chore(release): prepare v4.0.4

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## Unreleased
 
+## 4.0.4 - 2026-11-14
+
+### Fixed
+
+- Skip Composer virion preparation when building DevTools itself while keeping locked Composer packages available as configured build assets.
+- Accept full-SHA-pinned first-party GitHub Actions while continuing to require checkout credentials to be disabled.
+
 ## 4.0.3 - 2026-11-12
 
 ### Fixed

RELEASE_NOTES.md

@@ -1,16 +1,11 @@
-# DevTools 4.0.3
+# DevTools 4.0.4
 
-DevTools 4.0.3 hardens path validation, background build failures and localized diagnostics without changing the public command or manifest contracts.
+DevTools 4.0.4 fixes Composer dependency preparation when DevTools builds itself in automated workflows.
 
 ## Fixed
 
-- Preserve worker identifiers and typed responses when background jobs fail.
-- Keep source paths, Windows roots, locale identifiers and Composer PHP constraints intact across build and validation flows.
-- Reject unsafe virion paths, reserved Windows device names, duplicate manifest sections and external project paths.
-- Improve namespace reference detection for dynamic strings, reflection properties and compound function guards.
-- Preserve extracted files during rollback and create valid empty ZIP archives.
-- Localize diagnostics consistently across the CLI, workers, runtime loader and all 14 supported locales.
-- Clarify validation failures for PHPStan, YAML linting and unsupported PHP constraints.
+- Keep DevTools' locked Composer packages available as build assets without treating them as virions during its own build.
+- Accept full-SHA-pinned first-party GitHub Actions while requiring checkout credentials to remain disabled.
 
 ## Compatibility
 
@@ -19,8 +14,7 @@ DevTools 4.0.3 hardens path validation, background build failures and localized
 
 ## Upgrading
 
-- Replace `plugins/DevTools.phar` and restart the server.
-- No manifest or workflow changes are required for supported projects.
-- Projects using the existing DevTools workflows do not need configuration changes.
+- Projects using Composer-prepared BedrockNexus workflows should update to this release to build DevTools correctly.
+- Other projects do not need configuration changes.
 
 The release tag and checksum manifest are signed with the maintainer's GPG key. Verify `SHA256SUMS.txt.asc` before checking the downloaded assets against `SHA256SUMS.txt`.

composer.json

@@ -52,7 +52,7 @@
     },
     "extra": {
         "devtools": {
-            "release-version": "4.0.3"
+            "release-version": "4.0.4"
         }
     },
     "support": {

plugin.yml

@@ -1,5 +1,5 @@
 name: DevTools
-version: 4.0.3
+version: 4.0.4
 main: AxolotlBucketLabs\DevTools\DevTools
 api: 5.0.0
 load: STARTUP

tests/Validation/RepositoryMetadataTest.php

@@ -19,7 +19,7 @@
 
 final class RepositoryMetadataTest extends TestCase
 {
-	private const VERSION = '4.0.3';
+	private const VERSION = '4.0.4';
 	private const COMPATIBILITY_BUILDER_VERSION = '4.0.3';
 	private const PHP_ACTION_VERSION = '1.0.0';