task: #3622956 Set the recipe version to 1.0.3 and pin the cross-dependency constraints

Rajab Natshahrequested to merge
issue/horizonaid-3622956:3622956-release into 1.0.x

Summary

Prepare the Horizon Aid 1.0.3 release: set the recipe version, move every cross-dependency off its 1.0.x-dev branch, update the README badge and add the CHANGELOG section.

Changes

composer.json

  • version: 1.0.x-dev to 1.0.3.
  • All fourteen cross-dependency constraints off 1.0.x-dev. The tag ships zero x-dev constraints, because a release pinned to a dev branch cannot be resolved by a user building from a stock base project with a committed lock.

Two of them get a named floor rather than the house default ~1.0.0:

Package Constraint Why
drupal/varbase_webform_base ~1.0.2 The Newsletter page depends on the email field height fixes released in Varbase Webform Base 1.0.2.
drupal/vartheme_bs5_horizonaid ~1.0.2 The paired theme release is cut first precisely so this recipe can pin it.
the other twelve varbase_*_base ~1.0.0 Each publishes a stable 1.0.x release and needs no specific floor.

~1.0.0 is not sufficient for the first two. It normalizes to a range whose lower bound is 1.0.0.0-dev, so it permits 1.0.2 but does not require it, and the resolver is free to pick 1.0.0. Verified with Composer\Semver\Semver: 1.0.0 satisfies ~1.0.0 but not ~1.0.2.

README.md

Version badge 1.0.x-dev to 1.0.3.

CHANGELOG.md

A ## [1.0.3] section with Added, Fixed, Changed and Known issues.

What the 1.0.3 tag will ship

  • feat: #3622833 Add a Newsletter Canvas page at /newsletter and point the footer Subscribe button at it.
  • fix: #3622817 Give the footer Subscribe button a link destination.

The task: #3622160 Back to DEV commit also in the range is release bookkeeping and is not release note content.

Testing

The Newsletter work was verified on a fresh Drupal CMS 2 build installed through the browser installer picking the Horizon Aid site template: the template appears in the picker, installs clean, /newsletter renders with a real h1, the footer Subscribe links to /newsletter, a subscription saves, and the inline confirmation renders.

Note on what the pipeline proves. The CI job sets minimum-stability: dev, and a branch such as 1.0.x-dev normalizes to 1.0.9999999.9999999-dev, which satisfies ~1.0.2. So CI resolves the dependency branch tips, not the released versions the tag will ship. A green pipeline here is therefore not evidence that the pinned constraints resolve. That has to be proven separately, by building against the released constraints and reading the resolved versions back, before tagging.

AI-Generated: Yes

Checkpoints:

  • File an issue
  • Addition/Change/Update/Fix
  • Testing to ensure no regression
  • Automated unit testing coverage
  • Automated functional testing coverage
  • UX/UI designer responsibilities
  • Readability
  • Accessibility
  • Performance
  • Security
  • Developer Documentation
  • User Guide Documentation
  • Reviewed by human
  • Code review by maintainers
  • Full testing and approval
  • Credit contributors
  • Review with the product owner
  • Release notes snippet
  • Release
Edited by Rajab Natshah

Merge request reports