[ondrejmirtes]

Monthly dependency maintenance.

Updated

• GitHub Actions: step-security/harden-runner v2.22.2 → v2.22.3. Every other action is already on its latest release, and each pinned SHA matches its version comment.
• Root composer.lock (constraints unchanged): composer/semver 3.5.2, guzzlehttp/guzzle 7.16.1 (promises 2.6.0, psr7 2.13.2), react/child-process 0.7.x-dev 62e902d, symfony/console 5.4.54 (both patches still apply), symfony/process 5.4.54, Symfony polyfills 1.43.
• tests/composer.lock: PHPUnit 11.5.57, paratest 7.8.6, Symfony 7.4.21, nikic/php-parser 5.9.0, and others.
• compiler: PHPUnit 9.6 → 11.5. tests/phpunit.xml is migrated; the coverage-text logger is dropped because CI runs without a coverage driver. Also phpstan 2.3.3.
• compiler/box: humbug/php-scoper 0.18.20. It requires jetbrains/phpstorm-stubs ^2026.2, so dev-master is aliased as v2026.x-dev again. The php-scoper patch still applies.
• apigen/infra, changelog-generator, issue-bot: lock updates within their constraints. apigen is already at upstream master.

PHP 7.4 compatibility of the PHAR

Vendor code is not downgraded, so every updated runtime package was linted with PHP 7.4.33. The set of vendor files that don't parse on 7.4 is identical before and after this PR: 50 files, all PHP 8-only bootstraps and attributes that 7.4 never loads.

I built the PHAR locally the same way phar.yml does on PHP 8.2 (compiler tests, compiler PHPStan, prepare, box compile, resign) and ran it on PHP 7.4.33:

• --version works.
• Parallel analysis of 61 files with 2 workers on 7.4 gives the same findings as on 8.4, apart from 7.4-specific function.notFound for str_contains. No warnings or deprecations.
• bisect --good=2.3.2 --bad=2.3.3 on 7.4 calls the GitHub API and downloads a PHAR through Guzzle, with a progress bar.

Local checks

• make tests: OK (22637 tests, 106 skipped).
• make phpstan and make cs: no errors.
• composer-dependency-analyser and name-collision give the same results as on the base branch.
• apiref infra: npm run check, npm test (38 passed) and cdk synth pass.
• issue-bot tests on PHP 8.5 and changelog-generator PHPStan pass.

Not adopted

Root, blocked by the PHAR's PHP 7.4 runtime (vendor isn't downgraded):

• nette/utils 4, nette/php-generator 4, nette/robot-loader 4, nette/finder 3: need PHP 8.1+ or nette/utils 4.
• nette/di 3.2, nette/schema 1.3+, nette/bootstrap 3.2, nette/neon 3.4: need PHP 8.0 or 8.1+. neon is pinned on purpose.
• symfony/console, finder, process and string 6/7, symfony/service-contracts 3: need PHP 8.1 or 8.2+. psr/container 2 is held back with service-contracts 2.
• cweagans/composer-patches 2: needs PHP 8.0+, and the 7.4 CI jobs run Composer with the root plugins.

Root, possible but deferred:

• guzzlehttp/guzzle 8 (with psr7 3 and promises 3) declares PHP ^7.4, and PHPStan's usage is compatible. It adds symfony/polyfill-php82, which would need scoper and preload decisions (keep it prefixed, or exclude it like the other polyfills). Left for a separate PR.

Other:

• shipmonk/composer-dependency-analyser kept at 1.7.0. 1.8 adds ext-* shadow-dependency analysis, which fails make composer-dependency-analyser until the config declares or ignores the extensions.
• tests: PHPUnit 12 needs PHP 8.3, and the 8.2 test jobs use tests/composer.json as is.
• compiler: Symfony 7.4 is blocked because ondrejmirtes/simple-downgrader requires Symfony ^5.4.
• compiler/box: cweagans/composer-patches 2 kept off so it stays consistent with root, which can't move (see above).
• issue-bot: PHPUnit 13 needs sebastian/diff 9. diff 9 uses Myers alignment, which changes about 1% of the bot's diffs, and that could cause duplicate bot comments on the next --post-comments run.

phpstan/php-8-stubs and jetbrains/phpstorm-stubs are left to their bot PRs (#6868, #6861).