Bumped version to 2.13.2

Updated instructions to specify adding the file as a HTTP library.

.docker/debian-manual-guide/Dockerfile

@@ -0,0 +1,61 @@
+# Reproduces https://docs.part-db.de/installation/installation_guide-debian.html
+# on Debian 12 (bookworm) as closely as possible, for debugging issues reported
+# by users who followed that guide (Apache2 + mod_php, not the project's own
+# FrankenPHP-based Dockerfile at the repo root).
+FROM debian:12
+
+ARG HOST_UID=1000
+ARG HOST_GID=1000
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# --- Prerequisites (guide: "Prerequisites Installation") ---
+RUN apt-get update && apt-get upgrade -y && \
+    apt-get install -y --no-install-recommends \
+        git curl zip ca-certificates software-properties-common \
+        apt-transport-https lsb-release nano wget sqlite3 gnupg openssl \
+    && rm -rf /var/lib/apt/lists/*
+
+# --- PHP and Apache2 (guide: "PHP and Apache2 Setup") ---
+# Debian 12 ships PHP 8.2 by default, so no extra PHP repo is needed.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        apache2 php8.2 libapache2-mod-php8.2 \
+        php8.2-opcache php8.2-curl php8.2-gd php8.2-mbstring \
+        php8.2-xml php8.2-bcmath php8.2-intl php8.2-zip php8.2-xsl \
+        php8.2-sqlite3 php8.2-mysql \
+    && rm -rf /var/lib/apt/lists/*
+
+# --- Composer (guide: "Composer Installation") ---
+RUN wget -O /tmp/composer-setup.php https://getcomposer.org/installer \
+    && php /tmp/composer-setup.php --install-dir=/usr/local/bin --filename=composer \
+    && chmod +x /usr/local/bin/composer \
+    && rm /tmp/composer-setup.php
+
+# --- Node.js and Yarn (guide: "Node.js and Yarn Setup") ---
+RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && curl -sL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor -o /usr/share/keyrings/yarnkey.gpg \
+    && echo "deb [signed-by=/usr/share/keyrings/yarnkey.gpg] https://dl.yarnpkg.com/debian stable main" > /etc/apt/sources.list.d/yarn.list \
+    && apt-get update && apt-get install -y --no-install-recommends yarn \
+    && rm -rf /var/lib/apt/lists/*
+
+# Map www-data to the host user's uid/gid so files created inside the
+# bind-mounted repo (composer/yarn artifacts, chown'd dirs) don't end up
+# owned by a foreign uid on the host.
+RUN groupmod -g ${HOST_GID} www-data && usermod -u ${HOST_UID} -g ${HOST_GID} www-data \
+    && mkdir -p /var/www/partdb && chown -R www-data:www-data /var/www
+
+# --- Apache2 Configuration (guide: "Apache2 Configuration") ---
+COPY partdb.conf /etc/apache2/sites-available/partdb.conf
+RUN ln -sf /etc/apache2/sites-available/partdb.conf /etc/apache2/sites-enabled/partdb.conf \
+    && a2enmod rewrite headers access_compat \
+    && rm -f /etc/apache2/sites-enabled/000-default.conf
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+WORKDIR /var/www/partdb
+EXPOSE 80
+
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["apache2ctl", "-D", "FOREGROUND"]

.docker/debian-manual-guide/docker-compose.yml

@@ -0,0 +1,41 @@
+# Reproduces a Debian 12 install following
+# https://docs.part-db.de/installation/installation_guide-debian.html
+# using the repo checkout two levels up, for debugging.
+#
+# Usage (from this directory):
+#   HOST_UID=$(id -u) HOST_GID=$(id -g) docker compose up --build
+#
+# Then open http://localhost:8080 (login: admin / password printed in the
+# container logs by doctrine:migrations:migrate on first run).
+#
+# vendor/, node_modules/, var/, public/build, public/media and uploads live
+# in named volumes so composer/yarn/console never write into the host's own
+# working copy - only src/, config/, templates/, assets/, migrations/, etc.
+# are shared live for debugging.
+services:
+  partdb:
+    build:
+      context: .
+      args:
+        HOST_UID: ${HOST_UID:-1000}
+        HOST_GID: ${HOST_GID:-1000}
+    container_name: partdb-debian-guide
+    ports:
+      - "8080:80"
+    volumes:
+      - ../..:/var/www/partdb
+      - ./env.local:/var/www/partdb/.env.local:ro
+      - partdb_vendor:/var/www/partdb/vendor
+      - partdb_node_modules:/var/www/partdb/node_modules
+      - partdb_var:/var/www/partdb/var
+      - partdb_public_build:/var/www/partdb/public/build
+      - partdb_public_media:/var/www/partdb/public/media
+      - partdb_uploads:/var/www/partdb/uploads
+
+volumes:
+  partdb_vendor:
+  partdb_node_modules:
+  partdb_var:
+  partdb_public_build:
+  partdb_public_media:
+  partdb_uploads:

.docker/debian-manual-guide/entrypoint.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+# Reproduces the app-setup steps from
+# https://docs.part-db.de/installation/installation_guide-debian.html
+# against the repo bind-mounted at /var/www/partdb.
+set -euo pipefail
+
+cd /var/www/partdb
+
+# Only chown the named-volume mount points (see docker-compose.yml) - they're
+# fresh docker volumes owned by root until first use. The bind-mounted source
+# tree doesn't need it (www-data's uid/gid is mapped to the host user's at
+# image build time, so ownership already matches), and recursing into it
+# would also try (and fail) to chown the read-only .env.local mount.
+chown -R www-data:www-data \
+    var vendor node_modules public/build public/media uploads
+
+as_www() {
+    # -p preserves the environment (APP_ENV/APP_SECRET/DATABASE_URL from
+    # docker-compose) across the user switch. Plain `su` resets it, which
+    # would silently fall back to whatever's baked into .env.local.
+    su -p -s /bin/bash www-data -c "$*"
+}
+
+if [ ! -f vendor/autoload.php ] || [ "${FORCE_REINSTALL:-0}" = "1" ]; then
+    echo "==> composer install -o"
+    as_www "composer install -o"
+fi
+
+if [ ! -d node_modules/.bin ] || [ "${FORCE_REINSTALL:-0}" = "1" ]; then
+    echo "==> yarn install"
+    as_www "yarn install"
+fi
+
+if [ ! -f public/build/manifest.json ] || [ "${FORCE_REINSTALL:-0}" = "1" ]; then
+    echo "==> yarn build"
+    as_www "yarn build"
+fi
+
+echo "==> cache:clear"
+as_www "php bin/console cache:clear"
+
+echo "==> partdb:check-requirements"
+as_www "php bin/console partdb:check-requirements" || true
+
+echo "==> doctrine:migrations:migrate"
+as_www "php bin/console doctrine:migrations:migrate --no-interaction"
+
+exec "$@"

.docker/debian-manual-guide/env.local

@@ -0,0 +1,11 @@
+# Bind-mounted over /var/www/partdb/.env.local inside the container only.
+# The host's real .env.local (dev, MySQL on 127.0.0.1) is never touched or
+# read - this guarantees APP_ENV/DATABASE_URL are correct for BOTH Apache/
+# mod_php web requests and CLI (console/composer) commands, without relying
+# on environment variables being propagated into Apache's subprocess env
+# (which is what caused the "WebProfilerBundle" dev-bundle error: web
+# requests were silently falling back to the host .env.local's APP_ENV=dev,
+# while --no-dev composer install never installed that bundle).
+APP_ENV=prod
+APP_SECRET=0000000000000000000000000000000000000000000000000000000000debug
+DATABASE_URL="sqlite:///%kernel.project_dir%/var/app.db"

.docker/debian-manual-guide/partdb.conf

@@ -0,0 +1,15 @@
+# Verbatim from https://docs.part-db.de/installation/installation_guide-debian.html
+<VirtualHost *:80>
+    ServerName partdb.lan
+    ServerAlias www.partdb.lan
+
+    DocumentRoot /var/www/partdb/public
+    <Directory /var/www/partdb/public>
+        AllowOverride All
+        Order Allow,Deny
+        Allow from All
+    </Directory>
+
+    ErrorLog /var/log/apache2/partdb_error.log
+    CustomLog /var/log/apache2/partdb_access.log combined
+</VirtualHost>

VERSION

@@ -1 +1 @@
-2.13.1
+2.13.2

composer.lock

@@ -4638,16 +4638,16 @@
         },
         {
             "name": "guzzlehttp/guzzle",
-            "version": "7.14.1",
+            "version": "7.14.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/guzzle/guzzle.git",
-                "reference": "6b1d2429a2c312474c523aa9017fba0c07b5f4a0"
+                "reference": "fa88c57803501ad0770f5cddb1e60525d49da9a1"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/6b1d2429a2c312474c523aa9017fba0c07b5f4a0",
-                "reference": "6b1d2429a2c312474c523aa9017fba0c07b5f4a0",
+                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/fa88c57803501ad0770f5cddb1e60525d49da9a1",
+                "reference": "fa88c57803501ad0770f5cddb1e60525d49da9a1",
                 "shasum": ""
             },
             "require": {
@@ -4746,7 +4746,7 @@
             ],
             "support": {
                 "issues": "https://github.com/guzzle/guzzle/issues",
-                "source": "https://github.com/guzzle/guzzle/tree/7.14.1"
+                "source": "https://github.com/guzzle/guzzle/tree/7.14.2"
             },
             "funding": [
                 {
@@ -4762,7 +4762,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-13T01:32:54+00:00"
+            "time": "2026-07-14T18:15:01+00:00"
         },
         {
             "name": "guzzlehttp/promises",
@@ -10485,20 +10485,20 @@
         },
         {
             "name": "spomky-labs/cbor-php",
-            "version": "3.2.3",
+            "version": "3.3.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/Spomky-Labs/cbor-php.git",
-                "reference": "dd6eb84e6d92f7b8bd0da56b4b4dd7235aed0c32"
+                "reference": "013d13da69cf28b1ae501887daceccc850ca1c76"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Spomky-Labs/cbor-php/zipball/dd6eb84e6d92f7b8bd0da56b4b4dd7235aed0c32",
-                "reference": "dd6eb84e6d92f7b8bd0da56b4b4dd7235aed0c32",
+                "url": "https://api.github.com/repos/Spomky-Labs/cbor-php/zipball/013d13da69cf28b1ae501887daceccc850ca1c76",
+                "reference": "013d13da69cf28b1ae501887daceccc850ca1c76",
                 "shasum": ""
             },
             "require": {
-                "brick/math": "^0.9|^0.10|^0.11|^0.12|^0.13|^0.14|^0.15|^0.16|^0.17",
+                "brick/math": "^0.9|^0.10|^0.11|^0.12|^0.13|^0.14|^0.15|^0.16|^0.17|^0.18",
                 "ext-mbstring": "*",
                 "php": ">=8.0"
             },
@@ -10540,7 +10540,7 @@
             ],
             "support": {
                 "issues": "https://github.com/Spomky-Labs/cbor-php/issues",
-                "source": "https://github.com/Spomky-Labs/cbor-php/tree/3.2.3"
+                "source": "https://github.com/Spomky-Labs/cbor-php/tree/3.3.0"
             },
             "funding": [
                 {
@@ -10552,7 +10552,7 @@
                     "type": "patreon"
                 }
             ],
-            "time": "2026-04-01T12:15:20+00:00"
+            "time": "2026-07-15T18:56:27+00:00"
         },
         {
             "name": "spomky-labs/otphp",
@@ -10626,41 +10626,40 @@
         },
         {
             "name": "spomky-labs/pki-framework",
-            "version": "1.4.2",
+            "version": "1.5.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/Spomky-Labs/pki-framework.git",
-                "reference": "aa576cbd07128075bef97ac2f8af9854e67513d8"
+                "reference": "e0d61661962560c1cedfef02b51b431e720aae78"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Spomky-Labs/pki-framework/zipball/aa576cbd07128075bef97ac2f8af9854e67513d8",
-                "reference": "aa576cbd07128075bef97ac2f8af9854e67513d8",
+                "url": "https://api.github.com/repos/Spomky-Labs/pki-framework/zipball/e0d61661962560c1cedfef02b51b431e720aae78",
+                "reference": "e0d61661962560c1cedfef02b51b431e720aae78",
                 "shasum": ""
             },
             "require": {
-                "brick/math": "^0.10|^0.11|^0.12|^0.13|^0.14|^0.15|^0.16|^0.17",
+                "brick/math": "^0.10|^0.11|^0.12|^0.13|^0.14|^0.15|^0.16|^0.17|^0.18",
                 "ext-mbstring": "*",
-                "php": ">=8.1",
-                "psr/clock": "^1.0"
+                "php": ">=8.1"
             },
             "require-dev": {
                 "ekino/phpstan-banned-code": "^1.0|^2.0|^3.0",
                 "ext-gmp": "*",
                 "ext-openssl": "*",
-                "infection/infection": "^0.28|^0.29|^0.31|^0.32",
+                "infection/infection": "^0.28|^0.29|^0.31",
                 "php-parallel-lint/php-parallel-lint": "^1.3",
                 "phpstan/extension-installer": "^1.3|^2.0",
                 "phpstan/phpstan": "^1.8|^2.0",
                 "phpstan/phpstan-deprecation-rules": "^1.0|^2.0",
                 "phpstan/phpstan-phpunit": "^1.1|^2.0",
                 "phpstan/phpstan-strict-rules": "^1.3|^2.0",
-                "phpunit/phpunit": "^10.1|^11.0|^12.0|^13.0",
+                "phpunit/phpunit": "^10.1|^11.0|^12.0",
                 "rector/rector": "^1.0|^2.0",
                 "roave/security-advisories": "dev-latest",
                 "symfony/string": "^6.4|^7.0|^8.0",
                 "symfony/var-dumper": "^6.4|^7.0|^8.0",
-                "symplify/easy-coding-standard": "^12.0|^13.0"
+                "symplify/easy-coding-standard": "^12.0 || ^13.0"
             },
             "suggest": {
                 "ext-bcmath": "For better performance (or GMP)",
@@ -10720,7 +10719,7 @@
             ],
             "support": {
                 "issues": "https://github.com/Spomky-Labs/pki-framework/issues",
-                "source": "https://github.com/Spomky-Labs/pki-framework/tree/1.4.2"
+                "source": "https://github.com/Spomky-Labs/pki-framework/tree/1.5.0"
             },
             "funding": [
                 {
@@ -10732,7 +10731,7 @@
                     "type": "patreon"
                 }
             ],
-            "time": "2026-03-23T22:56:56+00:00"
+            "time": "2026-07-16T10:28:45+00:00"
         },
         {
             "name": "symfony/ai-bundle",
@@ -18647,20 +18646,20 @@
         },
         {
             "name": "web-auth/cose-lib",
-            "version": "4.5.2",
+            "version": "4.6.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/web-auth/cose-lib.git",
-                "reference": "5b38660f90070a8e45f3dbc9528ade3b608dd77d"
+                "reference": "3afe04df137baf97c5c3e28c5ee6f05536405148"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/web-auth/cose-lib/zipball/5b38660f90070a8e45f3dbc9528ade3b608dd77d",
-                "reference": "5b38660f90070a8e45f3dbc9528ade3b608dd77d",
+                "url": "https://api.github.com/repos/web-auth/cose-lib/zipball/3afe04df137baf97c5c3e28c5ee6f05536405148",
+                "reference": "3afe04df137baf97c5c3e28c5ee6f05536405148",
                 "shasum": ""
             },
             "require": {
-                "brick/math": "^0.9|^0.10|^0.11|^0.12|^0.13|^0.14|^0.15|^0.16|^0.17",
+                "brick/math": "^0.9|^0.10|^0.11|^0.12|^0.13|^0.14|^0.15|^0.16|^0.17|^0.18",
                 "ext-json": "*",
                 "ext-openssl": "*",
                 "php": ">=8.1",
@@ -18702,7 +18701,7 @@
             ],
             "support": {
                 "issues": "https://github.com/web-auth/cose-lib/issues",
-                "source": "https://github.com/web-auth/cose-lib/tree/4.5.2"
+                "source": "https://github.com/web-auth/cose-lib/tree/4.6.0"
             },
             "funding": [
                 {
@@ -18714,7 +18713,7 @@
                     "type": "patreon"
                 }
             ],
-            "time": "2026-05-03T09:49:50+00:00"
+            "time": "2026-07-16T10:19:49+00:00"
         },
         {
             "name": "web-auth/webauthn-lib",
@@ -20356,17 +20355,18 @@
             "source": {
                 "type": "git",
                 "url": "https://github.com/Roave/SecurityAdvisories.git",
-                "reference": "8f95407ba11cb3d30d131744f7396c6ad61f2e54"
+                "reference": "526c3e9555f6912cb025c1357e66956b1a1621c9"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Roave/SecurityAdvisories/zipball/8f95407ba11cb3d30d131744f7396c6ad61f2e54",
-                "reference": "8f95407ba11cb3d30d131744f7396c6ad61f2e54",
+                "url": "https://api.github.com/repos/Roave/SecurityAdvisories/zipball/526c3e9555f6912cb025c1357e66956b1a1621c9",
+                "reference": "526c3e9555f6912cb025c1357e66956b1a1621c9",
                 "shasum": ""
             },
             "conflict": {
                 "3f/pygmentize": "<1.2",
                 "adaptcms/adaptcms": "<=1.3",
+                "adawolfa/isdoc": "<1.4.3|>=1.5,<1.5.1|>=1.6,<1.6.1",
                 "admidio/admidio": "<=5.0.11",
                 "adodb/adodb-php": "<=5.22.9",
                 "aheinze/cockpit": "<2.2",
@@ -20417,7 +20417,7 @@
                 "austintoddj/canvas": "<=3.4.2",
                 "auth0/auth0-php": ">=3.3,<=8.18",
                 "auth0/login": "<=7.20",
-                "auth0/symfony": "<=5.7",
+                "auth0/symfony": "<=5.8",
                 "auth0/wordpress": "<=5.5",
                 "automad/automad": "<=2.0.0.0-beta27",
                 "automattic/jetpack": "<9.8",
@@ -20498,7 +20498,7 @@
                 "commerceteam/commerce": ">=0.9.6,<0.9.9",
                 "components/jquery": ">=1.0.3,<3.5",
                 "composer/composer": "<2.2.28|>=2.3,<2.9.8",
-                "concrete5/concrete5": "<9.5.1",
+                "concrete5/concrete5": "<9.5.2",
                 "concrete5/core": "<8.5.8|>=9,<9.1",
                 "contao-components/mediaelement": ">=2.14.2,<2.21.1",
                 "contao/comments-bundle": ">=2,<4.13.40|>=5.0.0.0-RC1-dev,<5.3.4",
@@ -20856,7 +20856,7 @@
                 "maikuolan/phpmussel": ">=1,<1.6",
                 "mainwp/mainwp": "<=4.4.3.3",
                 "manogi/nova-tiptap": "<=3.2.6",
-                "mantisbt/mantisbt": "<2.28.2",
+                "mantisbt/mantisbt": "<=2.28.3",
                 "marcwillmann/turn": "<0.3.3",
                 "markhuot/craftql": "<=1.3.7",
                 "marshmallow/nova-tiptap": "<5.7",
@@ -20989,8 +20989,8 @@
                 "pegasus/google-for-jobs": "<1.5.1|>=2,<2.1.1",
                 "personnummer/personnummer": "<3.0.2",
                 "ph7software/ph7builder": "<=17.9.1",
-                "phanan/koel": "<=9.3.4",
-                "pheditor/pheditor": ">=2.0.1,<=2.0.3",
+                "phanan/koel": "<=9.7",
+                "pheditor/pheditor": "<2.0.6",
                 "phenx/php-svg-lib": "<0.5.2",
                 "php-censor/php-censor": "<2.0.13|>=2.1,<2.1.5",
                 "php-mod/curl": "<2.3.2",
@@ -21290,8 +21290,8 @@
                 "typo3/cms-extensionmanager": ">=10,<=10.4.47|>=11,<=11.5.41|>=12,<=12.4.24|>=13,<=13.4.2",
                 "typo3/cms-felogin": ">=4.2,<4.2.3",
                 "typo3/cms-filelist": ">=11,<11.5.51|>=12,<12.4.46|>=13,<13.4.31|>=14,<14.3.3",
-                "typo3/cms-fluid": "<4.3.4|>=4.4,<4.4.1",
-                "typo3/cms-form": "<10.4.57|>=11,<11.5.51|>=12,<12.4.46|>=13,<13.4.31|>=14,<14.3.3",
+                "typo3/cms-fluid": "<4.3.4|>=4.4,<4.4.1|>=8,<8.7.23|>=9,<9.5.4",
+                "typo3/cms-form": "<10.4.57|>=11,<11.5.51|>=12,<12.4.46|>=13,<13.4.31|>=14,<14.3.5",
                 "typo3/cms-frontend": "<4.3.9|>=4.4,<4.4.5",
                 "typo3/cms-indexed-search": ">=10,<=10.4.47|>=11,<=11.5.41|>=12,<=12.4.24|>=13,<13.4.31|>=14,<14.3.3",
                 "typo3/cms-install": "<4.1.14|>=4.2,<4.2.16|>=4.3,<4.3.9|>=4.4,<4.4.5|>=12.2,<12.4.8|==13.4.2",
@@ -21469,7 +21469,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-14T14:50:25+00:00"
+            "time": "2026-07-16T20:57:14+00:00"
         },
         {
             "name": "sebastian/cli-parser",

docs/usage/eda_integration.md

@@ -54,7 +54,7 @@ To connect KiCad with Part-DB do the following steps:
 ```
 4. Replace the `root_url` with the URL of your Part-DB instance plus `/en/kicad-api/`. You can find the right value for this in the Part-DB user settings page under "API endpoints" in the "API tokens" panel.
 5. Replace the `token` field value with the token you have generated in step 1.
-6. Open KiCad and add this created file as a library in the KiCad symbol table under (Preferences --> Manage Symbol Libraries)
+6. Open KiCad and add this created file as a HTTP library in the KiCad symbol table under (Preferences --> Manage Symbol Libraries)
 
 If you then place a new part, the library dialog opens, and you should be able to see the categories and parts from Part-DB.
 

public/.htaccess

@@ -120,12 +120,23 @@ DirectoryIndex index.php
 </IfModule>
 
 <IfModule mod_headers.c>
-    # Set a strict CSP for all static assets not handled by PHP.
-    # PHP responses already carry their own CSP via NelmioSecurityBundle, so setifempty leaves those untouched.
-    Header always setifempty Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; sandbox;"
-    Header always setifempty X-Content-Type-Options "nosniff"
+    # Set a strict CSP for everything Apache serves, except the front controller (index.php),
+    # whose response CSP is set by NelmioSecurityBundle in PHP. Excluding it via a negative
+    # FilesMatch (rather than a blanket rule relying on "setifempty" to skip PHP responses)
+    # avoids depending on mod_headers detecting the PHP-set header at the right time: on a
+    # real Apache 2.4/mod_php install, "setifempty" did not reliably suppress the static policy,
+    # so BOTH Content-Security-Policy headers ended up on the same PHP response, and browsers
+    # enforce the intersection of all CSP headers on a response - so "script-src 'none';
+    # sandbox" silently disabled all scripts/styles site-wide. mod_rewrite's internal redirect
+    # to index.php re-runs directory-scoped matching against the new target, so this FilesMatch
+    # reliably excludes it regardless of the originally requested URL.
+    <FilesMatch "^(?!index\.php$).+$">
+        Header always set Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; sandbox;"
+        Header always set X-Content-Type-Options "nosniff"
+    </FilesMatch>
 
     # SVG files get a slightly different CSP because they can embed resources and must not be framed.
+    # (Declared after the general rule above so its more specific "set" wins for SVG files.)
     <FilesMatch "\.(svg|svg\.gz|svg\.br)$">
         Header always set Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; sandbox;"
     </FilesMatch>

public/kicad/footprints.txt

@@ -1,4 +1,4 @@
-# Generated on Mon Jun 22 07:31:48 UTC 2026
+# Generated on Mon Jul 13 05:43:59 UTC 2026
 # This file contains all footprints available in the offical KiCAD library
 Audio_Module:Reverb_BTDR-1H
 Audio_Module:Reverb_BTDR-1V

src/Services/Attachments/AttachmentSubmitHandler.php

@@ -78,7 +78,6 @@ class AttachmentSubmitHandler
         protected FileTypeFilterTools $filterTools,
         protected AttachmentsSettings $settings,
         protected readonly SVGSanitizer $SVGSanitizer,
-        private readonly AttachmentsSettings $attachmentsSettings,
         #[Autowire(env: "bool:ALLOW_ATTACHMENT_DOWNLOADS_FROM_LOCALNETWORK")]
         private readonly bool $allow_local_network_downloads = false,
     )

translations/messages.en.xlf

@@ -675,7 +675,7 @@ Sub elements will be moved upwards.</target>
     <unit id="maYlJO8" name="part_list.loading.message">
       <segment state="translated">
         <source>part_list.loading.message</source>
-        <target>This can take a moment. If this message do not disappear, try to reload the page.</target>
+        <target>This can take a moment. If this message does not disappear, try to reload the page.</target>
       </segment>
     </unit>
     <unit id="wKzcAZd" name="vendor.base.javascript_hint">
@@ -960,7 +960,7 @@ Sub elements will be moved upwards.</target>
     <unit id="I6zehgT" name="email.pw_reset.message">
       <segment state="translated">
         <source>email.pw_reset.message</source>
-        <target>somebody (hopefully you) requested a reset of your password. If this request was not made by you, ignore this mail.</target>
+        <target>Somebody (hopefully you) requested a reset of your password. If this request was not made by you, ignore this mail.</target>
       </segment>
     </unit>
     <unit id="P8NjvoC" name="email.pw_reset.button">
@@ -2143,7 +2143,7 @@ Also note that without two-factor authentication, your account is no longer as w
     <unit id="h3376Kl" name="tfa_google.step.download">
       <segment state="translated">
         <source>tfa_google.step.download</source>
-        <target>Download an authenticator app (e.g. &lt;a class="link-external" target="_blank" href="https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2"&gt;Google Authenticator&lt;/a&gt; oder &lt;a class="link-external" target="_blank" href="https://play.google.com/store/apps/details?id=org.fedorahosted.freeotp"&gt;FreeOTP Authenticator&lt;/a&gt;)</target>
+        <target>Download an authenticator app (e.g. &lt;a class="link-external" target="_blank" href="https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2"&gt;Google Authenticator&lt;/a&gt; or &lt;a class="link-external" target="_blank" href="https://play.google.com/store/apps/details?id=org.fedorahosted.freeotp"&gt;FreeOTP Authenticator&lt;/a&gt;)</target>
       </segment>
     </unit>
     <unit id="eriwJoR" name="tfa_google.step.scan">
@@ -3065,7 +3065,7 @@ If you have done this incorrectly or if a computer is no longer trusted, you can
     <unit id="AdYtBQG" name="attachment.edit.url.help">
       <segment state="translated">
         <source>attachment.edit.url.help</source>
-        <target>You can specify an URL to an external file here, or input an keyword which is used to search in built-in resources (e.g. footprints)</target>
+        <target>You can specify a URL to an external file here, or input a keyword which is used to search in built-in resources (e.g. footprints)</target>
       </segment>
     </unit>
     <unit id="jXplbqd" name="attachment.edit.name">
@@ -4208,7 +4208,7 @@ If you have done this incorrectly or if a computer is no longer trusted, you can
       </notes>
       <segment state="translated">
         <source>validator.noLockout</source>
-        <target>You can not withdraw yourself the "change permission" permission, to prevent that you lockout yourself accidentally.</target>
+        <target>You can not withdraw yourself the "change permission" permission, to prevent that you lock yourself out accidentally.</target>
       </segment>
     </unit>
     <unit id="tS2P7Jn" name="attachment_type.edit.filetype_filter">
@@ -4703,7 +4703,7 @@ Element 1 -&gt; Element 1.2</target>
       </notes>
       <segment state="translated">
         <source>storelocation.edit.is_full.label</source>
-        <target>Storelocation full</target>
+        <target>Storage location full</target>
       </segment>
     </unit>
     <unit id="XF4C7ZG" name="storelocation.edit.is_full.help">
@@ -4713,7 +4713,7 @@ Element 1 -&gt; Element 1.2</target>
       </notes>
       <segment state="translated">
         <source>storelocation.edit.is_full.help</source>
-        <target>If this option is selected, it is neither possible to add new [[part]] to this storelocation or to increase the amount of existing [[part]].</target>
+        <target>If this option is selected, it is neither possible to add new [[part]] to this storage location or to increase the amount of existing [[part]].</target>
       </segment>
     </unit>
     <unit id="V1su4ac" name="storelocation.limit_to_existing.label">
@@ -4733,7 +4733,7 @@ Element 1 -&gt; Element 1.2</target>
       </notes>
       <segment state="translated">
         <source>storelocation.limit_to_existing.help</source>
-        <target>If this option is activated, it is not possible to add new [[part]] to this storelocation, but the amount of existing [[part]] can be increased.</target>
+        <target>If this option is activated, it is not possible to add new [[part]] to this storage location, but the amount of existing [[part]] can be increased.</target>
       </segment>
     </unit>
     <unit id="tGVVeof" name="storelocation.only_single_part.label">
@@ -5988,7 +5988,7 @@ Element 1 -&gt; Element 1.2</target>
       </notes>
       <segment state="translated">
         <source>log.type.security.trusted_device_reset</source>
-        <target>Trusted devices resetted</target>
+        <target>Trusted devices reset</target>
       </segment>
     </unit>
     <unit id="a.Le1i0" name="log.type.collection_element_deleted">
@@ -6123,7 +6123,7 @@ Element 1 -&gt; Element 1.2</target>
     <unit id="uxw7_77" name="group.edit.enforce_2fa.help">
       <segment state="translated">
         <source>group.edit.enforce_2fa.help</source>
-        <target>If this option is enabled, every direct member of this group, has to configure at least one second-factor for authentication. Recommended for administrative groups with much permissions.</target>
+        <target>If this option is enabled, every direct member of this group, has to configure at least one second-factor for authentication. Recommended for administrative groups with many permissions.</target>
       </segment>
     </unit>
     <unit id="NwsYm0P" name="selectpicker.nothing_selected">
@@ -6363,7 +6363,7 @@ Element 1 -&gt; Element 1.2</target>
     <unit id="CdphPiM" name="tools.reel_calc.explanation">
       <segment state="translated">
         <source>tools.reel_calc.explanation</source>
-        <target>This calculator gives you an estimation, how many parts are remaining on an SMD reel. Measure the noted the dimensions on the reel (or use some of the presets) and click "Update" to get an result.</target>
+        <target>This calculator gives you an estimation, how many parts are remaining on an SMD reel. Measure the noted the dimensions on the reel (or use the presets) and click "Update" to get a result.</target>
       </segment>
     </unit>
     <unit id="21dEh63" name="perm.tools.reel_calculator">
@@ -7893,7 +7893,7 @@ Element 1 -&gt; Element 1.2</target>
     <unit id="h9kfyaE" name="log.element_edited.changed_fields.is_full">
       <segment state="translated">
         <source>log.element_edited.changed_fields.is_full</source>
-        <target>Storelocation full</target>
+        <target>Storage location full</target>
       </segment>
     </unit>
     <unit id="K754HtO" name="log.element_edited.changed_fields.limit_to_existing_parts">
@@ -8289,13 +8289,13 @@ Element 1 -&gt; Element 1.2</target>
     <unit id="gt2SlQN" name="import.create_unknown_datastructures">
       <segment state="translated">
         <source>import.create_unknown_datastructures</source>
-        <target>Create unknown datastructures</target>
+        <target>Create unknown data structures</target>
       </segment>
     </unit>
     <unit id=".TjGPnB" name="import.create_unknown_datastructures.help">
       <segment state="translated">
         <source>import.create_unknown_datastructures.help</source>
-        <target>If this is selected, datastructures (like categories, footprints, etc.) which does not exist in the database yet, will be automatically created. If this is not selected, only existing data structures will be used, and if no matching data structure is found, the part will get assigned nothing</target>
+        <target>If this is selected, data structures (like categories, footprints, etc.) which does not exist in the database yet, will be automatically created. If this is not selected, only existing data structures will be used, and if no matching data structure is found, the part will get assigned nothing</target>
       </segment>
     </unit>
     <unit id="y_rsaV8" name="import.path_delimiter">
@@ -8307,7 +8307,7 @@ Element 1 -&gt; Element 1.2</target>
     <unit id="AOG.hXc" name="import.path_delimiter.help">
       <segment state="translated">
         <source>import.path_delimiter.help</source>
-        <target>The delimiter used to mark different levels in data structure pathes like category, footprint, etc.</target>
+        <target>The delimiter used to mark different levels in data structure paths like category, footprint, etc.</target>
       </segment>
     </unit>
     <unit id="p_IxB9K" name="parts.import.help_documentation">
@@ -8367,7 +8367,7 @@ Element 1 -&gt; Element 1.2</target>
     <unit id="tNnYa0u" name="project.bom_import.type.kicad_pcbnew">
       <segment state="translated">
         <source>project.bom_import.type.kicad_pcbnew</source>
-        <target>KiCAD Pcbnew BOM (CSV file)</target>
+        <target>KiCad Pcbnew BOM (CSV file)</target>
       </segment>
     </unit>
     <unit id="AtW_ooO" name="project.bom_import.clear_existing_bom">
@@ -8535,7 +8535,7 @@ Element 1 -&gt; Element 1.2</target>
     <unit id="sg8NMZk" name="log.user_login.ip_anonymize_hint">
       <segment state="translated">
         <source>log.user_login.ip_anonymize_hint</source>
-        <target>If the last digits of the IP address are missing, then the GDPR mode is enabled, in which IP addresses are anynomized.</target>
+        <target>If the last digits of the IP address are missing, then the GDPR mode is enabled, in which IP addresses are anonymized.</target>
       </segment>
     </unit>
     <unit id="K_LOvwj" name="log.user_not_allowed.unauthorized_access_attempt_to">
@@ -8571,7 +8571,7 @@ Element 1 -&gt; Element 1.2</target>
     <unit id="YQafwyc" name="error_table.error">
       <segment state="translated">
         <source>error_table.error</source>
-        <target>An error occured during your request.</target>
+        <target>An error occurred during your request.</target>
       </segment>
     </unit>
     <unit id="SgZGiGG" name="part.table.invalid_regex">
@@ -9347,7 +9347,7 @@ Please note, that you can not impersonate a disabled user. If you try you will g
     <unit id="Y8bGSEj" name="permission.legend.dependency_note">
       <segment state="translated">
         <source>permission.legend.dependency_note</source>
-        <target>Please note that some permission operations depend on each other. If you encounter a warning that missing permissions were corrected and a permission was set to allow again, you have to set the dependent operation to forbid too. The dependents can normally found right of an operation.</target>
+        <target>Please note that some permission operations depend on each other. If you encounter a warning that missing permissions were corrected and a permission was set to allow again, you have to set the dependent operation to forbid too. The dependents can normally be found right of an operation.</target>
       </segment>
     </unit>
     <unit id="zWj5h2X" name="log.part_stock_changed.timestamp">
@@ -12152,7 +12152,7 @@ Buerklin-API Authentication server:
     <unit id="RFhwYWd" name="info_providers.search.error.transport_exception">
       <segment state="translated">
         <source>info_providers.search.error.transport_exception</source>
-        <target>Transport error while retrieving information from the providers. Check that your server has internet accesss. See server logs for more info.</target>
+        <target>Transport error while retrieving information from the providers. Check that your server has internet access. See server logs for more info.</target>
       </segment>
     </unit>
     <unit id="PExOL_J" name="update_manager.title">

yarn.lock

@@ -1621,9 +1621,9 @@
     tslib "^2.8.0"
 
 "@fortawesome/fontawesome-free@^7.0.0":
-  version "7.3.0"
-  resolved "https://registry.yarnpkg.com/@fortawesome/fontawesome-free/-/fontawesome-free-7.3.0.tgz#c26db8baad037c5dff9d88980757cb5d90540d8a"
-  integrity sha512-Yw4Qa43P6e4Xwh0TwEUkHQNRJInWaqIBo73VJmns3j2AIlZPAvUcR4yGIxCPqPRCgyJ5KIVIalF/I1GxhZ/Kgw==
+  version "7.3.1"
+  resolved "https://registry.yarnpkg.com/@fortawesome/fontawesome-free/-/fontawesome-free-7.3.1.tgz#9d7d7df8f850637e001d24e6cd901422b4b09099"
+  integrity sha512-wmglKKPDIkgV3aWlZzWECCPoGIkYCulzBwxG9+w7rc5BGapZ6cPMpoPOT8k36J0Ni7PPX6c/rsoMWfS4d1MUMg==
 
 "@hotwired/stimulus-webpack-helpers@^1.0.1":
   version "1.0.1"
@@ -2091,9 +2091,9 @@
   integrity sha512-p3KyPzxGc3vWSap5hHA6SllbUCmh7s+NtpGyC3qEWrxYJT9t9TUAzjPm48Okipo+UUyPQfDlIvTcs9JRShBFiQ==
 
 "@zxcvbn-ts/language-common@^4.1.2":
-  version "4.1.2"
-  resolved "https://registry.yarnpkg.com/@zxcvbn-ts/language-common/-/language-common-4.1.2.tgz#c38c52500865d3a2ab7fa1193d747dafc4f2b995"
-  integrity sha512-uJlBzhC9/KjPImqdnc1/lPxmdn4xKbkruN5p1mASWkXA0gli+GZ5LrVL+dqscA8Pcf4OfudE56TtCWeHljJOvA==
+  version "4.1.3"
+  resolved "https://registry.yarnpkg.com/@zxcvbn-ts/language-common/-/language-common-4.1.3.tgz#c0955cc6819f89e49f4274c7013890c1ae7fdd06"
+  integrity sha512-g2bg4skmlJG9aJqC/nWziZzgYpSe/f3rKeGobrkdFiOrfZVFqqzUgC6BUQWuX54Sua9j0Jxxt+1bf4f/Mal1Kg==
   dependencies:
     "@zxcvbn-ts/dictionary-compression" "^3.0.1"
 
@@ -2334,9 +2334,9 @@ caniuse-api@^3.0.0:
     lodash.uniq "^4.5.0"
 
 caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001803:
-  version "1.0.30001805"
-  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001805.tgz#78d5d5968a69b7ff81af87a96d7ddc7ea6670b1e"
-  integrity sha512-52noaS3DubycKSXaU30TwPGIp+POyQSUVa5jBEq3vkRkY0kjyb3LQgvhU6WGyCcyXqVLWO0Cw0Q6BSdD0kUfVA==
+  version "1.0.30001806"
+  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001806.tgz#1bc8e502b723fa393455dfbedd5ccec0c29bb74e"
+  integrity sha512-72Cuvd95zbSYPKq6Fhg8eDJRlzgWDf7/mtoZv6Qe/DYNCEBdNxoA3+rZAU2ZhGCpZlns3EssFavaZomckT5Uuw==
 
 ccount@^2.0.0:
   version "2.0.1"
@@ -2926,9 +2926,9 @@ domutils@^3.0.1:
     domhandler "^5.0.3"
 
 electron-to-chromium@^1.5.389:
-  version "1.5.389"
-  resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.389.tgz#538be9ebec78026d4daba6be321ab854dfac2a8f"
-  integrity sha512-cEto7aeOqBfU1D+c5py5pE+ooscKE75JifxLBdFUZsqAxRS6y7kebtxAZvICszSl05gPjYHDTjY+lXpyGvpJbg==
+  version "1.5.392"
+  resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.392.tgz#31e9f9af0d8df3d1489468a4242b173605617482"
+  integrity sha512-1yQq3VQCZRwsnYc67Oc+1fge6Lwtn0hzi6zmEVkB61Zx21kTbwJAW4dFLadl5Rc1tKhG/kSpYXnfiAhu0f0a1g==
 
 emoji-regex@^8.0.0:
   version "8.0.0"
@@ -5277,9 +5277,9 @@ wildcard@^2.0.1:
   integrity sha512-CC1bOL87PIWSBhDcTrdeLo6eGT7mCFtrg0uIJtqJUFyK+eJnzl8A1niH56uu7KMa5XFrtiV+AQuHO3n7DsHnLQ==
 
 ws@^8.19.0:
-  version "8.21.0"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-8.21.0.tgz#012e413fc07429945121b0c153158c4343086951"
-  integrity sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==
+  version "8.21.1"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-8.21.1.tgz#045650cd4b1207809e7547146223c3814a9af586"
+  integrity sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==
 
 xmldoc@^2.0.3:
   version "2.0.3"