riverside:rebuild lived in src/Commands with no drush.services.yml, so
the image built today (Drush 13.8) didn't find it: "There are no
commands defined in the riverside namespace", and the entrypoint's
rebuild of content types, fields, roles and navigation was skipped.
Drush discovers module commands in src/Drush/Commands
(Drupal\riverside_pt\Drush\Commands) via their create().
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every component imported Preact, its hooks and htm/preact from esm.sh
separately. htm/preact imports Preact unversioned, which esm.sh now
resolves to Preact 11, while the components asked for preact@10: two
Preacts on one page, so render() drew nothing, silently. Booking, FAQ,
testimonials, carousel, toggle and appointment type were all blank.
Use htm's single-file standalone build instead (Preact 10, its hooks and
html in one module, no further imports), downloaded at image build
pinned by version and checksum, like FullCalendar, and imported from
../vendor/preact-standalone.js. Checked on the live page: the booking
component renders again with it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Newer Drupal 11 (core-recommended, resolved at build time) pulls in
symfony/runtime, whose Composer plugin wasn't in allow-plugins, so
composer install refused to run. It's Symfony's own plugin.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The forge VM's runner reports http://localhost:3000 as the server URL,
which the job container can't reach.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replaces .gitea/workflows/ci.yml with .forgejo/workflows/deploy.yml,
the shared action's version of the same flow, on the same arm64
ubuntu-latest runner and privileged Podman container.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PHP 8.5.12 fixes CVE-2026-109618 and CVE-2026-109619, pre-auth remote
code execution in session upload progress, exploited in the wild (CISA
KEV, 2026-10-26); the running image was built in June on an older 8.5.
Pin the version once for both PHP stages (ARG PHP_VERSION), and turn the
feature off too (session.upload_progress.enabled = 0): Drupal doesn't
use it, and it covers later bugs in it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Postmark's API transport rejects headers like Return-Path that Drupal adds
automatically. The SMTP relay is more permissive and avoids this class of
rejection entirely.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Drupal core's symfony_mailer plugin reads system.mail.mailer_dsn directly
from settings.php — the mailer_transport module entity system is only a UI
layer and is not consulted when actually sending mail. Removed the
mailer_transport entity setup from the entrypoint and configured the DSN
correctly via $config overrides in settings.php instead.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
