Skip to content

feat(minifyx): replace Munee with pure-PHP pipeline for 2.0 - #9

Draft
Ibochkarev wants to merge 6 commits into
masterfrom
feat/minifyx-2.0-pure-php-pipeline
Draft

feat(minifyx): replace Munee with pure-PHP pipeline for 2.0#9
Ibochkarev wants to merge 6 commits into
masterfrom
feat/minifyx-2.0-pure-php-pipeline

Conversation

@Ibochkarev

Copy link
Copy Markdown
Member

Replace the abandoned Munee dependency with a pure-PHP asset pipeline for MinifyX 2.0. The snippet, plugin, minify(), groups, hooks, and connector URL stay compatible with 1.x, but compilation, caching, and image handling now run on maintained PHP libraries without Node on production.

Munee and its git submodule are removed. CSS/JS minification uses matthiasmullie/minify; SCSS/LESS use scssphp and wikimedia/less.php; images use Intervention Image v3. The facade delegates to a PSR-4 AssetPipeline with atomic filesystem cache, fingerprinting, and shared processFiles() for snippet and plugin paths.

Platform requirements:

  • MODX 2.8.x+ with PHP 7.4+
  • MODX 3.x with PHP 8.2+

Security hardening closes path traversal (directory-boundary checks), cache filename injection, unbounded resize DoS (4096px cap), and no-op HMAC when a signing key is set. Failed compiles no longer write empty bundles. Post-hooks sync content before cache write; SCSS/LESS receive query-string variables; bundled registered assets keep first-tag attributes and drop SRI/crossorigin.

PHPUnit (24 tests) and PHPStan level 8 are included with GitHub Actions CI. See core/components/minifyx/docs/migration-2.0.md for upgrade notes.

Drop the abandoned Munee stack in favor of a PSR-4 PHP 8.2 pipeline that
keeps the MODX 2.8/3.x public API while adding hardened caching, image
handling, CI, and regression tests.
Document MODX 2.8.x+ on PHP 7.4+ and MODX 3.x on PHP 8.2+, and enforce
the matching floor during package install/upgrade.
- Protect empty CSS url() values and rebasing via MatthiasCssOptimizer
- Add optional Terser/esbuild JS mangling with safe process runner and PHP fallback
- Introduce AssetTag model, semantic BundlePlanner and opt-in preload hints
- Replace Intervention Image with native GD/Imagick processors
- Wire BuildRequest/BuildResult/BuildSignature in AssetPipeline
- Extract RegisteredAssetPageProcessor; slim plugin to event adapter
- Extend CI matrix to PHP 7.4 (prefer-lowest) through 8.4

Fixes #4
Fixes #7
Fixes #8
Move MinifyX facade to MinifyX\Model with global alias, harden getService
entry points, add shared TestCase/phpstan-phpunit coverage, and apply PSR-12
plus 120-char line limits across src, model, tests, and lexicon.
Use the valid shivammathur/setup-php action so matrix jobs can start.
Add SRI/CORS injection, structured build errors, health check, import graph,
source maps, warm-cache CLI, and security defaults. Bump to 3.0.0 with PHP
8.2+, MODX 3 service resolver, minifyx.php connector, settings migration, and
CoffeeScript removal.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant