Scriptlog Files

[1.9.0] - 2026-09-27

Added

• Admin locale catalog with native labels: New admin_locales_catalog() function returns a map of lang_code => native name with database-driven catalog synchronization and static request caching; falls back to seven supported languages when no DB connection is available
• Native label select helpers: New admin_locale_select() helper renders a native-name locale <select> with full XSS-safe attribute and label escaping; legacy locales not in the catalog are appended as uppercased-code options
• getImageRadioButton() and createPageMedia() in PageService: Delegated to MediaDao so controllers never build DAOs themselves; featured-image radio list for the page form
• boundwize/structarmed dev dependency: Structural analysis tool added to catch array-shape mismatches and prevent silent data corruption at build time
• structarmed Composer script: New composer structarmed command for structural integrity analysis during quality checks

Changed

• Dependency injection in services: ExportService now requires UserDao constructor parameter; MigrationService now accepts UserDao for import author lookups; PageService accepts MediaDao; PostService accepts optional TopicDao and MediaDao parameters
• Controller refactoring: PostController and PageController no longer hold direct TopicDao/MediaDao references; they delegate all DAO operations through PostService and PageService respectively
• Class finality: PostController, PageService, and MigrationService marked as final to prevent inheritance and enforce composition-based design
• APP_FILE_SIZE and MAX_SIZE constants: Numeric literals updated to underscore-separated notation for improved readability
• PHPStan level-1 compatibility: Fixed empty() variable false-positive in sanitize-locale.php

Fixed

• CSRF token persistence: Submitted CSRF token is now preserved across policy saves so POST requests don't bounce on validation errors
• PHPStan level-1 analysis: Resolved empty() variable analysis error in sanitize-locale.php

Security

• boundwize/structarmed: Structural integrity analysis added to the build pipeline to detect array-shape mismatches and prevent silent data corruption
• composer audit integration: Security audit now included in the composer build quality script

Deprecated

• Direct DAO access in controllers: Controllers should now delegate all data access through service layers rather than instantiating DAOs directly

Notes

Feature release with admin locale catalog improvements, service-layer refactoring toward dependency injection, and structural analysis tooling. PostController, PageService, and MigrationService are now final to enforce composition-based design. ExportService and MigrationService now require UserDao injection. PostService accepts optional TopicDao and MediaDao for backward compatibility. 67 commits since v1.8.1 including 40 test commits, 5 fix commits, 2 feat commits, 3 refactor commits, 5 CI commits, and 1 docs commit.

Codename

Raja Ampat – Honoring Raja Ampat (Four Kings), the globally renowned marine biodiversity hotspot in West Papua, Indonesia, home to 75% of all known coral species and critically endangered marine species including the whale shark (Rhincodon typus), manta ray (Mobula alfredi), and the endangered hawksbill turtle (Eretmochelys imbricata). With coral reef systems facing unprecedented bleaching events and overfishing pressures, Raja Ampat's endemic marine species represent some of the most threatened biodiversity on Earth.