[dependabot]

Bumps sympress/workflows/.github/workflows/dependency-canary.yml from 1.2.2 to 1.2.5.

Release notes

Sourced from sympress/workflows/.github/workflows/dependency-canary.yml's releases.

v1.2.5

What's Changed

• fix: audit immutable dependencies before build and verify releases independently by @​brianvarskonst in SymPress/workflows#39
• docs: pin the reviewed audit-isolated deployment workflow by @​brianvarskonst in SymPress/workflows#40

Full Changelog: SymPress/workflows@v1.2.4...v1.2.5

v1.2.4

The Dependencies job now transfers Composer package archives and sanitized Git object caches to the credential-free Build job. Private ZIP and source-only Git packages can be installed again with Composer networking disabled. Authentication, Git remotes and hooks are excluded; the final release does not contain the download caches.

No deployment or install secret is added to Build. Trusted deployment tools remain separate from the uploaded artifact. The deploy example points to a reviewed commit containing the cache fix.

Validated with native workflow/contract/artifact checks, actual private ZIP and Git installation without network, credentials or SSH-agent access, and the release-generator regressions.

v1.2.3

Fix the automatic-release template's Conventional Commits 10 compatibility and its locked installation step. The template now pairs preset 10.4.0 with the published, exactly pinned @semantic-release/release-notes-generator 15.0.0-beta.3 and its Writer 9 dependency. The native preset upgrade no longer fails patch, minor or breaking-change notes with the Writer 8 missing-helper error. No transitive major override is used.

The generator is an upstream prerelease, intentionally pinned rather than followed through a version range. Node must satisfy ^22.22.2 || >=24.15.0; the workflow's Node 24 default is compatible. Consumer custom writer options must migrate from Handlebars partials to Writer 9 rendering functions, and preset type options from hidden/bumpStrict to effect; see release documentation. Default public workflow inputs, outputs and permissions are unchanged.

Also copy the locked local bounded-braces archive into the release-tools directory before npm ci. The regression fixture now runs the shipped install shell rather than reconstructing the installation manually.

Validation: native patch/minor/breaking analysis and rendered links, default Angular rendering, and six actual local Git/semantic-release dry runs for fallback and consumer configurations. Shell/artifact contracts, interface checks, actionlint, documentation checks and moderate npm audits passed. Final PR checks, including CodeQL, passed. The actual Starter DDEV/browser consumer run passed against the production candidate; its final follow-up only strengthens test URL assertions. These fixtures do not publish a real consumer release or exercise npm publishing credentials.

Reviewed and merged through [PR #36](SymPress/workflows#36). The protected v1 alias advances to this release after main checks pass; consumers pinning an immutable commit must update explicitly.

Commits

• a044303 docs: pin the reviewed immutable audit deployment workflow
• 2ed4e3b fix: audit immutable dependencies before build and verify releases independently
• b6ee6d0 docs(deploy): pin the reviewed private-cache implementation
• 3a5e871 fix(ci): update TOML parser and isolate artifact fixture cache
• 97a03ad docs(deploy): describe the sanitized bare Composer cache precisely
• 19540d2 fix: reinstall private Composer packages in credential-free builds
• 8d06f70 test(release): verify complete generated link targets
• 22af090 fix(release): render preset 10 notes with supported tooling
• 4c41a59 chore(deps): bump conventional-changelog-conventionalcommits
• See full diff in compare view