r/symfony

Composer 2.9.8 and 2.2.28 fix GitHub Actions token disclosure in error messages
▲ 49 r/symfony+2 crossposts

Composer 2.9.8 and 2.2.28 fix GitHub Actions token disclosure in error messages

Please immediately update Composer to version 2.9.8 or 2.2.28 (LTS) by running composer.phar self-update. The new releases fix a vulnerability where Composer leaks the full contents of GitHub Actions issued GITHUB_TOKENs or GitHub App installation tokens to the GitHub Actions logs. GitHub introduced a new format for these tokens including a - (hyphen). The new format is gradually being rolled out to repositories. The new format fails Composer’s validation, leading to an error message that exposes the full token contents to stderr. A CVE identifier will be assigned and added to this post once available.

blog.packagist.com
u/naderman — 12 hours ago
▲ 107 r/symfony+7 crossposts

I built lerd as a local PHP development environment and thought the WordPress community might find it useful, especially developers on Linux where tools like Local, XAMPP, and MAMP don't run.

It detects WordPress projects automatically and gives you automatic .test domains, per-project PHP version isolation, one-command HTTPS, MySQL, phpMyAdmin with one click, and Mailpit for email testing. Everything runs as rootless Podman containers so nothing touches your system PHP and no sudo is required after install.

The web UI lets you manage everything visually including switching PHP versions per project, toggling services, and watching live logs. You can also install it as a PWA.

macOS is also supported for developers who prefer a Podman-native setup without Docker Desktop.

Would love feedback from WordPress developers, especially around plugin development workflows.

github.com/geodro/lerd

u/geodro — 8 days ago

FormsBundle - Release

I've always had a distaste for writing `FormType` classes, so much so that I just stopped using them. But then I had to deal with raw HTML forms, and I hated that even more, so I decided to automate the boring part.

FormsBundle generates Symfony forms directly from DTOs: property types, nullability, and validator constraints already encode everything a `FormType` needs, the bundle just reads them, builds the form type class, and caches it.

Link: https://github.com/n-fasano/FormsBundle

Feedback welcome!

u/semdens — 3 days ago

AssetMapper seems to not detect changes for CSS when using Docker (dunglas)

I use Dunglas symfony docker to run the app (on dev environment)

Installed asset mapper, everything is setup correctly by flex.

I update CSS file but the version of css exposed to browser stays the same and therefore no changes are reflected. Anyone had this issue?

I remember using simple symfony serve it worked fine.

reddit.com
u/akimbas — 5 days ago
▲ 11 r/symfony

[Showcase] OrderInvoiceBundle: Symfony bundle to manage orders and invoices without full e-commerce overhead.

If you don't need a full-blown e-commerce store but just need to handle orders and generate invoices (PDF, proforma, etc.) in your Symfony app, I've created a bundle to simplify this: https://github.com/DavidPetrasek/OrderInvoiceBundle

----------------------------------------------

I am aware Sylius provides standalone Components & Bundles like https://github.com/Sylius/SyliusOrderBundle

... but they're outdated and can't find them in their new docs. Sylius also doesn't seem to support invoice types: regular, proforma, advance and final

u/RefrigeratorHairy256 — 5 days ago

Gedmo Loggable vs AuditTrailBundle for audit/security tracking in Symfony?

I’m building a Symfony application and need audit tracking for entity changes (who changed what and when).

I’m comparing Gedmo Loggable and AuditTrailBundle. Which one is better for production systems in terms of security, scalability, and maintainability?

Would like feedback from people who used them in real projects.

reddit.com
u/Miserable_Size_2299 — 7 days ago