[bpacholek]

What this changes

Fixes #5. versions-watch reported 22 entries of PLAN/07 §2 with newer releases. Each one moves to the release that was current on 2026-10-23, in the three places the issue names. Three releases came out after Monday's watch run, so they go one step past the issue's table: vite 8.3.5 (8.3.4 in the issue), html-validate 11.17.0 (11.16.4) and size-limit 14.3.0 (14.2.0). I re-ran the watch's own comparison against Packagist and npm afterwards, and it reports nothing outdated.

• eaaa24a3f Dependencies
  • versions.json: all 22 entries.
  • PLAN/07 §2: the rows and their release dates, plus a dated "re-verified" note. The qs row now says what P1-06 made it: watched only, not shipped (buildQueryString() replaced it). §7 names Playwright 1.64.
  • composer.json: raises the constraints that follow a row's minor version.
    • runtime: twig/twig ^3.30, doctrine/orm ^3.7, symfony/stimulus-bundle ^3.6
    • dev: phpunit/phpunit ^13.4, phpstan/phpstan ^2.3, rector/rector ^2.7
    • unchanged, because they already admit the new patch releases: doctrine/doctrine-bundle (^3.0), php-cs-fixer (^3.95), infection (^0.35), framework-bundle (^7.4 || ^8.0). doctrine/mongodb-odm-bundle and qs have no constraint in this repo.
  • package.json (exact pins) and package-lock.json: @axe-core/playwright 4.14.0, @playwright/test 1.64.1, eslint 10.13.0, html-validate 11.17.0, jsdom 30.1.3, prettier 3.9.10, size-limit + @size-limit/file 14.3.0, stylelint 17.16.0, vite 8.3.5, vitest 5.0.5. The lock file changes only these packages and their own dependencies.
  • src/Resources/public/app.js is rebuilt. Vite 8.3's minifier rewrites some early returns as conditional expressions. Behaviour is the same, and the size budget (86.2 of 100 kB) and the CSS contract still pass.
  • bin/visual.sh reads the Playwright image tag from package.json, so screenshots now come from mcr.microsoft.com/playwright:v1.64.1-noble. playwright.config.js names that image.
  • README and UPGRADE.md state the new Twig and ORM floors. CHANGELOG [Unreleased] → ### Changed.
• 1ee2e5cfc User menu: the button is named by its avatar. axe-core 4.14 turns on label-content-name-mismatch by default, and it failed on every page, width and theme. It flagged one element: the user menu button. The button shows the initials ("AD", aria-hidden), but its name came from aria-label="admin", so its visible text was not part of its name (WCAG 2.5.3 Label in Name). Now the initials are an avatar image, <span role="img" aria-label="{{ userName }}">, and the button takes its name from it without an aria-label of its own. A screen reader still hears "admin, button". Nothing changes on screen: all 84 screenshot baselines match unchanged. The JS fixtures are re-dumped (7 pages), and CHANGELOG ### Fixed has an entry.

Contract

• No template file, registry key, config node, service id or Twig block is removed or renamed. The user menu loses one aria-label on its toggle button, which was never a markup hook (nothing in PHP, JS or the tests selects on it). The name is now carried by the role="img" span inside the button.
• No Bootstrap/AdminLTE class, jQuery, inline script or AJAX submit. npm run check:jquery and make check-names are clean.
• idct/adminata-admin-mongodb-bundle: its unit suite against this checkout (mongo-compat) is green on this PR.

Gates

Local (2-core machine):

• make lint-php (both configs), make lint-composer (validate + normalize), php bin/check-upstream-versions.php, make check-names, make lint-symfony (container, twig, xliff, yaml): clean.
• Front end (this branch's package-lock.json): eslint, stylelint, css:layers, prettier, check:jquery, fixture (11 Tailwind assumptions), Vitest 281/281, npm run build (git diff only app.js, committed), css:contract, size: all pass.
• PHPUnit (composer update = what CI's highest installs, MySQL from docker-compose.yml): every suite gives 2638 tests, 0 failures, 29 errors. All 29 are environmental. 26 are DashboardPantherTest (no geckodriver here). 3 are DoctrineODMQuerySourceIteratorTest (no MongoDB on 27017). After the second commit, adminata-functional,contract,unit give 323 tests with only the 26 Panther errors.
• Playwright in the v1.64.1-noble container (bin/visual.sh), Chromium only:
  • screenshots, all 3 widths: 84 passed before and after the user menu change (no baseline regenerated);
  • before the fix: axe/hygiene/markup/responsive/autocomplete/sidebar-place on 3 widths gave 335 passed and 84 failed, all on that one axe node;
  • after the fix: axe + autocomplete + html-validate on 375 and 1280 px gave 98 passed.
  • Firefox and WebKit ran only in CI (below).

CI on this PR:

• Green:
  • the whole test matrix: PHP 8.4 lowest/highest, 8.5 highest, Symfony 7.4 and 8.1, including the Panther suite in Firefox;
  • Screenshots, axe and html-validate in Chromium, Firefox and WebKit (14 min);
  • Node 24 and 26, and the MongoDB layer's unit suite;
  • CS-Fixer, Composer, YAML/XML/XLIFF, container/Twig lint, Sphinx and No jQuery.
• Red: PHPStan ×2 and Rector ×2, the same as main. main's Quality assurance run fails the same way (scheduled 2026-10-23 05:12, 987f223), because CI installs highest, which already had phpstan 2.3 and rector 2.7 before this PR.
  • PHPStan: the 42 errors diff identical to that run. They are assertEmpty/assertNotEmpty from strict-rules and unused $message/$previousExceptionMessage/foreach variables, mostly in inherited tests/ files.
  • Rector's FlipAssertRector flags the same 5 files: AdminHelper, AbstractBlockService, AddDependencyCallsCompilerPass, tests/Admin/AdminTest.php and tests/DependencyInjection/ConfigurationTest.php. Its parallel workers also time out.
  • This PR touches none of those files.

Discovered

• Runtime floors went up. I read the issue's "corresponding constraint" and the repo's pattern (^3.28 for 3.28.0, ^3.4 for 3.4.0, ^3.6 for 3.6.8) as "constraint = ^minor of the PLAN/07 row". That raises require for users too. recomaty-panel's develop lock has twig 3.28.0, doctrine/orm 3.6.8 and stimulus-bundle 3.4.0. Its own composer.json doesn't hold any of them back (doctrine/orm: ^3; it doesn't require the other two directly), but its next composer update idct/adminata needs --with-dependencies. If you'd rather keep the runtime floors and move only the dev ones, it is three lines in composer.json plus README/UPGRADE.md/CHANGELOG.
• The user menu fix is a judgement call. Two alternatives: add label-content-name-mismatch to findings.json as debt (the axe ledger is {} today), or keep @axe-core/playwright at 4.13. I chose the avatar pattern (role="img" + name on the initials, as Fluent UI's Avatar does). It keeps the screen reader output the same and adds no debt.
• PLAN/05 (vite/vitest/jsdom/qs), PLAN/08 ("Playwright 1.62") and PLAN/07 §3's sample composer.json still show the versions they were written with. They are design records, and the issue names only §2, so I left them alone.

Screenshots

No screenshots: only recomaty-panel can be shot here. The template change has no visible effect, and the repo's own 84 Chromium baselines (both themes, 375/768/1280 px) match without regeneration.

Changelog

[Unreleased] → ### Changed → "Requirements follow the current releases (2026-10-23, #5)"; ### Fixed → "The user menu's button is named by its avatar (2026-10-23, #5)".

After merge

recomaty-panel picks this up with composer update idct/adminata --with-dependencies (twig 3.30, doctrine/orm 3.7, stimulus-bundle 3.6 come along).

Work done, @bpacholek! ~Bober 🦫