chore(deps): Upgrade Composer dependencies - #49
Merged
Conversation
📝 WalkthroughWalkthroughThe pull request updates the exceptions dependency to version 1.x, adapts Guzzle handler tests to typed APIs, removes obsolete PHPStan entries, and adds CI security scanning and workflow permission changes. ChangesGuzzle Handler Compatibility
CI Security and Release Workflows
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #49 +/- ##
==========================================
Coverage 98.84% 98.84%
Complexity 1023 1023
==========================================
Files 76 76
Lines 2430 2430
==========================================
Hits 2402 2402
Misses 28 28
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
soulevilx
marked this pull request as ready for review
August 9, 2026 00:14
|
ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
tests/Unit/Middleware/MiddlewarePipelineCoverageTest.php (1)
100-109: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse a Guzzle version-neutral
HandlerStackPHPDoc where Guzzle 7 compatibility applies.Guzzle 8.0.2 declares
HandlerStackas generic, but Guzzle 7.10.0 does not. Sincecomposer.jsonstill supports^7.10 || ^8.0, avoid genericHandlerStack<...>annotations attests/Unit/Middleware/MiddlewarePipelineCoverageTest.php:104,tests/Unit/Middleware/MiddlewarePipelineTest.php:72, andtests/Unit/Support/FinalCoverageTest.php:272, or document the Guzzle 7 PHPStan behavior.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/Unit/Middleware/MiddlewarePipelineCoverageTest.php` around lines 100 - 109, Use a Guzzle-version-neutral HandlerStack PHPDoc in setMalformedHandler and the corresponding annotations at tests/Unit/Middleware/MiddlewarePipelineCoverageTest.php:100-109, tests/Unit/Middleware/MiddlewarePipelineTest.php:68-77, and tests/Unit/Support/FinalCoverageTest.php:268-277; remove the generic HandlerStack type arguments or explicitly document the Guzzle 7 PHPStan compatibility behavior at each site.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@tests/Unit/Middleware/MiddlewarePipelineCoverageTest.php`:
- Around line 100-109: Use a Guzzle-version-neutral HandlerStack PHPDoc in
setMalformedHandler and the corresponding annotations at
tests/Unit/Middleware/MiddlewarePipelineCoverageTest.php:100-109,
tests/Unit/Middleware/MiddlewarePipelineTest.php:68-77, and
tests/Unit/Support/FinalCoverageTest.php:268-277; remove the generic
HandlerStack type arguments or explicitly document the Guzzle 7 PHPStan
compatibility behavior at each site.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 4f8549c3-c34f-4eec-9df0-de413c7fdb63
⛔ Files ignored due to path filters (1)
composer.lockis excluded by!**/*.lock
📒 Files selected for processing (8)
composer.jsonphpstan-tests-baseline.neontests/Benchmark/CoreBench.phptests/Unit/Client/ClientBuilderTest.phptests/Unit/Client/HttpClientTest.phptests/Unit/Middleware/MiddlewarePipelineCoverageTest.phptests/Unit/Middleware/MiddlewarePipelineTest.phptests/Unit/Support/FinalCoverageTest.php
💤 Files with no reviewable changes (1)
- phpstan-tests-baseline.neon
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 0 |
🟢 Coverage ∅ diff coverage
Metric Results Coverage variation Report missing for 6073e731 Diff coverage ✅ ∅ diff coverage Coverage variation details
Coverable lines Covered lines Coverage Common ancestor commit (6073e73) Report Missing Report Missing Report Missing Head commit (d6007ee) 2072 2044 98.65% Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch:
<coverage of head commit> - <coverage of common ancestor commit>Diff coverage details
Coverable lines Covered lines Diff coverage Pull request (#49) 0 0 ∅ (not applicable) Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified:
<covered lines added or modified>/<coverable lines added or modified> * 100%1 Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
github-actions
Bot
added
the
documentation
There was a problem hiding this comment.
Pull request overview
This PR upgrades Composer dependencies (notably Guzzle 8.0.2 and jooservices/exceptions 1.0.0), updates tests/benchmarks to align with Guzzle 8’s stricter handler/promise typing, and refreshes CI/security workflows (including adding Codacy/Fortify scans and tightening permissions/pins).
Changes:
- Upgrade runtime/dev dependencies and refresh
composer.lock. - Update tests and benchmarks to use
MockHandler/HandlerStackpatterns compatible with Guzzle 8 promise generics; remove now-superseded PHPStan baseline entries. - Harden/extend GitHub Actions workflows (SHA-pinning, permissions scoping, labeler base-sha checkout, add Codacy & Fortify workflows, add Codacy coverage upload).
Reviewed changes
Copilot reviewed 17 out of 18 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/Unit/Support/FinalCoverageTest.php | Updates pipeline stack setup to use a MockHandler-backed HandlerStack for Guzzle 8 compatibility. |
| tests/Unit/Middleware/MiddlewarePipelineTest.php | Adjusts handler injection in tests to bypass stricter handler typing under Guzzle 8. |
| tests/Unit/Middleware/MiddlewarePipelineCoverageTest.php | Uses MockHandler stacks and the new helper to exercise malformed-handler guards under Guzzle 8 typing. |
| tests/Unit/Client/HttpClientTest.php | Adds stronger assertions around captured adapter options shape. |
| tests/Unit/Client/ClientBuilderTest.php | Makes header assertions safer for static analysis; simplifies WAN IP provider return typing in the fixture. |
| tests/TestCase.php | Adds a shared helper to force-set a handler onto a Guzzle HandlerStack for malformed-handler test coverage. |
| tests/Benchmark/CoreBench.php | Reworks benchmark handler to a large MockHandler queue for long benchmark iterations. |
| README.md | Adds a Codacy badge to the project header. |
| phpstan-tests-baseline.neon | Removes obsolete baseline entries related to handler/promise typing and fixture return types. |
| composer.lock | Locks updated dependency versions (Guzzle, promises, PHPUnit tooling, Symfony components, etc.). |
| composer.json | Bumps jooservices/exceptions constraint to ^1.0. |
| .github/workflows/semantic-pr.yml | Pins semantic PR title action to a specific commit SHA. |
| .github/workflows/scorecard.yml | Updates pinned upload-sarif action SHA/version. |
| .github/workflows/release.yml | Scopes job permissions, SHA-pins actions, and adds composer validation/audit in release validation. |
| .github/workflows/pr-labeler.yml | Checks out base SHA to prevent PR-controlled labeler config from influencing labeling; SHA-pins labeler. |
| .github/workflows/fortify.yml | Adds optional Fortify AST scanning workflow that skips cleanly without secrets. |
| .github/workflows/codacy.yml | Adds Codacy Analysis CLI workflow producing SARIF for code scanning. |
| .github/workflows/ci.yml | Updates setup-php pins, adds optional Codacy coverage upload, reduces artifact retention, and exports Codacy token env. |
Suppressed comments (1)
composer.json:36
- Bumping
jooservices/exceptionsfrom^0.5to^1.0is a major-version upgrade and changes the package's minimum dependency set. The README and CHANGELOG currently documentjooservices/exceptions (^0.5)(e.g. README.md:33, CHANGELOG.md:34), so those docs should be updated (and a breaking-change note considered) to avoid conflicting guidance for consumers.
"require": {
"php": "^8.5",
"guzzlehttp/guzzle": "^7.10 || ^8.0",
"jooservices/exceptions": "^1.0",
"monolog/monolog": "^3.10",
"psr/http-client": "^1.0",
"psr/log": "^3.0",
"psr/simple-cache": "^3.0"
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
Author
|
Addressed the review feedback from this round of checks: Fixed (d6007ee):
Evaluated, not changed:
|
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/ci.yml (1)
103-108: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winSet explicit permissions for the
testsjob.The job currently uses the repository default
GITHUB_TOKENpermissions. This job installs dependencies and executes test code. Limit it tocontents: readunless a command requires an additional permission.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 103 - 108, Add an explicit least-privilege permissions block to the tests job in the workflow, granting only contents: read for its GITHUB_TOKEN. Keep the existing tests job configuration and environment unchanged.Source: Linters/SAST tools
🧹 Nitpick comments (1)
tests/TestCase.php (1)
62-68: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winCorrect the
setHandler()visibility statement.
HandlerStack::setHandler()is public in Guzzle 7.10.0 and 8.0.2. The docblock incorrectly describes it as private. Document the reflection use without describing a public API as private. (raw.githubusercontent.com)Proposed documentation fix
- * exercised. This reaches through Reflection into a private Guzzle - * method: it depends on `GuzzleHttp\HandlerStack::setHandler()` keeping - * its current name/visibility, and may need updating if a future Guzzle - * release changes that internal. + * exercised. This invokes Guzzle's public `setHandler()` through + * Reflection to install a deliberately malformed handler for this test.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/TestCase.php` around lines 62 - 68, Update the docblock above the reflection helper in tests/TestCase.php to state that Guzzle’s public HandlerStack::setHandler() is being invoked through Reflection, while preserving the note about its method name and potential future changes.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 107-108: Remove CODACY_API_TOKEN from the workflow-level env
configuration and define it only within the “Upload coverage to Codacy” step.
Keep the token available for that upload while preventing dependency
installation and test steps from inheriting it.
In @.github/workflows/codacy.yml:
- Around line 32-33: Disable GitHub token persistence in both checkout steps by
adding persist-credentials: false to the checkout action in
.github/workflows/codacy.yml lines 32-33 and .github/workflows/fortify.yml lines
45-47.
---
Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 103-108: Add an explicit least-privilege permissions block to the
tests job in the workflow, granting only contents: read for its GITHUB_TOKEN.
Keep the existing tests job configuration and environment unchanged.
---
Nitpick comments:
In `@tests/TestCase.php`:
- Around line 62-68: Update the docblock above the reflection helper in
tests/TestCase.php to state that Guzzle’s public HandlerStack::setHandler() is
being invoked through Reflection, while preserving the note about its method
name and potential future changes.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 437cd134-ac94-4fd9-abad-cf580507e0ee
📒 Files selected for processing (14)
.github/workflows/ci.yml.github/workflows/codacy.yml.github/workflows/fortify.yml.github/workflows/pr-labeler.yml.github/workflows/release.yml.github/workflows/scorecard.yml.github/workflows/semantic-pr.ymlCHANGELOG.mdREADME.mdtests/Benchmark/CoreBench.phptests/TestCase.phptests/Unit/Middleware/MiddlewarePipelineCoverageTest.phptests/Unit/Middleware/MiddlewarePipelineTest.phptests/Unit/Support/FinalCoverageTest.php
💤 Files with no reviewable changes (3)
- tests/Unit/Middleware/MiddlewarePipelineCoverageTest.php
- tests/Unit/Middleware/MiddlewarePipelineTest.php
- tests/Unit/Support/FinalCoverageTest.php
🚧 Files skipped from review as they are similar to previous changes (1)
- tests/Benchmark/CoreBench.php
Comment on lines
+107
to
+108
| env: | ||
| CODACY_API_TOKEN: ${{ secrets.CODACY_API_TOKEN }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Limit CODACY_API_TOKEN to the Codacy upload step.
Line 108 exposes the token to dependency installation and test processes. An internal pull request can modify code executed before the upload step and transmit the token.
Move the environment variable to the Upload coverage to Codacy step.
Proposed fix
tests:
name: Tests & Coverage
runs-on: ubuntu-latest
needs: [lint]
- env:
- CODACY_API_TOKEN: ${{ secrets.CODACY_API_TOKEN }}
services:
mongodb:
@@
- name: Upload coverage to Codacy
+ env:
+ CODACY_API_TOKEN: ${{ secrets.CODACY_API_TOKEN }}
if: env.CODACY_API_TOKEN != ''📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| env: | |
| CODACY_API_TOKEN: ${{ secrets.CODACY_API_TOKEN }} | |
| - name: Upload coverage to Codacy | |
| env: | |
| CODACY_API_TOKEN: ${{ secrets.CODACY_API_TOKEN }} | |
| if: env.CODACY_API_TOKEN != '' |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 107 - 108, Remove CODACY_API_TOKEN
from the workflow-level env configuration and define it only within the “Upload
coverage to Codacy” step. Keep the token available for that upload while
preventing dependency installation and test steps from inheriting it.
Comment on lines
+32
to
+33
| - name: Checkout code | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not persist the GitHub token in scan checkouts.
actions/checkout stores the job token in local Git configuration by default. The following scan tools process pull request contents after checkout. Disable credential persistence in both steps.
.github/workflows/codacy.yml#L32-L33: addpersist-credentials: falseto the checkout step..github/workflows/fortify.yml#L45-L47: addpersist-credentials: falseto the checkout step.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 32-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 2 files
.github/workflows/codacy.yml#L32-L33(this comment).github/workflows/fortify.yml#L45-L47
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codacy.yml around lines 32 - 33, Disable GitHub token
persistence in both checkout steps by adding persist-credentials: false to the
checkout action in .github/workflows/codacy.yml lines 32-33 and
.github/workflows/fortify.yml lines 45-47.
Source: Linters/SAST tools
soulevilx
added a commit
that referenced
this pull request
Aug 9, 2026
* ci(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.4 (#47) Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.3 to 4.37.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@54f647b...f205ea1) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#46) Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](actions/checkout@v7...v7.0.1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Viet Vu <jooservices@gmail.com> * chore(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates (#42) Bumps the dev-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [friendsofphp/php-cs-fixer](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer) | `3.95.15` | `3.95.18` | | [laravel/pint](https://github.com/laravel/pint) | `1.29.3` | `1.30.0` | | [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) | `2.2.5` | `2.2.7` | | [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit) | `13.2.4` | `13.2.6` | | [symfony/var-dumper](https://github.com/symfony/var-dumper) | `8.1.1` | `8.1.2` | Updates `friendsofphp/php-cs-fixer` from 3.95.15 to 3.95.18 - [Release notes](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases) - [Changelog](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/blob/master/CHANGELOG.md) - [Commits](PHP-CS-Fixer/PHP-CS-Fixer@v3.95.15...v3.95.18) Updates `laravel/pint` from 1.29.3 to 1.30.0 - [Release notes](https://github.com/laravel/pint/releases) - [Changelog](https://github.com/laravel/pint/blob/main/CHANGELOG.md) - [Commits](laravel/pint@v1.29.3...v1.30.0) Updates `phpstan/phpstan` from 2.2.5 to 2.2.7 - [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits) Updates `phpunit/phpunit` from 13.2.4 to 13.2.6 - [Release notes](https://github.com/sebastianbergmann/phpunit/releases) - [Changelog](https://github.com/sebastianbergmann/phpunit/blob/13.2.6/ChangeLog-13.2.md) - [Commits](sebastianbergmann/phpunit@13.2.4...13.2.6) Updates `symfony/filesystem` from 7.4.11 to 7.4.15 - [Release notes](https://github.com/symfony/filesystem/releases) - [Changelog](https://github.com/symfony/filesystem/blob/8.2/CHANGELOG.md) - [Commits](symfony/filesystem@v7.4.11...v7.4.15) Updates `symfony/var-dumper` from 8.1.1 to 8.1.2 - [Release notes](https://github.com/symfony/var-dumper/releases) - [Changelog](https://github.com/symfony/var-dumper/blob/8.2/CHANGELOG.md) - [Commits](symfony/var-dumper@v8.1.1...v8.1.2) --- updated-dependencies: - dependency-name: friendsofphp/php-cs-fixer dependency-version: 3.95.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: laravel/pint dependency-version: 1.30.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: phpstan/phpstan dependency-version: 2.2.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: phpunit/phpunit dependency-version: 13.2.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: symfony/filesystem dependency-version: 7.4.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: symfony/var-dumper dependency-version: 8.1.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Viet Vu <jooservices@gmail.com> * chore(deps): bump guzzlehttp/guzzle from 8.0.0 to 8.0.1 (#39) Bumps [guzzlehttp/guzzle](https://github.com/guzzle/guzzle) from 8.0.0 to 8.0.1. - [Release notes](https://github.com/guzzle/guzzle/releases) - [Changelog](https://github.com/guzzle/guzzle/blob/8.0/CHANGELOG.md) - [Commits](guzzle/guzzle@8.0.0...8.0.1) --- updated-dependencies: - dependency-name: guzzlehttp/guzzle dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Viet Vu <jooservices@gmail.com> * chore(deps-dev): bump squizlabs/php_codesniffer from 4.0.1 to 4.0.2 (#48) Bumps [squizlabs/php_codesniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer) from 4.0.1 to 4.0.2. - [Release notes](https://github.com/PHPCSStandards/PHP_CodeSniffer/releases) - [Changelog](https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/4.x/CHANGELOG-4.x.md) - [Commits](PHPCSStandards/PHP_CodeSniffer@4.0.1...4.0.2) --- updated-dependencies: - dependency-name: squizlabs/php_codesniffer dependency-version: 4.0.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Viet Vu <jooservices@gmail.com> * ci(deps): bump actions/labeler from 6 to 7 (#37) Bumps [actions/labeler](https://github.com/actions/labeler) from 6 to 7. - [Release notes](https://github.com/actions/labeler/releases) - [Commits](actions/labeler@v6...v7) --- updated-dependencies: - dependency-name: actions/labeler dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#36) Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.3 to 2.4.4. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Viet Vu <jooservices@gmail.com> * chore(deps): Upgrade Composer dependencies (#49) * chore(deps): upgrade Composer dependencies * test(bench): dedupe handler-stack bypass helper and clarify magic numbers * ci: add Codacy security scan and Fortify AST workflows * ci: bump setup-php pin and cap coverage artifact retention * ci: harden release/labeler workflows and add Codacy badge * fix: address PR review feedback on handler bypass and stale docs * feat(transport): Add native ext-curl transport with builder middleware support (#50) * feat(transport): add native ext-curl transport with builder middleware support * docs(guide): Document the uppercase PR-title subject requirement * fix(transport): Fix CI failures and address review feedback on the cURL transport * chore(codacy): Move nosemgrep suppressions inline and simplify guidance prose * docs(claude): Split remaining compound bullet and remove ambiguous pronoun * test(transport): Cover duplicate multipart names, string/invalid query, auth-type fallback, and UA case-insensitivity * fix(transport): Register buffered multipart temp file before writing to it * feat(curl): Add portable cURL transport enhancements (#51) * feat(curl): Add portable cURL transport enhancements * test(curl): Cover portable transport edge cases * fix(curl): Address PR review feedback for transport enhancements * test(coverage): Raise class and method coverage above 95% * fix(guzzle): Guard on_headers for Guzzle 7 MockHandler throwables * chore(codacy): Exclude tests from Codacy static analysis * fix(middleware): Prevent same-name insert from corrupting pipeline order * chore(release): Prepare 2.4.0 * fix(release): Address 2.4.0 review feedback --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
jooservices/exceptions1.0.0; retain Symfony Filesystem 7.4 because pdepend 2.16.2 does not yet support Symfony 8.HandlerStacktest bypass into a single sharedtests/TestCase.phphelper.ci.yml.release.yml/pr-labeler.yml/semantic-pr.yml/scorecard.yml: SHA-pin all actions, scoperelease.ymlpermissions per-job, restorecomposer validate --strict+composer auditin the release gate, guard the PR labeler against base-branch config tampering, bumpcodeql-actionpin, and add the Codacy badge to README.Why
Started as a routine Composer bump; scope grew after diffing this repo's CI against
jooservices/dtoandjooservices/exceptionssurfaced several drift points (job naming, missing release-gate steps, unpinned actions, a stale branch-protection required-checks list) that were fixed alongside it rather than filed separately.Risk
Low. No
src/behavior change — only tests, CI workflows, and docs. Verified locally viacomposer lint:all,composer test(527 tests green),composer test:coverage(98.65%, above the 98% gate), andcomposer check.Documentation impact
README and CHANGELOG updated to match the
jooservices/exceptions^1.0bump (was documented as^0.5).Rollback
Revert this PR; no data/schema/runtime changes to unwind.
Checklist
composer lint:allcomposer testcomposer test:coveragecomposer checkValidation
composer cicomposer audit --no-dev --locked --abandoned=failSummary by CodeRabbit
Dependency Updates
Tests
Security & Quality
Documentation