Repository navigation
release: v1.19.0 — named routes across a domain list, Symfony CVE bumps - #186
Merged
Merged
Conversation
Pages now serves the site from the custom domain's root, but the workflow still built it with DOCS_BASE=/hkm-kernel/ for the github.io sub-path. The HTML loaded and every stylesheet and script 404'd under /hkm-kernel/assets/, so the site rendered as unstyled HTML. Build with DOCS_BASE=/.
A group or route whose "domain" or "subdomain" is a list now keeps its route names. Each host's copy used to claim the name again, so the boot failed as soon as a route under the list was named, and a project serving one brand on several hosts had to copy the whole group per host. The copies of one declaration differ only in host, so the name still means one URL path. GroupExpander records where each route was declared, RouteCompiler::claimName() lets copies of the same declaration share a name, RouteIndex::names() indexes it under the first host, and a disabled copy no longer releases a name the other hosts still hold. Two separate declarations reusing a name still fail the boot. Bumps symfony/http-foundation to 8.1.9 (CVE-2026-108082) and symfony/expression-language to 7.4.21 (CVE-2026-109449), which were failing the required composer audit check.
hakeemRash
requested review from
Alshatri and
craftdevscommunity
as code owners
October 16, 2026 14:30
Alshatri
approved these changes
Oct 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Releases v1.19.0. Merging lands the
## [1.19.0]CHANGELOG heading onmain, which startsauto-release.yml(tag →release.yml→ Homebrew bump).Changed
domainorsubdomainlist keeps its route names."domain": ["brand.com", "vote.brand.com", "brand.local"]used to fail the boot as soon as any route under it was named, because every host's copy claimed the name again. A project serving one brand on several hosts had to copy the whole group per host. Now every copy carries the name. The copies differ only in host (same method, same path), so the name still means one URL path and a relativeroute()is right on every host.route()for such a name points at the first host: the firstdomain, orAPP_URLfor bare labels.routePolicy.disableno longer frees a name the other hosts still hold.Security
symfony/http-foundation8.1.9 (CVE-2026-108082) andsymfony/expression-language7.4.21 (CVE-2026-109449). Both were failing the requiredcomposer auditcheck. The lock diff touches only these two packages.Verified
composer auditis clean.