From ddce15b672f53f9db9064f4e77724b0d4d65a8c0 Mon Sep 17 00:00:00 2001
From: Gregor Harlan <mail@gh01.de>
Date: Sat, 30 May 2026 13:18:59 +0200
Subject: [PATCH 1/2] chore: drop write-only 'version' core config

The 'version' key was written to rex_config at the end of setup but never
read anywhere. It is a leftover from the 5.x version-diff update detection;
6.x runs updates via idempotent install.php (console migrate) instead.
---
 pages/setup/index.php                   | 1 -
 src/Console/Command/SetupRunCommand.php | 1 -
 2 files changed, 2 deletions(-)

diff --git a/pages/setup/index.php b/pages/setup/index.php
index 65203e5744..3ee3ba81ed 100644
--- a/pages/setup/index.php
+++ b/pages/setup/index.php
@@ -291,7 +291,6 @@
 
     if (0 == count($errors)) {
         LanguageHandler::generateCache();
-        Core::setConfig('version', Core::getVersion());
     } else {
         $step = 4;
         $context->setParam('step', $step);
diff --git a/src/Console/Command/SetupRunCommand.php b/src/Console/Command/SetupRunCommand.php
index bd021b172a..51549db136 100644
--- a/src/Console/Command/SetupRunCommand.php
+++ b/src/Console/Command/SetupRunCommand.php
@@ -454,7 +454,6 @@ static function ($value) use ($createdbOptions) {
         }
 
         LanguageHandler::generateCache();
-        Core::setConfig('version', Core::getVersion());
 
         // ---------------------------------- Step 5 . Create User
         $io->title('Step 5 of 5 / User');

From e8c05c278df485afe8f3fd62aed8d7b98e60bc7c Mon Sep 17 00:00:00 2001
From: Gregor Harlan <mail@gh01.de>
Date: Sun, 31 May 2026 11:39:58 +0200
Subject: [PATCH 2/2] refactor: read version solely from Composer in Core and
 Addon

The 'version' property was only ever set by getVersion() itself as an
in-memory cache; nothing else writes it anymore (the persisted core
config was just dropped). Composer's InstalledVersions already caches
installed.php statically, so the memoization saved nothing.

Read directly from InstalledVersions and drop the now-dead 'version'
property validation, its getProperty type-map entry and the obsolete
taint-escape (the Composer-provided value is not a taint source). For
addons this also makes Composer the single source of truth, so a stray
'version' in package.yml can no longer override it.
---
 src/Addon/Addon.php |  9 +--------
 src/Core.php        | 25 ++++++-------------------
 2 files changed, 7 insertions(+), 27 deletions(-)

diff --git a/src/Addon/Addon.php b/src/Addon/Addon.php
index eb6398554c..eb9e2cda31 100644
--- a/src/Addon/Addon.php
+++ b/src/Addon/Addon.php
@@ -257,14 +257,7 @@ final public function getAuthor(?string $default = null): ?string
     /** @param string|null $format See {@link Formatter::version()} */
     final public function getVersion(?string $format = null): string
     {
-        $version = $this->getProperty('version');
-
-        if (null === $version) {
-            $version = InstalledVersions::getPrettyVersion($this->package) ?? '';
-            $this->setProperty('version', $version);
-        }
-
-        Type::string($version);
+        $version = InstalledVersions::getPrettyVersion($this->package) ?? '';
 
         if ($format) {
             return Formatter::version($version, $format);
diff --git a/src/Core.php b/src/Core.php
index b766145a21..e802ce9814 100644
--- a/src/Core.php
+++ b/src/Core.php
@@ -143,11 +143,6 @@ public static function setProperty(string $key, mixed $value): bool
                     throw new InvalidArgumentException(sprintf('"%s" property: expecting $value to be an instance of %s, "%s" found.', $key, Application::class, get_debug_type($value)));
                 }
                 break;
-            case 'version':
-                if (!is_string($value) || !preg_match('/^\d+(?:\.\d+)*(?:\.x)*(?:-\w+)?$/', $value)) {
-                    throw new InvalidArgumentException(sprintf('"%s" property: expecting $value to be a valid version string, got %s.', $key, is_string($value) ? '"' . $value . '"' : get_debug_type($value)));
-                }
-                break;
         }
         $exists = isset(self::$properties[$key]);
         self::$properties[$key] = $value;
@@ -174,7 +169,6 @@ public static function setProperty(string $key, mixed $value): bool
      *      ($key is 'timezone' ? string :
      *      ($key is 'table_prefix' ? non-empty-string :
      *      ($key is 'temp_prefix' ? non-empty-string :
-     *      ($key is 'version' ? string :
      *      ($key is 'server' ? string :
      *      ($key is 'servername' ? string :
      *      ($key is 'error_email' ? string :
@@ -189,7 +183,7 @@ public static function setProperty(string $key, mixed $value): bool
      *      ($key is 'setup' ? bool|array<string, int> :
      *      ($key is 'setup_addons' ? non-empty-string[] :
      *      mixed|null
-     *      )))))))))))))))))))))))))))
+     *      ))))))))))))))))))))))))))
      * ) The value for $key or $default if $key cannot be found
      */
     public static function getProperty(string $key, mixed $default = null): mixed
@@ -433,19 +427,12 @@ public static function getErrorEmail(): string
      */
     public static function getVersion(?string $format = null): string
     {
-        /** @psalm-taint-escape file */
-        $version = self::getProperty('version');
-
-        if (!$version) {
-            $version = Type::string(InstalledVersions::getPrettyVersion('redaxo/core'));
-
-            // On feature branches Composer returns "dev-<branch>", which is not
-            // a meaningful version. Fall back to a generic dev version.
-            if (str_starts_with($version, 'dev-')) {
-                $version = '6.x-dev';
-            }
+        $version = Type::string(InstalledVersions::getPrettyVersion('redaxo/core'));
 
-            self::setProperty('version', $version);
+        // On feature branches Composer returns "dev-<branch>", which is not
+        // a meaningful version. Fall back to a generic dev version.
+        if (str_starts_with($version, 'dev-')) {
+            $version = '6.x-dev';
         }
 
         if ($format) {