v3.16.2

Release v3.16.2 (2026-07-12)

Bug Fixes

• Resolve brace-expansion ReDoS vulnerability (CVE-2025-5889) by bumping to 1.1.16 / 5.0.7 (#127 by @sectsect)

Refactor / Maintenance

• Sync CI Biome setup version (2.5.3) with the dev dependency in the typescript-code-quality workflow (#127 by @sectsect)
• Replace deprecated FILTER_DEFAULT with FILTER_UNSAFE_RAW for PHP 8.5 compatibility (#127 by @sectsect)
• Narrow array_diff_interactive() parameter/return types to int|string and filter non-scalar values before array_diff to satisfy stricter PHPStan checks (#127 by @sectsect)
• Bump version to v3.16.2 for release (by @sectsect)

Dependencies

• Bump dev dependencies to latest: commitlint 20 → 21, rspack 2.0 → 2.1, secretlint 12 → 13, @types/node 25 → 26, lint-staged 16 → 17, and other minor bumps (#127 by @sectsect)
• Bump @biomejs/biome from 2.4.13 to 2.5.3, migrating biome.jsonc to the 2.5 preset syntax and relocating nursery rules promoted to stable groups (#127 by @sectsect)
• Bump phpstan/phpstan to 2.2.5 and refresh composer.lock for related dev packages (#127 by @sectsect)