Release v2.2.3: Spec Kit, Twig decrypt escape fix, MysqlAes deprecation.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: HecFranco

docs/CHANGELOG.md

@@ -9,6 +9,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [2.2.3] - 2026-07-09
+
+### Added
+
+- **GitHub Spec Kit:** `.specify/` tooling, Cursor Agent skills (`.cursor/skills/speckit-*`), and baseline spec in `specs/001-baseline/` (100% `src/` inventory). See [SPEC-KIT.md](SPEC-KIT.md) and [SPEC-DRIVEN-DEVELOPMENT.md](SPEC-DRIVEN-DEVELOPMENT.md).
+- **CodeRabbit:** review configuration (`.coderabbit.yaml`) and GitHub Actions workflow for automated PR review.
+
+### Changed
+
+- **Documentation:** [SPEC-KIT.md](SPEC-KIT.md) (install, structure, Cursor usage); README link under Documentation.
+- **MysqlAes:** PHPDoc `@deprecated since 2.1.0` — not recommended for new production deployments (AES-128-ECB); prefer Halite or Defuse. No runtime change.
+- **Twig `|decrypt` filter:** removed `isSafe: ['html']` so decrypted output is auto-escaped by Twig (security fix). Use `|raw` only when the decrypted value is trusted HTML.
+- **composer.lock:** dependency sync for the bundle root and demo apps (`symfony7`, `symfony8`).
+
+No configuration changes required. See [UPGRADING.md](UPGRADING.md#upgrading-to-223).
+
+---
+
 ## [2.2.2] - 2026-06-11
 
 ### Fixed

docs/RELEASE.md

@@ -34,6 +34,13 @@
 
 ---
 
+## v2.2.3 (2026-07-09)
+
+- **Scope:** GitHub Spec Kit (`.specify/`, baseline `specs/001-baseline/`, Cursor skills, SPEC-KIT.md); CodeRabbit CI; Twig `|decrypt` auto-escape fix; MysqlAes PHPDoc `@deprecated`; composer.lock sync (root + demos).
+- **Checklist:** CHANGELOG and UPGRADING updated; `make test`; commit release notes; tag `v2.2.3`; push branch and tag.
+
+---
+
 ## v2.2.2 (2026-06-11)
 
 - **Scope:** Functional tests — native lazy objects on PHP 8.4+ for Symfony 8 CI matrix (LazyGhost unavailable in `symfony/var-exporter` 8.x).

docs/UPGRADING.md

@@ -29,6 +29,32 @@ This guide explains how to upgrade the Doctrine Encrypt Bundle between versions.
 
 ---
 
+## Upgrading to 2.2.3
+
+No breaking changes. Patch release (Spec Kit maintainer tooling, Twig `|decrypt` auto-escape fix, MysqlAes PHPDoc deprecation, composer.lock sync).
+
+If your Twig templates relied on the `|decrypt` filter **not** being escaped (previous incorrect `isSafe: ['html']` marking), apply `|raw` only when the decrypted content is trusted HTML:
+
+```twig
+{# Before (implicit unescaped output — incorrect) #}
+{{ value|decrypt }}
+
+{# After — default: escaped (recommended) #}
+{{ value|decrypt }}
+
+{# Only if decrypted HTML is trusted #}
+{{ value|decrypt|raw }}
+```
+
+Update as usual:
+
+```bash
+composer update nowo-tech/doctrine-encrypt-bundle
+php bin/console cache:clear
+```
+
+---
+
 ## Upgrading to 2.2.2
 
 No breaking changes. Patch release only (functional test / CI fix for PHP 8.4 + Symfony 8). **No changes required** in your application.