Repository navigation
Conversation
Added a missing translation fetch (wordcode is already existing but not used)
…of just retired member.
…llow comments with email addresses.
…f applicable. Sort translations correctly. Show/hide password.
(cherry picked from commit ec4b029)
…in all cases. (cherry picked from commit 0dd7c69)
(cherry picked from commit 8fad344)
… (#558) Prod wrote every record at debug level to rotating files in the container (about 1.6 GB a day) plus an unbounded prod.deprecations.log (about 1.5 GB a day). Nothing reached docker logs, so errors never got to VictoriaLogs. - main: fingers_crossed at error, 404/405 excluded, 50-record buffer, JSON to php://stderr. Normal requests write nothing; a failing request writes the error plus its buffered context. - Deprecations go to their own handler whose path is the DEPRECATION_LOG env var, default /dev/null. Stage sets php://stderr; prod can turn it on with an env change and a restart, no new image. A summary of the last 2.5 days of prod deprecations is on #519. - Drop the syslog and file handlers (no syslog in the container, files are lost on each deploy). - SuggestLocationController::logSearchInfo() logged every suggestion at alert, which would trigger the error buffer on each request. Now debug. (cherry picked from commit 2f94d37)
…follow-up) (#559) Since #558, prod writes only errors (with their buffered request context). Warnings from requests that don't fail were no longer written anywhere. On 3.8.0 that was about 28k a day, and they pointed at real problems: the avatar fallback (#556, which members have unreadable avatar files), header injection in the language switcher (#550), undecodable sessions (#532). - warnings: a filter handler that passes only the warning level, straight to php://stderr as JSON, no buffer. Errors stay with "main", so an error is never written twice. A warning in a request that later fails appears twice (alone and as context of the error), about 400 requests a day. - Deprecations, notices and debug stay off. Volume: about 28k lines a day, about 20k once ROX-502 (alias.cache.ini warning) is fixed. (cherry picked from commit fa6a635)
…come/sysadmins-infra#654) (#564) /about/faq answered with a 302 to /faq and every page linked to /about/faq (footer, landing, search map, About submenu), so Google kept /about/faq as canonical and reported /faq as a duplicate, against the sitemap and canonical tag. The redirect is now a 301 and the links use faqs_overview. Also fixes the groups menu link about/faq/6 (404) to faq/6. (cherry picked from commit 5f5ff1b)
- Manticore commands: keep this base's versions (manticoresearch-php 4, table() API; main's code is for client 3). Port from main: forum index reads forums_posts.message with a LEFT JOIN on languages (8ea7efa; no dependency on the forum_trads view, see #560) and memory_limit -1 (#506). Not ported: main's geonames column rename to geoname_id; prod's column is geonameId, which this base already uses. - Member.php: back to this base's version. main's api-platform and @groups cleanups (9eb5030, 7db45bf) clash with this base's attributes; the #[Groups] here are Symfony Serializer attributes and stay.
- AvatarController: this base's version plus main's #548 fallback (log and serve the empty avatar when the file is missing or cannot be created); the membersphotos entry was already here. - LocaleController: this base's version plus main 0dd7c69 (absolute homepage URL when there is no referrer; the old code passed a RedirectResponse object to new RedirectResponse()). - Remove duplicate #[MapEntity] attributes in CommentController and LocaleController (repeated attributes make the route fail). - StatisticsModel: main's 1-hour cache with DBAL 4 fetchAssociative / fetchAllAssociative. - FaqController: /about/faq redirect as a #[Route] attribute. - forum:cleanup: #[AsCommand] again after main's cleanup commit. - SearchController: Routing\Attribute\Route.
(cherry picked from commit a441668)
(cherry picked from commit fcf9131)
(cherry picked from commit 4c1cf43)
(cherry picked from commit 6c8e691)
(cherry picked from commit 007022e)
(cherry picked from commit a111d0b)
(cherry picked from commit 002be53)
(cherry picked from commit 9759638)
(cherry picked from commit 32dd5d3)
(cherry picked from commit 229b4cf)
…red to icon. (cherry picked from commit e7286e0)
(cherry picked from commit 7690667)
(cherry picked from commit ff0b408)
(cherry picked from commit 0ad55a7)
(cherry picked from commit 5a56b53)
main a111d0b adds checkCommentSpam(); this base already has it, and the line-by-line merge broke the file.
The navigation's _logout_main route comes from security.route_loader.logout (config/routes/security.yaml), so it needs no controller route.
package.json, yarn.lock and webpack.config.js back to this base's versions (the automatic merge had brought in main's CKEditor 40 / FontAwesome 5 stack). Added only what the redesign needs: @fontsource/noto-sans (main 32dd5d3) and the block_highlight entry (main 4ce44da); password/showhide was already there.
… config/reference.php (#519) The automatic merge of main's api-platform cleanup added main's JWT bundle line to bundles.php; this base does not install the bundle. reference.php was generated by a local console run and is not tracked on this base.
main 6cfaac3 adds a find() override that LEFT JOINs the legs and their locations; Doctrine ORM 3 requires the typed parent signature.
Contributor
Author
|
End point of the test reached (stage image All 125
Stage compared with prod (logged out and logged in, 21 pages plus 13 member, conversation and gallery routes): same status codes and assets, comment order identical, home and login pixel-identical (the new header, logos and home page are in), Plausible on every layout. JS errors on Adaptations worth reviewing
One open product decision: Still draft: this branch replaces |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #519 (route C: upgrade the framework first, redesign the schema later). Target branch:
main.What this is
developat4a3b74550(2025-10-20) is the lastdevelopcommit that still runs on prod's database. One commit later (7ecf67c4c, "Introduce new member entity")developmoves the login and about 160 files to the newmembertable. At4a3b74550it already has Symfony 7.4, PHP 8.4 and Doctrine ORM 3, and its CI was green.On top of it, everything needed to run it the way prod runs:
docker/,docker-compose.yml,.trivyignore, image workflowsmain7.4.x-devto 7.4.20 releases (SYMFONY_REQUIRE=7.4.*), Twig, Guzzle patch releasescomposer update, audit clean300d2e2e2, #535)maincircle-flagsand@tomickigrzegorz/autocompletefrom npm (the GitHub sources need git in the build; the autocomplete commit no longer exists)developDB_*instead of aDATABASE_URLbuilt in.env; the session handler reuses the Doctrine connectionmaintranslations:add:missing: bind the three parametersdevelopParamConverterdocblocks to#[MapEntity](5 controllers)develop{username:member}on 23 routes (controller_resolver.auto_mappingis false)develop:in the conversation adaptersdevelophas the same bugerror500.html.twigtrans({username: ...})mainanddeveloppublic/images/logo_index_top.pngmainprofile.jsnull check for the language switchstageimage tagsTested on stage (prod data copy, 2026-10-09)
sha-cbf2c40: deploy and stage smoke tests green, Trivy 0 findings (OS, npm, Composer), no CRITICAL in the PHP log after deploy./faqand/feedback,/locale/fr404, visitors page redirect.mainhas the new header, logos and home page (2026-04-24, 2026-05-12); this branch hasdevelop's older header. That is part of the list below.Not ported yet
The 125
maincommits below are the porting list for this route. Some of the Docker and CI ones are already covered by takingmain's Docker layer and workflows. Each group would be its own reviewed PR onto this branch.125 commits on main that this branch does not have
Docker, CI and deploy (28)
6105114a82026-05-31 Update admin templates to align with current deployment.08e3e91892026-05-31 Update admin templates to align with current deployment.901b23a9c2026-08-03 Make master work on php8.2 and update docker setup accordingly.acb28089a2026-08-05 fix(docker): fix 5 bugs in Shevek's PHP 8.2 Docker setup (fix(docker): fix 5 bugs in Shevek's PHP 8.2 Docker setup #470)58fdc4a4b2026-08-15 feat(docker): production PHP-FPM/Nginx image, Manticore 6.3.8, OPcache preload, config split; fix mailer Reply-Tof856534fd2026-08-15 feat(docker): write /srv/VERSION from APP_VERSION build argef118ed2f2026-08-15 fix(ci): add SHA tag for Nginx image, include web_image in dispatch payload4446c68cf2026-08-20 fix(ci): bust apk layer cache + pin Trivy to v0.74.0c9d7e03fe2026-08-27 feat(docker): create feature/docker-master branch from master infra baselined082e2f202026-08-27 fix(ci): ignore CVE-2026-54164 - api-platform/core v2.x, no fix in v2 line1e5c62dea2026-08-27 fix(legacy-mvc): use DIR for entrypoints.json path158a337422026-09-04 feat: Add DevContainer configuration for local development (feat: Add DevContainer configuration for local development #484)6b41b74eb2026-09-05 ci: add missing build/ lib/ modules/ roxlauncher/ tools/ to build trigger paths33b1840302026-09-10 feat(analytics): add Plausible CE tracking script for beta.stage.bewelcome.org852f7d3c52026-09-13 fix(docker): warm Symfony cache for non-php-fpm containers79d9f5fed2026-09-15 ci: rename beta→stage workflow, add prod release workflow, run CI on docker-masterec459a4eb2026-10-02 fix(docker): refresh apk packages daily despite the layer cache; drop unused python3 (fix(docker): refresh apk packages daily despite the layer cache; drop unused python3 #538)06bc861bb2026-10-02 chore(trivy): drop the CVE-2026-58055 exception, nghttp2 is fixed (chore(trivy): drop the CVE-2026-58055 exception, nghttp2 is fixed #539)6e23fd3be2026-10-02 ci: run CI on PHP 8.3 and Node 20, bump PHP_CodeSniffer past CVE-2026-67434 (ci: run CI on PHP 8.3 and Node 20, bump PHP_CodeSniffer past CVE-2026-67434 #530)1298cf72c2026-10-08 chore(trivy): ignore CVE-2026-102633 until Alpine 3.24 ships libexpat 2.9.0 (chore(trivy): ignore CVE-2026-102633 until Alpine 3.24 ships libexpat 2.9.0 #562)b09768e942026-10-09 fix(docker): keep git and openssh-client out of the runtime image (fix(docker): keep git and openssh-client out of the runtime image #565)966e0a7fd2026-10-09 ci: build, CI and the GitLab mirror run from main (Rename feature/docker-master to main, make it the protected default branch #518) (ci: build, CI and the GitLab mirror run from main (#518) #567)43fb43a7d2026-10-09 ci: make the code checks runnable on main (Fix CI on feature/docker-master (future main): 8 jobs fail on every push #517) (ci: make the code checks runnable on main (#517) #572)6cc861f332026-10-09 fix(ci): PHP-Code-Sniffer and PHPCPD green on main (Fix CI on feature/docker-master (future main): 8 jobs fail on every push #517) (fix(ci): PHP-Code-Sniffer and PHPCPD green on main (#517) #574)18c74aa4c2026-10-09 fix(ci): PHPUnit green on main (Fix CI on feature/docker-master (future main): 8 jobs fail on every push #517) (fix(ci): PHPUnit green on main (#517) #575)20018d6722026-10-09 fix(ci): JS security check green on main (Fix CI on feature/docker-master (future main): 8 jobs fail on every push #517) (fix(ci): JS security check green on main (#517) #576)476cf78db2026-10-09 ci: skip image builds and the GitLab mirror on forks (Fix CI on feature/docker-master (future main): 8 jobs fail on every push #517) (ci: skip image builds and the GitLab mirror on forks (#517) #578)5e6bedb962026-10-09 ci: build the images on every pull request to main (CI: build the images (PHP, nginx, frontend) on every pull request #577) (ci: build the images on every pull request to main (#577) #579)Security and privacy (7)
23aae920e2024-04-27 Use session invalidation to force user logout to avoid re-activation of just retired member.58ceac4ff2026-08-15 fix(proxy): forward X-Forwarded-Proto so Symfony generates https:// URLs5fdbc73ad2026-08-27 fix(proxy): declare trusted_proxies/headers in framework.yaml; cookie_samesite lax0633769fb2026-08-27 fix(proxy): trusted_headers must be YAML list in Symfony 5.4, not env stringaa9ed3ee22026-08-27 chore: remove api-platform/core (unused, accumulating CVEs)777a5d0a02026-09-02 Migrate cron job to symfony command.3eb41314c2026-09-27 fix(session): keep members logged in for 7 days, remember-me samesite lax (fix(session): keep members logged in for 7 days, remember-me samesite lax #516)Mail (9)
65d53478e2023-07-10 Re-add comment notification emails.ec31a52062026-08-05 fix(mailer): use noreply@bewelcome.org as From to pass DMARC (fix(mailer): use noreply@bewelcome.org as From to pass DMARC #471)893caed0a2026-08-31 feat(newsletter): add List-Unsubscribe, Precedence, and one-click POST handler (feat(newsletter): add List-Unsubscribe headers and RFC 8058 one-click handler #488)8b547b40c2026-09-02 Use new logo in email notifications.741ceed2b2026-09-02 Opening pages from email notification in mobile browsers failed with stric setting.74529902e2026-09-09 feat(mailer): route bulk newsletters through dedicated news relayce458f1892026-09-09 fix(mailer): remove default_transport - not supported in Symfony 5.xd6aed15192026-09-13 fix(email): remove spurious < from anchor in request templatefd5df055a2026-10-02 feat(analytics): Plausible on every layout; signup, login, 404 and donation events; newsletter UTM (Analytics: Plausible missing on home, signup, login, profiles, legacy pages; track donations and newsletter campaigns #540) (feat(analytics): Plausible on every layout; signup, login, 404 and donation events; newsletter UTM (#540) #543)Frontend, layout and UX (10)
a441668322026-04-24 Add new logos everywhere. Update navigation and footer. New home page.fcf91311f2026-04-25 Fix menu for legacy pages like signup.c43ed79022026-04-25 Fix menu for pages that work without login.46fae7b9e2026-04-25 Fix menu for policy pages.4c1cf43372026-04-26 Fix menu overflow on legacy pages.6c8e691942026-05-06 Use new logo on error pages. Update yarn.lock for browserslist.002be53782026-05-12 login access from header + redesign login pagee7286e0542026-05-31 Give full logo space to breath. Fix wordmark becoming too small compared to icon.0ad55a7782026-06-10 Make sure the member menu is right aligned.5a56b53502026-06-13 Update web preview images. Fix old logo in base-lite template.Bug fixes (29)
21b74aa3d2022-06-16 Fix not set entry in membersphots table.b87a565402024-04-27 Fix problem with user authentication and only report blank errors for form fields.18d1f2ff12024-04-27 Fix problem with user authentication and only report blank errors for form fields.a384058922026-04-26 Fix formatting of language dropdown.79fe269b92026-05-06 Fixing server errors due to wrong trans usage. Allow Ukrainian as translation language.0e0b7cbc02026-06-23 Fix redirect problems.3d6e26e7e2026-08-15 fix(fpm): increase PHP-FPM worker pool from 5 to 258ea7efaa02026-08-27 fix(manticore): fix geonames column name, forum query, and add negotiation dep9abfd8eab2026-08-27 fix(nginx): set HTTPS fastcgi param so legacy PHP detects HTTPS9eb5030412026-08-27 fix(api-platform): remove leftover bundle registration and annotations0109bda242026-08-27 fix: apply Shevek's review - bump APCu to 5.1.28, drop Phinx migration dead coded1836d9652026-08-30 Fix forum reply (MariaDB in safe mode; not default value for authorid)1a3d001ea2026-09-02 Fix broken range slider on signup and edit my profile page.0491b2bdc2026-09-05 fix(forum): use configured Manticore host/port for search045626d102026-09-06 fix(manticore): revert geoname_id → geonameid in SQL queries4868d2a9a2026-09-08 fix(php): set date.timezone to Europe/Berlin to match Lion and DBcc2281edd2026-09-16 fix(translation): handle missing DB schema gracefully during cache:clear67f1b71d72026-09-19 Fix manticore index generation.d6363ae9d2026-09-19 fix(manticore,nginx): fix geonames rebuild and font caching (fix(manticore,nginx): fix geonames rebuild and font caching #506)b25faacd22026-09-19 Fix display glitch on search location input.6cfaac3442026-09-21 Fix/feat: Always show trips even if legs' location is missing in database.4a1ac75c32026-09-22 Fix: Newly added translations were not imported.f66cc1ef52026-10-01 fix(upload): raise nginx and PHP upload limits to match Lion (8M) (fix(upload): raise nginx and PHP upload limits to match Lion (8M) #528)e18ea1fa22026-10-02 fix(public): serve the lion-only verification files; https for dev seed downloads (fix(public): serve the lion-only verification files; https for dev seed downloads #537)8fad344d02026-10-04 Fix ValueError for translations containing %.2f94d37af2026-10-05 fix(logging): prod logs errors to stderr, deprecations on demand ([High priority] Prod logs at debug level, about 2 GB/day in the container: port #499 logging config to feature/docker-master #524) (fix(logging): prod logs errors to stderr, deprecations on demand (#524) #558)5368d83462026-10-08 fix(seo): canonical tags, apex sitemap and valid robots.txt (sysadmins-infra#654) (fix(seo): canonical tags, apex sitemap and valid robots.txt (sysadmins-infra#654) #561)4e2339a542026-10-08 fix(terms): correct BeVolunteer RNA number (W353003546) (fix(terms): correct BeVolunteer RNA number (W353003546) #563)5f5ff1b902026-10-09 fix(seo): /about/faq is a permanent redirect, links go to /faq (BeWelcome/sysadmins-infra#654) (fix(seo): /about/faq is a permanent redirect, links go to /faq (sysadmins-infra#654) #564)Other (42)
51f0d0aed2023-07-10 Add flash that is shown if comment is locked.6d620c3442023-07-11 Set status to active after successful login (even if login was using remember me).ee51b7cfb2023-07-13 Show comment update on profile page and set ADMIN_CHECK for negative comments.c6c666b1f2024-04-27 Make /deleteprofile accessible without redirect from Play store compliance.ee911ab632026-05-06 Add blocked messages to the admin tools.007022ed72026-05-09 Force checkbox appearance.5860d89b32026-05-11 Add more constraints for activities.a111d0bb62026-05-11 Align master with production.9759638922026-05-13 Further align master and www.32dd5d34f2026-05-13 Move to Noto Sans and some alignment of master and www.229b4cfde2026-05-31 Align login forms. Fix signup date.7690667482026-06-06 Use full size sheet only for xs and sm screens.ff0b408772026-06-07 Use Noto Sans on /login as well.93157bfa92026-08-04 Use latest ACPu extension.4ce44da922026-08-13 Update formatting options for messages.4d0622f5d2026-08-15 perf(nginx): enable gzip and long-lived cache for hashed assets90137e8b62026-08-27 perf(homepage): cache statistics queries for 1 hour112fd85c42026-08-27 chore: remove api-platform Serializer normalizers left behind by 3dd46fc7db45bf3e2026-08-27 chore: remove unused @groups annotations from entitiesed15175202026-08-27 perf(trips): add bounding-box pre-filter before haversine GeoDistancef2cd5dfec2026-08-30 chore(db): pin MariaDB to 12.3 LTS (mariadb:lts tag)965102a022026-09-02 Rewrite to use only PHP 7.4 features.e255945742026-09-02 Add system to highlights.92297d20b2026-09-02 Add external contact info.5984133e32026-09-02 Set correct anchor (#external is referenced in tou).efabe053c2026-09-06 Remove SQL_CALC_FOUND_ROWS everywhere.5d265d2ef2026-09-06 Some cleanup in ForumCleanupCommand.96117b2ce2026-09-10 Removing spurious < from template.fc6bc398e2026-09-10 feat(analytics): parameterize Plausible script URL via PLAUSIBLE_SCRIPT_URL env var0249203aa2026-09-15 feat(analytics): add Plausible custom event tracking for key user actions70b7df3ec2026-09-19 Revert fix for display glitch (not effective).782c9ccee2026-09-20 Update LOCALES to include Armeniand28f0215f2026-09-20 Add necessary files to support Armenian in translations directory.02cf7e57c2026-09-20 Use object instances instead of static access for Mod_htmlpure.fcd8c91bc2026-09-21 Feat: Add znuny to the credits page. Closes Add znuny to the credits page #510.455c600642026-10-01 Add Ukrainian and fix display glitch in language dropdown.ec4b029392026-10-02 Use symfony translator instead of loading rows from the database.300d2e2e22026-10-02 Upgrade to Intervention image library v4.x and adapt image handling code accordingly.0dd7c69062026-10-04 Set absolute URL on empty referrer. Return a valid redirect response in all cases.af342242f2026-10-04 Backport fix for 548 to production source.fa6a635672026-10-05 feat(logging): write warnings to stderr in prod as they happen ([High priority] Prod logs at debug level, about 2 GB/day in the container: port #499 logging config to feature/docker-master #524 follow-up) (feat(logging): write warnings to stderr in prod as they happen (#524 follow-up) #559)43d64020d2026-10-09 style: bring src/ back in line with php-cs-fixer (Fix CI on feature/docker-master (future main): 8 jobs fail on every push #517) (style: bring src/ back in line with php-cs-fixer (#517) #573)Questions for review
4a3b74550the right base, or should this start from a laterdevelopcommit and keep the oldmemberstable some other way?main's flow until the schema step (as Privacy: member email addresses in /signup/resend URLs reach Plausible and logs (low priority) #541 suggests,develop's sign-up comes with the new tables)?mainsorts them (new experiences first),developshows the last 10. Which one?forum_tradsview fromVersion20200307133359then need another way into fresh databases (devcontainer, CI), for example a SQL file next tolanguages.sql.