feat(ci): add composer audit to CI pipeline

.github/workflows/ci.yml

@@ -86,14 +86,25 @@ jobs:
       - name: Set phpunit/phpunit version constraint
         run: composer require phpunit/phpunit:'${{ matrix.php.phpunit }}' --dev --no-interaction --no-update
 
-      - name: Install highest dependencies
-        run: composer update --no-progress --no-interaction --prefer-dist
+      - name: Resolve highest dependencies
+        run: composer update --no-progress --no-interaction --prefer-dist --no-install --no-plugins --no-scripts --no-audit
         if: ${{ matrix.dependencies == 'highest' }}
 
-      - name: Install lowest dependencies
-        run: composer update --no-progress --no-interaction --prefer-dist --prefer-lowest
+      - name: Resolve lowest dependencies
+        run: composer update --no-progress --no-interaction --prefer-dist --prefer-lowest --no-install --no-plugins --no-scripts --no-audit
         if: ${{ matrix.dependencies == 'lowest' }}
 
+      - name: Audit highest dependencies
+        run: composer audit --locked --no-interaction --format=table
+        if: ${{ matrix.dependencies == 'highest' }}
+
+      - name: Audit lowest dependencies
+        run: composer audit --locked --no-interaction --format=table --abandoned=report
+        if: ${{ matrix.dependencies == 'lowest' }}
+
+      - name: Install dependencies
+        run: composer install --no-progress --no-interaction --prefer-dist --no-plugins --no-scripts
+
       - name: Run unit tests
         run: vendor/bin/phpunit --testsuite unit --coverage-clover=coverage.xml
       # The reason for running some OOM tests without coverage is that because the coverage information collector can cause another OOM event invalidating the test
@@ -133,8 +144,14 @@ jobs:
           key: ${{ runner.os }}-runtime-frankenphp-composer-${{ hashFiles('**/composer.lock') }}
           restore-keys: ${{ runner.os }}-runtime-frankenphp-composer-
 
+      - name: Resolve dependencies
+        run: composer update --no-progress --no-interaction --prefer-dist --no-install --no-plugins --no-scripts --no-audit
+
+      - name: Audit dependencies
+        run: composer audit --locked --no-interaction --format=table
+
       - name: Install dependencies
-        run: composer install --no-progress --no-interaction --prefer-dist
+        run: composer install --no-progress --no-interaction --prefer-dist --no-plugins --no-scripts
 
       - name: Install FrankenPHP
         env:
@@ -198,8 +215,14 @@ jobs:
           key: ${{ runner.os }}-runtime-roadrunner-composer-${{ hashFiles('**/composer.lock') }}
           restore-keys: ${{ runner.os }}-runtime-roadrunner-composer-
 
+      - name: Resolve dependencies
+        run: composer update --no-progress --no-interaction --prefer-dist --no-install --no-plugins --no-scripts --no-audit
+
+      - name: Audit dependencies
+        run: composer audit --locked --no-interaction --format=table
+
       - name: Install dependencies
-        run: composer install --no-progress --no-interaction --prefer-dist
+        run: composer install --no-progress --no-interaction --prefer-dist --no-plugins --no-scripts
 
       - name: Install RoadRunner
         env:

.github/workflows/static-analysis.yaml

@@ -23,8 +23,14 @@ jobs:
         with:
           php-version: '8.4'
 
+      - name: Resolve dependencies
+        run: composer update --no-progress --no-interaction --prefer-dist --no-install --no-plugins --no-scripts --no-audit
+
+      - name: Audit dependencies
+        run: composer audit --locked --no-interaction --format=table
+
       - name: Install dependencies
-        run: composer update --no-progress --no-interaction --prefer-dist
+        run: composer install --no-progress --no-interaction --prefer-dist --no-plugins --no-scripts
 
       - name: Run script
         run: vendor/bin/php-cs-fixer fix --verbose --diff --dry-run
@@ -41,8 +47,14 @@ jobs:
         with:
           php-version: '8.4'
 
+      - name: Resolve dependencies
+        run: composer update --no-progress --no-interaction --prefer-dist --no-install --no-plugins --no-scripts --no-audit
+
+      - name: Audit dependencies
+        run: composer audit --locked --no-interaction --format=table
+
       - name: Install dependencies
-        run: composer update --no-progress --no-interaction --prefer-dist
+        run: composer install --no-progress --no-interaction --prefer-dist --no-plugins --no-scripts
 
       - name: Run script
         run: vendor/bin/phpstan analyse
@@ -59,8 +71,14 @@ jobs:
         with:
           php-version: '8.4'
 
+      - name: Resolve dependencies
+        run: composer update --no-progress --no-interaction --prefer-dist --no-install --no-plugins --no-scripts --no-audit
+
+      - name: Audit dependencies
+        run: composer audit --locked --no-interaction --format=table
+
       - name: Install dependencies
-        run: composer update --no-progress --no-interaction --prefer-dist
+        run: composer install --no-progress --no-interaction --prefer-dist --no-plugins --no-scripts
 
       - name: Run script
         run: composer mago

composer.json

@@ -35,7 +35,6 @@
         "carthage-software/mago": "^1.13.3",
         "friendsofphp/php-cs-fixer": "^3.4",
         "guzzlehttp/promises": "^2.0.3",
-        "guzzlehttp/psr7": "^1.8.4|^2.1.1",
         "monolog/monolog": "^1.6|^2.0|^3.0",
         "nyholm/psr7": "^1.8",
         "open-telemetry/api": "^1.0",