Skip to content

Update dependencies - #334

Merged
ondrejmirtes merged 1 commit into
2.3.xfrom
dependency-updates-2026-10
Oct 28, 2026
Merged

ondrejmirtes merged 1 commit into
2.3.xfrom
dependency-updates-2026-10

Conversation

@ondrejmirtes

Copy link
Copy Markdown
Member

Monthly dependency maintenance.

GitHub Actions

  • step-security/harden-runner v2.22.2 → v2.22.3
  • astral-sh/setup-uv v8.3.2 → v10.3.2 — majors only change cache defaults; this workflow sets enable-cache: false, runs on push/pull_request
  • zizmor 1.20.0 → 1.31.1 (SARIF mode still exits 0; findings are uploaded as before)

apigen

  • Lock refreshed. Added config.platform.php: 8.1.0 so the lock resolves for PHP 8.1, which the API reference workflow uses (unpinned resolution pulled symfony/string 7.4, requiring PHP 8.2).
  • Pinned nette/schema: ~1.2.0: ApiGen 7.0.0-alpha.6 uses Nette\Schema\Helpers::PREVENT_MERGING, removed in nette/schema 1.3.

tools/phplrt

  • Lock refreshed: symfony/polyfill-* → 1.43.0, symfony/service-contracts → 3.7.3.

Root — composer.lock is not committed; phpstan/phpstan 2.3.3 is picked up by composer update in CI already.

Skipped major: metcalfc/changelog-generator v4 → v5 (v5 renders commit subjects as inline code in release notes, so #123 stops autolinking).

Verified locally: make check (7767 tests, PHPStan OK), FuzzyTest with the phplrt toolchain, ApiGen generates docs, actionlint clean.

- step-security/harden-runner v2.22.2 -> v2.22.3
- astral-sh/setup-uv v8.3.2 -> v10.3.2 (cache is disabled explicitly, so the v9/v10 cache default changes do not apply)
- zizmor 1.20.0 -> 1.31.1
- apigen: refresh lock, resolve for PHP 8.1 (the PHP the API reference workflow runs on), keep nette/schema on 1.2 because ApiGen 7.0.0-alpha.6 uses Helpers::PREVENT_MERGING removed in 1.3
- tools/phplrt: refresh lock (symfony polyfills, service-contracts)

Amp-Thread-ID: https://ampcode.com/threads/T-01a181a3-bf20-7051-9622-c042e00acde1

- name: Install the latest version of uv
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
@ondrejmirtes
ondrejmirtes merged commit d10f40e into 2.3.x Oct 28, 2026
66 checks passed
@ondrejmirtes
ondrejmirtes deleted the dependency-updates-2026-10 branch October 28, 2026 08:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants