From c75253a3b06d2cf8a3345786ea25f5c3cac8ef03 Mon Sep 17 00:00:00 2001 From: Coysh Date: Thu, 6 Aug 2026 17:25:59 +0100 Subject: [PATCH] release: 1.7.1 - scheduled advisory scanning, nothing on the wire Nothing here changes what a site may send. No schema, no canonical string, no signing behaviour, no fixture - a 1.7.0 platform and a 1.7.0 connector are unaffected by taking it, and there is nothing to coordinate. What it carries is the scheduled dependency audit that merged after 1.7.0 was tagged, and the version and changelog entry that should have merged alongside it. Numbered as a patch because there is nothing new to go and use, which is the honest shape of most releases of a package this stable. --- CHANGELOG.md | 22 ++++++++++++++++++++++ composer.json | 2 +- src/Protocol.php | 2 +- 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ecd692d..b7b5e12 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,28 @@ This package is the wire contract between the Manager platform and the connector A change here is a change to what a site may send, so every entry says what was added and - more usefully - what was deliberately left out of it. +## 1.7.1 - 2026-08-06 + +Nothing on the wire moved. No schema, no canonical string, no signing behaviour, no fixture - a +`1.7.0` platform and a `1.7.0` connector are unaffected by taking this, and there is nothing to +coordinate. + +### Advisories are scanned on a schedule, not only when somebody opens a pull request + +`composer audit --locked` already ran on every pull request. The schedule is what was missing, and +for a package that changes as rarely as this one that is the whole gap: an advisory is published when +it is published, and a library nobody has needed to touch for a month was a month behind on knowing. + +Its own workflow rather than a `schedule:` on `ci.yml`, so it fails for exactly one reason. GitHub +emails the repository owner when a scheduled run fails, which is the alerting mechanism; +`workflow_dispatch` is there to run it by hand while investigating rather than waiting for Monday. + +No lockfile is committed here, this being a library, so `composer install` resolves fresh and the +audit reads the newest versions the constraints admit rather than a snapshot from whenever a file was +last touched. + +Actions are pinned to commits. `ci.yml` still uses moving tags and is worth correcting separately. + ## 1.7.0 `SchemaValidator` refused nothing at all when handed an empty JSON object. No schema changed; what diff --git a/composer.json b/composer.json index d0a247f..a1d233b 100644 --- a/composer.json +++ b/composer.json @@ -1,7 +1,7 @@ { "name": "coysh-digital/manager-protocol", "description": "Wire contract shared by the Manager platform and the Manager Connector for Craft CMS.", - "version": "1.7.0", + "version": "1.7.1", "type": "library", "license": "MIT", "keywords": [ diff --git a/src/Protocol.php b/src/Protocol.php index bd6faff..6693e9a 100644 --- a/src/Protocol.php +++ b/src/Protocol.php @@ -22,7 +22,7 @@ final class Protocol /** * @var string Package version. Independent of the platform and connector versions. */ - public const VERSION = '1.7.0'; + public const VERSION = '1.7.1'; /** * @var string Prefix on the canonical string a connector signs.