fix: require DependencyInjection 8.1.8 and release Runtime 1.2.6

.github/workflows/platforms.yml

@@ -27,7 +27,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0
+        env:
+          verbose: ${{ runner.os == 'macOS' }}
         with:
           php-version: '8.5'
           extensions: curl, dom, mbstring, mysqli
@@ -97,7 +99,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0
         with:
           php-version: '8.5'
           extensions: curl, dom, mbstring, mysqli

CHANGELOG.md

@@ -4,6 +4,13 @@
 
 No changes yet.
 
+## 1.2.6 — 2026-10-09
+
+- Require Symfony DependencyInjection 8.1.8 or newer to preserve environment placeholders reused across container extensions. Library consumers now receive the fix without relying on a development lockfile.
+- Report the current release version in the standalone CLI.
+
+See the [1.2.6 upgrade notes](docs/releases/1.2.6.md).
+
 ## 1.2.5 — 2026-10-07
 
 - Generate native `wp-config.php` directly in the WordPress core parent (`public/` for a `public/wp/` layout), eliminating the default root configuration and forwarding loader. WP-CLI, section editing, setup drift and production diagnostics follow the same target.

composer.json

@@ -46,7 +46,7 @@
         "composer/semver": "^3.4",
         "opis/json-schema": "^2.6",
         "symfony/console": "^8.1",
-        "symfony/dependency-injection": "^8.1",
+        "symfony/dependency-injection": "^8.1.8",
         "symfony/dotenv": "^8.1",
         "symfony/event-dispatcher": "^8.1",
         "symfony/filesystem": "^8.1",

docs/releases/1.2.6.md

@@ -0,0 +1,15 @@
+# Runtime 1.2.6
+
+Update `sympress/runtime` with Composer and review the resulting lockfile.
+Symfony DependencyInjection now requires 8.1.8 or newer, which preserves
+environment placeholders reused after an earlier container extension overrides
+the same value. The fix is the stable upstream change in
+[Symfony PR 66434](https://github.com/symfony/symfony/pull/66434).
+
+The repository does not publish a Composer lockfile. The public dependency
+constraint therefore guarantees the fix for fresh and existing consumers after
+dependency resolution. The standalone CLI reports version 1.2.6.
+
+The later Process `SYMFONY_DOTENV_VARS` fix and Symfony 8.2
+`resolvesAtCompileTime()` API remain upstream follow-ups. They are not part of
+Symfony 8.1.8 and this release does not require unreleased dependencies.

src/Console/Application.php

@@ -31,7 +31,7 @@ public static function main(array $arguments, string $root, string $vendor, ?arr
         $installed = is_file($installedFile) ? json_decode((string) file_get_contents($installedFile), true, 512, JSON_THROW_ON_ERROR) : [];
         $dev = !is_array($installed) || ($installed['dev'] ?? true) !== false;
         $context = $data === null ? new RunContext($root, $vendor, $bin, dev: $dev, manifest: $manifestFile) : RunContext::fromArray($data);
-        $application = new ConsoleApplication('SymPress Runtime', '1.2.5');
+        $application = new ConsoleApplication('SymPress Runtime', '1.2.6');
         $application->setAutoExit(false);
         foreach (['run', ...Registry::RESERVED] as $operation) {
             $application->addCommand(new RuntimeCommand($context, $operation));

tests/Contract/ArchitectureTest.php

@@ -40,7 +40,7 @@ public function testInstalledGraphExcludesWpStarterAndUsesTheRequiredStack(): vo
             if (!str_starts_with($name, 'symfony/')) {
                 continue;
             }
-            self::assertSame('^8.1', $constraint);
+            self::assertSame($name === 'symfony/dependency-injection' ? '^8.1.8' : '^8.1', $constraint);
         }
         self::assertArrayHasKey('sympress/qa', $manifest['require-dev']);
         self::assertStringContainsString('sympress/workflows/.github/workflows/sympress-qa.yml@cd809f3986df3ea617d2d26bdf21ab69cae19c1e', (string) file_get_contents($root . '/.github/workflows/qa.yml'));