Exponential Platform Legacy v5.0.3.1

A release of the 5 line (branch 5.x: Symfony 7.4, se7enxweb/exponential-platform-dxp 5, LegacyBridge 5, Netgen Layouts 2, the Exponential 6 legacy kernel).

About v5.0.3: v5.0.3 was cut from the 2.5 line; v5.0.3.1 is the first correct 5.x release since v5.0.2; use ~5.0.3.1. The tag v5.0.3 points to a commit on master whose composer.json is the 2.5 line's (Symfony 3.4, LegacyBridge 2.1), although its release notes described 5.x changes. Published tags never move, so it stays as it is. v5.0.3.1 sorts after it, so ^5.0 and a version-less create-project resolve to the 5 line again; a constraint of ~5.0.3.1 excludes v5.0.3 altogether:

:::bash
composer create-project se7enxweb/exponential-platform-legacy:~5.0.3.1 my_project

A project created from v5.0.3 is a 2.5 project (app/, web/); it cannot be updated to this release with composer update. Create a new project from v5.0.3.1, or move it as chapter 10 of the book describes.

Requirements of this release: PHP 8.4 or later (every LegacyBridge 5 release needs it) and Node.js 24 LTS for the asset build.

Changes in the code and configuration since v5.0.2

• TRUSTED_PROXIES sets the proxies Symfony trusts (78e2848). The .env this line installs sets it, but Symfony 7's default reads SYMFONY_TRUSTED_PROXIES. The new config/packages/trusted_proxies.yaml reads TRUSTED_PROXIES and trusts X-Forwarded-For, -Proto and -Port from those proxies.
• Install and cache-clear blockers removed (c98f567): config/services.yaml keeps the legacy kernel's config.php out of service discovery, so cache:clear --env=prod no longer aborts; webpack.config.js uses the modern Sass API and a CSS minimiser without SVG warnings; the guide generates APP_SECRET before the first cache clear.
• lexik:jwt:generate-keypair works out of the box (561294c): the JWT configuration uses the key files the command writes, config/jwt/private.pem and public.pem, with JWT_PASSPHRASE.
• Front-end build stack modernised (27ff2ca), on Node.js 24 LTS and Yarn 1.22.22.

Still open on this line, from the Flex recipe rather than this repository: the recipe's public/.htaccess forces APP_ENV=dev, and its legacy settings switch DebugOutput on. Chapter 13.4 of the book shows what to change in your project before going live.

Documentation

• The book in doc/book/, thirteen chapters on all four release lines, and a copy of master's short installation guide in doc/INSTALL.md, each with a note on which branch the copy is on (fff2a69); the newest copies are on master. The README has a documentation section (20a922b).
• The README and the installation guide create the project with an explicit ~5.0.3.1 (54f90fb).
• The legacy INI files are listed in the order the kernel reads them: settings/override/ is read last and wins over the siteaccess files (c85428c).
• The git clone section checks out 5.x instead of master, over HTTPS (dc4080b).
• The database user is created with CREATE USER before GRANT; MySQL 8.0 rejects GRANT ... IDENTIFIED BY (58287e0).
• The branch carries the security policy, and the README names security@se7enx.com (609d482, 4989924).
• The guide says what reads TRUSTED_PROXIES (aad93de).

Full list of changes: https://github.com/se7enxweb/exponential-platform-legacy/compare/v5.0.2...v5.0.3.1