Scriptlog Files

[1.8.2] - 2026-09-27

Added

• Admin locale catalog with native labels: New admin_locales_catalog() function returns a map of lang_code => native name with database-driven catalog synchronization and static request caching; falls back to seven supported languages when no DB connection is available
• Native label select helpers: New admin_locale_select() helper renders a native-name locale <select> with full XSS-safe attribute and label escaping; legacy locales not in the catalog are appended as uppercased-code options
• getImageRadioButton() and createPageMedia() in PageService: Delegated to MediaDao so controllers never build DAOs themselves; featured-image radio list for the page form
• boundwize/structarmed dev dependency: Structural analysis tool added to catch array-shape mismatches; CI configured with --ignore-platform-reqs for PHP 7.4 platform compatibility
• composer audit integration: Security audit now included in the composer build quality script
• StructArmed configuration files: structarmed.php and structarmed-baseline.php for architecture guard enforcement

Changed

• Dependency injection in services: ExportService now requires UserDao constructor parameter; MigrationService now accepts UserDao for import author lookups; PageService accepts MediaDao; PostService accepts optional TopicDao and MediaDao parameters
• Controller refactoring: PostController and PageController no longer hold direct TopicDao/MediaDao references; they delegate all DAO operations through PostService and PageService respectively
• Class finality: PostController, PageService, and MigrationService marked as final to prevent inheritance and enforce composition-based design
• APP_FILE_SIZE and MAX_SIZE constants: Numeric literals updated to underscore-separated notation for improved readability
• PHPStan baseline: Fixed empty() variable false-positive in sanitize-locale.php to satisfy level-1 analysis
• Playwright CI: Added --ignore-platform-reqs to composer install for PHP 7.4 platform compatibility

Fixed

• CSRF token persistence: Submitted CSRF token is now preserved across policy saves so POST requests don't bounce on validation errors
• PHPStan level-1 compatibility: Resolved empty() variable analysis error in sanitize-locale.php
• PostService null DAO handling: Fixed topicDao and mediaDao null pointer exceptions in unit tests by adding proper null checks

Security

• boundwize/structarmed: Structural integrity analysis added to the build pipeline to detect array-shape mismatches and prevent silent data corruption
• composer audit integration: Security audit now included in the composer build quality script

Deprecated

• Direct DAO access in controllers: Controllers should now delegate all data access through service layers rather than instantiating DAOs directly

Notes

Patch release with admin locale catalog improvements, service-layer refactoring toward dependency injection, and structural analysis tooling. PostController, PageService, and MigrationService are now final to enforce composition-based design. ExportService and MigrationService now require UserDao injection. PostService accepts optional TopicDao and MediaDao for backward compatibility with proper null handling. CI configured with --ignore-platform-reqs to support boundwize/structarmed on the PHP 7.4 platform. 67 commits since v1.8.1 including 40 test commits, 5 fix commits, 2 feat commits, 3 refactor commits, 5 CI commits, and 1 docs commit.

Codename

Maleo Senkawor (retained) – Honoring Macrocephalon maleo, the critically endangered megapode endemic to Sulawesi, Indonesia.

Comparison

• Previous release: v1.8.1
• Changes since v1.8.1: 67 commits