Keep dependency updates compatible with PHP 8.2

.github/dependabot.yml

@@ -6,6 +6,13 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+    # Revisit these ranges when the supported PHP platform is upgraded.
+    ignore:
+      - dependency-name: codeception/module-yii2
+        update-types: ["version-update:semver-major"]
+      - dependency-name: endroid/qr-code
+        # 6.1 raises the PHP requirement within the same major version.
+        versions: [">=6.1"]
 
   - package-ecosystem: github-actions
     directory: /

.github/workflows/ci.yml

@@ -60,7 +60,9 @@ jobs:
           echo "MASTER_KEY=$MASTER_KEY" >> "$GITHUB_ENV"
 
       - name: Install dependencies
-        run: composer install --no-interaction --prefer-dist
+        run: |
+          composer install --no-interaction --prefer-dist
+          composer check-platform-reqs
 
       - name: Verify vendor patches
         run: php scripts/apply-vendor-patches.php
@@ -89,7 +91,9 @@ jobs:
           coverage: none
 
       - name: Install dependencies
-        run: composer install --no-interaction --prefer-dist
+        run: |
+          composer install --no-interaction --prefer-dist
+          composer check-platform-reqs
 
       - name: License inventory
         run: composer licenses

CHANGELOG.md

@@ -9,6 +9,7 @@
 
 ### Changed
 
+* Composer 依最低 PHP 8.2.0 解析依賴，CI 另檢查實際平台需求；Dependabot 暫緩需較高 PHP 的 Yii2 測試模組主要版本與 QR Code 6.1 以上更新
 * 將最低 PHP 版本與 lock file 統一為 PHP 8.2，並明列必要 extensions
 * 公開文件改用通用發布、架構、環境權限與版本支援說明
 * Web 測試入口改為僅在明確測試環境啟用

composer.json

@@ -77,6 +77,9 @@
         }
     },
     "config": {
+        "platform": {
+            "php": "8.2.0"
+        },
         "process-timeout": 1800,
         "fxp-asset": {
             "enabled": false

docs/RELEASING.md

@@ -13,13 +13,16 @@
 
 ```bash
 composer validate --strict
+composer check-platform-reqs
 composer audit
 bash scripts/open-source-prep.sh
 bash tests/run-all.sh
 ```
 
 Acceptance tests 需依 [tests/README.md](../tests/README.md) 啟動測試伺服器，並且只能使用獨立測試資料庫。
 
+依賴解析以 `composer.json` 的 `config.platform.php`（目前 8.2.0）為最低支援平台；`check-platform-reqs` 仍須在實際部署環境執行。升級最低 PHP 版本時，一併檢視 `.github/dependabot.yml` 中暫緩的 Yii2 測試模組主要版本及 QR Code 6.1 以上更新，再分別驗證測試隔離與 TOTP QR 綁定流程。
+
 若環境有安裝 Gitleaks，另執行：
 
 ```bash