Every component imported Preact, its hooks and htm/preact from esm.sh
separately. htm/preact imports Preact unversioned, which esm.sh now
resolves to Preact 11, while the components asked for preact@10: two
Preacts on one page, so render() drew nothing, silently. Booking, FAQ,
testimonials, carousel, toggle and appointment type were all blank.
Use htm's single-file standalone build instead (Preact 10, its hooks and
html in one module, no further imports), downloaded at image build
pinned by version and checksum, like FullCalendar, and imported from
../vendor/preact-standalone.js. Checked on the live page: the booking
component renders again with it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PHP 8.5.12 fixes CVE-2026-109618 and CVE-2026-109619, pre-auth remote
code execution in session upload progress, exploited in the wild (CISA
KEV, 2026-10-26); the running image was built in June on an older 8.5.
Pin the version once for both PHP stages (ARG PHP_VERSION), and turn the
feature off too (session.upload_progress.enabled = 0): Drupal doesn't
use it, and it covers later bugs in it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Add required email input (with autocomplete="email") to the booking
details form in the homepage Preact widget (rpt-booking.js).
Update EMPTY_FORM, submit payload, confirmedAppointment, and success
summary to include it. The form now collects: first/last name, email,
phone, comments.
- Update ScheduleController::storeSlot to extract/pass email in the
booking_request mail params (and require it for the full-contact path).
Log failures with details; return a structured error with a user-friendly
message instead of bare "mail_failed".
- riverside_pt_mail hook now includes the user's email in the notification
body (when provided).
- Dev improvements for mail:
- In DEBUG mode (default on localhost), force php_mail interface in
settings.php so the mailer uses the sendmail_path override.
- Dockerfile + entrypoint.sh now provide/install a fake-sendmail.sh
that prints the full email (To, Subject, headers, body from the
hook) to stderr (visible in `docker compose logs`) and always
succeeds (exit 0). This prevents "sh: 1: /usr/sbin/sendmail: not
found" and guarantees booking submissions never return the
"unable to send confirmation email" error in dev.
- In non-DEBUG, still uses symfony_mailer + Postmark as before.
- The fake is also baked into the image for consistency.
- JS error handling now prefers the server-provided 'message' from
the JSON error response (better UX for real mail failures).
- Update CLAUDE.md with the new email field + dev mail mocking behavior.
- New file: docker/php/fake-sendmail.sh (the mock).
This addresses the recent "mail_failed" issues while keeping production
email via Postmark.
