Repository navigation
release(http): 0.1.0-beta7 — trusted-proxy client IP, upload-root race fix - #28
Merged
Merged
Conversation
- Toolchain: mago ^1.50, psalm ^6.19, igor-php ^0.9.7, plus every minor/patch update of the other direct dependencies (composer.lock refreshed). - CI: the canonical workflow from component-template — checkout v7, cache v6, codecov v7, TruffleHog pinned to v3.97.9, the igor job pinned to 0.9.7 and checked against the binary itself. - Dependabot: Composer and GitHub Actions, minor and patch updates only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- igor-php 0.9 adds detectors (writes through injected services, per-call spans, __destruct, superglobals). Each finding was checked against the code; these carry a method-level #[WorkerSafe] stating why nothing survives the request: GlobalsFactory::createFromGlobals, ::getParsedBody, ::createUploadedFilesFromGlobals, Stream::__destruct. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Workers that boot together race to create the same upload directory. The loser's mkdir() returned false and emitted "mkdir(): File exists" at every concurrent boot, as the EcoShield Gateway logs showed. The creation now runs under a scoped error handler, as FileCache::attempt() does (no @ operator), and the is_dir() re-check still throws when the directory really cannot be created. - Tests replay the lost race (php-mock is_dir) and a path squatted by a regular file; both fail with the fix reverted (failOnWarning). - Real boot check: an image built from the fix booted 3 x 4 workers with no warning, where the released beta6 image logged it from several workers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ClientIp\TrustedProxyClientIpResolver reads X-Forwarded-For only behind allow-listed proxies (IPs or CIDR, v4/v6), right to left; a client-prepended hop cannot win, a malformed hop falls back to REMOTE_ADDR. wfl dod http PASS (96.55 %), igor 0 KO. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The file declared the PHPUnit 10.2 schema URL while the suite runs on 12.5, so attributes such as displayDetailsOnPhpunitDeprecations were invalid against it and Infection refused the configuration. It now points at vendor/phpunit/phpunit/phpunit.xsd, which always matches the installed PHPUnit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The release is stamped in the CHANGELOG (## [0.1.0-beta7] — 2026-11, with its theme) and in the README's release line. Nothing else changes: the tag comes from the umbrella release wave. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The unit_tests job starts redis:7-alpine (the pin the umbrella's workspace job uses) and gives PHPUnit WAFFLE_TEST_REDIS_HOST=127.0.0.1. Until now the data and queue suites that talk to a real Redis were skipped on GitHub and ran only in the local gate. Same change in component-template and all 25 library components, so ci:check reports no drift. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… 2.16; lock refresh Every third-party package in composer.lock moves to its latest minor or patch release (PHPUnit 12.5.42); the waffle-commons/* entries wait for the release-day relock. CI pins igor 0.10.1 and TruffleHog v3.99.7. wfl dod PASS, psalm taint clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
supa-chayajin
added
bug
…esystem 8.1.11 Pins the released beta7 contracts (main 9a0f59b) and utils (main 20b7067), and the Symfony security releases of 2026-11-04 that composer audit requires (symfony/filesystem). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
What
httpships in0.1.0-beta7: 8 commits ahead ofmain.Theme: the client address behind trusted proxies.
Added
ClientIp\TrustedProxyClientIpResolver(NET-01) — implementsClientIpResolverInterface:X-Forwarded-Foris read only whenREMOTE_ADDRis an allow-listed proxy (addresses or CIDR ranges, IPv4 and IPv6), right to left, and the first hop that is not a trusted proxy is the client; a client-prepended hop cannot win, and a malformed hop falls back toREMOTE_ADDR.Fixed
GlobalsFactoryno longer emitsmkdir(): File existswhen workers that boot together race to create the upload root, a warning the EcoShield Gateway logged at every worker start. The creation runs under a scoped error handler (no@operator), and theis_dir()re-check still throws when the directory really cannot be created.Dependency refresh (2026-11-02)
Related issues
No open Dependabot PR in this repository.
Roadmap:
Roadmap_Beta7.md.Evidence
Before:
main=0.1.0-beta6toolchain (mago 1.50, igor-php 0.9.7).After:
wfl pre-release httpon this branch, 2026-11-03:psalm --taint-analysis6.20: no errors (2026-11-02).Checklist
composer magozero output (fmt, lint, analyze, guard); no baseline.composer testsa cleanOK; coverage ≥ 95 % and at or above the component's floor.composer igor0 KO.mago guardperimeter holds.0.1.0-beta7;CHANGELOG.mdhas the entry.Merge Danger
Door: two-way until the
0.1.0-beta7tag (a revert undoes the merge), one-way after: the tag publishesto Packagist.
Once
0.1.0-beta7is tagged, Packagist serves thismainto every consumer. Merge with a merge commit, never a squash: a squash orphans the commit the umbrella pins and thewave exits 3.
Blast Radius: release
CI before the release-day relock.
composer.lockpinswaffle-commons/contracts(andutils) at theircurrent
main, the beta6 code, until those PRs merge and the locks are refreshed. A CI job that loads a beta7contract fails until then; the gates under Evidence ran locally against the beta7 tree.
🤖 Generated with Claude Code