chore(deps): bump sympress/kernel from 1.1.1 to 1.1.7

[dependabot]

Bumps sympress/kernel from 1.1.1 to 1.1.7.

Release notes

Sourced from sympress/kernel's releases.

v1.1.7

Fix runtime recompilation with stateful native compiler passes. Every container candidate now uses fresh pass instances, preserving Doctrine event listeners when newly discovered resources trigger a second compile.

Validation: shared local and hosted QA passed, including the new isolated-state and cache-reload regression (78 tests, 372 assertions). Downstream native Doctrine tests cover listeners, forms, validation, Security entity providers, Messenger, Maker generation and cached-container reload. The kernel suite retains its existing environment skip and PHPUnit notices.

v1.1.6 (withdrawn)

This tag was accidentally created at the v1.1.5 commit before the pending fetch completed. It contains no compiler-pass fix. Do not select it for the Doctrine integration. The repository's immutable tag rule prevents changing or removing the tag; the correction is released as v1.1.7.

Kernel 1.1.5

Unchanged mutable cache reads currently invalidate OPcache, and a CLI metadata publication can leave an existing FPM worker stale. Store private container/discovery metadata as atomic JSON and keep invalidation on compiled-container publication only. Restore the automatic private fallback for classic WordPress webroots and cold read-only projects while retaining rejection of unsafe explicit paths.

Validation: full package QA (77 tests, 394 assertions; strict coding standards and PHPStan), baseline reproduction, and a persistent native FPM worker with opcache.validate_timestamps=0: zero invalidations on unchanged reads, then a separate CLI publication observed by that same worker. Legacy PHP metadata is ignored and rebuilt without execution. Release: 1.1.5.

SymPress kernel v1.1.4

Unsafe explicit APP_CACHE_DIR paths now fail with actionable diagnostics. Implicit fallback is visible; private storage and timestamp-disabled OPcache metadata refresh are covered by upgrade tests.

Validation: full QA, 72 tests/354 assertions, real OPcache timestamp-disabled regression and container lint passed.

sympress/kernel v1.1.3

sympress/kernel 1.1.3

Metadata validation replaces repeated content hashing by default; strong hashing remains optional. Warm reads preserve OPcache, writes invalidate it, and poisoned group-writable legacy cache artifacts are isolated safely.

sympress/kernel v1.1.2

Mutable warm boots validate consumed configuration content once instead of hashing it twice. Existing installations with group-writable compiled-cache directories use a fresh private cache generation, preserving the executable-cache trust boundary.

Validation: 70 PHPUnit tests / 337 assertions, coding standards and PHPStan, independent review, and all GitHub PR checks. Immutable production builds remain the supported way to eliminate request-time content hashing entirely.

Changelog

Sourced from sympress/kernel's changelog.

1.1.7 — 2026-10-06

• Isolate native compiler-pass state when rebuilding a runtime container after newly discovered resources change its identity. Doctrine event listeners and other passes now populate the final container instead of retaining definitions from the discarded first candidate.

1.1.6 — 2026-10-06 (withdrawn)

• An accidental duplicate of the v1.1.5 source, created before a fetch completed. Immutable repository tags retain it for audit. Use v1.1.7 for the compiler fix.

1.1.5 — 2026-10-05

• Store container metadata and discovery descriptors as atomic private JSON, so unchanged readers retain OPcache entries while CLI publications remain visible to existing FPM workers with timestamp validation disabled. Ignore and rebuild legacy PHP metadata without executing it.
• Restore automatic private-cache fallback outside served directories for classic WordPress webroots and cold read-only projects; reject pre-created symlinks, foreign owners and writable shared cache roots.

1.1.4 — 2026-10-03

• Fail unsafe explicit APP_CACHE_DIR settings with deployment guidance and migrate implicit legacy caches once into visible durable project storage shared by CLI/PHP-FPM.
• Refresh mutable metadata/discovery OPcache reads after atomic replacement while retaining immutable build-ID cache behavior.
• Admit the stable SYMPRESS_PROJECT_DIR cache identity as a safe environment parameter without changing active release discovery.

1.1.3 — 2026-10-02

• Default mutable cache validation to mtime/size metadata; keep content hashing as an explicit SYMPRESS_KERNEL_CONTENT_HASHES=1 mode. Warm container and discovery reads retain OPcache entries.
• Verify upgrade from group-writable caches without executing or modifying prior metadata, discovery or container artifacts.

1.1.2 — 2026-10-02

• Validate consumed configuration content once per mutable warm request while preserving same-timestamp edits, imported resources and the explicit immutable build-ID policy.
• Boot existing installations with group-writable compiled-cache directories through a fresh private generation without executing or chmod-adopting prior PHP cache artifacts.

Added

• Bridge App::enableDebug() and App::disableDebug() to an optional profiler service.

Changed

• Split package-manager actions, package-manager rendering, kernel configuration, runtime container cache, and core service registration into focused collaborators.
• Adopt shared SymPress QA tooling and PHP 8.5 package constraints.

Fixed

• Normalize mixed metadata, route, hook, environment, and WordPress context inputs before using them as typed kernel state.

Commits

• 910e5bb docs: assign compiler pass fix to v1.1.7
• 3aca3d9 fix: isolate compiler passes during runtime recompilation
• 33779b9 fix: publish mutable cache metadata without reader invalidation
• 8657940 fix(cache): keep private kernel storage durable and metadata fresh
• ed83314 docs: prepare reviewed patch release notes
• 4919f4a fix: use metadata signatures for warm kernel caches
• 720d95f Document findings patch release
• 8371b47 fix(kernel): reduce warm cache hashing and migrate unsafe cache paths
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like sympress/kernel is up-to-date now, so this is no longer needed.