Fix review findings and prepare v1.0.2

.gitattributes

@@ -0,0 +1,21 @@
+* text=auto eol=lf
+
+/.github export-ignore
+/tests export-ignore
+/docs export-ignore
+/AGENTS.md export-ignore
+/CONTRIBUTING.md export-ignore
+/qa-adoption.json export-ignore
+/phpcs.xml export-ignore
+/phpcs.xml.dist export-ignore
+/phpstan.neon export-ignore
+/phpstan.neon.dist export-ignore
+/phpunit*.xml* export-ignore
+/.php-cs-fixer* export-ignore
+/.gitignore export-ignore
+/.gitattributes export-ignore
+/.env* export-ignore
+/auth.json export-ignore
+/.npmrc export-ignore
+/composer.review*.json export-ignore
+/composer.review*.lock export-ignore

.github/workflows/dependency-canary.yml

@@ -0,0 +1,18 @@
+name: Dependency compatibility
+
+on:
+  schedule:
+    - cron: '26 4 * * 3'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  compatibility:
+    permissions:
+      contents: read
+      issues: write
+    uses: sympress/workflows/.github/workflows/dependency-canary.yml@177fa0d727b278d2103052ec77c102b4a4c492a0
+    with:
+      php_version: '8.5'

.github/workflows/qa.yml

@@ -12,10 +12,10 @@ permissions:
 
 jobs:
   workflows:
-    uses: sympress/workflows/.github/workflows/lint-workflows.yml@v1
+    uses: sympress/workflows/.github/workflows/lint-workflows.yml@177fa0d727b278d2103052ec77c102b4a4c492a0
 
   qa:
-    uses: sympress/workflows/.github/workflows/sympress-qa.yml@v1
+    uses: sympress/workflows/.github/workflows/sympress-qa.yml@177fa0d727b278d2103052ec77c102b4a4c492a0
     with:
       php_version: '8.5'
     secrets:

README.md

@@ -71,3 +71,19 @@ repository.
 ## License
 
 This package is licensed under `GPL-2.0-or-later`.
+
+## Generated literals, output paths, and Process
+
+PHP skeleton values use exported literals; JavaScript/TSX values use JSON-based
+quoting with escaped HTML delimiters and Unicode separators. Identifiers are
+validated separately, and generated frontend code compares data-block attribute
+values without interpolating user text into a CSS selector. Root project packages
+and nested packages both generate relative output paths. MakePackage --path must
+be relative and remain inside the canonical project, including nonexistent children
+of symlinks; traversal and absolute paths are rejected and checked again before
+writing. Project/cache parents must remain trusted while generation runs.
+
+This bundle declares the real symfony/process ^8.1 dependency and integrates with
+symfony/maker-bundle ^1.68. It no longer provides a fictitious Symfony Process
+version through wp-cli/process. Generated PHP, webpack JavaScript and TSX/TS must
+be syntax checked alongside existing fixture contracts before release.

Resources/skeleton/asset_entry/AssetConfigLoader.tpl.php

@@ -9,7 +9,7 @@
 final class <?= $class_name; ?> implements ConfigLoaderInterface
 
 {
-    public const HANDLE = '<?= $asset_handle; ?>';
+    public const HANDLE = <?= var_export($asset_handle, true); ?>;
 
     public function accepts(Asset $asset): bool
     {

Resources/skeleton/block/Block.tpl.php

@@ -14,12 +14,12 @@ final class <?= $class_name; ?> implements <?= $localizable ? 'LocalizableBlockI
 
 {
 <?php if ($localizable) { ?>
-    public const JS_CONFIG_VAR = '<?= $js_config_var; ?>';
+    public const JS_CONFIG_VAR = <?= var_export($js_config_var, true); ?>;
 
 <?php } ?>
     public function name(): string
     {
-        return '<?= $block_name; ?>';
+        return <?= var_export($block_name, true); ?>;
     }
 
     /**
@@ -29,17 +29,17 @@ public function args(): array
     {
         return [
             'api_version' => 2,
-            'title' => __('<?= $title; ?>', '<?= $text_domain; ?>'),
-            'description' => __('<?= $description; ?>', '<?= $text_domain; ?>'),
-            'category' => '<?= $category; ?>',
-            'icon' => '<?= $icon; ?>',
+            'title' => __(<?= var_export($title, true); ?>, <?= var_export($text_domain, true); ?>),
+            'description' => __(<?= var_export($description, true); ?>, <?= var_export($text_domain, true); ?>),
+            'category' => <?= var_export($category, true); ?>,
+            'icon' => <?= var_export($icon, true); ?>,
             'supports' => [
                 'html' => false,
             ],
             'attributes' => [],
-            'editor_script' => '<?= $editor_handle; ?>',
+            'editor_script' => <?= var_export($editor_handle, true); ?>,
 <?php if ($with_frontend) { ?>
-            'script' => '<?= $frontend_handle; ?>',
+            'script' => <?= var_export($frontend_handle, true); ?>,
 <?php } ?>
             'render_callback' => [$this, 'render'],
         ];
@@ -61,7 +61,7 @@ public function localize(): array
     public function render(array $attributes): string
     {
 <?php if ($with_view) { ?>
-        $template = __DIR__ . '/<?= $view_path; ?>';
+        $template = __DIR__ . <?= var_export('/' . $view_path, true); ?>;
 
         if (!is_file($template)) {
             return '';
@@ -73,7 +73,7 @@ public function render(array $attributes): string
 
         return (string) ob_get_clean();
 <?php } else { ?>
-        return '<div data-block="<?= $block_name; ?>"></div>';
+        return <?= var_export('<div data-block="' . htmlspecialchars($block_name, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . '"></div>', true); ?>;
 <?php } ?>
     }
 }

Resources/skeleton/config_loader/FrontendConfigLoader.tpl.php

@@ -9,7 +9,7 @@
 final class <?= $class_name; ?> implements ConfigLoaderInterface
 
 {
-    public const FRONTEND = '<?= $frontend_handle; ?>';
+    public const FRONTEND = <?= var_export($frontend_handle, true); ?>;
 
     public function accepts(Asset $asset): bool
     {

Resources/skeleton/config_loader/GutenbergConfigLoader.tpl.php

@@ -11,7 +11,7 @@
 final class <?= $class_name; ?> implements ConfigLoaderInterface
 
 {
-    public const EDITOR = '<?= $editor_handle; ?>';
+    public const EDITOR = <?= var_export($editor_handle, true); ?>;
 
     /** @var list<LocalizableBlockInterface> */
     private array $blocks = [];
@@ -45,7 +45,7 @@ public function process(Asset $asset): Asset
 
         if ($asset instanceof Script) {
             $asset
-                ->withLocalize('<?= $localize_var; ?>', $localization)
+                ->withLocalize(<?= var_export($localize_var, true); ?>, $localization)
                 ->withDependencies('wp-blocks');
         }
 

composer.json

@@ -13,17 +13,14 @@
     "require": {
         "php": "^8.5",
         "composer-runtime-api": "^2.1",
-        "symfony/maker-bundle": "^1.0",
-        "sympress/kernel": "dev-main",
-        "wp-cli/process": "^5.9.99"
-    },
-    "provide": {
-        "symfony/process": "8.1.0"
+        "symfony/maker-bundle": "^1.68",
+        "sympress/kernel": "^1.1.1",
+        "symfony/process": "^8.1"
     },
     "require-dev": {
         "symfony/security-core": "^8.1",
         "symfony/validator": "^8.1",
-        "sympress/qa": "dev-main"
+        "sympress/qa": "^0.1.2"
     },
     "autoload": {
         "psr-4": {
@@ -75,15 +72,6 @@
             "phpstan/extension-installer": true
         }
     },
-    "repositories": [
-        {
-            "type": "path",
-            "url": "./../*",
-            "options": {
-                "symlink": true
-            }
-        }
-    ],
-    "minimum-stability": "dev",
+    "minimum-stability": "stable",
     "prefer-stable": true
 }

docs/releases/1.0.2.md

@@ -0,0 +1,9 @@
+# 1.0.2 release candidate
+
+This candidate contains the 2026-10-01 review repairs and requires the stable
+SymPress dependency train. It has not been published yet. CI consumers use the
+reviewed workflows commit 177fa0d727b278d2103052ec77c102b4a4c492a0.
+
+Local exact-commit Composer archives verify dependency resolution and distribution
+contents before publication. They do not imply that prospective tags exist on
+GitHub or Packagist. Historical tags remain unchanged.

src/Maker/MakeBlock.php

@@ -8,6 +8,7 @@
 use SymPress\MakerBundle\Util\PackageContext;
 use SymPress\MakerBundle\Util\PackageContextResolver;
 use SymPress\MakerBundle\Util\PackageServiceConfigurator;
+use SymPress\MakerBundle\Util\SourceLiteral;
 use SymPress\MakerBundle\Util\WebpackEncoreEntryConfigurator;
 use Symfony\Bundle\MakerBundle\ConsoleStyle;
 use Symfony\Bundle\MakerBundle\DependencyBuilder;
@@ -137,7 +138,7 @@ public function generate(InputInterface $input, ConsoleStyle $io, Generator $gen
         if ($withView) {
             $generator->dumpFile(
                 $context->packageRelativePath(sprintf('Resources/views/block/%s.php', $slug)),
-                "<div data-block=\"{$blockName}\"></div>\n",
+                '<div data-block="' . htmlspecialchars($blockName, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . '"></div>' . "\n",
             );
         }
 
@@ -248,31 +249,32 @@ private function editorSource(string $blockName, string $title, string $textDoma
 import { registerBlockType } from '@wordpress/blocks';
 import { __ } from '@wordpress/i18n';
 
-registerBlockType('%s', {
-    title: __('%s', '%s'),
+registerBlockType(%s, {
+    title: __(%s, %s),
     edit: () => {
         const blockProps = useBlockProps();
 
         return (
             <div {...blockProps}>
-                <strong>{__('%s', '%s')}</strong>
+                <strong>{__(%s, %s)}</strong>
             </div>
         );
     },
     save: () => null,
 });
 TS
             ,
-            $blockName,
-            $title,
-            $textDomain,
-            $title,
-            $textDomain,
+            SourceLiteral::javascript($blockName),
+            SourceLiteral::javascript($title),
+            SourceLiteral::javascript($textDomain),
+            SourceLiteral::javascript($title),
+            SourceLiteral::javascript($textDomain),
         ) . "\n";
     }
 
     private function frontendSource(string $blockName): string
     {
-        return sprintf("document.querySelectorAll('[data-block=\"%s\"]');\n", $blockName);
+        return "Array.from(document.querySelectorAll('[data-block]')).filter(element => element.getAttribute('data-block') === "
+            . SourceLiteral::javascript($blockName) . ");\n";
     }
 }

src/Maker/MakeHook.php

@@ -6,6 +6,7 @@
 
 use SymPress\MakerBundle\Util\PackageContextResolver;
 use SymPress\MakerBundle\Util\PackageServiceConfigurator;
+use SymPress\MakerBundle\Util\SourceLiteral;
 use Symfony\Bundle\MakerBundle\ConsoleStyle;
 use Symfony\Bundle\MakerBundle\DependencyBuilder;
 use Symfony\Bundle\MakerBundle\Generator;
@@ -55,6 +56,7 @@ public function generate(InputInterface $input, ConsoleStyle $io, Generator $gen
         }
 
         $method = (string) $input->getOption('method');
+        SourceLiteral::identifier($method);
         $classDetails = $generator->createClassNameDetails((string) $input->getArgument('class'), 'Hook\\');
         $generator->generateClass(
             $classDetails->getFullName(),

src/Maker/MakeSympressPackage.php

@@ -5,6 +5,8 @@
 namespace SymPress\MakerBundle\Maker;
 
 use SymPress\MakerBundle\Util\JsonFile;
+use SymPress\MakerBundle\Util\ProjectPath;
+use SymPress\MakerBundle\Util\SourceLiteral;
 use Symfony\Bundle\MakerBundle\ConsoleStyle;
 use Symfony\Bundle\MakerBundle\DependencyBuilder;
 use Symfony\Bundle\MakerBundle\Generator;
@@ -73,13 +75,17 @@ public function generate(InputInterface $input, ConsoleStyle $io, Generator $gen
         $packageType = $this->normalizePackageType((string) $input->getOption('type'));
         $packageDirectory = $this->packageDirectory($packageName);
         $packagePath = (string) ($input->getOption('path') ?: sprintf('packages/%s', $packageDirectory));
+        $packagePath = ProjectPath::relative($this->projectDir, $packagePath);
         $absolutePackagePath = sprintf('%s/%s', rtrim($this->projectDir, '/'), trim($packagePath, '/'));
 
         if (is_dir($absolutePackagePath)) {
             throw new \RuntimeException(sprintf('Package directory "%s" already exists.', $packagePath));
         }
 
         $namespace = trim((string) ($input->getOption('namespace') ?: $this->namespace($packageName)), '\\');
+        foreach (explode('\\', $namespace) as $segment) {
+            SourceLiteral::identifier($segment);
+        }
         $bundleClass = $this->isKernelPackage($packageType)
             ? sprintf('%s\\%s', $namespace, $this->bundleClassName($packageName))
             : null;
@@ -117,6 +123,7 @@ public function generate(InputInterface $input, ConsoleStyle $io, Generator $gen
             $generator->dumpFile('composer.json', $this->rootComposerWithPackage($packageName, (bool) $input->getOption('dev')));
         }
 
+        ProjectPath::relative($this->projectDir, $packagePath);
         $generator->writeChanges();
         $this->writeSuccessMessage($io);
         $io->text(sprintf('Package "%s" (%s) was created at %s.', $packageName, $packageType, $packagePath));
@@ -373,7 +380,7 @@ private function pluginEntry(string $packageName, string $description, string $n
 PHP
             ,
             Str::asHumanWords($packageName),
-            $description,
+            str_replace(['*/', "\r", "\n"], ['* /', ' ', ' '], $description),
             $namespace,
             Str::getShortClassName($bundleClass),
         ) . "\n";
@@ -421,7 +428,7 @@ private function themeStylesheet(string $packageName, string $description): stri
 CSS
             ,
             Str::asHumanWords($name),
-            $description,
+            str_replace(['*/', "\r", "\n"], ['* /', ' ', ' '], $description),
             $name,
         ) . "\n";
     }

src/SymPressMakerBundle.php

@@ -8,6 +8,7 @@
 use SymPress\MakerBundle\Composer\InstalledComposerPackageLocator;
 use SymPress\MakerBundle\Composer\PackageAutoloadResolver;
 use Symfony\Bundle\MakerBundle\DependencyInjection\CompilerPass\MakeCommandRegistrationPass;
+use Symfony\Bundle\MakerBundle\DependencyInjection\CompilerPass\MakeDecoratorPass;
 use Symfony\Bundle\MakerBundle\DependencyInjection\CompilerPass\RemoveMissingParametersPass;
 use Symfony\Bundle\MakerBundle\DependencyInjection\CompilerPass\SetDoctrineAnnotatedPrefixesPass;
 use Symfony\Bundle\MakerBundle\MakerBundle;
@@ -17,6 +18,7 @@
 use Symfony\Component\DependencyInjection\Compiler\PassConfig;
 use Symfony\Component\DependencyInjection\ContainerBuilder;
 use Symfony\Component\DependencyInjection\Loader\Configurator\ContainerConfigurator;
+use Symfony\Component\DependencyInjection\Reference;
 
 final class SymPressMakerBundle extends AbstractBundle
 {
@@ -51,6 +53,9 @@ public function loadExtension(
         $configurator->import(sprintf('%s/config/makers.php', $makerBundlePath));
         $configurator->import('../Resources/config/services.php');
 
+        // Keep the complete constructor positional when Symfony rebuilds debug/lint definitions.
+        $container->getDefinition('maker.maker.make_command')->setArguments([null, new Reference('maker.file_manager')]);
+
         $rootNamespace = $this->rootNamespace($config, $container);
         $entityNamespace = $this->entityNamespace($config, $rootNamespace);
 
@@ -79,6 +84,7 @@ public function build(ContainerBuilder $container): void
             ->addTag(MakeCommandRegistrationPass::MAKER_TAG);
 
         $container->addCompilerPass(new MakeCommandRegistrationPass(), PassConfig::TYPE_BEFORE_OPTIMIZATION, 10);
+        $container->addCompilerPass(new MakeDecoratorPass());
         $container->addCompilerPass(new RemoveMissingParametersPass());
         $container->addCompilerPass(new SetDoctrineAnnotatedPrefixesPass());
     }