[rmcdaniel]

Prepares the next Waterline release so the standalone Symfony 7.4.23 security fix (#279) reaches users. Published 2.14.0 (latest GitHub Release) and 2.15.0 (Docker Hub only) images both ship http-foundation 7.4.21, http-kernel 7.4.14 and routing 7.4.13.

Why 2.16.0 and not 2.15.1: the 2.15.0 tag already exists (pre-fix, 275bd593), and main has features since then (#278 saved-view start-time filters, #281 shortened-failure notices, #288 schedule outcome fixes). Semver needs a minor.

Changes:

• Retarget the fixed release identity from 2.15.1 to 2.16.0 in every existing release surface: composer.json product-train (and branch alias to 2.16.x-dev), service-image.yml, service-image-publish.yml, oci_release.py, prepare-oci-publication.sh, check-registry-version.sh, their tests and docs/image-publication.md. Same shape as the 2.14.0 preparation (8498c14). No new workflow or process.
• Dated 2.16.0 CHANGELOG notes, leading with the security fix.
• The standalone lock is unchanged (SHA-256 bc2014dd…3e506, Symfony 7.4.23).
• The held scripts/ci/source-smoke-* fixtures stay bound to their sealed 2.15.1 inputs; they are not release surfaces.

Local checks: waterline_release_identity.py --release-version 2.16.0 verifies; test-oci-release.py, test-waterline-release-identity.py, test-installed-release-graph.py, test-release-example-contract.py, test-standalone-lock-contract.py, test-publication-docker-config.py, test-published-provenance.py pass.

Release plan after merge: annotated tag 2.16.0 on the merge commit → service-image.yml native build → dispatch service-image-publish.yml from main with that run's identities → automatic published-image qualification → GitHub Release → verify the published image's lock shows 7.4.23 → close #279. The current product tuple and SERVICE_MODE examples move after published acceptance, as with 2.14.0.

Refs #279.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
5 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

CI status: 33 of 35 checks pass. Complete database qualification (mssql) and Service request budget and browser recovery failed on 3 attempts (14:51–15:21 UTC) because hosted runners can't resolve the Ubuntu package mirrors (Temporary failure resolving 'azure.archive.ubuntu.com' / security.ubuntu.com) during apt-get. packages.microsoft.com resolves on the same runners. Neither job touches this diff, and both passed on main d3e26fc. Target branch qualification fails only because of them. Next: retry at ~15:50 UTC. If the mirrors are still unreachable, General decides whether to admin-merge (asked in chat).

[rmcdaniel]

Admin-merging under General's narrow approval (this PR only). The two failing jobs fail only because hosted runners can't resolve Ubuntu's package mirrors. The code isn't involved.

Job	Attempts (all same error)	Error
Complete database qualification (mssql)	a1, a2, a3, a4	E: Failed to fetch https://security.ubuntu.com/... Temporary failure resolving 'security.ubuntu.com' in install-sqlserver-odbc.sh
Service request budget and browser recovery	a1, a2, a3, a4	Temporary failure resolving 'azure.archive.ubuntu.com', then Playwright Failed to install browsers

Target branch qualification fails only because of these two. Both jobs passed on main d3e26fc (mssql, budget). This diff touches neither job, only version strings, the changelog and held-lane test fixtures. The other 33 checks pass. Cloud's release-308 build hit the same runner DNS failure.

No bypass after this merge: tag, native build, publish and published-image qualification must pass normally. Once the mirrors recover, I'll rerun mssql and the browser budget job on main and record the result on #279.