CWA Logo
CWA 2 is a prerelease (2.0.0-alpha), heading for a beta. It runs production sites; configuration can still change between releases, always with upgrade notes. View versions and support
Getting Started

Releases

The latest api-components-bundle, @cwa/nuxt and template releases, with their notes and upgrade steps from GitHub.

A CWA site is built from three parts, each released on its own:

  • api-components-bundle, the Symfony bundle, installed with Composer.
  • @cwa/nuxt, the Nuxt module, installed from npm.
  • The template (components-web-app), the project create-cwa generates. create-cwa has the same version as the template release it installs.

CWA 2 is a prerelease (2.0.0-alpha), heading for a beta. It runs production sites; configuration can still change between releases, always with upgrade notes. Update the three together, and follow the upgrade notes of every release you skip over.

The docs describe the current version. They follow the bundle's main, the module's dev and the template's main, which can be ahead of the last release, and they don't say which release a feature arrived in. What changed in each release, and how to upgrade, is in its release notes below.

Versions and support

  • SemVer from 2.0.0. Until then every release is a prerelease, and any release can include a breaking change. Each one comes with an upgrade note in its release notes, so apply the notes of every release you skip.
  • The beta freezes the data model. Before the beta, the template's migrations are squashed into one (template #192). From the beta on, schema changes come as new migrations only, and breaking changes still come with upgrade notes.
  • The template and create-cwa share one version. create-cwa X installs the template tagged vX, and --ref installs another branch or tag (see Installation › 1. Scaffold your project).
  • npm's latest tag carries prereleases until 2.0.0. create-cwa and @cwa/nuxt publish each prerelease as latest, so pnpm create cwa and pnpm add @cwa/nuxt install the newest release.
  • Only the latest prerelease is supported. Older alphas get no fixes, security fixes included: upgrade to the latest release. Each repository's security policy says so and explains how to report a problem privately: the template's SECURITY.md, the API bundle's SECURITY.md and the Nuxt module's SECURITY.md.
  • Some bundle and module versions must be updated together. The bundle each @cwa/nuxt release needs is in Module Setup › Bundle versions.

Each template release moves to a bundle and a module version:

Templateapi-components-bundle@cwa/nuxt
2.0.0-alpha.45 (latest)2.0.0-alpha.342.0.0-alpha.25
2.0.0-alpha.442.0.0-alpha.342.0.0-alpha.24

Latest releases

Each release's notes come straight from GitHub, including its upgrade notes. Template releases also say which bundle and module versions they move to.

Template

v2.0.0-alpha.55

2.0.0-alpha.55 - 2026-11-01

Upgrade notes

  • create-cwa's questions changed (commit): --yes and --ci now pick the pre-selected components (navigation, rich text, images; was none) and --content demo. Pass --features none for the old default. --fixtures/--no-fixtures still work, as --content demo/--content empty, and --content home creates just the layout and home page. Scripts that call create-cwa unattended should check their flags.

Added

  • Single-server deploys from CI over SSH (#212, commit, README): GitLab's manual production server job and GitHub's server.yml run bin/devops/server-deploy.sh. It copies the commit to the server with rsync, never sending or deleting what git ignores there (.env.prod, backups/), and runs bin/server/deploy.sh. Setting CWA_CI_SERVER_HOST makes a project single-server, and every Kubernetes deploy job then skips. Also set CWA_CI_SERVER_SSH_KEY (secret) and CWA_CI_SERVER_KNOWN_HOSTS (host keys are always checked), with optional _USER (deploy), _PORT and _PATH (cwa). Take .gitlab-ci.yml, or .github/workflows/ (server.yml is new; ci.yml, cleanup.yml and production.yml skip on it), with bin/devops/server-deploy.sh.
  • Single-server deploys run the images CI built (commit): the server pulls the pipeline's php and app images by digest instead of building them, with a registry login that only lasts the run. CWA_CI_SERVER_BUILD="true" builds on the server instead (for a server of another architecture than the runners).

  • create-cwa asks where to deploy and which starting pages to create (commit):

    • "Deploy to?" (with a pipeline): Kubernetes, or one server (--deploy).
    • The components are named by what an editor gets, with navigation, rich text and images pre-selected (--features default).
    • "Start with example pages?": an example of each component, just a home page, or an empty site (--content demo|home|empty).
  • api/tests/Functional/ContentWritePermissionTest.php (#228): a signed-in user without ROLE_ADMIN gets 403 on writes to components, layouts, pages, routes, component groups and positions; an admin can write. It guards publishable.permission (is_granted('ROLE_ADMIN')). (commit)

Security

  • pnpm audit and composer audit (2026-11-01): nothing new. Still accepted, not in the server output: deepmerge 4.3.1 (GHSA-gcqx-w48m-w2h4, low), glob 10.5.0, 11.1.0 and 13.0.6 (GHSA-3g3m-2fjr-6pw4, moderate) and minimatch 5.1.9, 9.0.9 and 10.2.6 (GHSA-g3hv-75wg-m249, moderate), all build-only, waiting on fixes their dependents allow.

Fixed

  • A create-cwa project without the image feature builds and passes its tests (#227): AltHtmlContent.vue uses a plain <img> instead of <nuxt-img> (@nuxt/image goes with the image feature), and api/tests/Functional/ImageTest.php goes with it too. A project created without images takes app/app/cwa/components/HtmlContent/ui/AltHtmlContent.vue and deletes api/tests/Functional/ImageTest.php. bin/test/manifest-features.php (template CI only) checks every feature's exclude list. (commit)

cwa-php-base 2.0.0-alpha.55

Pin it as ghcr.io/components-web-app/cwa-php-base:2.0.0-alpha.55@sha256:61113ef15c9c2c6835223eb74a0f38b4baf0451f5c7d0e380e6cdde4b940adb1.

Verify it with:

gh attestation verify oci://ghcr.io/components-web-app/cwa-php-base:2.0.0-alpha.55 --repo components-web-app/components-web-app \
  --signer-workflow components-web-app/components-web-app/.github/workflows/publish-php-base.yml --source-ref refs/tags/v2.0.0-alpha.55
# Base images (from the build provenance)
pkg:docker/caddy@builder?platform=linux%2Famd64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0
pkg:docker/caddy@builder?platform=linux%2Farm64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0
pkg:docker/docker/buildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315
pkg:docker/docker/buildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315
pkg:docker/docker/dockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e
pkg:docker/dunglas/frankenphp@builder?platform=linux%2Famd64 sha256:8a7b37474d2778a745ca1bd8a0b6d0cd15c6f7b2a835117bad108411781869ec
pkg:docker/dunglas/frankenphp@builder?platform=linux%2Farm64 sha256:8a7b37474d2778a745ca1bd8a0b6d0cd15c6f7b2a835117bad108411781869ec
pkg:docker/dunglas/frankenphp@latest?platform=linux%2Famd64 sha256:6f86f003f1478bafa7befe6ec26db5575e703882171f785189de1e222df0e38e
pkg:docker/dunglas/frankenphp@latest?platform=linux%2Farm64 sha256:6f86f003f1478bafa7befe6ec26db5575e703882171f785189de1e222df0e38e

PHP 8.5.12 (cli) (built: Oct 28 2026 01:23:40) (ZTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.5.12, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies

[PHP Modules]
apcu
brotli
Core
ctype
curl
date
dom
exif
FFI
fileinfo
filter
gd
hash
iconv
intl
json
lexbor
libxml
mbstring
mysqlnd
openssl
pcre
PDO
pdo_pgsql
pdo_sqlite
Phar
posix
random
readline
Reflection
session
SimpleXML
sodium
SPL
sqlite3
standard
tokenizer
uri
xml
xmlreader
xmlwriter
xsl
Zend OPcache
zip
zlib

[Zend Modules]
Zend OPcache


go	go1.27.3
path	caddy
mod	caddy	(devel)	
dep	cel.dev/cel-go	v0.32.0	h1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=
dep	cel.dev/expr	v0.25.3	h1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=
dep	cloud.google.com/go/auth	v0.24.1	h1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=
dep	cloud.google.com/go/auth/oauth2adapt	v0.3.0	h1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=
dep	cloud.google.com/go/compute/metadata	v0.10.0	h1:pyKMUQSwchgkIBBJGdILqQbs/BNJXqwSA7Ej6LAvvtY=
dep	dario.cat/mergo	v1.0.2	h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
dep	filippo.io/bigmod	v0.1.0	h1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=
dep	filippo.io/edwards25519	v1.2.0	h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
dep	github.com/BurntSushi/toml	v1.6.0	h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
dep	github.com/DeRuina/timberjack	v1.4.9	h1:9RjDMSkUDQRYzwVNB/FLonXNurcZVEh9sK43m2jw3A4=
dep	github.com/KimMachineGun/automemlimit	v1.0.1	h1:87PowSIJFht5TmyyZKJNR4y2v7Cm9OdCzsSMR8jXJHM=
dep	github.com/Masterminds/goutils	v1.1.1	h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
dep	github.com/Masterminds/semver/v3	v3.5.0	h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
dep	github.com/Masterminds/sprig/v3	v3.3.0	h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
dep	github.com/MauriceGit/skiplist	v0.0.0-20211105230623-77f5c8d3e145	h1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=
dep	github.com/MicahParks/jwkset	v0.11.3	h1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=
dep	github.com/MicahParks/keyfunc/v3	v3.8.2	h1:eydEwk/pBAVrDIpmFfB/gkCcrp++xQ7YYXirrI2zlWE=
dep	github.com/RoaringBitmap/roaring/v2	v2.30.0	h1:1sD4xsCenNd9n/gOWaExCWanP9WTyiNuqLAvaDQ5jkY=
dep	github.com/alecthomas/chroma/v2	v2.27.0	h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
dep	github.com/antlabs/stl	v0.0.1	h1:TRD3csCrjREeLhLoQ/supaoCvFhNLBTNIwuRGrDIs6Q=
dep	github.com/antlabs/timer	v0.0.11	h1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=
dep	github.com/antlr4-go/antlr/v4	v4.13.1	h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
dep	github.com/aryann/difflib	v0.0.0-20210328193216-ff5ff6dc229b	h1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=
dep	github.com/beorn7/perks	v1.0.1	h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
dep	github.com/bits-and-blooms/bitset	v1.26.0	h1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=
dep	github.com/bwmarrin/snowflake	v0.3.0	h1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=
dep	github.com/caddyserver/caddy/v2	v2.11.7	h1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=
dep	github.com/caddyserver/certmagic	v0.25.6	h1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=
dep	github.com/caddyserver/zerossl	v0.1.6	h1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT/4REW//lsas=
dep	github.com/ccoveille/go-safecast/v2	v2.0.1	h1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=
dep	github.com/cenkalti/backoff/v5	v5.0.3	h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
dep	github.com/cespare/xxhash/v2	v2.3.0	h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
dep	github.com/chzyer/readline	v1.5.1	h1:upd/6fQk4src78LMRzh5vItIt361/o4uq553V8B5sGI=
dep	github.com/cloudflare/circl	v1.6.5	h1:O64F26HEqNhznd/hrC5KZXVKYuKM2rx4deZDTc4ihQA=
dep	github.com/components-web-app/components-web-app/api/frankenphp/caddy/queryallowlist	v0.0.0-20261101092458-4a75f4e1c5d0
=>	/tmp/queryallowlist	(devel)	

dep	github.com/coreos/go-oidc/v3	v3.21.0	h1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=
dep	github.com/cpuguy83/go-md2man/v2	v2.0.7	h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
dep	github.com/darkweak/souin	v1.7.9
=>	/tmp/souin	(devel)	

dep	github.com/darkweak/souin/plugins/caddy	v1.7.9	h1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=
dep	github.com/darkweak/storages/badger	v0.0.21	h1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M/JRc+zhN7Wsx0=
dep	github.com/darkweak/storages/badger/caddy	v0.0.22	h1:4/byA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=
dep	github.com/darkweak/storages/core	v0.0.21	h1:zfa0Bqzdm9/oPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=
dep	github.com/darkweak/storages/go-redis	v0.0.22
=>	/tmp/storages-go-redis	(devel)	

dep	github.com/darkweak/storages/go-redis/caddy	v0.0.22	h1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=
dep	github.com/darkweak/storages/nuts	v0.0.21	h1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=
dep	github.com/darkweak/storages/nuts/caddy	v0.0.22	h1:kg/HYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=
dep	github.com/darkweak/storages/otter	v0.0.21	h1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=
dep	github.com/darkweak/storages/otter/caddy	v0.0.22	h1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=
dep	github.com/dgraph-io/badger/v4	v4.9.1	h1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=
dep	github.com/dgraph-io/ristretto/v2	v2.2.0	h1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=
dep	github.com/dgryski/go-rendezvous	v0.0.0-20200823014737-9f7001d12a5f	h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
dep	github.com/dlclark/regexp2/v2	v2.10.0	h1:zSNli+yyb7Rg4VzzLiZuJ3eZup/OObARXm/qs1a2//c=
dep	github.com/dolthub/maphash	v0.1.0	h1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L/QxPDyQ=
dep	github.com/dunglas/caddy-cbrotli	v1.0.1	h1:mkg7EB1GmoyfBt3kY3mq4o/0bfnBeq7ZLQjmVmdBE3Y=
dep	github.com/dunglas/frankenphp	v1.13.4	h1:MK45+Ai4Hnd+/V3fpcFNXh5JknkOx+VIbmThLgHiDrw=
dep	github.com/dunglas/frankenphp/caddy	v1.13.4	h1:PY4Q1l5CJM6ZfWeKU+dTeo4b8DHjoJ923ik+ugHU9NM=
dep	github.com/dunglas/go-urlpattern	v1.0.0	h1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=
dep	github.com/dunglas/httpsfv	v1.1.2	h1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ/Dkmc=
dep	github.com/dunglas/mercure	v1.1.5	h1:SlEUgMTiQst0zhx4HlPKuo95GRZM6bHCrxH1Me7jQ4M=
dep	github.com/dunglas/mercure/caddy	v1.1.5	h1:Rl1Xh55YwZkFisNnlEZNLpLDL97bfdePSktcbhNb/RU=
dep	github.com/dunglas/skipfilter	v1.2.0	h1:J7/RXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=
dep	github.com/dunglas/vulcain	v1.4.5	h1:vO7CS3/KwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=
dep	github.com/dunglas/vulcain/caddy	v1.4.5	h1:2qzg18nEkpsc1QIvpNn/oztSHRxY1/G6xuxylxVobGY=
dep	github.com/dustin/go-humanize	v1.1.0	h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
dep	github.com/e-dant/watcher	v0.0.0-20260223030516-06f84a1314be	h1:vqHrvilasyJcnru/0Z4FoojsQJUIfXGVplte7JtupfY=
dep	github.com/elnormous/contenttype	v1.0.4	h1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=
dep	github.com/felixge/httpsnoop	v1.1.0	h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
dep	github.com/fxamacker/cbor/v2	v2.9.6	h1:NHZPxuUjJXQjX9itA785y/5NKSlI4HQ+S7noZsmI7hs=
dep	github.com/gammazero/deque	v0.2.1	h1:qSdsbG6pgp6nL7A0+K/B7s12mcCY/5l5SIUpMOl+dC0=
dep	github.com/getkin/kin-openapi	v0.152.0	h1:XRVo77lMRyOGMHf1paMu9lxX3wzuQDZeprssZJnz/x8=
dep	github.com/go-chi/chi/v5	v5.5.0	h1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=
dep	github.com/go-jose/go-jose/v3	v3.0.5	h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
dep	github.com/go-jose/go-jose/v4	v4.1.6	h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
dep	github.com/go-logr/logr	v1.4.4	h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
dep	github.com/go-logr/stdr	v1.2.2	h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
dep	github.com/go-openapi/jsonpointer	v1.0.2	h1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=
dep	github.com/gofrs/flock	v0.13.0	h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
dep	github.com/gofrs/uuid	v4.4.0+incompatible	h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=
dep	github.com/golang-jwt/jwt/v5	v5.3.1	h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
dep	github.com/google/brotli/go/cbrotli	v1.2.1	h1:3NEHODycoTQr6cCq/yYNyBqcuk9fKRjSuiADFy2V8h8=
dep	github.com/google/certificate-transparency-go	v1.4.0	h1:78uNaR2knzCoKKXXDSAGVkz9XPkDg5xXJRP9tP6+rr0=
dep	github.com/google/flatbuffers	v25.2.10+incompatible	h1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H/pNX4FP1v0Q=
dep	github.com/google/go-tpm	v0.9.8	h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
dep	github.com/google/go-tspi	v0.3.0	h1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=
dep	github.com/google/s2a-go	v0.1.11	h1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=
dep	github.com/google/uuid	v1.6.0	h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
dep	github.com/googleapis/enterprise-certificate-proxy	v0.3.24	h1:G9iCJIY+AYVmUskKdjX8FVy7sG+nbzjOQ41cvlmhcvg=
dep	github.com/googleapis/gax-go/v2	v2.27.0	h1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc/RRZhKA/2g0=
dep	github.com/gorilla/handlers	v1.5.2	h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
dep	github.com/gorilla/mux	v1.8.1	h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
dep	github.com/grpc-ecosystem/grpc-gateway/v2	v2.32.0	h1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=
dep	github.com/huandu/xstrings	v1.6.3	h1:7997PcI0mYC9uPNBJ7udg/KrdJh1GhJid8f2tzKFHYQ=
dep	github.com/klauspost/compress	v1.20.3	h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
dep	github.com/klauspost/cpuid/v2	v2.4.1	h1:I9KxadAkvo+QjtcEE2f2tyfEvmIla/T0m+14PrZNl0U=
dep	github.com/libdns/libdns	v1.1.1	h1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS/P/U=
dep	github.com/manifoldco/promptui	v0.9.0	h1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=
dep	github.com/mattn/go-colorable	v0.1.16	h1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=
dep	github.com/mattn/go-isatty	v0.0.24	h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
dep	github.com/maypok86/otter	v1.2.4	h1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=
dep	github.com/maypok86/otter/v2	v2.4.0	h1:1XpRRWaq9DRIqZV7UtglS4VLzYKSsnFOQmzV+KZxLb0=
dep	github.com/mgutz/ansi	v0.0.0-20200706080929-d51e80ef957d	h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
dep	github.com/mholt/acmez/v3	v3.1.7	h1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=
dep	github.com/mholt/caddy-ratelimit	v0.1.0	h1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=
dep	github.com/miekg/dns	v1.1.73	h1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=
dep	github.com/mitchellh/copystructure	v1.2.0	h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
dep	github.com/mitchellh/go-ps	v1.0.0	h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
dep	github.com/mitchellh/reflectwalk	v1.0.2	h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
dep	github.com/munnerz/goautoneg	v0.0.0-20191010083416-a7dc8b61c822	h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
dep	github.com/nlnwa/whatwg-url	v0.6.2	h1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ/Q=
dep	github.com/nutsdb/nutsdb	v1.0.4	h1:BurzkxijXJY1/AkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=
dep	github.com/oasdiff/yaml	v0.1.1	h1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=
dep	github.com/oasdiff/yaml3	v0.0.14	h1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=
dep	github.com/pbnjay/memory	v0.0.0-20210728143218-7b4eea64cf58	h1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=
dep	github.com/pierrec/lz4/v4	v4.1.29	h1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=
dep	github.com/pires/go-proxyproto	v0.16.0	h1:9KYT/fM3wpjT8bdMEj/7FBcoiUG1KyzEjRYnPu+vz7A=
dep	github.com/pkg/errors	v0.9.1	h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
dep	github.com/pquerna/cachecontrol	v0.2.0	h1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=
dep	github.com/prometheus/client_golang	v1.25.0	h1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=
dep	github.com/prometheus/client_model	v0.6.3	h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
dep	github.com/prometheus/common	v0.72.1	h1:ZAiQed/nk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=
dep	github.com/prometheus/otlptranslator	v1.0.0	h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=
dep	github.com/prometheus/procfs	v0.23.0	h1:ad+S6FTkzwaMgacKLM5h6bNKExS+DMH0YiUwXItH/o4=
dep	github.com/quic-go/qpack	v0.6.0	h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
dep	github.com/quic-go/quic-go	v0.64.1	h1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=
dep	github.com/redis/go-redis/v9	v9.18.0	h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=
dep	github.com/rs/cors	v1.11.1	h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
dep	github.com/rs/xid	v1.6.0	h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
dep	github.com/russross/blackfriday/v2	v2.1.0	h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
dep	github.com/santhosh-tekuri/jsonschema/v6	v6.0.3	h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
dep	github.com/shopspring/decimal	v1.6.0	h1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=
dep	github.com/shurcooL/sanitized_anchor_name	v1.0.0	h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
dep	github.com/sirupsen/logrus	v1.10.2	h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
dep	github.com/slackhq/nebula	v1.11.2	h1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=
dep	github.com/smallstep/certificates	v0.30.2	h1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf/iQtA5QlN0Y=
dep	github.com/smallstep/cli-utils	v0.12.2	h1:lGzM9PJrH/qawbzMC/s2SvgLdJPKDWKwKzx9doCVO+k=
dep	github.com/smallstep/go-attestation	v0.4.9	h1:/fVmzB8A8tk7B2PCGPlszWzyl/GDcEQbynqcg2PMaZ0=
dep	github.com/smallstep/linkedca	v0.26.0	h1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=
dep	github.com/smallstep/nosql	v0.8.0	h1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli/XB4Jp4A=
dep	github.com/smallstep/pkcs7	v0.2.3	h1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=
dep	github.com/smallstep/scep	v0.0.0-20261014185058-63893dadfda8	h1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=
dep	github.com/smallstep/truststore	v0.13.0	h1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi/py4=
dep	github.com/spf13/cast	v1.10.0	h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
dep	github.com/spf13/cobra	v1.10.2	h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
dep	github.com/spf13/pflag	v1.0.10	h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
dep	github.com/tailscale/tscert	v0.0.0-20251216020129-aea342f6d747	h1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=
dep	github.com/tidwall/btree	v1.6.0	h1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=
dep	github.com/unrolled/secure	v1.17.0	h1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=
dep	github.com/urfave/cli	v1.22.17	h1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=
dep	github.com/x448/float16	v0.8.4	h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
dep	github.com/xujiajun/mmap-go	v1.0.1	h1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv/WHc=
dep	github.com/xujiajun/utils	v0.0.0-20220904132955-5f7c5b914235	h1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=
dep	github.com/yuin/goldmark	v1.8.6	h1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=
dep	github.com/yuin/goldmark-highlighting/v2	v2.0.0-20230729083705-37449abec8cc	h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=
dep	github.com/zeebo/blake3	v0.2.4	h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
dep	go.etcd.io/bbolt	v1.5.0	h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
dep	go.opentelemetry.io/auto/sdk	v1.2.1	h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
dep	go.opentelemetry.io/contrib/bridges/prometheus	v0.72.0	h1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w/1ROwHEM7M=
dep	go.opentelemetry.io/contrib/exporters/autoexport	v0.72.0	h1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=
dep	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.72.0	h1:LxwW/9ctSCv+QkE/cLR7M91ZIkXNMqJtEMi1vCw9U8s=
dep	go.opentelemetry.io/contrib/propagators/autoprop	v0.72.0	h1:/Kv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=
dep	go.opentelemetry.io/contrib/propagators/aws	v1.47.0	h1:n/2x/vQki1ojD7R2jYHdnNdI74Yx/OFdY4YXFFesm8M=
dep	go.opentelemetry.io/contrib/propagators/b3	v1.47.0	h1:vlKDmtjhe1R0d7kdov/+KVTKWOKeGLyohB+iXoDPRMQ=
dep	go.opentelemetry.io/contrib/propagators/jaeger	v1.47.0	h1:2lDw6AKPV33/7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=
dep	go.opentelemetry.io/contrib/propagators/ot	v1.47.0	h1:nZUqh0/8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=
dep	go.opentelemetry.io/otel	v1.47.0	h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=
dep	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc	v0.23.0	h1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=
dep	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp	v0.23.0	h1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI/nE=
dep	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc	v1.47.0	h1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=
dep	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	v1.47.0	h1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=
dep	go.opentelemetry.io/otel/exporters/otlp/otlptrace	v1.47.0	h1:julhjPeUH/q/7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=
dep	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	v1.47.0	h1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=
dep	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	v1.47.0	h1:aXZXsZ012wOgVkqaiQv+Z/d8V0xKjmg70F6m4CE94lc=
dep	go.opentelemetry.io/otel/exporters/prometheus	v0.69.0	h1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=
dep	go.opentelemetry.io/otel/exporters/stdout/stdoutlog	v0.23.0	h1:PW/E9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=
dep	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric	v1.47.0	h1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=
dep	go.opentelemetry.io/otel/exporters/stdout/stdouttrace	v1.47.0	h1:N3YQCxjxQ/bMjyc3heladfRm9t9RTksGQH8z4w6yU/0=
dep	go.opentelemetry.io/otel/log	v1.47.0	h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI=
dep	go.opentelemetry.io/otel/metric	v1.47.0	h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=
dep	go.opentelemetry.io/otel/sdk	v1.47.0	h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=
dep	go.opentelemetry.io/otel/sdk/log	v1.47.0	h1:W4N/ZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=
dep	go.opentelemetry.io/otel/sdk/metric	v1.47.0	h1:lfISg2j93VT6yqdk9OfUaZmw/GfcZqCCV3jdXtsPnKw=
dep	go.opentelemetry.io/otel/trace	v1.47.0	h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM=
dep	go.opentelemetry.io/proto/otlp	v1.11.1	h1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=
dep	go.step.sm/crypto	v0.91.0	h1:0mN0DwVOvUuh7VbyTnxABZuAkxwak/Grp8Y/b4YaZDU=
dep	go.uber.org/atomic	v1.11.0	h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
dep	go.uber.org/automaxprocs	v1.6.0	h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
dep	go.uber.org/multierr	v1.11.0	h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
dep	go.uber.org/zap	v1.28.0	h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
dep	go.uber.org/zap/exp	v0.3.0	h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
dep	go.yaml.in/yaml/v3	v3.0.5	h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
dep	golang.org/x/crypto	v0.58.0	h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
dep	golang.org/x/crypto/x509roots/fallback	v0.0.0-20261020153306-9f2b28d4331a	h1:V5oicZXS0oqZx30gY/apgSVD7YvNBfrIOdcMnlelJY4=
dep	golang.org/x/exp	v0.0.0-20261014143641-f0251eb4aa3e	h1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI/A=
dep	golang.org/x/net	v0.61.0	h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
dep	golang.org/x/oauth2	v0.37.0	h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
dep	golang.org/x/sync	v0.24.0	h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
dep	golang.org/x/sys	v0.49.0	h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
dep	golang.org/x/term	v0.47.0	h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
dep	golang.org/x/text	v0.43.0	h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
dep	golang.org/x/time	v0.16.0	h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
dep	google.golang.org/api	v0.308.0	h1:iGb+4qT3nVb3uuIzwor3yP2nyu+rMZr31PvLFiRNJQk=
dep	google.golang.org/genproto/googleapis/api	v0.0.0-20261019180522-ce908d29299b	h1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=
dep	google.golang.org/genproto/googleapis/rpc	v0.0.0-20261019180522-ce908d29299b	h1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=
dep	google.golang.org/grpc	v1.84.0	h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
dep	google.golang.org/protobuf	v1.36.12	h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
dep	gopkg.in/yaml.v3	v3.0.1	h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
build	-buildmode=exe
build	-compiler=gc
build	-ldflags="-w -s"
build	-tags=nobadger,nomysql,nopgx
build	CGO_ENABLED=1
build	CGO_CFLAGS="-I/usr/local/include/php -I/usr/local/include/php/main -I/usr/local/include/php/TSRM -I/usr/local/include/php/Zend -I/usr/local/include/php/ext -I/usr/local/include/php/ext/date/lib"
build	CGO_CPPFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
build	CGO_CXXFLAGS=
build	CGO_LDFLAGS="-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto"
build	GOARCH=amd64
build	GOOS=linux
build	GOAMD64=v1
Template

v2.0.0-alpha.54

2.0.0-alpha.54 - 2026-11-01

Upgrade notes

  • PostgreSQL 18 (commit): Doctrine's server_version, compose's database image and serverVersion default, the e2e image, the CI test service and the backup job's default image go to 18. PG18 images keep their data under /var/lib/postgresql (a versioned directory), so compose mounts the volume there instead of /data: an existing local PG14/16 volume won't start under 18. Dump it first (pg_dump) or recreate it (docker compose down -v, then bin/up).
  • The in-cluster PostgreSQL is the chart's own StatefulSet on postgres:18-alpine (commit), replacing the Bitnami subchart, which never published PostgreSQL 18. Take helm/cwa whole (templates/postgresql.yaml is new, Chart.lock goes), with bin/devops/k8s.sh and bin/test/database-job-chart.sh. It upgrades a release in place (same immutable StatefulSet fields; rehearsed from chart 14.3.3 in kind), but the data directory is new, so an in-cluster database starts empty on its first deploy: reload fixtures, or pg_dump a persistent one first. CWA_CI_POSTGRES_IMAGE_TAG is now an official image tag (default 18-alpine); POSTGRES_ROOT_PASSWORD (the Bitnami postgres superuser's password) is no longer read: delete it from a project's CI variables.
  • No chart dependencies, and the chart's PostgreSQL values are flat (commit): helm_init is gone from bin/devops/k8s.sh, so take .gitlab-ci.yml or .github/workflows/ci.yml and production.yml with it (a project job still calling helm_init fails with "not found"). postgresql.global.postgresql.auth is now postgresql.auth, and postgresql.primary.persistence, .resources and .pullPolicy are postgresql.persistence etc.: move any project_values or --set that used the old paths. GitHub's functional-test service and the backup image's fallback also go to PostgreSQL 18.

Security

  • pnpm audit and composer audit (2026-11-01): nothing new. Still accepted, not in the server output: deepmerge 4.3.1 (GHSA-gcqx-w48m-w2h4, low), glob 10.5.0, 11.1.0 and 13.0.6 (GHSA-3g3m-2fjr-6pw4, moderate) and minimatch 5.1.9, 9.0.9 and 10.2.6 (GHSA-g3hv-75wg-m249, moderate), all build-only, waiting on fixes their dependents allow.

Fixed

  • The browser-test and server-script stacks mount the database's tmpfs on /var/lib/postgresql: PostgreSQL 18 images refuse to start with a mount on /var/lib/postgresql/data. A project that copies e2e/ takes e2e/compose.yaml. (commit)

cwa-php-base 2.0.0-alpha.54

Pin it as ghcr.io/components-web-app/cwa-php-base:2.0.0-alpha.54@sha256:e655cd15377f6915a3a5c5a305b3af71c2282e60b2a1249b0e86900856717ade.

Verify it with:

gh attestation verify oci://ghcr.io/components-web-app/cwa-php-base:2.0.0-alpha.54 --repo components-web-app/components-web-app \
  --signer-workflow components-web-app/components-web-app/.github/workflows/publish-php-base.yml --source-ref refs/tags/v2.0.0-alpha.54
# Base images (from the build provenance)
pkg:docker/caddy@builder?platform=linux%2Famd64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0
pkg:docker/caddy@builder?platform=linux%2Farm64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0
pkg:docker/docker/buildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315
pkg:docker/docker/buildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315
pkg:docker/docker/dockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e
pkg:docker/dunglas/frankenphp@builder?platform=linux%2Famd64 sha256:8a7b37474d2778a745ca1bd8a0b6d0cd15c6f7b2a835117bad108411781869ec
pkg:docker/dunglas/frankenphp@builder?platform=linux%2Farm64 sha256:8a7b37474d2778a745ca1bd8a0b6d0cd15c6f7b2a835117bad108411781869ec
pkg:docker/dunglas/frankenphp@latest?platform=linux%2Famd64 sha256:6f86f003f1478bafa7befe6ec26db5575e703882171f785189de1e222df0e38e
pkg:docker/dunglas/frankenphp@latest?platform=linux%2Farm64 sha256:6f86f003f1478bafa7befe6ec26db5575e703882171f785189de1e222df0e38e

PHP 8.5.12 (cli) (built: Oct 28 2026 01:23:40) (ZTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.5.12, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies

[PHP Modules]
apcu
brotli
Core
ctype
curl
date
dom
exif
FFI
fileinfo
filter
gd
hash
iconv
intl
json
lexbor
libxml
mbstring
mysqlnd
openssl
pcre
PDO
pdo_pgsql
pdo_sqlite
Phar
posix
random
readline
Reflection
session
SimpleXML
sodium
SPL
sqlite3
standard
tokenizer
uri
xml
xmlreader
xmlwriter
xsl
Zend OPcache
zip
zlib

[Zend Modules]
Zend OPcache


go	go1.27.3
path	caddy
mod	caddy	(devel)	
dep	cel.dev/cel-go	v0.32.0	h1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=
dep	cel.dev/expr	v0.25.3	h1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=
dep	cloud.google.com/go/auth	v0.24.1	h1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=
dep	cloud.google.com/go/auth/oauth2adapt	v0.3.0	h1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=
dep	cloud.google.com/go/compute/metadata	v0.10.0	h1:pyKMUQSwchgkIBBJGdILqQbs/BNJXqwSA7Ej6LAvvtY=
dep	dario.cat/mergo	v1.0.2	h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
dep	filippo.io/bigmod	v0.1.0	h1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=
dep	filippo.io/edwards25519	v1.2.0	h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
dep	github.com/BurntSushi/toml	v1.6.0	h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
dep	github.com/DeRuina/timberjack	v1.4.9	h1:9RjDMSkUDQRYzwVNB/FLonXNurcZVEh9sK43m2jw3A4=
dep	github.com/KimMachineGun/automemlimit	v1.0.1	h1:87PowSIJFht5TmyyZKJNR4y2v7Cm9OdCzsSMR8jXJHM=
dep	github.com/Masterminds/goutils	v1.1.1	h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
dep	github.com/Masterminds/semver/v3	v3.5.0	h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
dep	github.com/Masterminds/sprig/v3	v3.3.0	h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
dep	github.com/MauriceGit/skiplist	v0.0.0-20211105230623-77f5c8d3e145	h1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=
dep	github.com/MicahParks/jwkset	v0.11.3	h1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=
dep	github.com/MicahParks/keyfunc/v3	v3.8.2	h1:eydEwk/pBAVrDIpmFfB/gkCcrp++xQ7YYXirrI2zlWE=
dep	github.com/RoaringBitmap/roaring/v2	v2.30.0	h1:1sD4xsCenNd9n/gOWaExCWanP9WTyiNuqLAvaDQ5jkY=
dep	github.com/alecthomas/chroma/v2	v2.27.0	h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
dep	github.com/antlabs/stl	v0.0.1	h1:TRD3csCrjREeLhLoQ/supaoCvFhNLBTNIwuRGrDIs6Q=
dep	github.com/antlabs/timer	v0.0.11	h1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=
dep	github.com/antlr4-go/antlr/v4	v4.13.1	h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
dep	github.com/aryann/difflib	v0.0.0-20210328193216-ff5ff6dc229b	h1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=
dep	github.com/beorn7/perks	v1.0.1	h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
dep	github.com/bits-and-blooms/bitset	v1.26.0	h1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=
dep	github.com/bwmarrin/snowflake	v0.3.0	h1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=
dep	github.com/caddyserver/caddy/v2	v2.11.7	h1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=
dep	github.com/caddyserver/certmagic	v0.25.6	h1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=
dep	github.com/caddyserver/zerossl	v0.1.6	h1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT/4REW//lsas=
dep	github.com/ccoveille/go-safecast/v2	v2.0.1	h1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=
dep	github.com/cenkalti/backoff/v5	v5.0.3	h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
dep	github.com/cespare/xxhash/v2	v2.3.0	h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
dep	github.com/chzyer/readline	v1.5.1	h1:upd/6fQk4src78LMRzh5vItIt361/o4uq553V8B5sGI=
dep	github.com/cloudflare/circl	v1.6.5	h1:O64F26HEqNhznd/hrC5KZXVKYuKM2rx4deZDTc4ihQA=
dep	github.com/components-web-app/components-web-app/api/frankenphp/caddy/queryallowlist	v0.0.0-20261101082154-a6d4ca67f6e0
=>	/tmp/queryallowlist	(devel)	

dep	github.com/coreos/go-oidc/v3	v3.21.0	h1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=
dep	github.com/cpuguy83/go-md2man/v2	v2.0.7	h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
dep	github.com/darkweak/souin	v1.7.9
=>	/tmp/souin	(devel)	

dep	github.com/darkweak/souin/plugins/caddy	v1.7.9	h1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=
dep	github.com/darkweak/storages/badger	v0.0.21	h1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M/JRc+zhN7Wsx0=
dep	github.com/darkweak/storages/badger/caddy	v0.0.22	h1:4/byA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=
dep	github.com/darkweak/storages/core	v0.0.21	h1:zfa0Bqzdm9/oPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=
dep	github.com/darkweak/storages/go-redis	v0.0.22
=>	/tmp/storages-go-redis	(devel)	

dep	github.com/darkweak/storages/go-redis/caddy	v0.0.22	h1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=
dep	github.com/darkweak/storages/nuts	v0.0.21	h1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=
dep	github.com/darkweak/storages/nuts/caddy	v0.0.22	h1:kg/HYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=
dep	github.com/darkweak/storages/otter	v0.0.21	h1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=
dep	github.com/darkweak/storages/otter/caddy	v0.0.22	h1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=
dep	github.com/dgraph-io/badger/v4	v4.9.1	h1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=
dep	github.com/dgraph-io/ristretto/v2	v2.2.0	h1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=
dep	github.com/dgryski/go-rendezvous	v0.0.0-20200823014737-9f7001d12a5f	h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
dep	github.com/dlclark/regexp2/v2	v2.10.0	h1:zSNli+yyb7Rg4VzzLiZuJ3eZup/OObARXm/qs1a2//c=
dep	github.com/dolthub/maphash	v0.1.0	h1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L/QxPDyQ=
dep	github.com/dunglas/caddy-cbrotli	v1.0.1	h1:mkg7EB1GmoyfBt3kY3mq4o/0bfnBeq7ZLQjmVmdBE3Y=
dep	github.com/dunglas/frankenphp	v1.13.4	h1:MK45+Ai4Hnd+/V3fpcFNXh5JknkOx+VIbmThLgHiDrw=
dep	github.com/dunglas/frankenphp/caddy	v1.13.4	h1:PY4Q1l5CJM6ZfWeKU+dTeo4b8DHjoJ923ik+ugHU9NM=
dep	github.com/dunglas/go-urlpattern	v1.0.0	h1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=
dep	github.com/dunglas/httpsfv	v1.1.2	h1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ/Dkmc=
dep	github.com/dunglas/mercure	v1.1.5	h1:SlEUgMTiQst0zhx4HlPKuo95GRZM6bHCrxH1Me7jQ4M=
dep	github.com/dunglas/mercure/caddy	v1.1.5	h1:Rl1Xh55YwZkFisNnlEZNLpLDL97bfdePSktcbhNb/RU=
dep	github.com/dunglas/skipfilter	v1.2.0	h1:J7/RXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=
dep	github.com/dunglas/vulcain	v1.4.5	h1:vO7CS3/KwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=
dep	github.com/dunglas/vulcain/caddy	v1.4.5	h1:2qzg18nEkpsc1QIvpNn/oztSHRxY1/G6xuxylxVobGY=
dep	github.com/dustin/go-humanize	v1.1.0	h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
dep	github.com/e-dant/watcher	v0.0.0-20260223030516-06f84a1314be	h1:vqHrvilasyJcnru/0Z4FoojsQJUIfXGVplte7JtupfY=
dep	github.com/elnormous/contenttype	v1.0.4	h1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=
dep	github.com/felixge/httpsnoop	v1.1.0	h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
dep	github.com/fxamacker/cbor/v2	v2.9.6	h1:NHZPxuUjJXQjX9itA785y/5NKSlI4HQ+S7noZsmI7hs=
dep	github.com/gammazero/deque	v0.2.1	h1:qSdsbG6pgp6nL7A0+K/B7s12mcCY/5l5SIUpMOl+dC0=
dep	github.com/getkin/kin-openapi	v0.152.0	h1:XRVo77lMRyOGMHf1paMu9lxX3wzuQDZeprssZJnz/x8=
dep	github.com/go-chi/chi/v5	v5.5.0	h1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=
dep	github.com/go-jose/go-jose/v3	v3.0.5	h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
dep	github.com/go-jose/go-jose/v4	v4.1.6	h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
dep	github.com/go-logr/logr	v1.4.4	h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
dep	github.com/go-logr/stdr	v1.2.2	h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
dep	github.com/go-openapi/jsonpointer	v1.0.2	h1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=
dep	github.com/gofrs/flock	v0.13.0	h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
dep	github.com/gofrs/uuid	v4.4.0+incompatible	h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=
dep	github.com/golang-jwt/jwt/v5	v5.3.1	h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
dep	github.com/google/brotli/go/cbrotli	v1.2.1	h1:3NEHODycoTQr6cCq/yYNyBqcuk9fKRjSuiADFy2V8h8=
dep	github.com/google/certificate-transparency-go	v1.4.0	h1:78uNaR2knzCoKKXXDSAGVkz9XPkDg5xXJRP9tP6+rr0=
dep	github.com/google/flatbuffers	v25.2.10+incompatible	h1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H/pNX4FP1v0Q=
dep	github.com/google/go-tpm	v0.9.8	h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
dep	github.com/google/go-tspi	v0.3.0	h1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=
dep	github.com/google/s2a-go	v0.1.11	h1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=
dep	github.com/google/uuid	v1.6.0	h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
dep	github.com/googleapis/enterprise-certificate-proxy	v0.3.24	h1:G9iCJIY+AYVmUskKdjX8FVy7sG+nbzjOQ41cvlmhcvg=
dep	github.com/googleapis/gax-go/v2	v2.27.0	h1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc/RRZhKA/2g0=
dep	github.com/gorilla/handlers	v1.5.2	h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
dep	github.com/gorilla/mux	v1.8.1	h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
dep	github.com/grpc-ecosystem/grpc-gateway/v2	v2.32.0	h1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=
dep	github.com/huandu/xstrings	v1.6.3	h1:7997PcI0mYC9uPNBJ7udg/KrdJh1GhJid8f2tzKFHYQ=
dep	github.com/klauspost/compress	v1.20.3	h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
dep	github.com/klauspost/cpuid/v2	v2.4.1	h1:I9KxadAkvo+QjtcEE2f2tyfEvmIla/T0m+14PrZNl0U=
dep	github.com/libdns/libdns	v1.1.1	h1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS/P/U=
dep	github.com/manifoldco/promptui	v0.9.0	h1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=
dep	github.com/mattn/go-colorable	v0.1.16	h1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=
dep	github.com/mattn/go-isatty	v0.0.24	h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
dep	github.com/maypok86/otter	v1.2.4	h1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=
dep	github.com/maypok86/otter/v2	v2.4.0	h1:1XpRRWaq9DRIqZV7UtglS4VLzYKSsnFOQmzV+KZxLb0=
dep	github.com/mgutz/ansi	v0.0.0-20200706080929-d51e80ef957d	h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
dep	github.com/mholt/acmez/v3	v3.1.7	h1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=
dep	github.com/mholt/caddy-ratelimit	v0.1.0	h1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=
dep	github.com/miekg/dns	v1.1.73	h1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=
dep	github.com/mitchellh/copystructure	v1.2.0	h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
dep	github.com/mitchellh/go-ps	v1.0.0	h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
dep	github.com/mitchellh/reflectwalk	v1.0.2	h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
dep	github.com/munnerz/goautoneg	v0.0.0-20191010083416-a7dc8b61c822	h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
dep	github.com/nlnwa/whatwg-url	v0.6.2	h1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ/Q=
dep	github.com/nutsdb/nutsdb	v1.0.4	h1:BurzkxijXJY1/AkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=
dep	github.com/oasdiff/yaml	v0.1.1	h1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=
dep	github.com/oasdiff/yaml3	v0.0.14	h1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=
dep	github.com/pbnjay/memory	v0.0.0-20210728143218-7b4eea64cf58	h1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=
dep	github.com/pierrec/lz4/v4	v4.1.29	h1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=
dep	github.com/pires/go-proxyproto	v0.16.0	h1:9KYT/fM3wpjT8bdMEj/7FBcoiUG1KyzEjRYnPu+vz7A=
dep	github.com/pkg/errors	v0.9.1	h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
dep	github.com/pquerna/cachecontrol	v0.2.0	h1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=
dep	github.com/prometheus/client_golang	v1.25.0	h1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=
dep	github.com/prometheus/client_model	v0.6.3	h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
dep	github.com/prometheus/common	v0.72.1	h1:ZAiQed/nk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=
dep	github.com/prometheus/otlptranslator	v1.0.0	h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=
dep	github.com/prometheus/procfs	v0.23.0	h1:ad+S6FTkzwaMgacKLM5h6bNKExS+DMH0YiUwXItH/o4=
dep	github.com/quic-go/qpack	v0.6.0	h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
dep	github.com/quic-go/quic-go	v0.64.1	h1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=
dep	github.com/redis/go-redis/v9	v9.18.0	h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=
dep	github.com/rs/cors	v1.11.1	h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
dep	github.com/rs/xid	v1.6.0	h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
dep	github.com/russross/blackfriday/v2	v2.1.0	h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
dep	github.com/santhosh-tekuri/jsonschema/v6	v6.0.3	h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
dep	github.com/shopspring/decimal	v1.6.0	h1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=
dep	github.com/shurcooL/sanitized_anchor_name	v1.0.0	h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
dep	github.com/sirupsen/logrus	v1.10.2	h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
dep	github.com/slackhq/nebula	v1.11.2	h1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=
dep	github.com/smallstep/certificates	v0.30.2	h1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf/iQtA5QlN0Y=
dep	github.com/smallstep/cli-utils	v0.12.2	h1:lGzM9PJrH/qawbzMC/s2SvgLdJPKDWKwKzx9doCVO+k=
dep	github.com/smallstep/go-attestation	v0.4.9	h1:/fVmzB8A8tk7B2PCGPlszWzyl/GDcEQbynqcg2PMaZ0=
dep	github.com/smallstep/linkedca	v0.26.0	h1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=
dep	github.com/smallstep/nosql	v0.8.0	h1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli/XB4Jp4A=
dep	github.com/smallstep/pkcs7	v0.2.3	h1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=
dep	github.com/smallstep/scep	v0.0.0-20261014185058-63893dadfda8	h1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=
dep	github.com/smallstep/truststore	v0.13.0	h1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi/py4=
dep	github.com/spf13/cast	v1.10.0	h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
dep	github.com/spf13/cobra	v1.10.2	h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
dep	github.com/spf13/pflag	v1.0.10	h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
dep	github.com/tailscale/tscert	v0.0.0-20251216020129-aea342f6d747	h1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=
dep	github.com/tidwall/btree	v1.6.0	h1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=
dep	github.com/unrolled/secure	v1.17.0	h1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=
dep	github.com/urfave/cli	v1.22.17	h1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=
dep	github.com/x448/float16	v0.8.4	h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
dep	github.com/xujiajun/mmap-go	v1.0.1	h1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv/WHc=
dep	github.com/xujiajun/utils	v0.0.0-20220904132955-5f7c5b914235	h1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=
dep	github.com/yuin/goldmark	v1.8.6	h1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=
dep	github.com/yuin/goldmark-highlighting/v2	v2.0.0-20230729083705-37449abec8cc	h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=
dep	github.com/zeebo/blake3	v0.2.4	h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
dep	go.etcd.io/bbolt	v1.5.0	h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
dep	go.opentelemetry.io/auto/sdk	v1.2.1	h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
dep	go.opentelemetry.io/contrib/bridges/prometheus	v0.72.0	h1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w/1ROwHEM7M=
dep	go.opentelemetry.io/contrib/exporters/autoexport	v0.72.0	h1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=
dep	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.72.0	h1:LxwW/9ctSCv+QkE/cLR7M91ZIkXNMqJtEMi1vCw9U8s=
dep	go.opentelemetry.io/contrib/propagators/autoprop	v0.72.0	h1:/Kv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=
dep	go.opentelemetry.io/contrib/propagators/aws	v1.47.0	h1:n/2x/vQki1ojD7R2jYHdnNdI74Yx/OFdY4YXFFesm8M=
dep	go.opentelemetry.io/contrib/propagators/b3	v1.47.0	h1:vlKDmtjhe1R0d7kdov/+KVTKWOKeGLyohB+iXoDPRMQ=
dep	go.opentelemetry.io/contrib/propagators/jaeger	v1.47.0	h1:2lDw6AKPV33/7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=
dep	go.opentelemetry.io/contrib/propagators/ot	v1.47.0	h1:nZUqh0/8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=
dep	go.opentelemetry.io/otel	v1.47.0	h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=
dep	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc	v0.23.0	h1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=
dep	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp	v0.23.0	h1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI/nE=
dep	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc	v1.47.0	h1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=
dep	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	v1.47.0	h1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=
dep	go.opentelemetry.io/otel/exporters/otlp/otlptrace	v1.47.0	h1:julhjPeUH/q/7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=
dep	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	v1.47.0	h1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=
dep	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	v1.47.0	h1:aXZXsZ012wOgVkqaiQv+Z/d8V0xKjmg70F6m4CE94lc=
dep	go.opentelemetry.io/otel/exporters/prometheus	v0.69.0	h1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=
dep	go.opentelemetry.io/otel/exporters/stdout/stdoutlog	v0.23.0	h1:PW/E9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=
dep	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric	v1.47.0	h1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=
dep	go.opentelemetry.io/otel/exporters/stdout/stdouttrace	v1.47.0	h1:N3YQCxjxQ/bMjyc3heladfRm9t9RTksGQH8z4w6yU/0=
dep	go.opentelemetry.io/otel/log	v1.47.0	h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI=
dep	go.opentelemetry.io/otel/metric	v1.47.0	h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=
dep	go.opentelemetry.io/otel/sdk	v1.47.0	h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=
dep	go.opentelemetry.io/otel/sdk/log	v1.47.0	h1:W4N/ZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=
dep	go.opentelemetry.io/otel/sdk/metric	v1.47.0	h1:lfISg2j93VT6yqdk9OfUaZmw/GfcZqCCV3jdXtsPnKw=
dep	go.opentelemetry.io/otel/trace	v1.47.0	h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM=
dep	go.opentelemetry.io/proto/otlp	v1.11.1	h1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=
dep	go.step.sm/crypto	v0.91.0	h1:0mN0DwVOvUuh7VbyTnxABZuAkxwak/Grp8Y/b4YaZDU=
dep	go.uber.org/atomic	v1.11.0	h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
dep	go.uber.org/automaxprocs	v1.6.0	h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
dep	go.uber.org/multierr	v1.11.0	h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
dep	go.uber.org/zap	v1.28.0	h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
dep	go.uber.org/zap/exp	v0.3.0	h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
dep	go.yaml.in/yaml/v3	v3.0.5	h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
dep	golang.org/x/crypto	v0.58.0	h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
dep	golang.org/x/crypto/x509roots/fallback	v0.0.0-20261020153306-9f2b28d4331a	h1:V5oicZXS0oqZx30gY/apgSVD7YvNBfrIOdcMnlelJY4=
dep	golang.org/x/exp	v0.0.0-20261014143641-f0251eb4aa3e	h1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI/A=
dep	golang.org/x/net	v0.61.0	h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
dep	golang.org/x/oauth2	v0.37.0	h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
dep	golang.org/x/sync	v0.24.0	h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
dep	golang.org/x/sys	v0.49.0	h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
dep	golang.org/x/term	v0.47.0	h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
dep	golang.org/x/text	v0.43.0	h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
dep	golang.org/x/time	v0.16.0	h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
dep	google.golang.org/api	v0.308.0	h1:iGb+4qT3nVb3uuIzwor3yP2nyu+rMZr31PvLFiRNJQk=
dep	google.golang.org/genproto/googleapis/api	v0.0.0-20261019180522-ce908d29299b	h1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=
dep	google.golang.org/genproto/googleapis/rpc	v0.0.0-20261019180522-ce908d29299b	h1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=
dep	google.golang.org/grpc	v1.84.0	h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
dep	google.golang.org/protobuf	v1.36.12	h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
dep	gopkg.in/yaml.v3	v3.0.1	h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
build	-buildmode=exe
build	-compiler=gc
build	-ldflags="-w -s"
build	-tags=nobadger,nomysql,nopgx
build	CGO_ENABLED=1
build	CGO_CFLAGS="-I/usr/local/include/php -I/usr/local/include/php/main -I/usr/local/include/php/TSRM -I/usr/local/include/php/Zend -I/usr/local/include/php/ext -I/usr/local/include/php/ext/date/lib"
build	CGO_CPPFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
build	CGO_CXXFLAGS=
build	CGO_LDFLAGS="-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto"
build	GOARCH=amd64
build	GOOS=linux
build	GOAMD64=v1
Template

v2.0.0-alpha.53

2.0.0-alpha.53 - 2026-10-31

Upgrade notes

  • Bundle 2.0.0-alpha.40 and @cwa/nuxt 2.0.0-alpha.32 go together: take both in one deploy (api/composer.lock, api/config/reference.php, app/package.json, app/pnpm-lock.yaml). No migration.

    • Every write to CWA content (pages, layouts, routes, component groups and positions, components including /move, and page data, your own classes included) now needs publishable.permission (the template's is is_granted('ROLE_ADMIN')) or the class's #[Publishable(isGranted:)]. A project resource that anyone else writes needs extraProperties: ['publishable_permission' => false] on that operation. Form /submit stays public.
    • An email change now confirms at the new address, and setting newEmailAddress needs the signed-in user's own password as oldPassword (an admin changing another user's email enters their own). The module's admin user page sends it; a project's own change-email form must too. (merge)

Security

  • pnpm audit and composer audit (2026-10-31): nothing new besides the two below. Still accepted, not in the server output: deepmerge 4.3.1 (GHSA-gcqx-w48m-w2h4, low), @rollup/plugin-node-resolve's at build only, with no fix released.
  • Accepted, not in the server output: glob 10.5.0, 11.1.0 and 13.0.6 (GHSA-3g3m-2fjr-6pw4, moderate; archiver-utils, workbox-build and @vercel/nft at build only) and minimatch 5.1.9, 9.0.9 and 10.2.6 (GHSA-g3hv-75wg-m249, moderate; under them, filelist and readdir-glob). Both are fixed only in new majors (glob 14, minimatch 11) that their dependents don't allow; the production app image has them only in the Node image's own npm CLI. (commit)

Changed

  • api-components-bundle 2.0.0-alpha.40 (also: an email logo setting, emails.logo, and user fixes) and @cwa/nuxt 2.0.0-alpha.32 (the synchroniser runs only for admins; the admin user page sends oldPassword). (merge)
  • A release's create-cwa smoke test runs on its own image (#226): publish-php-base.yml calls create-cwa-smoke.yml once the release's cwa-php-base is tagged, failing (not skipping) without it, and publish-create-cwa.yml publishes only after that run passed. The push-time smoke jobs still skip on a release commit. Template CI only. (merge)
  • The php entrypoint retries composer install three times, 10 s apart, and a failed smoke test prints php's full log and how its network reaches api.github.com (#226). (merge)

cwa-php-base 2.0.0-alpha.53

Pin it as ghcr.io/components-web-app/cwa-php-base:2.0.0-alpha.53@sha256:8e373dbe54f8b8e7c2b25947c6a0bd24db3ef651c5da23f8487a61f95b057b64.

Verify it with:

gh attestation verify oci://ghcr.io/components-web-app/cwa-php-base:2.0.0-alpha.53 --repo components-web-app/components-web-app \
  --signer-workflow components-web-app/components-web-app/.github/workflows/publish-php-base.yml --source-ref refs/tags/v2.0.0-alpha.53
# Base images (from the build provenance)
pkg:docker/caddy@builder?platform=linux%2Famd64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0
pkg:docker/caddy@builder?platform=linux%2Farm64 sha256:c4cd20eaa0b69112fd5d4f721ffc9671687e1d5d0b155c8620cf7546dbef94c0
pkg:docker/docker/buildkit-syft-scanner@stable-1?platform=linux%2Famd64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315
pkg:docker/docker/buildkit-syft-scanner@stable-1?platform=linux%2Farm64 sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315
pkg:docker/docker/dockerfile@1 sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e
pkg:docker/dunglas/frankenphp@builder?platform=linux%2Famd64 sha256:47412b99ece26524ca61b457a1fdf69fc020e66a19eaa6b4165342f1b4dece44
pkg:docker/dunglas/frankenphp@builder?platform=linux%2Farm64 sha256:47412b99ece26524ca61b457a1fdf69fc020e66a19eaa6b4165342f1b4dece44
pkg:docker/dunglas/frankenphp@latest?platform=linux%2Famd64 sha256:c8abcc7925f16b1431f139d0410abe8f48db3fd862bacb646b05a4413337106a
pkg:docker/dunglas/frankenphp@latest?platform=linux%2Farm64 sha256:c8abcc7925f16b1431f139d0410abe8f48db3fd862bacb646b05a4413337106a

PHP 8.5.12 (cli) (built: Oct 28 2026 01:23:40) (ZTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.5.12, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies

[PHP Modules]
apcu
brotli
Core
ctype
curl
date
dom
exif
FFI
fileinfo
filter
gd
hash
iconv
intl
json
lexbor
libxml
mbstring
mysqlnd
openssl
pcre
PDO
pdo_pgsql
pdo_sqlite
Phar
posix
random
readline
Reflection
session
SimpleXML
sodium
SPL
sqlite3
standard
tokenizer
uri
xml
xmlreader
xmlwriter
xsl
Zend OPcache
zip
zlib

[Zend Modules]
Zend OPcache


go	go1.27.3
path	caddy
mod	caddy	(devel)	
dep	cel.dev/cel-go	v0.32.0	h1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=
dep	cel.dev/expr	v0.25.3	h1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=
dep	cloud.google.com/go/auth	v0.24.1	h1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=
dep	cloud.google.com/go/auth/oauth2adapt	v0.3.0	h1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=
dep	cloud.google.com/go/compute/metadata	v0.10.0	h1:pyKMUQSwchgkIBBJGdILqQbs/BNJXqwSA7Ej6LAvvtY=
dep	dario.cat/mergo	v1.0.2	h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
dep	filippo.io/bigmod	v0.1.0	h1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=
dep	filippo.io/edwards25519	v1.2.0	h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
dep	github.com/BurntSushi/toml	v1.6.0	h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
dep	github.com/DeRuina/timberjack	v1.4.9	h1:9RjDMSkUDQRYzwVNB/FLonXNurcZVEh9sK43m2jw3A4=
dep	github.com/KimMachineGun/automemlimit	v1.0.1	h1:87PowSIJFht5TmyyZKJNR4y2v7Cm9OdCzsSMR8jXJHM=
dep	github.com/Masterminds/goutils	v1.1.1	h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
dep	github.com/Masterminds/semver/v3	v3.5.0	h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
dep	github.com/Masterminds/sprig/v3	v3.3.0	h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
dep	github.com/MauriceGit/skiplist	v0.0.0-20211105230623-77f5c8d3e145	h1:1yw6O62BReQ+uA1oyk9XaQTvLhcoHWmoQAgXmDFXpIY=
dep	github.com/MicahParks/jwkset	v0.11.3	h1:Phli4RdTDdIdLXZpuO7abkwZyzIk0RDTUPVVBHPRdkQ=
dep	github.com/MicahParks/keyfunc/v3	v3.8.2	h1:eydEwk/pBAVrDIpmFfB/gkCcrp++xQ7YYXirrI2zlWE=
dep	github.com/RoaringBitmap/roaring/v2	v2.30.0	h1:1sD4xsCenNd9n/gOWaExCWanP9WTyiNuqLAvaDQ5jkY=
dep	github.com/alecthomas/chroma/v2	v2.27.0	h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
dep	github.com/antlabs/stl	v0.0.1	h1:TRD3csCrjREeLhLoQ/supaoCvFhNLBTNIwuRGrDIs6Q=
dep	github.com/antlabs/timer	v0.0.11	h1:z75oGFLeTqJHMOcWzUPBKsBbQAz4Ske3AfqJ7bsdcwU=
dep	github.com/antlr4-go/antlr/v4	v4.13.1	h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
dep	github.com/aryann/difflib	v0.0.0-20210328193216-ff5ff6dc229b	h1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=
dep	github.com/beorn7/perks	v1.0.1	h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
dep	github.com/bits-and-blooms/bitset	v1.26.0	h1:WPvcPZbP1yuKofmjs2SYIFO1EjzIGhCP9ducElLsh5Q=
dep	github.com/bwmarrin/snowflake	v0.3.0	h1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=
dep	github.com/caddyserver/caddy/v2	v2.11.7	h1:yj0Y4fYZGPkSvibBJ1sTWE33xC0fxztVyXEW5iIdUT4=
dep	github.com/caddyserver/certmagic	v0.25.6	h1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=
dep	github.com/caddyserver/zerossl	v0.1.6	h1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT/4REW//lsas=
dep	github.com/ccoveille/go-safecast/v2	v2.0.1	h1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=
dep	github.com/cenkalti/backoff/v5	v5.0.3	h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
dep	github.com/cespare/xxhash/v2	v2.3.0	h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
dep	github.com/chzyer/readline	v1.5.1	h1:upd/6fQk4src78LMRzh5vItIt361/o4uq553V8B5sGI=
dep	github.com/cloudflare/circl	v1.6.5	h1:O64F26HEqNhznd/hrC5KZXVKYuKM2rx4deZDTc4ihQA=
dep	github.com/components-web-app/components-web-app/api/frankenphp/caddy/queryallowlist	v0.0.0-20261031205830-3ebcdeeed2ad
=>	/tmp/queryallowlist	(devel)	

dep	github.com/coreos/go-oidc/v3	v3.21.0	h1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=
dep	github.com/cpuguy83/go-md2man/v2	v2.0.7	h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
dep	github.com/darkweak/souin	v1.7.9
=>	/tmp/souin	(devel)	

dep	github.com/darkweak/souin/plugins/caddy	v1.7.9	h1:RZGX+EObyH5rBdzSyX0nmpfV4Nu2p2PEsKubW9nJdDQ=
dep	github.com/darkweak/storages/badger	v0.0.21	h1:i1M9mz0lVKm4GXLnayw2i8Huh2jv7M/JRc+zhN7Wsx0=
dep	github.com/darkweak/storages/badger/caddy	v0.0.22	h1:4/byA4HKcuPKOvQKFGKTTAKHlypjC8SOCJs9rvBN7ao=
dep	github.com/darkweak/storages/core	v0.0.21	h1:zfa0Bqzdm9/oPQiG6pEKHhfP1jAj6cfUvByb8tnwrZE=
dep	github.com/darkweak/storages/go-redis	v0.0.22
=>	/tmp/storages-go-redis	(devel)	

dep	github.com/darkweak/storages/go-redis/caddy	v0.0.22	h1:tNjW02dMpgvktkh2PJsh2E4SobUaKCNF5UDD+3PoIEE=
dep	github.com/darkweak/storages/nuts	v0.0.21	h1:79COG49RUc5v+3lLKELoNfGgJX1xYzAOJi13Eb8PpEo=
dep	github.com/darkweak/storages/nuts/caddy	v0.0.22	h1:kg/HYShNqwbjTyrs91I3eNTViSgCvBGFoBz5uRv6a+E=
dep	github.com/darkweak/storages/otter	v0.0.21	h1:Rb69g8l4t7HfX1r0FCDHixDe+GLl2Sp+aO0JRLe1NXQ=
dep	github.com/darkweak/storages/otter/caddy	v0.0.22	h1:YcE7a6x+gtz0VarMno9nbA35gKwg0lgqmnJUm2Yso3o=
dep	github.com/dgraph-io/badger/v4	v4.9.1	h1:DocZXZkg5JJHJPtUErA0ibyHxOVUDVoXLSCV6t8NC8w=
dep	github.com/dgraph-io/ristretto/v2	v2.2.0	h1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=
dep	github.com/dgryski/go-rendezvous	v0.0.0-20200823014737-9f7001d12a5f	h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
dep	github.com/dlclark/regexp2/v2	v2.10.0	h1:zSNli+yyb7Rg4VzzLiZuJ3eZup/OObARXm/qs1a2//c=
dep	github.com/dolthub/maphash	v0.1.0	h1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L/QxPDyQ=
dep	github.com/dunglas/caddy-cbrotli	v1.0.1	h1:mkg7EB1GmoyfBt3kY3mq4o/0bfnBeq7ZLQjmVmdBE3Y=
dep	github.com/dunglas/frankenphp	v1.13.4	h1:MK45+Ai4Hnd+/V3fpcFNXh5JknkOx+VIbmThLgHiDrw=
dep	github.com/dunglas/frankenphp/caddy	v1.13.4	h1:PY4Q1l5CJM6ZfWeKU+dTeo4b8DHjoJ923ik+ugHU9NM=
dep	github.com/dunglas/go-urlpattern	v1.0.0	h1:AmMwIDXWJFezeE1v38rxvQRGvvzTlityFuifLLVfoQQ=
dep	github.com/dunglas/httpsfv	v1.1.2	h1:432E+FKy2DLMbVcZeAnOuM7nhyJ4vTiH7b9iXJ/Dkmc=
dep	github.com/dunglas/mercure	v1.1.5	h1:SlEUgMTiQst0zhx4HlPKuo95GRZM6bHCrxH1Me7jQ4M=
dep	github.com/dunglas/mercure/caddy	v1.1.5	h1:Rl1Xh55YwZkFisNnlEZNLpLDL97bfdePSktcbhNb/RU=
dep	github.com/dunglas/skipfilter	v1.2.0	h1:J7/RXRxEx3t+DEu2Zt8ISsRuptbUFOWHEIzWIjraqRM=
dep	github.com/dunglas/vulcain	v1.4.5	h1:vO7CS3/KwQQNquh0gMjX8BeWhXkVxa4a2+55Qdz4AUg=
dep	github.com/dunglas/vulcain/caddy	v1.4.5	h1:2qzg18nEkpsc1QIvpNn/oztSHRxY1/G6xuxylxVobGY=
dep	github.com/dustin/go-humanize	v1.1.0	h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
dep	github.com/e-dant/watcher	v0.0.0-20260223030516-06f84a1314be	h1:vqHrvilasyJcnru/0Z4FoojsQJUIfXGVplte7JtupfY=
dep	github.com/elnormous/contenttype	v1.0.4	h1:FjmVNkvQOGqSX70yvocph7keC8DtmJaLzTTq6ZOQCI8=
dep	github.com/felixge/httpsnoop	v1.1.0	h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
dep	github.com/fxamacker/cbor/v2	v2.9.6	h1:NHZPxuUjJXQjX9itA785y/5NKSlI4HQ+S7noZsmI7hs=
dep	github.com/gammazero/deque	v0.2.1	h1:qSdsbG6pgp6nL7A0+K/B7s12mcCY/5l5SIUpMOl+dC0=
dep	github.com/getkin/kin-openapi	v0.152.0	h1:XRVo77lMRyOGMHf1paMu9lxX3wzuQDZeprssZJnz/x8=
dep	github.com/go-chi/chi/v5	v5.5.0	h1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=
dep	github.com/go-jose/go-jose/v3	v3.0.5	h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
dep	github.com/go-jose/go-jose/v4	v4.1.6	h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
dep	github.com/go-logr/logr	v1.4.4	h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
dep	github.com/go-logr/stdr	v1.2.2	h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
dep	github.com/go-openapi/jsonpointer	v1.0.2	h1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=
dep	github.com/gofrs/flock	v0.13.0	h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
dep	github.com/gofrs/uuid	v4.4.0+incompatible	h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=
dep	github.com/golang-jwt/jwt/v5	v5.3.1	h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
dep	github.com/google/brotli/go/cbrotli	v1.2.1	h1:3NEHODycoTQr6cCq/yYNyBqcuk9fKRjSuiADFy2V8h8=
dep	github.com/google/certificate-transparency-go	v1.4.0	h1:78uNaR2knzCoKKXXDSAGVkz9XPkDg5xXJRP9tP6+rr0=
dep	github.com/google/flatbuffers	v25.2.10+incompatible	h1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H/pNX4FP1v0Q=
dep	github.com/google/go-tpm	v0.9.8	h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
dep	github.com/google/go-tspi	v0.3.0	h1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=
dep	github.com/google/s2a-go	v0.1.11	h1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=
dep	github.com/google/uuid	v1.6.0	h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
dep	github.com/googleapis/enterprise-certificate-proxy	v0.3.24	h1:G9iCJIY+AYVmUskKdjX8FVy7sG+nbzjOQ41cvlmhcvg=
dep	github.com/googleapis/gax-go/v2	v2.27.0	h1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc/RRZhKA/2g0=
dep	github.com/gorilla/handlers	v1.5.2	h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
dep	github.com/gorilla/mux	v1.8.1	h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
dep	github.com/grpc-ecosystem/grpc-gateway/v2	v2.32.0	h1:QMILzF8BA7xftE4zVORkRrlv08m12St3csK4RsyRgRs=
dep	github.com/huandu/xstrings	v1.6.3	h1:7997PcI0mYC9uPNBJ7udg/KrdJh1GhJid8f2tzKFHYQ=
dep	github.com/klauspost/compress	v1.20.3	h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
dep	github.com/klauspost/cpuid/v2	v2.4.1	h1:I9KxadAkvo+QjtcEE2f2tyfEvmIla/T0m+14PrZNl0U=
dep	github.com/libdns/libdns	v1.1.1	h1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS/P/U=
dep	github.com/manifoldco/promptui	v0.9.0	h1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=
dep	github.com/mattn/go-colorable	v0.1.16	h1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=
dep	github.com/mattn/go-isatty	v0.0.24	h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
dep	github.com/maypok86/otter	v1.2.4	h1:HhW1Pq6VdJkmWwcZZq19BlEQkHtI8xgsQzBVXJU0nfc=
dep	github.com/maypok86/otter/v2	v2.4.0	h1:1XpRRWaq9DRIqZV7UtglS4VLzYKSsnFOQmzV+KZxLb0=
dep	github.com/mgutz/ansi	v0.0.0-20200706080929-d51e80ef957d	h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
dep	github.com/mholt/acmez/v3	v3.1.7	h1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=
dep	github.com/mholt/caddy-ratelimit	v0.1.0	h1:73lOvdSLSoBGPT5l61nrTzh9liax+IDfXeQDtfzNcZ4=
dep	github.com/miekg/dns	v1.1.73	h1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=
dep	github.com/mitchellh/copystructure	v1.2.0	h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
dep	github.com/mitchellh/go-ps	v1.0.0	h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
dep	github.com/mitchellh/reflectwalk	v1.0.2	h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
dep	github.com/munnerz/goautoneg	v0.0.0-20191010083416-a7dc8b61c822	h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
dep	github.com/nlnwa/whatwg-url	v0.6.2	h1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ/Q=
dep	github.com/nutsdb/nutsdb	v1.0.4	h1:BurzkxijXJY1/AkIXe1ek+U1ta3WGi6nJt4nCLqkxQ8=
dep	github.com/oasdiff/yaml	v0.1.1	h1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=
dep	github.com/oasdiff/yaml3	v0.0.14	h1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=
dep	github.com/pbnjay/memory	v0.0.0-20210728143218-7b4eea64cf58	h1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=
dep	github.com/pierrec/lz4/v4	v4.1.29	h1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=
dep	github.com/pires/go-proxyproto	v0.16.0	h1:9KYT/fM3wpjT8bdMEj/7FBcoiUG1KyzEjRYnPu+vz7A=
dep	github.com/pkg/errors	v0.9.1	h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
dep	github.com/pquerna/cachecontrol	v0.2.0	h1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=
dep	github.com/prometheus/client_golang	v1.25.0	h1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=
dep	github.com/prometheus/client_model	v0.6.3	h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
dep	github.com/prometheus/common	v0.72.1	h1:ZAiQed/nk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y=
dep	github.com/prometheus/otlptranslator	v1.0.0	h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=
dep	github.com/prometheus/procfs	v0.23.0	h1:ad+S6FTkzwaMgacKLM5h6bNKExS+DMH0YiUwXItH/o4=
dep	github.com/quic-go/qpack	v0.6.0	h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
dep	github.com/quic-go/quic-go	v0.64.1	h1:BCNTP+6x6++OPKrGST2FR3f1tycx8O3QOA3QQv09g70=
dep	github.com/redis/go-redis/v9	v9.18.0	h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=
dep	github.com/rs/cors	v1.11.1	h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
dep	github.com/rs/xid	v1.6.0	h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
dep	github.com/russross/blackfriday/v2	v2.1.0	h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
dep	github.com/santhosh-tekuri/jsonschema/v6	v6.0.3	h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
dep	github.com/shopspring/decimal	v1.6.0	h1:DcTwjCj4tJPLuGZYsR9W0hyX9pQwMIkdo26Ig1T9xX4=
dep	github.com/shurcooL/sanitized_anchor_name	v1.0.0	h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
dep	github.com/sirupsen/logrus	v1.10.2	h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
dep	github.com/slackhq/nebula	v1.11.2	h1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=
dep	github.com/smallstep/certificates	v0.30.2	h1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf/iQtA5QlN0Y=
dep	github.com/smallstep/cli-utils	v0.12.2	h1:lGzM9PJrH/qawbzMC/s2SvgLdJPKDWKwKzx9doCVO+k=
dep	github.com/smallstep/go-attestation	v0.4.9	h1:/fVmzB8A8tk7B2PCGPlszWzyl/GDcEQbynqcg2PMaZ0=
dep	github.com/smallstep/linkedca	v0.26.0	h1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=
dep	github.com/smallstep/nosql	v0.8.0	h1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli/XB4Jp4A=
dep	github.com/smallstep/pkcs7	v0.2.3	h1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=
dep	github.com/smallstep/scep	v0.0.0-20261014185058-63893dadfda8	h1:zgVu63OduupjsN62avqOI6Xber8K2ZLL4wYn7TycZn4=
dep	github.com/smallstep/truststore	v0.13.0	h1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi/py4=
dep	github.com/spf13/cast	v1.10.0	h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
dep	github.com/spf13/cobra	v1.10.2	h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
dep	github.com/spf13/pflag	v1.0.10	h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
dep	github.com/tailscale/tscert	v0.0.0-20251216020129-aea342f6d747	h1:RnBbFMmodYzhC6adOjTbtUQXyzV8dcvKYbolzs6Qch0=
dep	github.com/tidwall/btree	v1.6.0	h1:LDZfKfQIBHGHWSwckhXI0RPSXzlo+KYdjK7FWSqOzzg=
dep	github.com/unrolled/secure	v1.17.0	h1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=
dep	github.com/urfave/cli	v1.22.17	h1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=
dep	github.com/x448/float16	v0.8.4	h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
dep	github.com/xujiajun/mmap-go	v1.0.1	h1:7Se7ss1fLPPRW+ePgqGpCkfGIZzJV6JPq9Wq9iv/WHc=
dep	github.com/xujiajun/utils	v0.0.0-20220904132955-5f7c5b914235	h1:w0si+uee0iAaCJO9q86T6yrhdadgcsoNuh47LrUykzg=
dep	github.com/yuin/goldmark	v1.8.6	h1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=
dep	github.com/yuin/goldmark-highlighting/v2	v2.0.0-20230729083705-37449abec8cc	h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=
dep	github.com/zeebo/blake3	v0.2.4	h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
dep	go.etcd.io/bbolt	v1.5.0	h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
dep	go.opentelemetry.io/auto/sdk	v1.2.1	h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
dep	go.opentelemetry.io/contrib/bridges/prometheus	v0.72.0	h1:OUIUu7ovHCEvG4IE5LQd2PNBH2eVYh50w/1ROwHEM7M=
dep	go.opentelemetry.io/contrib/exporters/autoexport	v0.72.0	h1:TPXrl7vEkmh69tp7dHTpz+Y6AUenFg1Du3Nx3a6dlxY=
dep	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.72.0	h1:LxwW/9ctSCv+QkE/cLR7M91ZIkXNMqJtEMi1vCw9U8s=
dep	go.opentelemetry.io/contrib/propagators/autoprop	v0.72.0	h1:/Kv8DucXan87cGRpa3NeZtlk26kFahF2YrL6Sz3GFsI=
dep	go.opentelemetry.io/contrib/propagators/aws	v1.47.0	h1:n/2x/vQki1ojD7R2jYHdnNdI74Yx/OFdY4YXFFesm8M=
dep	go.opentelemetry.io/contrib/propagators/b3	v1.47.0	h1:vlKDmtjhe1R0d7kdov/+KVTKWOKeGLyohB+iXoDPRMQ=
dep	go.opentelemetry.io/contrib/propagators/jaeger	v1.47.0	h1:2lDw6AKPV33/7Qw9oN5YdxuSJIlUz7q3tkfSlJX5rh0=
dep	go.opentelemetry.io/contrib/propagators/ot	v1.47.0	h1:nZUqh0/8CMRh7fQMfJl3HWFW92vqJ4FcTRQ7lrubOO4=
dep	go.opentelemetry.io/otel	v1.47.0	h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=
dep	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc	v0.23.0	h1:5Ek4qQ5XX0PSQfY7lMW3CvcR36yy8YFDfGnYnaku8zE=
dep	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp	v0.23.0	h1:5WVp40k2fJHuc5BtNTgKk+EugKFT8Eg3lywFfCPI/nE=
dep	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc	v1.47.0	h1:LaLVGJtIzHcvHjVs2OftmKcc+M9mdOqS8vZ1fBD1Yes=
dep	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	v1.47.0	h1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=
dep	go.opentelemetry.io/otel/exporters/otlp/otlptrace	v1.47.0	h1:julhjPeUH/q/7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=
dep	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	v1.47.0	h1:UFpxOpYPmMNUtOWhdb+nC1WELIgVf8z9higURrbzYU4=
dep	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	v1.47.0	h1:aXZXsZ012wOgVkqaiQv+Z/d8V0xKjmg70F6m4CE94lc=
dep	go.opentelemetry.io/otel/exporters/prometheus	v0.69.0	h1:LQVBTGnHvzrfGJpDoCSVTY7eaLZArvaTSq5l84Skxew=
dep	go.opentelemetry.io/otel/exporters/stdout/stdoutlog	v0.23.0	h1:PW/E9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=
dep	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric	v1.47.0	h1:ww5DYBpMKcqLdxjWrhGUIh6O+ZfvZUaMk4niVyNQPEQ=
dep	go.opentelemetry.io/otel/exporters/stdout/stdouttrace	v1.47.0	h1:N3YQCxjxQ/bMjyc3heladfRm9t9RTksGQH8z4w6yU/0=
dep	go.opentelemetry.io/otel/log	v1.47.0	h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI=
dep	go.opentelemetry.io/otel/metric	v1.47.0	h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=
dep	go.opentelemetry.io/otel/sdk	v1.47.0	h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=
dep	go.opentelemetry.io/otel/sdk/log	v1.47.0	h1:W4N/ZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=
dep	go.opentelemetry.io/otel/sdk/metric	v1.47.0	h1:lfISg2j93VT6yqdk9OfUaZmw/GfcZqCCV3jdXtsPnKw=
dep	go.opentelemetry.io/otel/trace	v1.47.0	h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM=
dep	go.opentelemetry.io/proto/otlp	v1.11.1	h1:SCrPqH9NE5CmBrOqpjNCiT0X5mGwMyGERXdogfR7Yjw=
dep	go.step.sm/crypto	v0.91.0	h1:0mN0DwVOvUuh7VbyTnxABZuAkxwak/Grp8Y/b4YaZDU=
dep	go.uber.org/atomic	v1.11.0	h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
dep	go.uber.org/automaxprocs	v1.6.0	h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
dep	go.uber.org/multierr	v1.11.0	h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
dep	go.uber.org/zap	v1.28.0	h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
dep	go.uber.org/zap/exp	v0.3.0	h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
dep	go.yaml.in/yaml/v3	v3.0.5	h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
dep	golang.org/x/crypto	v0.58.0	h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
dep	golang.org/x/crypto/x509roots/fallback	v0.0.0-20261020153306-9f2b28d4331a	h1:V5oicZXS0oqZx30gY/apgSVD7YvNBfrIOdcMnlelJY4=
dep	golang.org/x/exp	v0.0.0-20261014143641-f0251eb4aa3e	h1:HgI6W1OolKK6tcV74is+rl9SMT0njsHlp0TbQiGXI/A=
dep	golang.org/x/net	v0.61.0	h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
dep	golang.org/x/oauth2	v0.37.0	h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
dep	golang.org/x/sync	v0.24.0	h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
dep	golang.org/x/sys	v0.49.0	h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
dep	golang.org/x/term	v0.47.0	h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
dep	golang.org/x/text	v0.43.0	h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
dep	golang.org/x/time	v0.16.0	h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
dep	google.golang.org/api	v0.308.0	h1:iGb+4qT3nVb3uuIzwor3yP2nyu+rMZr31PvLFiRNJQk=
dep	google.golang.org/genproto/googleapis/api	v0.0.0-20261019180522-ce908d29299b	h1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=
dep	google.golang.org/genproto/googleapis/rpc	v0.0.0-20261019180522-ce908d29299b	h1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=
dep	google.golang.org/grpc	v1.84.0	h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
dep	google.golang.org/protobuf	v1.36.12	h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
dep	gopkg.in/yaml.v3	v3.0.1	h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
build	-buildmode=exe
build	-compiler=gc
build	-ldflags="-w -s"
build	-tags=nobadger,nomysql,nopgx
build	CGO_ENABLED=1
build	CGO_CFLAGS="-I/usr/local/include/php -I/usr/local/include/php/main -I/usr/local/include/php/TSRM -I/usr/local/include/php/Zend -I/usr/local/include/php/ext -I/usr/local/include/php/ext/date/lib"
build	CGO_CPPFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
build	CGO_CXXFLAGS=
build	CGO_LDFLAGS="-Wl,-O1 -pie -lreadline -lncurses -lm -lpthread -lxml2 -lssl -lcrypto -lsqlite3 -lz -lcurl -lxml2 -lonig -lsqlite3 -lxml2 -largon2 -lrt -ldl -lxml2 -lxml2 -lxml2 -lz -lssl -lcrypto"
build	GOARCH=amd64
build	GOOS=linux
build	GOAMD64=v1
Nuxt module

v2.0.0-alpha.32

  • Changing a user's email in the admin asks for your own current password and sends it as oldPassword; a wrong or missing password is shown on the field. Needs api-components-bundle 2.0.0-alpha.40, which also sends the email-change confirmation to the new address (#451, #449)
  • The component group synchroniser only creates or updates groups for an admin; a signed-in non-admin's page load no longer sends writes that api-components-bundle#569 refuses with a 403 (#450, #448)
  • An admin can select and move a page-data slot's component straight after navigating between pages that share a template; before, a component the manifest showed before the position's re-fetch landed was not counted as the position's, so its clicks missed the position and Move said "Nothing can be placed here" (#445, #443)
  • Dependencies updated to their latest versions, including set-cookie-parser 3.2.2 (d83192bb)
API bundle

2.0.0-alpha.40

Breaking

  • Writing CWA content (pages, layouts, routes, component groups and their order, component positions, every component including /move, and every page data class, project classes included) requires publishable.permission (or the class's #[Publishable(isGranted:)]), ANDed with any security the operation already has; opt an operation or resource out with extraProperties: ['publishable_permission' => false]. Form /submit stays public (#579)
  • An email change's confirmation link goes to the new address instead of the current one, and setting newEmailAddress needs the signed-in user's current password as oldPassword on API writes and in NewEmailAddressType (a super admin enters their own; a cancel needs none) (#580)

Added

  • emails.logo (a Twig path, default the bundle's logo) and emails.logo_width (pixels, optional) set the logo at the top of every email the bundle sends, whose alt text is now the website_name instead of Logo (#576)
  • A notice to the current address when an email change is requested, with the new address masked and no link; user.emails.change_email_notice sets its subject or disables it (#580)

Fixed

  • A user referenced by IRI from another resource's write is no longer processed as a new registration, which reset their emailAddressVerified (#575)
  • A plainPassword set through the API is validated (6 to 4096 characters, 422 on plainPassword) before it is hashed, and setting a password no longer marks the email address verified; only a password reset does (#577)
  • User lookups trim the identifier, so a username or email address with a trailing space (a mobile keyboard's) still signs in and still finds the user for password reset and resend verification (#578)

The module's minimum bundle

Some @cwa/nuxt releases need a newer bundle. The table of the bundle each module release needs, and why, is in Module Setup › Bundle versions. The module's other requirements, such as its Nuxt version, are in Module Setup › Requirements.

Key Ideas

The handful of terms the guides use — layouts, pages, component groups, IRIs, uiComponent, page data and edit mode — each in a sentence or two.

Overview

How a CWA site works, from the request to the data model, caching and the admin. Who this section is for and the order to read it.