[dependabot]

Bumps conduction/hydra-gates from 1.18.0 to 1.19.0.

Release notes

Sourced from conduction/hydra-gates's releases.

hydra-gates v1.19.0

Gate package release cut from main at 9e35872e9. Everything merged into hydra-gates/ since v1.18.0 is included. That includes the multi-line attribute fix for gate 16 (#811): an @spec above a multi-line #[...] attribute is now found, so apps that vendor the package get the same verdict locally as CI on @main.

The weekly hydra-gates/vYYYY.WW tags list the individual changes. The full diff is v1.18.0...v1.19.0.

Commits

• 9e35872 Merge pull request #898 from ConductionNL/fix/manifest-gates-false-positives
• 9b04b46 Merge pull request #897 from ConductionNL/feat/canonical-assert-lockfile
• c4ea948 Merge pull request #888 from ConductionNL/fix/contracts-email-link-reader-spe...
• 141d71b Merge pull request #896 from ConductionNL/fix/vendor-manifest-schema-2.171
• ebc2706 Merge pull request #893 from ConductionNL/fix/gate-122-vue-script-reader
• a4a8538 Merge pull request #895 from ConductionNL/docs/sig-scores-matrix
• 0c8d4da fix(hydra-gates): stop gates 54, 55 and 102 reporting non-defects
• 7432046 docs(ci): say how the sync PR's runs stall
• d29ff87 feat(quality-config): canonical assert-lockfile-matches-install.js
• 38f8af1 fix(ci): run the required checks on schema sync pull requests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Quality Report — ConductionNL/hermiq @ 4c347dd

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
test-l10n		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
check-bundle-budget		✅
composer			❌	✅ 126/126
npm			✅	✅ 854/854
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					❌ 3063/3070
Newman					✅ 15/15
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-11-05 13:52 UTC

Download the full PDF report from the workflow artifacts.