* ci(deps): unblock minor and patch Dependabot updates on develop and 1.2.x
Scope the 7-day Dependabot cooldown to major releases (semver-major-days: 7) so weekly runs pick up minor and patch updates without an extra week of delay. Ignore unresolvable major versions on develop (symfony/* >= 8.0.0 on PHP 8.3 and pestphp/* >= 4.0.0) and all major version bumps on 1.2.x so Dependabot's Composer and npm version resolvers fall back to the latest minor and patch releases instead of aborting. Set versioning-strategy: increase for /api where no composer.lock is tracked.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(deps): enforce Dependabot branch policy
Cover every 1.2.x update entry and add the missing GitHub Actions major-version block. Run the contract test when dependency automation changes so the maintenance-branch blind spot cannot recur.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(deps): lock Composer and Symfony policy
Keep Composer update jobs on 1.2.x while requiring the only Symfony version cap to remain on develop at Symfony 7.x.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci(deps): draft 1.2.x security remediations
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Thomas Vincent