From 6a563a346e2ac889447253bf520c85490f2a9e2f Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 22 Aug 2026 06:10:13 +0000 Subject: [PATCH 1/3] chore(deps): refresh the shared Conduction locks hydra-gates v1.8.2 -> v1.9.0 nc-vue 2.10.1 -> 2.11.1 Lock-only: both packages are already declared with caret ranges that permit these versions, so nothing about what this app ACCEPTS changes - only what it currently resolves to. Opened by the weekly fleet shared-dependency bump, because a lock nobody re-resolves is a pin nobody chose. Merging is gated by this repository's own suite, deliberately: taking hydra-gates v1.8.1 added patchObject() to a published interface, which is a load-time fatal for any concrete double that implements it without the method. CI is the only thing that can tell a safe bump from that. --- composer.lock | 17 ++++++----------- package-lock.json | 6 +++--- 2 files changed, 9 insertions(+), 14 deletions(-) diff --git a/composer.lock b/composer.lock index 9bfbbdf7..df03ac60 100644 --- a/composer.lock +++ b/composer.lock @@ -2792,16 +2792,16 @@ }, { "name": "conduction/hydra-gates", - "version": "v1.8.2", + "version": "v1.9.0", "source": { "type": "git", "url": "https://github.com/ConductionNL/.github.git", - "reference": "3dfcd1e56d27bd06eaa98a9a66e377e7e14fe491" + "reference": "9801ffdbff17d05f0934742190742d733ac912b4" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/ConductionNL/.github/zipball/3dfcd1e56d27bd06eaa98a9a66e377e7e14fe491", - "reference": "3dfcd1e56d27bd06eaa98a9a66e377e7e14fe491", + "url": "https://api.github.com/repos/ConductionNL/.github/zipball/9801ffdbff17d05f0934742190742d733ac912b4", + "reference": "9801ffdbff17d05f0934742190742d733ac912b4", "shasum": "" }, "require": { @@ -2818,11 +2818,6 @@ "schemas": "hydra-gates/scripts/schemas" } }, - "autoload": { - "psr-4": { - "OCA\\OpenRegister\\Contract\\": "hydra-gates/contracts/" - } - }, "notification-url": "https://packagist.org/downloads/", "license": [ "EUPL-1.2" @@ -2845,9 +2840,9 @@ "support": { "docs": "https://github.com/ConductionNL/.github/blob/main/hydra-gates/README.md", "issues": "https://github.com/ConductionNL/.github/issues", - "source": "https://github.com/ConductionNL/.github/tree/v1.8.2" + "source": "https://github.com/ConductionNL/.github/tree/v1.9.0" }, - "time": "2026-08-20T09:37:12+00:00" + "time": "2026-08-22T00:30:18+00:00" }, { "name": "consolidation/annotated-command", diff --git a/package-lock.json b/package-lock.json index 4a7dfbb4..5643021d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2192,9 +2192,9 @@ } }, "node_modules/@conduction/nextcloud-vue": { - "version": "2.10.1", - "resolved": "https://registry.npmjs.org/@conduction/nextcloud-vue/-/nextcloud-vue-2.10.1.tgz", - "integrity": "sha512-4S2X+Bv6mGzQMfxZW8XJheJ8iFis+iJdrl3+hlchYl50qQ77TDWy2xsp9Dog+ggfOikfngzmJseF5kz2MHZt4A==", + "version": "2.11.1", + "resolved": "https://registry.npmjs.org/@conduction/nextcloud-vue/-/nextcloud-vue-2.11.1.tgz", + "integrity": "sha512-E5oB7KUXL2JO68nMItsmL8kepmx6omI6SqDnKm04U7y81ipRASeyyh9bIB9ViT8/yHsqjBIF2VkwnvIwcuTfFQ==", "license": "EUPL-1.2", "dependencies": { "@ckpack/vue-color": "^1.6.0", From cb6366a98b89084b5ea1f98c055e6ee534458932 Mon Sep 17 00:00:00 2001 From: Conduction Release Bot Date: Sat, 22 Aug 2026 09:43:47 +0200 Subject: [PATCH 2/3] fix(psalm): stub OpenRegister's contract, which v1.9.0 stopped autoloading MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hydra-gates v1.9.0 removed `OCA\OpenRegister\Contract\` from its runtime psr-4 autoload (ConductionNL/.github#531). The removal was correct — that prefix is longer than openregister's own, so a vendored copy in ANY app defined the contract for the whole process — but it was verified against PHPUnit only. Psalm never runs the test bootstrap; it resolves types through the composer autoload map. So the guarded require added to this app's bootstrap does nothing for it, and 213 UndefinedClass errors appeared for a class the app typehints but does not own. This is the same situation as the decidesk event stubs already in this file: a sibling Nextcloud app supplies the type at runtime, so it is absent from the analysis path and gets declared here. A stub teaches the analyser the shape without putting the class back into the runtime autoloader, which is what caused the original defect. Measured in this checkout on the real v1.9.0: 213 errors before, 0 after — "No errors found!", psalm exit 0. --- psalm.xml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/psalm.xml b/psalm.xml index 6c147fd6..60e83f60 100644 --- a/psalm.xml +++ b/psalm.xml @@ -16,6 +16,22 @@ + + +