORY_LIMIT`, `_GOMEMLIMIT`.\n  - `PRODUCTION_API_DISABLED` → `CWA_CI_PRODUCTION_DISABLED`, `CI_DISABLED` (GitHub) → `CWA_CI_DISABLED`, `ENABLE_DATABASE_FIXTURES` → `CWA_CI_FIXTURES_ENABLED`, `LETSENCRYPT_SECRET_NAME` → `CWA_CI_TLS_SECRET_NAME`, `KUBE_INGRESS_WWW_REDIRECT` → `CWA_CI_WWW_REDIRECT`, `DATABASE_IMAGE_TAG` → `CWA_CI_POSTGRES_IMAGE_TAG`, `POSTGRESQL_ENABLED` → `CWA_CI_POSTGRES_ENABLED`.\n  - `CWA_API_` + the same name: `CACHE_QUERY_ALLOWLIST`, `CADDY_TRUSTED_PROXIES`, `CLOUDFLARE_IP_RANGES`, `RATE_LIMIT_*`, `FRANKENPHP_MAX_WAIT_TIME`, `CLOUDFLARE_PURGE_*`, `CADDY_GLOBAL_CONFIG`, `JWT_COOKIE_SAMESITE`, `MERCURE_JWT_ALGORITHM`.\n- Copy `run_test_functional` from `bin\u002Fdevops\u002Fk8s.sh` **and** add `MAILER_DSN=null:\u002F\u002Fnull` to `api\u002F.env.test`: the job unsets `MAILER_DSN` and `MAILER_EMAIL` so a test that sends email can't deliver it through your live relay (every CI variable reaches the test job and beats `api\u002F.env.test`), and the null transport stops it falling back to `.env`'s `smtp-relay`, which CI doesn't have. ([!12](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F12), [#123](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F123))\n- Optional: add a `GITHUB_TOKEN` CI variable (a fine-grained token with no permissions is enough) and copy the composer step from `api\u002FDockerfile`, `build_api` from `bin\u002Fdevops\u002Fk8s.sh`, the `COMPOSER_AUTH` block at the end of `bin\u002Fdevops\u002Fsetup.sh` and the build step's `GITHUB_TOKEN` in `.github\u002Fworkflows\u002Fci.yml`, so composer installs stop failing on GitHub's anonymous rate limit. Without the token nothing changes. ([!12](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F12), [#123](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F123))\n- Delete a `VARNISH_TOKEN` CI variable if you have one: nothing reads it any more. ([!12](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F12), [#123](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F123))\n- Delete any `NUXT_CWA_API_URL`, `NUXT_PUBLIC_CWA_API_URL`, `NUXT_PUBLIC_CWA_API_URL_BROWSER` or `NUXT_PUBLIC_CWA_ENVIRONMENT` CI variable: the deploy now fails on names the chart sets. Copy `bin\u002Fdevops\u002Fk8s.sh`, the chart and, on GitHub, `github-export-secrets.sh` with its step; move site settings from build args to runtime env. ([#125](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F125)) ([497e8ac](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F497e8ac74cf3ba8b066982df0192bff238abd906))\n- Rename `POSTGRES_USERNAME` to `POSTGRES_USER`. `POSTGRES_USER`\u002F`_PASSWORD`\u002F`_DB` now take effect in-cluster (it always ran as `example` \u002F `!ChangeMe!` \u002F `api`): if you set them, a new user or database restarts PostgreSQL empty, and a new password alone needs `kubectl delete pod \u003Crelease>-postgresql-0`. ([e15f168](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe15f16818a61f9a3f68697808bea5998bf34b0dc))\n- Fix the seeded layout once (fixtures keep existing rows): set the `main` layout's UI component to `CwaLayoutPrimary` in the admin, or `UPDATE _acb_layout SET ui_component = 'CwaLayoutPrimary' WHERE ui_component = 'CwaLayoutCwaLayoutPrimary';` then `bin\u002Fconsole silverback:api-components:purge-http-cache`. ([#126](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F126), [6c0b9d8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F6c0b9d8514e64ea42e4162eeeda8f50dbb582ce3))\n\n### Added\n- Site settings without template edits: `NUXT_*` CI variables reach the PWA, `CWA_API_\u003CNAME>` the API as `\u003CNAME>`, through `envFrom`. ([#125](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F125)) ([497e8ac](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F497e8ac74cf3ba8b066982df0192bff238abd906))\n- `CWA_ENVIRONMENT` \u002F `NUXT_PUBLIC_CWA_ENVIRONMENT` name the environment from the deploy's track. ([#125](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F125)) ([497e8ac](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F497e8ac74cf3ba8b066982df0192bff238abd906))\n- GitHub deploys export `NUXT_*` and `CWA_API_*` secrets, masked, without a workflow edit per secret. ([#125](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F125)) ([75a416b](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F75a416bc14edcdd601918bf44fa291f391abcbcf))\n- Composer authenticates to github.com with an optional `GITHUB_TOKEN`, passed to the API build as a build secret, with at most 6 parallel downloads. ([!12](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F12), [#123](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F123))\n- Optional in-cluster PostgreSQL persistence (`CWA_CI_POSTGRES_PERSISTENCE`, `_PERSISTENCE_SIZE`, `CWA_CI_POSTGRES_STORAGE_CLASS`). A deploy that would change a live volume stops first and says what to run; review cleanup deletes the review volume. ([7675190](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F767519054d9b8473a42eb30144ea6eaeae65d39a))\n\n### Changed\n- The template's CI settings are `CWA_CI_*`. ([3a4ab9a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3a4ab9a2996c7b2639c93fa3f2afd9d90c157185), [1960c43](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1960c431e3688591ce1d87e5f11d6ffdb541c9c4), [151fa6f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F151fa6fb4e46b62fe711783f7f078f4064183d64))\n- The API's optional runtime settings are set as `CWA_API_*` through the passthrough instead of their own chart wiring; an empty `CWA_API_` value is left out. ([d64c278](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd64c278997770b07fb0c2d04ed2fa7383059ab03))\n- A canary release's SSR minimum defaults to 1 pod (production keeps 2). ([#124](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F124), [095c074](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F095c074eba4a660412fad08c74a6415c11591115))\n\n### Fixed\n- The fixtures seed the layout as `CwaLayoutPrimary` (was `CwaLayoutCwaLayoutPrimary`), so pages render through `primary.vue`. ([#126](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F126), [6c0b9d8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F6c0b9d8514e64ea42e4162eeeda8f50dbb582ce3))\n- A `create-cwa` project without fixtures no longer keeps fixture classes that reference deleted ones; the fixtures wire themselves with attributes. ([#127](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F127), [78478ed](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F78478ed90647a427646e9305057bb6b8b78a0fd2))\n- GitLab creates the `main` pipeline with production switched off and fixtures on. ([e7d1be3](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe7d1be335105348503aaf74e0407598756d34760))\n- A downstream functional test that sends email no longer reaches the live mail relay (`.env.test` uses the null transport), and tests that sign in get a JWT keypair. ([!12](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F12), [#123](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F123))\n- The registry pull secret is applied rather than replaced with `--force`, so releases that share a namespace don't race (\"already exists\"). The first deploy after this prints a harmless one-off warning about a missing `last-applied-configuration` annotation. ([!12](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F12), [#123](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F123))\n- `helm lint` and `helm template` work on the chart's own defaults: `jwt-passphrase` defaults to `\"\"` instead of failing `b64enc`. ([!12](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F12), [#123](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F123))\n- Release steps tag with `--cleanup=verbatim`, so a tag message keeps the changelog's `###` headings. ([56f3065](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F56f3065abea729f33375ee5db664510114fed341))\n- `POSTGRES_USER`\u002F`_PASSWORD`\u002F`_DB` reach the in-cluster PostgreSQL and its `database-url`, now percent-encoded. ([e15f168](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe15f16818a61f9a3f68697808bea5998bf34b0dc))\n- A `KUBERNETES_VERSION` or `HELM_VERSION` CI variable is honoured on GitLab, as on GitHub; `setup.sh` used to overwrite it. ([13243ae](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F13243aea131252dd9be88174b9d57a5b35a44864))\n\n### Removed\n- `apiSecretToken` (`VARNISH_TOKEN`), which nothing in the chart read. ([!12](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F12), [#123](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F123))\n",{"part":885,"tag":1191,"name":1191,"publishedAt":1337,"url":1338,"body":1339},"2026-10-08T12:37:36Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.15","Since [v2.0.0-alpha.14](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.14).\n\n### Upgrade notes\n- Update `components-web-app\u002Fapi-components-bundle` to 2.0.0-alpha.9 and `@cwa\u002Fnuxt` to 2.0.0-alpha.8 **together**, and add the migration for the new `is_reachable_without_route` column on `_acb_page` and `_acb_abstract_page_data` (generate your own with `doctrine:migrations:diff`, or copy `Version20261008121224.php` if your schema matches the template's). The module's toggle needs the bundle's column. ([d1849ab](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd1849abb898385590190d470a883c22ff62018fb), [cca6db5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fcca6db54b842e47328c78deb96f455e8ceea7064))\n- Migrations are upward-only: delete `down()` from your migrations, including new ones, so a rollback aborts instead of dropping data. ([3fbfb4e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3fbfb4e142d6a7f20714843ff24c45e1b43c6ffc))\n\n### Added\n- Pages and page data have a **Public without a route** admin toggle (bundle `isReachableWithoutRoute`): a routeless page loaded by a custom fetch IRI, such as a share link, can be read by visitors (api-components-bundle#381, cwa-nuxt-module#369). ([d1849ab](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd1849abb898385590190d470a883c22ff62018fb), [cca6db5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fcca6db54b842e47328c78deb96f455e8ceea7064))\n\n### Removed\n- Every migration's `down()`; Doctrine's inherited one aborts. ([3fbfb4e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3fbfb4e142d6a7f20714843ff24c45e1b43c6ffc))\n\n",{"part":885,"tag":1201,"name":1201,"publishedAt":1341,"url":1342,"body":1343},"2026-10-08T12:32:03Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.14","Since [v2.0.0-alpha.13](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.13).\n\n### Upgrade notes\n- **Production certificates are opt-in again:** with no `CLUSTER_ISSUER` variable, deploys use `letsencrypt-staging` (as before alpha.11). Every production site must set `CLUSTER_ISSUER=letsencrypt-prod`; alpha.12's advice that it could be deleted is withdrawn. Check it exists **before** syncing `bin\u002Fdevops\u002Fsetup.sh`. ([5f3f785](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5f3f78521fca025b9d6f9f0fdb8132cbb679b92d))\n- Replace alpha.13's `routeRules` `\u002Fsw.js` block with `registerWebManifestInRouteRules: true` in the `pwa` block of `app\u002Fnuxt.config.ts`. ([e4ebb26](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe4ebb264617e5013ff4b5a70d477c27edd451209))\n\n### Changed\n- An unset `CLUSTER_ISSUER` gives `letsencrypt-staging`, so a misconfigured domain fails against the staging issuer's limits rather than production's; an explicit empty value still turns cert-manager off. ([5f3f785](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5f3f78521fca025b9d6f9f0fdb8132cbb679b92d))\n- The service worker and manifest headers now come from `@vite-pwa\u002Fnuxt` (`public, max-age=0, must-revalidate`, plus the manifest's `Content-Type`) instead of the template's own rule. ([e4ebb26](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe4ebb264617e5013ff4b5a70d477c27edd451209))\n\n",{"part":901,"tag":1345,"name":1345,"publishedAt":1346,"url":1347,"body":1348},"v2.0.0-alpha.8","2026-10-08T12:20:54Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.8","- Pages and page data have a **Public without a route** toggle in their settings, so a routeless page loaded by a custom fetch IRI can be read by visitors; it has no effect while the page has a route, and a flagged page shows as public (green) like a routed one. Needs api-components-bundle 2.0.0-alpha.9 or later ([#369](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F369), [5a919456](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F5a919456))\n",{"part":907,"tag":1350,"name":1350,"publishedAt":1351,"url":1352,"body":1353},"2.0.0-alpha.9","2026-10-08T12:06:51Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.9","### Added\n- `isReachableWithoutRoute` on pages and page data (admin-only, default `false`): a page with no route that is flagged is readable as though a live route reached it, so an application can serve it from its own routes (e.g. the module's fetch by IRI) with `routable_security` set. Its components, manifest and ancestors follow, as for a routed page, and its nearest routed ancestor must still be readable. A page with a route ignores the flag. Upgrade step: new `is_reachable_without_route` column on the page and page data tables; generate and run a migration ([#382](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F382))\n",{"part":885,"tag":1210,"name":1210,"publishedAt":1355,"url":1356,"body":1357},"2026-10-08T10:44:26Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.13","## [2.0.0-alpha.13](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.13) - 2026-10-08\n\nSince [v2.0.0-alpha.12](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.12).\n\n### Upgrade notes\n- Copy the `routeRules` block (`\u002Fsw.js` with `cache-control: no-cache`) into `app\u002Fnuxt.config.ts`. Then a Cloudflare zone can rely on Cloudflare's default caching of static files: no blanket \"Bypass cache for everything\" rule and no `\u002F_nuxt` exception rule. ([4add7fe](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F4add7fe97b9b191b5eec862dd8d50d27b4a70f37))\n\n### Fixed\n- After a deploy, a CDN could serve the previous build's service worker for hours, because Nitro sent `\u002Fsw.js` with no `Cache-Control` and Cloudflare caches `.js` by default. It now goes out `no-cache`. ([4add7fe](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F4add7fe97b9b191b5eec862dd8d50d27b4a70f37))\n",{"part":885,"tag":1220,"name":1220,"publishedAt":1359,"url":1360,"body":1361},"2026-10-08T09:03:57Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.12","## [2.0.0-alpha.12](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.12) - 2026-10-08\n\nSince [v2.0.0-alpha.11](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.11).\n\n### Upgrade notes\n- **Copy `bin\u002Fdevops\u002Fsetup.sh` before deleting `CLUSTER_ISSUER`.** v2.0.0-alpha.11's `letsencrypt-prod` default never applied, because `setup.sh` set an unset value to `letsencrypt-staging` first, so a site that deleted the variable got an untrusted staging certificate on its next deploy. With this release's `setup.sh` (no `CLUSTER_ISSUER` default) and `k8s.sh`, an unset value gives `letsencrypt-prod`; an empty value still turns cert-manager off. Until you've synced both, keep `CLUSTER_ISSUER=letsencrypt-prod`. ([0225e8c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F0225e8ce48cbed0e49627938d965f335884e2269), [#119](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F119))\n\n### Fixed\n- An unset `CLUSTER_ISSUER` now really gives `letsencrypt-prod`, and `setup.sh` no longer warns about an unset `CORS_ALLOW_ORIGIN` or `TRUSTED_HOSTS`, which `deploy` derives. ([0225e8c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F0225e8ce48cbed0e49627938d965f335884e2269), [#119](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F119))\n",{"part":885,"tag":1256,"name":1256,"publishedAt":1363,"url":1364,"body":1365},"2026-10-08T08:23:36Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.11","## [2.0.0-alpha.11](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.11) - 2026-10-08\n\nSince [v2.0.0-alpha.10](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.10).\n\n### Upgrade notes\n- Deploys now default `INGRESS_ENABLED=true`, `CLUSTER_ISSUER=letsencrypt-prod`, `CORS_ALLOW_ORIGIN`, `TRUSTED_HOSTS` and `MERCURE_CORS_ORIGIN` (exact matches for the deploy's own hostname and, in production, `KUBE_INGRESS_ALIAS_DOMAINS`), `DATABASE_SSL_MODE=require` when `POSTGRESQL_ENABLED=false`, and an unset `CADDY_CACHE_CDN_CONFIG` now really means `strategy hard`. Copy `apply_site_defaults` and `site_hosts` from `bin\u002Fdevops\u002Fk8s.sh` and the `caddy-cache-cdn-config` changes in `helm\u002Fcwa`, deploy once, then delete the CI variables that only repeated these values. Keep `CORS_ALLOW_ORIGIN`\u002F`TRUSTED_HOSTS` if another site calls this API from the browser; set `CLUSTER_ISSUER` to an empty value on a cluster without cert-manager. Don't delete `CADDY_CACHE_CDN_CONFIG=strategy hard` before that deploy. ([be14ab0](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fbe14ab050a7f2b7d6bb843ab4dc85982fede316c))\n\n### Fixed\n- An unset `CADDY_CACHE_CDN_CONFIG` replaced the Caddyfile's `strategy hard` with an empty `cdn` block (Kubernetes received a newline), so Souin would keep stale copies of purged responses; every site had to set `strategy hard` by hand. ([be14ab0](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fbe14ab050a7f2b7d6bb843ab4dc85982fede316c))\n",{"part":885,"tag":1283,"name":1283,"publishedAt":1367,"url":1368,"body":1369},"2026-10-08T07:51:05Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.10","## [2.0.0-alpha.10](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.10) - 2026-10-08\n\nSince [v2.0.0-alpha.9](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.9).\n\n### Upgrade notes\n- Production CPU requests are lower: php 200m → 100m, SSR 250m → 100m, and the SSR autoscaler's CPU target 70% → 175%, so a pod is still added at about 175m. A site that sets only `PWA_AUTOSCALE_CPU_PERCENT` or only `PWA_CPU_REQUEST` must set the other to match (request × target ≈ 175m), or SSR scales on ordinary traffic. ([e79ad3b](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe79ad3b7fc18feb7f20fcfe8d810da3ef1973c09))\n\n### Changed\n- Production reserves less CPU per site: php and SSR pods request 100m instead of 200m and 250m. With page HTML cached, SSR pods mostly idle; the autoscaler still adds an SSR pod at about one render a second. ([e79ad3b](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe79ad3b7fc18feb7f20fcfe8d810da3ef1973c09))\n",{"part":885,"tag":1301,"name":1301,"publishedAt":1371,"url":1372,"body":1373},"2026-10-07T23:21:01Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.9","## [2.0.0-alpha.9](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.9) - 2026-10-08\n\nSince [v2.0.0-alpha.8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.8).\n\n### Upgrade notes\n- Copy the `nitro` block from `app\u002Fnuxt.config.ts`, and the `goMemLimit` lines and `cwa.php.goMemLimit` helper from `helm\u002Fcwa` and `bin\u002Fdevops\u002Fk8s.sh`. ([5e732e9](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5e732e9d36688fcbdb59b656f47ccbae1ccfd8e2))\n- Copy the `@cache_tag` matcher and `header @cache_tag` block from `api\u002Ffrankenphp\u002FCaddyfile`, and the `NODE_OPTIONS` line from `app\u002FDockerfile`; if your deploy sets `NODE_OPTIONS`, add `--max-http-header-size=65536` to it. A site whose sitemap is empty, or whose SSR log shows `UND_ERR_HEADERS_OVERFLOW`, needs this. ([3eae185](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3eae1859ff82264773072b57856febb83e420a91))\n\n### Fixed\n- SSR fetches of large API collections no longer fail with `UND_ERR_HEADERS_OVERFLOW` (which left the sitemap empty from about 100 routes): `Cache-Tag` is added only for public hosts, never for SSR's internal ones, and the app image allows 64 KB of response headers. ([3eae185](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3eae1859ff82264773072b57856febb83e420a91), [#118](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F118))\n- php no longer runs out of memory under a burst of first-time visitors. Nitro now precompresses `\u002F_nuxt` assets at build time (`nitro.compressPublicAssets`), so php's Caddy stops brotli-compressing every JS chunk per request, and the php container gets `GOMEMLIMIT` at 80% of its memory limit (`PHP_GOMEMLIMIT` overrides, `off` unsets). ([5e732e9](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5e732e9d36688fcbdb59b656f47ccbae1ccfd8e2), [#117](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F117))\n- A deploy now fails before helm, with a message naming the line, when `CADDY_CACHE_CDN_CONFIG` has a `cdn` directive with no value or an unexpanded `$NAME` (e.g. `api_key $CLOUDFLARE_API_TOKEN` when the token is a Protected GitLab variable and the branch isn't protected). Souin panics parsing it, so php crash-looped while helm reported the release deployed. ([f0e62d7](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff0e62d7b2a9dba93aa4b1a6e6a458d89bfdd8153), [#116](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F116))\n",{"part":885,"tag":1345,"name":1345,"publishedAt":1375,"url":1376,"body":1377},"2026-10-07T19:12:27Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.8","Since [v2.0.0-alpha.7](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.7).\n\n### Upgrade notes\n- Sites with `provider cloudflare` in `CADDY_CACHE_CDN_CONFIG`: replace `api\u002Ffrankenphp\u002Fsouin\u002Fv1.7.9-cloudflare-purge.patch` with the new one (the Dockerfile lines are unchanged apart from a comment) and rebuild php. Cloudflare's purge limit is per account, so when several sites, or staging and production, share an account, give each a share of it with `CLOUDFLARE_PURGE_REQUESTS`, `CLOUDFLARE_PURGE_WINDOW` and `CLOUDFLARE_PURGE_BURST` (or set `CLOUDFLARE_PURGE_PLAN` if the account isn't on Free). To pass them through, copy the `compose.yaml`, `bin\u002Fdevops\u002Fk8s.sh` and `helm\u002Fcwa` changes from the same commit. ([37afcb1](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F37afcb10d2e4594c3e36b6f462ab76e3569fdacb))\n\n### Fixed\n- Cloudflare edge purges are no longer lost to Cloudflare's per-account purge rate limit (Free: 5 a minute, burst 25), which left pages stale at the edge for up to a year after a short editing session. The Cloudflare Souin patch now queues purges, deduplicates tags, sends up to 100 per request at the plan's rate, retries a `429` after `Retry-After` (and 5xx or network errors), and turns a backlog too big to send within a minute into one purge everything. Optional settings: `CLOUDFLARE_PURGE_PLAN` (`free` default, `pro`, `business`, `enterprise`), or `CLOUDFLARE_PURGE_REQUESTS` per `CLOUDFLARE_PURGE_WINDOW` and `CLOUDFLARE_PURGE_BURST`; set a lower rate when staging and production, or several sites, share a Cloudflare account. Only used with `provider cloudflare`. ([37afcb1](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F37afcb10d2e4594c3e36b6f462ab76e3569fdacb), [#115](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F115))\n",{"part":885,"tag":1379,"name":1379,"publishedAt":1380,"url":1381,"body":1382},"v2.0.0-alpha.7","2026-10-06T17:15:57Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.7","Since [v2.0.0-alpha.6](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.6).\n\n### Changed\n- `@cwa\u002Fnuxt` 2.0.0-alpha.7: page-data pages no longer show the previous page's dynamic component to visitors after client-side navigation, and pick up live changes to it (cwa-nuxt-module#368). ([e746bd9](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe746bd989ba2da1573300e76bbab8e250d30d836))\n\n### Fixed\n- A full flush (\"Purge all cached data\", `purge-http-cache`, fixture loads, and deploys with `provider cloudflare`) no longer closes the Badger or Nuts store, which left nothing cached until php restarted (`BADGER-INSERTION-ERROR`). A fourth Souin patch makes the flush clear the surrogate keys instead of shutting the storage down; `bin\u002Ftest\u002Fsouin-flush-storage.sh` checks otter, badger and nuts in CI. Otter, the default, was never affected. ([8ebf5e9](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8ebf5e994687014d0496da33a209eafd2137cd93), [#114](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F114))\n",{"part":901,"tag":1379,"name":1379,"publishedAt":1384,"url":1385,"body":1386},"2026-10-06T11:52:29Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.7","- Visitors no longer see the previous page's dynamic component after client navigation between page-data pages, get live page-data component changes, and keep a dynamic position when its component is deleted: a dynamic position is recognised by `_metadata.isDynamicPosition`, since `pageDataProperty` is only sent to admins ([#368](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F368), [60c9635c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F60c9635c))\n",{"part":885,"tag":1388,"name":1388,"publishedAt":1389,"url":1390,"body":1391},"v2.0.0-alpha.6","2026-10-06T11:03:46Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.6","Since [v2.0.0-alpha.5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.5).\n\n### Upgrade notes\n- In `app\u002Fnuxt.config.ts`, write the PWA `cacheWillUpdate` as a single expression: `async ({ response }) => \u002Fno-store|private\u002F.test(response.headers.get('cache-control') || '') || response.status !== 200 ? null : response`. Workbox joins the function onto one line in `sw.js`, and from Nuxt 4.6.0 (which the next `@cwa\u002Fnuxt` requires) its source keeps no semicolons, so the old multi-statement version fails the build with \"Unable to write the service worker file … Missing semicolon\". Works on Nuxt 4.5 too. ([eac5e7b](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Feac5e7bee474f04347a180e642163f7057e71949))\n\n### Changed\n- `@cwa\u002Fnuxt` 2.0.0-alpha.6 and Nuxt 4.6.0 (the module now requires it). Apply the `cacheWillUpdate` upgrade note above in the same change, or the build fails writing `sw.js`. ([125661d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F125661d07cd8c160e77fd5878e7854854ff39aa7))\n\n### Added\n- CI's unit-tests job runs `bin\u002Ftest\u002Fcaddy-validate.sh`: `frankenphp validate` on the image's Caddyfile for helm's `SERVER_NAME=:80` and compose's multi-port one. `adapt` only parses, so errors raised while modules load (a second unnamed Mercure hub, #113; a `#` inside the cache CEL expression) passed CI and only showed when php didn't start. ([843082a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F843082a54c663a44bc6267314f491647ec94275e), [f3912b0](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff3912b07f766bacf190e3ec57e81a4d0eb9d93d8))\n",{"part":901,"tag":1388,"name":1388,"publishedAt":1393,"url":1394,"body":1395},"2026-10-06T10:40:42Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.6","- **Breaking:** the minimum Nuxt version is 4.6.0, the first release that keeps layer pages reached through a symlink out of prefetch itself, so the module's workaround for it is removed ([#361](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F361), [6bb0743a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F6bb0743a))\n- **Security:** requires `vue` ^3.5.43, which fixes GHSA-g2v6-rqmx-r4w6 in `@vue\u002Fserver-renderer` ([675cf507](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F675cf507))\n- In development with Vue 3.5.42 or later, selecting a newly added component whose element renders after it mounts outlines that component, not the next one in the group ([532ebbed](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F532ebbed))\n- On Nuxt 4.6, a page that throws while rendering a route the API serves is no longer sent as a cacheable 500: an error render is recognised by Nuxt's `ssrContext.error`, which also covers Nuxt 5's inline error rendering ([#340](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F340), [11f72946](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F11f72946))\n",{"part":885,"tag":1397,"name":1397,"publishedAt":1398,"url":1399,"body":1400},"v2.0.0-alpha.5","2026-10-05T19:31:16Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.5","Since [v2.0.0-alpha.4](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.4).\n\n### Upgrade notes\n- **Add `name cwa` to the Caddyfile's `mercure` block** (or copy the template's). Without it, php doesn't start in the compose stack on an image with Mercure 1.0.3 or later. ([51ea465](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F51ea465fc34749c1ceabfcf754705cbf4f4b220e), [#113](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F113))\n\n### Fixed\n- php starts again in the compose stack (local dev and `compose.prod.yaml`) on Mercure 1.0.3+: the hub is named, so the `localhost`\u002F`php.local:80`\u002F`php.local:443` servers share one hub instead of being refused as two unnamed hubs. Helm deploys weren't affected. ([51ea465](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F51ea465fc34749c1ceabfcf754705cbf4f4b220e), [#113](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F113))\n",{"part":885,"tag":1402,"name":1402,"publishedAt":1403,"url":1404,"body":1405},"v2.0.0-alpha.4","2026-10-05T18:08:49Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.4","Since [v2.0.0-alpha.3](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.3).\n\n### Upgrade notes\n- **Rebuild the API image** before deploying this Caddyfile: it uses two new Caddy modules (`query_allowlist`, `rate_limit`), and an old image refuses it. Locally: `docker compose build php && docker compose up -d php`. No new variable is required. If your pages read a query parameter other than `page`, `search`, `order[...]` or `cwa_force`, add it to `CACHE_QUERY_ALLOWLIST`, or SSR stops seeing it. Behind a proxy with public addresses other than Cloudflare (e.g. a Google load balancer), add its ranges to `CADDY_TRUSTED_PROXIES`. ([4cbe05a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F4cbe05a949518be7da67995f6d247807e7a39b7f), [#106](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F106))\n- **GitHub projects:** variables you had added by hand to a workflow's `env:` can stay, but are no longer needed. Any repository variable now reaches `k8s.sh`, so check none holds a stale value you were relying on GitHub to ignore. ([8f290d8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8f290d85d234a60da74b0eec6be8294764b7e842), [#91](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F91))\n- The API's liveness probe now checks php over HTTP instead of TCP, so a pod whose php stops answering is restarted after about a minute. That includes a database outage. Rebuild the API image to pick up the patched Souin, and recreate the API pod. ([9b7bca6](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F9b7bca608d019231a9458ea2406a3a4e4d881208), [#104](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F104))\n- **Mercure 1.0 (protocol change):** the API image builds Mercure 1.0, and the template now speaks its protocol: OAuth 2.0 access tokens, `match=` subscriptions, the `__Secure-mercure_access_token` cookie. **Deploy the bundle (2.0.0-alpha.8) and module updates in this release together with the rebuilt API image**: an older module subscribes with `topic=`, which the hub rejects. Copy `api\u002Fconfig\u002Fpackages\u002Fmercure.yaml` (`protocol_version: '1.0'`, the `iss`\u002F`sub`\u002F`client_id` claims) and the Caddyfile's `mercure` block (an `issuer` block, `resource_identifier` pinned to `MERCURE_PUBLIC_URL`). Mercure 1.0 also rejects unknown directives and removed `demo` and `ui`: if `MERCURE_EXTRA_DIRECTIVES` sets either, use `debugger` (dev only). Anything of your own that read the `mercureAuthorization` cookie must change. An image built before this release can't load the Caddyfile. ([28fa2bb](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F28fa2bb2b989fcdff007d84676931ed68e3a922e), [1a9f7a5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1a9f7a5ea2a43f6d314f9c00f18137a241be3567), [#67](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F67), [api-components-bundle#377](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F377))\n- The API uses API Platform's default request handling (`MainController` and the provider\u002Fprocessor chain) instead of Symfony event listeners: `use_symfony_listeners: true` is gone from `api_platform.yaml`. A site with its own code on `EventPriorities` or `kernel.view`\u002F`kernel.request` for API resources must move it to a state provider or processor decorator, or set the flag back. ([fc0afb7](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ffc0afb71bc7274db9cc6e3dd4ff51dbb64874650))\n- **Behat is gone.** API tests are PHPUnit functional tests on API Platform's `ApiTestCase` (`api\u002Ftests\u002FFunctional`, base class `FunctionalTestCase`, which rebuilds the schema per test and refuses a database whose name lacks `test`). CI's `behat tests` job is now `functional tests` (`run_test_functional`; GitHub: `functional-tests`), and `production`\u002F`canary` need it instead. A project with its own Behat features ports them to `tests\u002FFunctional`, or keeps Behat and its `behat.yml`, `features\u002F` and `run_test_behat` itself. ([8885b3c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8885b3c01adafbe6e37263553d84ae9cd572b714))\n- **Cloudflare API rule (only if you added the optional one):** add `and not starts_with(http.request.uri.path, \"\u002F_api\u002F_\u002Fcomponent_positions\u002F\")` and purge everything once. Page-data positions vary by the `path` request header, which Cloudflare ignores, so page-data pages (e.g. blog articles) showed one page's content after client-side navigation. ([39c5f4a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F39c5f4a97d71e2e1edbdb7b5cb38440a4b247ddc), [docs#134](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fdocs\u002Fissues\u002F134))\n\n### Changed\n- With `provider cloudflare`, a full flush (\"Purge all cached data\", `purge-http-cache`, every fixture load) also purges everything at Cloudflare, and deploys flush instead of purging only rendered HTML, so edge-cached `\u002F_api` responses can't outlive a release. No more manual Purge Everything. Rebuild the API image (the Souin Cloudflare patch changed). ([6a8c898](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F6a8c8984b1408d48fced26655ad32b83afcbaeac))\n- The `api`, `app`, `helm` and load-test READMEs are current: working docs links (cwa.rocks), the Nuxt 4 and pnpm workflow, and load testing since the query allowlist and rate limit. ([3d38d3a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3d38d3a8638b34d3365e2534e2c8feac4a44edf7), [#112](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F112))\n- Caddy's access log records the visitor's resolved address as `visitor_ip` (behind Cloudflare, `client_ip` is Cloudflare's). The helm chart now requires `mercure.publicUrl` instead of falling back to an `http` URL that Mercure 1.0's `__Secure-` cookie refuses. ([b3b8622](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fb3b8622d3fc1375da564668aab3dea9053e1807f), [#110](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F110), [#111](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F111))\n- `@cwa\u002Fnuxt` `2.0.0-alpha.4` (Mercure 1.0 `match=` subscriptions, the `cwa_force` loop fix, stranded component group and orphaned file admin tools; needs Nuxt `>=4.5.2`), and every PHP and front-end dependency at its latest release, except TypeScript (still `6.0.3`: `vue-tsc` can't run on TypeScript 7) and `justinrainbow\u002Fjson-schema` (5.x, held by `behatch\u002Fcontexts` until Behat was removed; now 6.x). ([109c3e7](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F109c3e7a611fba4da26e34d293d5f2098ce34958))\n- Bundle `2.0.0-alpha.8`: Mercure 1.0 only, a liveness endpoint (`\u002F_\u002Fhealth\u002Flive`), an orphaned file report (new table; the migration is included), file clean-up when uploadable entities are removed. The bundle now works with `use_symfony_listeners` on or off. ([1a9f7a5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1a9f7a5ea2a43f6d314f9c00f18137a241be3567))\n- pnpm 12.9.1 (drops the v11-only `confirmModulesPurge` setting, which pnpm 12 refuses) and PHPUnit 13.4.1. ([e919d06](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe919d069d24b7e74f59395d49772b394a70b036d))\n- `@cwa\u002Fnuxt` `2.0.0-alpha.5`: navigating between page-data pages no longer shows the previous page's content under the new title and then a blank body ([cwa-nuxt-module#368](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F368)); live page-data updates show on other open pages straight away. ([f67cb96](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Ff67cb9621f76665ae4c960f9743a91ec4f9de89e))\n\n### Added\n- Origin protection: pages drop query parameters they don't use before the cache (so `\u002F?x=1` is a cache hit), a per-visitor rate limit on cache misses that understands Cloudflare, and FrankenPHP sheds load with a fast 503 instead of queueing into a 504. All on by default, each tunable or off by an optional variable. `compose.prod.yaml` sets `CADDY_EDGE=true`, so a client facing Caddy directly can't dodge the limit with invented `X-Forwarded-For` headers. ([4cbe05a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F4cbe05a949518be7da67995f6d247807e7a39b7f), [d0021ba](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd0021ba64992a631fa7afa3c815754bb00f5d71e), [#106](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F106))\n\n### Fixed\n- The API image builds again: FrankenPHP 1.13.0 requires Mercure 1.0.3, so the Mercure 0.24.2 pin is gone. ([28fa2bb](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F28fa2bb2b989fcdff007d84676931ed68e3a922e), [#67](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F67))\n- Souin's Cloudflare purge now works (it called the wrong endpoint and failed silently), accepts a scoped Cache Purge token, and logs failures; responses carry `Cache-Tag` so Cloudflare can purge by tag. Only matters with `provider cloudflare` in `CADDY_CACHE_CDN_CONFIG`; rebuild the php image. ([cd99b55](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fcd99b5541becc7e9b5539c29e2bb929769e97842), [#108](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F108))\n- GitHub deploys now receive every repository and environment variable, as GitLab does, so `INGRESS_ENABLED`, `CLUSTER_ISSUER` and the sizing, Caddy and mail variables take effect. Branch names no longer reach CI scripts unquoted. ([8f290d8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8f290d85d234a60da74b0eec6be8294764b7e842), [#91](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F91))\n- A large file in Nuxt's `public\u002F` (e.g. a PDF brochure) no longer runs the API container out of memory when someone downloads it. Only pages and the sitemap go through the page cache now, and PDFs under `\u002F_api` are really excluded. ([7f84445](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F7f84445927f3ff128cc5f2928a22f2a9d9cdd18e), [#105](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F105))\n- One stalled request no longer leaves the API pod unready for good. Souin is patched (darkweak\u002Fsouin#850) so a timed-out call releases its cache key, and the kubelet's probes skip the cache. ([9b7bca6](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F9b7bca608d019231a9458ea2406a3a4e4d881208), [#104](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F104))\n\n### Security\n- Pages no longer keep `cwa_force` in the default `CACHE_QUERY_ALLOWLIST`: an anonymous `?cwa_force=\u003Canything but true>` sent the server render into an infinite redirect loop, pinning an SSR pod until its liveness probe restarted it ([cwa-nuxt-module#366](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F366); the module fix is in its next release). A site that set `CACHE_QUERY_ALLOWLIST` itself should remove `cwa_force` from it. ([3f7130f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F3f7130f73ee2cdfab4579a26aefe2e4fd9dc0465))\n- `api\u002F.env`'s `TRUSTED_PROXIES` default trusted `172.0.0.0\u002F8`, which includes public addresses; it's now the private `172.16.0.0\u002F12`. No deployment used the default (compose and the chart set their own). Copy the fix to any project-specific `.env.local`. ([b5aa360](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fb5aa360393fe77f0d2dbfd3ca33fa44bf7fe069b), [#107](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F107))\n",{"part":901,"tag":1397,"name":1397,"publishedAt":1407,"url":1408,"body":1409},"2026-10-05T15:17:43Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.5","- A live page-data update that swaps a dynamic component now shows on other open pages straight away, instead of after the next navigation ([3938a1f3](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F3938a1f3))\n- On a nested URL, adding a component to a dynamic position on a shallower page-data page writes it to that page's page data, not the routed child's, and its tab lists that page's properties ([bf37fd73](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fbf37fd73))\n- A template page shared at two depths now renders each depth's own dynamic components; the console warning says what is left: a shallower depth shows a change to which component its page data holds after the next navigation ([05f4611e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F05f4611e))\n- Navigating between page-data pages no longer shows the previous page's dynamic component under the new title and then a blank body: a dynamic position renders the component the displayed page's manifest resolved for it until it is re-fetched for that path ([#368](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F368), [1e76b367](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F1e76b367))\n- The build warns, naming the file and the reason, when a `\u003CCwaComponentGroup>` (a bound reference at an unrecognised location, a `v-bind` object) or an unreadable file switches stranded component group warnings off for the whole site ([#367](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F367), [ceee52b2](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fceee52b2))\n",{"part":901,"tag":1402,"name":1402,"publishedAt":1411,"url":1412,"body":1413},"2026-10-04T17:19:39Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.4","- **Security:** `?cwa_force=` with any value other than `true` no longer sends the server render into an endless redirect that pinned an SSR process; the parameter is removed whatever its value ([#366](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F366), [038e1364](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F038e1364))\n- **Breaking:** live updates subscribe with the Mercure 1.0 protocol (`match=*`, and `last_event_id` on reconnect), so the API's hub must be Mercure 1.0 (api-components-bundle 2.0.0-alpha.8); a 0.x hub rejects the subscription ([#364](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F364), [61dd29f8](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F61dd29f8))\n- A `\u003CCwaComponentGroup>` whose location is page data (or any type that cannot own a group) is no longer created or attached, and the admin console warns to pass the page IRI instead: such a group was invisible to visitors, listed as orphaned, and was PATCHed with an `undefined` property on every admin load ([#363](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F363), [0a02879d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F0a02879d))\n- A warning in the admin header counts stranded component groups: groups attached to the page, its layout or a component on it whose reference no `\u003CCwaComponentGroup>` in the app's templates declares, such as the old group left behind when a reference is renamed or a legacy group located at a draft IRI; the declarations are read from the app's Vue files at build time. Its modal lists their components and merges each one to the end of a shown group or deletes it ([#360](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F360), [94481372](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F94481372), [fee09284](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Ffee09284))\n- `\u002F_cwa\u002Forphaned` also reports stored files: orphaned files nothing references, which can be deleted after a confirmation, unknown files the API cannot prove it wrote, which are only listed, and missing files, whose resource can be viewed; site settings scans files separately and counts both reports in its notice. Needs an api-components-bundle release containing #371 ([#362](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F362), [60a0d792](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F60a0d792), [0d76809e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F0d76809e))\n- The module declares its real minimum Nuxt version, `>=4.5.2`, so Nuxt warns an app on an older version instead of failing later ([e0ef82ed](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fe0ef82ed))\n- View on a never-published orphaned component shows its content instead of a 404 ([#359](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F359), [292f7885](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F292f7885))\n- Every `\u002F_cwa` admin page is guarded by the `cwa-admin` middleware: a signed-in non-admin goes home, and a signed-out visitor goes to login from the browser, since with a cross-origin API the server cannot see the session ([dd4f8a6d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fdd4f8a6d), [5be5b635](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F5be5b635))\n",{"part":907,"tag":1415,"name":1415,"publishedAt":1416,"url":1417,"body":1418},"2.0.0-alpha.8","2026-10-04T14:37:05Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.8","### Breaking\n- `api_platform.use_symfony_listeners` is no longer forced on: the bundle follows API Platform's default (off). An application that needs API Platform's listeners must enable it itself; the bundle works either way ([#369](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F369))\n- The bundle's API behaviour runs in state provider and processor decorators instead of `EventPriorities` listeners. Removed: `DenyAccessListener`, `ComponentUsageEventListener`, `RouteEventListener`, `DeletedResourceEventListener`, `UploadableEventListener` and the listeners' request\u002Fview methods ([#369](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F369))\n- Renamed: `EventListener\\Api\\UserEventListener` → `Helper\\User\\UserWriteNotifier` (`postWrite()` → `notify()`, id `silverback.api_components.helper.user.write_notifier`); `EventListener\\Api\\CollectionApiEventListener` → `Helper\\Collection\\CollectionPopulator` (`transform()` → `populate()`, id `silverback.api_components.helper.collection.populator`); the draft merge moved from `PublishableEventListener` to `Helper\\Publishable\\PublishableDraftMerger` (id `silverback.api_components.helper.publishable.draft_merger`) ([#369](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F369))\n- Upload and download operations no longer use custom controllers; `UploadStateProvider`\u002F`DownloadStateProvider` run them from the read chain ([#369](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F369))\n- Mercure 1.0 protocol only: subscribe grants are URL Patterns in `authorization_details` (`…\u002F:id\\?`, and `…\u002F:id\\?draft=1` for draft access) and the cookie is `__Secure-mercure_access_token`; `symfony\u002Fmercure` ^0.8 and `symfony\u002Fmercure-bundle` ^0.5 are required. Upgrade steps: set `protocol_version: '1.0'` and `jwt.claims` `iss`\u002F`sub`\u002F`client_id` on the hub in `mercure.yaml`; in the Caddyfile, move the keys into an `issuer \u003Ciss> { publisher { jwt … } subscriber { jwt … } }` block matching `iss`, pin `resource_identifier` to the public hub URL (the tokens' `aud`; publishing through the internal URL is 401 otherwise) and drop `protocol_version_compatibility`; on a plain-HTTP hub URL set a prefix-less `cookie_name` on both sides ([#379](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F379))\n\n### Added\n- `GET \u002F_\u002Fhealth\u002Flive` (`api_components_health_live`): an anonymous, `private, no-store` liveness check that touches no database, cache or remote service, so it stays 200 through a database outage; use it for the liveness probe and `\u002F_\u002Fhealth` for readiness ([#375](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F375))\n- Orphaned file report (admin): `POST \u002F_\u002Forphaned_files\u002Fscan`, `GET \u002F_\u002Forphaned_files` and `silverback:api-components:scan-orphaned-files` report stored files under the uploadable fields' filesystems and prefixes that no row references (older than `orphaned_files.minimum_age`, default one hour; imagine cache and `orphaned_files.excluded_paths` excluded) as orphaned when the bundle named them or has file info for them and as unknown otherwise, and rows whose file is missing; `POST \u002F_\u002Forphaned_files\u002Fdelete` deletes selected orphaned paths or all of them, re-checked against a fresh scan, and never an unknown file. Upgrade step: the report is stored in a new table, `_acb_orphaned_file_report`; generate and run a migration ([#373](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F373))\n\n### Fixed\n- Stored files, their imagine variants and `_acb_file_info` rows are deleted whenever Doctrine removes an uploadable entity (group, page and orphan cascades, `POST \u002F_\u002Forphaned_resources\u002Fdelete`, direct removal), only after the flush succeeds, and never while another row still references the path; a failed file delete is logged, not a 500 ([#372](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F372))\n- `GET \u002Fme` and `GET \u002F…\u002F{id}\u002Fusage` work with `use_symfony_listeners: false`: `\u002Fme` keeps the controller of the `Get` it is built from and `UserStateProvider` resolves the token user itself, and the usage operation is named after its key ([#369](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F369))\n\n### Tooling\n- `API_PLATFORM_USE_SYMFONY_LISTENERS=0|1` sets the flag in the Behat test app, with a cache directory per value, and CI runs one Behat leg with it on ([#369](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F369))\n- `simple-phpunit` runs PHPUnit 13.4 ([#378](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F378))\n",{"part":885,"tag":1420,"name":1421,"publishedAt":1422,"url":1423,"body":1424},"v2.0.0-alpha.3","2.0.0-alpha.3","2026-09-26T10:50:08Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.3","Since [v2.0.0-alpha.2](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.2).\n\n### Upgrade notes\n- A deploy with `JWT_SECRET_KEY` set but no `JWT_PASSPHRASE` now fails with a clear message, instead of getting a random passphrase that can't decrypt the key. ([85d3f43](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F85d3f43e2ec75af0b19b9a18a56010c6dd16eaa8))\n- **Run the new migration** for bundle 2.0.0-alpha.6's orphaned-resource report table, and update `@cwa\u002Fnuxt` to 2.0.0-alpha.3 at the same time. `clean-orphaned` no longer deletes anything. ([8bab085](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8bab085d597f165d950772faa878160146520525))\n\n### Changed\n- `generate_jwt_keys` derives `JWT_PUBLIC_KEY` from the secret key when it's empty. ([85d3f43](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F85d3f43e2ec75af0b19b9a18a56010c6dd16eaa8))\n- `api-components-bundle` 2.0.0-alpha.6 and `@cwa\u002Fnuxt` 2.0.0-alpha.3: an orphaned-resources admin page with bulk delete, and a scan that can email admins when the result changes. ([8bab085](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F8bab085d597f165d950772faa878160146520525))\n\n### Added\n- A daily 03:00 orphaned-resource scan on production that emails `MAILER_EMAIL` when orphans change. ([c31d28f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fc31d28f929bd78ee5670a72c511aeb42e2415eb3), [#101](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F101))\n\n### Fixed\n- The orphan scan's email reaches a `MAILER_EMAIL` in the `Name \u003Caddress>` form (bundle 2.0.0-alpha.7). ([6bf6b7c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F6bf6b7c2cfd1a657b8d64ac00bfd1d325d326029))\n- The orphan-scan CronJob no longer receives `RESET_DATABASE`, which would have dropped the schema nightly. ([70b9802](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F70b9802d879f29e3e6fd3121e893a328ec85bf2e), [#103](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F103))\n- An empty `MAILER_EMAIL` no longer crashes the orphan scan. ([70b9802](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F70b9802d879f29e3e6fd3121e893a328ec85bf2e))\n- A deploy without `MAILER_DSN` no longer fails the helm render, and GitHub deploys pass the mail and orphan-scan variables. ([70b9802](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F70b9802d879f29e3e6fd3121e893a328ec85bf2e), [#102](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F102))\n\n### Security\n- `TRUSTED_HOSTS` defaults anchor every alternative, so no default trusts an attacker's hostname. Projects should check their own `TRUSTED_HOSTS` CI variable the same way. ([b43fd09](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fb43fd0925b7f130d1362562ec8d0001285c05644), [#97](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F97))\n\nBuilt against `api-components-bundle` 2.0.0-alpha.7 and `@cwa\u002Fnuxt` 2.0.0-alpha.3. `create-cwa@2.0.0-alpha.3` installs this release.\n",{"part":907,"tag":1426,"name":1426,"publishedAt":1427,"url":1428,"body":1429},"2.0.0-alpha.7","2026-09-26T10:34:22Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.7","### Fixed\n- `scan-orphaned` (and `clean-orphaned`) no longer fails with a `TypeError` when the notification recipients resolve to null, e.g. from an empty `%env(default::MAILER_EMAIL)%`: null or empty recipients mean no email ([#366](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F366))\n- `orphaned_resources.notify.recipients` accepts `Name \u003Caddress>` as well as a bare address, in a list or a comma-separated string (quote a name containing a comma), so the template's default `MAILER_EMAIL` no longer silently stops the orphan alert ([#363](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F363))\n\n### Tooling\n- The Behat suite runs as concurrent shards (`bin\u002Fbehat-parallel`) with coverage merged into one report, and the test app hashes passwords at bcrypt cost 4: about 9x faster locally ([#360](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F360))\n- Infection on a pull request mutates only the lines it changes in `src\u002F`, gated at 80; `main` still runs the full set and is the only run that sends the Stryker badge score ([#362](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F362))\n",{"part":907,"tag":1431,"name":1431,"publishedAt":1432,"url":1433,"body":1434},"2.0.0-alpha.6","2026-09-26T07:58:58Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.6","### Breaking\n- Upgrade step: the orphaned resource report is now stored in a new table, `_acb_orphaned_resource_report`. Generate and run a migration (`doctrine:migrations:diff`). Reports previously held in `cache.app` are not migrated; `GET \u002F_\u002Forphaned_resources` is 404 until the next scan ([#354](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F354))\n- `silverback:api-components:clean-orphaned` no longer deletes anything: it is now an alias of `scan-orphaned`, which only scans. Delete orphans through the API (`DELETE` per IRI, or `POST \u002F_\u002Forphaned_resources\u002Fdelete`) ([#353](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F353))\n\n### Added\n- `silverback:api-components:scan-orphaned` emails `silverback_api_components.orphaned_resources.notify.recipients` when the orphaned resources differ from the last alert, with the counts, what is new since then and a link to the admin page (`notify.admin_page_path`, default `\u002F_cwa\u002Forphaned`, on `user.email_links.default_origin`). `--no-notify` skips it; the HTTP scan never emails ([#354](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F354))\n- `POST \u002F_\u002Forphaned_resources\u002Fdelete` (admin) deletes selected orphans (`iris`) or all of them (`all: true`), re-checked against a fresh scan, and returns what was deleted and what was rejected ([#353](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F353))\n- Fixture builder: `PageBuilder::withoutRoute()` keeps a non-template page without a route; `generate-fixtures --namespace` sets the generated class's namespace ([#347](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F347))\n\n### Changed\n- The orphaned resource report is stored in the database instead of `cache.app`, so it is shared between pods and survives deploys, and its `generatedAt` has microsecond precision ([#354](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F354))\n- `silverback:api-components:scan-orphaned` (alias `clean-orphaned`) runs the same scan as `POST \u002F_\u002Forphaned_resources\u002Fscan` synchronously, stores the report `GET \u002F_\u002Forphaned_resources` returns, and prints the counts per kind (IRIs with `-v`) ([#353](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F353))\n\n### Fixed\n- The orphan scan reports what is orphaned only through an orphaned parent: the positions in an orphaned group, the components only those positions hold, the groups those components own, to any depth, and cycles nothing live reaches. A resource still reached from a live page, layout, component or page data is not listed, and `POST \u002F_\u002Forphaned_resources\u002Fdelete` accepts the newly listed IRIs ([#358](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F358))\n- An admin's `POST \u002F_\u002Forphaned_resources\u002Fscan`, or the refresh after `POST \u002F_\u002Forphaned_resources\u002Fdelete`, no longer absorbs an orphan change: `scan-orphaned` compares with the orphans at the last alert, kept in the same table, instead of with the last stored report. A failed send is retried on the next run ([#356](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F356))\n- A delete leaves nothing for the next orphan scan: a component removed by a cascade takes the groups it owns and its unused draft with it. An explicit `DELETE` of a published component still keeps its draft ([#353](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F353))\n- A fixture `redirect()` whose `name:` belongs to a route created in the same load throws even when its path already exists, instead of re-pointing that name at the existing route ([#352](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F352))\n- A component held by a page data property typed as a parent class (such as `AbstractComponent`) counts as used, so `clean-orphaned` no longer deletes it; it is public only when the page data is on a live route, and editing it purges and publishes the page data ([#349](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F349))\n- The new email address and change password forms and `\u002Fverify-email` look the user up through `UserRepositoryInterface::loadUserByIdentifier()` instead of the undeclared `find()`\u002F`findOneBy()` ([#346](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F346))\n- A failed user email send returns 503 (or is logged after a write) whether or not a logger is configured, instead of a 500 ([#346](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F346))\n- `generate-fixtures` names the class after the `--output` file instead of always `GeneratedScaffold` ([#347](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F347))\n- `generate-fixtures` emits `withoutRoute()` for a non-template page with no route, so it no longer gains a route on reload ([#347](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F347))\n- A fixture `redirect()` whose derived route name is taken gets a suffixed name instead of failing on the unique constraint ([#347](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F347))\n- Two scaffold classes in one `doctrine:fixtures:load` no longer fail on detached entities: each scaffold starts a new builder load and `getRoute()` finds existing routes by name ([#347](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F347))\n",{"part":901,"tag":1420,"name":1420,"publishedAt":1436,"url":1437,"body":1438},"2026-09-26T07:22:51Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.3","- Times from the API with more than millisecond precision, such as the orphan report's `generatedAt`, display correctly in every browser ([d1695b8d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fd1695b8d))\n- Orphaned resources are deleted in one request to `POST \u002F_\u002Forphaned_resources\u002Fdelete`, which checks each one again first; the page re-reads the report afterwards and lists what was deleted, including cascaded items, and what was kept and why. Needs an api-components-bundle release containing #353 ([#358](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F358), [519ef3e5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F519ef3e5))\n- Review orphaned component groups, positions and components at `\u002F_cwa\u002Forphaned`, view and delete them, and scan from site settings, which says when a scan has found orphans ([api-components-bundle#190](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fissues\u002F190), [dca1fb13](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fdca1fb13))\n- An `undefined` or non-string `allowedComponents` entry warns and syncs nothing instead of throwing ([#354](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F354), [825cf38c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F825cf38c))\n- `useResendVerifyEmail` resets `success` when a new request starts, so a throttled or failed resend no longer shows alongside the earlier success; Back to Login after a password reset no longer sends a second reset request ([#355](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F355), [28901c51](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F28901c51))\n- An email the API refuses to send (400) asks the visitor to contact the site administrator, and warns in the console about `user.email_links.allowed_origins` ([#356](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F356), [28901c51](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F28901c51))\n",{"part":885,"tag":1440,"name":1441,"publishedAt":1442,"url":1443,"body":1444},"v2.0.0-alpha.2","2.0.0-alpha.2","2026-09-25T22:21:40Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.2","Since [v2.0.0-alpha.1](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.1).\n\n### Upgrade notes\n- Bundle alpha.5: throttled email requests now return 429, and an application with its own `RouteGeneratorInterface` must add `generatePath()`. ([867c412](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F867c4128d66553744a1fb6c6269e1b1a4452a667))\n- **Staging no longer has a fixture job** (it shares production's database). `FIXTURES_PURGE` empties the database before a fixture load: `\"true\"` on review apps, `\"force\"` for production. ([!11](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F11))\n- **Rename `NUXT_PUBLIC_CWA_API_URL` to `NUXT_CWA_API_URL`** in the same deploy as the module update. The old name still works, but it publishes the internal URL and logs a deprecation warning. ([66e9365](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F66e93658cb394b52e39e5664e54153a21c74e99d))\n- **Configure `user.email_links.default_origin`.** Without it, bundle alpha.4 refuses password-reset and verification emails with a 400. ([e23956d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe23956dceafbbb7caaa2a9875be25e3325985742))\n- `compose.prod.yaml` now needs every secret set. ([1456c7c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1456c7cd1002d3da18f8b7191b69983c819c65fc))\n\n### Changed\n- `api-components-bundle` 2.0.0-alpha.5 and `@cwa\u002Fnuxt` 2.0.0-alpha.2: fixture loads with `--append` are idempotent, and drafts can be scheduled to publish. ([867c412](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F867c4128d66553744a1fb6c6269e1b1a4452a667))\n- Every fixture load ends by flushing the whole HTTP cache, so reloaded content isn't served stale. ([!11](https:\u002F\u002Fgitlab.com\u002Fsilverback-web-apps\u002Fcwa\u002Fcomponents-web-app\u002F-\u002Fmerge_requests\u002F11))\n- `CLAUDE.md` trimmed from 1,992 to 351 lines of current guidance. ([d13dbe1](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fd13dbe1aa2df04b0b004ce8c9cd3a4e56e08b296))\n- Depend on `@cwa\u002Fnuxt` `^2.0.0-alpha.1`, its first tagged release, instead of an edge build. ([b3602d5](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fb3602d5455581f47b62c280bb82f96d0f87577eb))\n- `@cwa\u002Fnuxt` edge `5cc17ad`: readiness route, purgeable sitemap, private server API URL, first-run and API-down error pages. ([66e9365](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F66e93658cb394b52e39e5664e54153a21c74e99d))\n- `api-components-bundle` 2.0.0-alpha.4: uncached `\u002F_api\u002F_\u002Fhealth`, a failed purge no longer fails a saved write, and email links use a configured origin. ([e23956d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fe23956dceafbbb7caaa2a9875be25e3325985742))\n- `create-cwa` downloads the template tag matching its own version, with `--ref` to choose another. ([c3a0984](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fc3a09842bbbc3f524bb7fefabdabf734c34120d7))\n- A branch without a review namespace shows orange (passed with warnings), not red. ([5b6a953](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5b6a953ee17221d8612648d4594f2b7f40608155))\n\n### Added\n- `CHANGELOG.md`, kept from now on and used as each release's notes. ([7d04051](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F7d040513a14cbaaae5c167ff41a2cb8789db3ffc))\n- Dev JWT keys are generated on first boot. ([1456c7c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F1456c7cd1002d3da18f8b7191b69983c819c65fc))\n- `.gitguardian.yaml` for the required-secret placeholders in `compose.prod.yaml`. ([64f8d58](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F64f8d58d36703aed3b3433c969002ebaf1576c9f))\n- Release process documented in `CLAUDE.md`. ([5fc5e64](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F5fc5e64fb843db67ee9c810c38fba189e69d558d))\n\n### Fixed\n- CORS exposes `Retry-After`, so a cross-origin site can count down a throttled email request. ([ba0ea40](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fba0ea409338e653e25b44afcfb545e0006809014), [#100](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F100))\n- `compose.prod.yaml` gives the app service its API URL and warm origin. ([ba0ea40](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fba0ea409338e653e25b44afcfb545e0006809014), [#98](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F98))\n- Review fixtures, warm, audit and stop jobs stop with a reason when the review job didn't deploy. ([ba0ea40](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fba0ea409338e653e25b44afcfb545e0006809014), [#99](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fissues\u002F99))\n\n### Security\n- Local JWT keys, secrets and uploads are kept out of the API image. ([176fa9d](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F176fa9d708e892f75acc367a05997f2c00a8633a))\n- Caddy's admin API listens only on the php container's loopback, and port 2019 is no longer published. ([0170978](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002F0170978196ef9dd3092a15f761b5edf024c4d174))\n- Removed a hardcoded, unused `COMPOSER_PACKAGIST_TOKEN` from the Behat job. ([cf6591e](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Fcommit\u002Fcf6591e9586df420834bdcab713b65efa4be7889))\n\nBuilt against `api-components-bundle` 2.0.0-alpha.5 and `@cwa\u002Fnuxt` 2.0.0-alpha.2. `create-cwa@2.0.0-alpha.2` installs this release.\n",{"part":907,"tag":1446,"name":1446,"publishedAt":1447,"url":1448,"body":1449},"2.0.0-alpha.5","2026-09-25T22:04:12Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.5","### Breaking\n- `RouteGeneratorInterface` gains `generatePath()`: an application with its own route generator must implement it ([#335](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F335))\n- A throttled password reset, email verification or new email confirmation request returns 429 with `Retry-After`, where it returned 200 ([#332](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F332))\n- Registration and a new email address request whose email link is refused return 201, where they returned 400 for a user that had been saved ([#327](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F327))\n\n### Added\n- Fixture builder: `allow:` on page groups, `liveAt()` on pages and page data, `redirect()` and `afterRoutes()` ([#322](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F322))\n- Orphaned resource report: `POST \u002F_\u002Forphaned_resources\u002Fscan` and `GET \u002F_\u002Forphaned_resources` (admin) list unowned groups, empty positions and unused components ([#329](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F329))\n- `doctrine:fixtures:load --append` with a `CwaFixtureBuilder` scaffold creates only what is missing and prints a created\u002Fkept\u002Fskipped summary; adds `PageDataBuilder::withoutRoute()` and `RouteGeneratorInterface::generatePath()` ([#335](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F335))\n\n### Fixed\n- The current-password check (`UserPasswordValidator`) reloads the user through `UserRepositoryInterface::loadUserByIdentifier()` instead of the undeclared `find()`, so it works with an application's own user repository ([#337](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F337))\n- `generate-fixtures` writes a scaffold that loads and gives back the same site: published state and drafts, uploaded files, component-owned and shared groups, relations, dates, inherited and non-public fields, meta descriptions, scheduled routes and redirects. It lists anything it cannot reproduce ([#322](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F322))\n- An application's `#[ORM\\MappedSuperclass]` between `AbstractComponent` or `AbstractPageData` and its entities no longer breaks queries with a missing table ([#328](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F328))\n- A refused email link no longer leaves a half-done change: a password reset request is a 400 that keeps the existing reset token, and an email after a completed user write (welcome, account enabled, email change and the rest) is logged at error instead of turning the saved write into a 400 ([#327](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F327))\n- A throttled password reset, email verification or new email confirmation request is a 429 with `Retry-After` instead of a 200 that sends nothing. Each flow has its own throttle: new `user.new_email_confirmation.repeat_ttl_seconds` and `user.email_verification.repeat_ttl_seconds` (default 300), with `password_reset.repeat_ttl_seconds` now governing only password resets. The throttle starts only once the email is sent ([#332](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F332))\n- The `UserPassword` constraint no longer fails with an undefined-method error for a signed-in user that is not the bundle's user, such as an in-memory admin ([#334](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F334))\n\n### Tooling\n- `CHANGELOG.md` is kept for every change, and pushing a tag publishes its section as the GitHub release notes ([#320](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F320))\n- PHPStan: all 23 `method.notFound` baseline entries resolved; the baseline is down from 98 findings to 69 ([#334](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Fpull\u002F334))\n",{"part":901,"tag":1440,"name":1440,"publishedAt":1451,"url":1452,"body":1453},"2026-09-25T22:01:35Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.2","- Throttled email requests (429) say when another can be sent; the admin resend link counts down until then ([#353](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F353), [6e0fd593](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F6e0fd593))\n- A failed email send (503) says the email couldn't be sent, rather than implying one is on its way ([#353](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F353), [5467165f](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F5467165f))\n- Cancel a pending email change from the admin user page ([#353](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F353), [6e0fd593](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F6e0fd593), [a5b34725](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fa5b34725))\n- `CwaUiDatePicker`, `CwaUiCalendar` and `CwaUiInputDate`, built on `reka-ui` and ported from Nuxt UI; the Publish tab and a route's go-live date use the picker ([#320](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F320), [b57599bf](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fb57599bf))\n- Schedule a draft to publish at a future time from the Publish tab, or publish it now ([#320](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F320), [f909013a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Ff909013a), [d654ed96](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fd654ed96))\n- Ship type declarations for `ResourceModalTabs.vue`, which were empty in 2.0.0-alpha.1 ([#349](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F349), [314c6708](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F314c6708))\n- `allowedComponents` accepts component names, with an auto-imported `CwaComponentNames` constant and `CwaComponentName` type ([#352](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F352), [93ca8a0a](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F93ca8a0a))\n- Sync `allowedComponents` to groups with no stored list; an empty list is sent as `null` ([#351](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fissues\u002F351), [a995f757](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002Fa995f757))\n",{"part":901,"tag":1455,"name":1455,"publishedAt":1456,"url":1457,"body":1458},"v2.0.0-alpha.1","2026-09-25T15:18:34Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.1","- First tagged release of `@cwa\u002Fnuxt`; releases are now published from `v*` tags ([7c61b7c](https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcwa-nuxt-module\u002Fcommit\u002F7c61b7ce331ec4a0cb8e76951a5de2ff806ed07a))\n",{"part":907,"tag":1460,"name":1460,"publishedAt":1461,"url":1462,"body":1463},"2.0.0-alpha.4","2026-09-24T15:15:42Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.4","**Upgrade step required: configure the origin of links in user emails** (#316). Links in password reset, email verification, new-email confirmation, welcome and account-enabled emails now use the request's `Origin`\u002F`Referer` only when it matches `silverback_api_components.user.email_links.allowed_origins` (anchored regexes), and otherwise `email_links.default_origin`. With neither set, those emails are not sent and the request is a 400:\n\n```yaml\nsilverback_api_components:\n    user:\n        email_links:\n            default_origin: '%env(default::EMAIL_LINK_DEFAULT_ORIGIN)%'\n```\n\nA path from `redirect_path_query` must now be a plain relative path; anything else falls back to the configured redirect path. `RefererUrlResolver::getAbsoluteUrl()` now takes a `RelativeUrlPath`.\n\n**New:** `GET \u002F_\u002Fhealth` (`\u002F_api\u002F_\u002Fhealth` in the template), an uncached readiness check: `200 {\"status\":\"ok\"}` after a dummy query on the default connection, or 503 (#312).\n\n**Fixed:** a failed HTTP cache purge after a write no longer turns the saved write into a 500. It is logged at error level and Mercure still publishes. `silverback:api-components:purge-rendered-html` exits 1 on failure, and both purge endpoints return 502 (#311).\n\n**Pinned:** the exact cache tags a Route write purges under the API route prefix, e.g. `\u002F_api\u002F_\u002Froutes`, identical over HTTP and CLI (#313).\n\nStill an alpha: the bundle and `@cwa\u002Fnuxt` are changing together with the projects that use them.\n\n**Requires:** PHP 8.5; Symfony ^7.4 or ^8.1; API Platform ^4.4 or ^5.0; Doctrine ORM 3.\n",{"part":885,"tag":1455,"name":1465,"publishedAt":1466,"url":1467,"body":1468},"2.0.0-alpha.1","2026-09-24T11:49:40Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fcomponents-web-app\u002Freleases\u002Ftag\u002Fv2.0.0-alpha.1","The first tagged release of the CWA template: the demo app and the starting point for new projects.\n\n```bash\npnpm create cwa my-project\n```\n\n`create-cwa` now has the same version as the template: `create-cwa@2.0.0-alpha.1` installs this release. Add `--ref main` to get the latest unreleased template instead.\n\n**Still an alpha.** The template, `@cwa\u002Fnuxt` and `api-components-bundle` are changing together with the projects that use them.\n\n### Built against\n- **api-components-bundle `2.0.0-alpha.3`**, required as `^2.0@alpha`\n- **`@cwa\u002Fnuxt` edge `0.0.0-29837288.9a15df5`**. The module has no tagged release yet, so the edge build is pinned exactly.\n- Nuxt 4.5.2 (Vite 8), `@nuxt\u002Fui` 4.11, Vue 3.5, TypeScript 6.0.3 (TypeScript 7 isn't supported by `vue-tsc` yet)\n- API Platform 5.0, Symfony 8.1, Doctrine ORM 3, PHP 8.5, FrankenPHP with Souin and Mercure\n\n### What's in it\n- **Page and API caching in Souin.** Pages are purged by surrogate key when content changes, and flushed after each front-end deploy. The cache is warmed from the sitemap after a production deploy. Tracking parameters are stripped from the cache key.\n- **Offline support.** A service worker caches the app shell and public API content. Updates apply on the next page change, and the caches are cleared when a session ends.\n- **Kubernetes.** A Helm chart with autoscaling for the front end and eviction protection. A certificate is issued before any hostname change takes effect, so the site keeps a valid certificate throughout.\n- **CI for GitLab and GitHub Actions.** Review apps, staging, canary and production deploys, plus an optional Lighthouse audit you start by hand.\n- **Demo content.** Fixtures cover a blog, nested pages and a form that uses every Symfony field type.\n- **Load testing.** A k6 harness in `bin\u002Fload-test\u002F`.\n\n`CLAUDE.md` records the reasoning and measurements behind these decisions.\n",{"part":907,"tag":1421,"name":1421,"publishedAt":1470,"url":1471,"body":1472},"2026-09-24T11:38:59Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.3","**Manifest change:** `GET \u002F_\u002Fresource_manifest\u002F{id}` now lists a component's own component groups, their positions and their components at the component's depth, to any depth (#309). Before, each level of component nesting cost another round trip. A component's own response is unchanged.\n\nStill an alpha: the bundle and `@cwa\u002Fnuxt` are changing together with the projects that use them.\n\n**Requires:** PHP 8.5; Symfony ^7.4 or ^8.1; API Platform ^4.4 or ^5.0; Doctrine ORM 3.",{"part":907,"tag":1441,"name":1441,"publishedAt":1474,"url":1475,"body":1476},"2026-09-24T11:17:08Z","https:\u002F\u002Fgithub.com\u002Fcomponents-web-app\u002Fapi-components-bundle\u002Freleases\u002Ftag\u002F2.0.0-alpha.2","The first 2.x release since `2.0.0-alpha.1` in 2020. It reflects the current `main`.\n\nThis is still an **alpha**. The bundle and `@cwa\u002Fnuxt` are changing together with the projects that use them, and breaking changes are still expected before 2.0.0, possibly including the namespace.\n\n**Requires:** PHP 8.5; Symfony ^7.4 or ^8.1; API Platform ^4.4 or ^5.0; Doctrine ORM 3.\n\n`dev-main` is now aliased to `2.x-dev`.",1793565687994]