Skip to content

Composer(deps): bump the composer-production group with 7 updates - #105

Merged
coisa merged 2 commits into
mainfrom
dependabot/composer/composer-production-1c0ec6461d
Nov 6, 2026
Merged

Composer(deps): bump the composer-production group with 7 updates#105
coisa merged 2 commits into
mainfrom
dependabot/composer/composer-production-1c0ec6461d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the composer-production group with 7 updates:

Package From To
composer/composer 2.10.3 2.11.0
ergebnis/json-normalizer 4.11.0 4.12.0
phpstan/phpstan 2.3.3 2.3.4
rector/rector 2.8.2 2.8.3
symfony/console 7.4.21 7.4.22
symfony/process 7.4.21 7.4.22
symplify/easy-coding-standard 13.3.9 13.3.12

Updates composer/composer from 2.10.3 to 2.11.0

Release notes

Sourced from composer/composer's releases.

2.11.0

Read the Composer 2.11 Release Announcement for more details on the release highlights.

Full Changelog

  • BC Break: Removed the source-fallback config option which was added in 2.10 as a temporary measure, dist installs no longer fall back to source (#13050)
  • Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
  • Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
  • Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
  • Security: Fixed svn passwords not being redacted from debug output (#13171)
  • Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
  • Security: Reject TLS connections presenting distrusted intermediate certificates (the compromised eMudhra ones) even if the system CA store trusts their roots (#13146)
  • Security: Fixed bin proxies embedding package-controlled bin paths and shebangs unescaped, and bin paths containing shell metacharacters are now rejected (#13056)
  • Security: Fixed secure-http not catching insecure URLs that are not strictly valid or use git's <transport>::<address> syntax (#13144)
  • Security: Fixed repository options like custom http headers being sent along to dist URLs on other hosts whose name starts with the repository host (#13142)
  • Bumped composer-plugin-api to 2.11.0
  • Added a cooldown policy to withhold newly released package versions for a configurable period, reducing exposure to compromised releases (#12692, #13098, #13099, #13100, #13102, #13153)
  • Added block-scope option to custom policies so they can also block during install (#12990)
  • Added terminal progress/status reporting via OSC 7501 and OSC 9 escape sequences, which can be configured with COMPOSER_TERMINAL_STATUS (#13117)
  • Added --direct (-D) option to audit to only audit direct dependencies (#13121)
  • Added support for Bitbucket Cloud's new ssh.bitbucket.org SSH hostname, which is also used for the SSH fallback now (#13152)
  • Added strict-psr-autoloader config option, the equivalent of the --strict-psr-autoloader flag (#12893)
  • Added a warning when an optimized autoload dump contains paths only differing in casing (#13085)
  • Added only-branches option to VCS repositories to restrict which branches are loaded (#13086)
  • Added installed versions of sub-dependencies in show --tree --format=json output (#13049)
  • Added batching of security advisory API queries for projects with a very large number of dependencies (#13051)
  • Added support for 429 responses and Retry-After headers, Composer now waits and retries when a repository asks for it (#13082)
  • Added AI coding agent to the User-Agent (#13073, #13087)
  • Added a prompt in init to add composer.lock to .gitattributes with export-ignore when creating a library (#13127)
  • Improved dependency resolution performance and memory usage (#13071, #13072, #13103, #13123, #13124, #13132, #13174)
  • Improved performance by not requesting HTTP/3 anymore, which added a delay on every new connection with recent curl versions (#13096)
  • Improved performance of outdated and show --latest by loading package metadata in parallel (#13113)
  • Improved explanations for versions blocked by security advisories in dependency conflict errors (#13108, #13075)
  • Fixed the lock file not being flagged as outdated when the policy config changes - this will trigger a lock file change warning if you have a policy config defined (#13149)
  • Fixed install to fail when composer.lock has a content-hash merge conflict (#13105)
  • Fixed truncated zip downloads failing at extraction, they are now retried and never cached (#13094)
  • Fixed generated files (autoloader, composer.json, ...) being rewritten in place, which affected hardlinked copies and concurrent readers (#13069)
  • Fixed SSH URLs losing their user in git commands, causing auth failures since 2.10.3 (#13081)
  • Fixed GitLab CI job token authentication (#12916)
  • Fixed custom-headers from a project auth.json or COMPOSER_AUTH replacing the global ones instead of being merged (#13141)
  • Fixed parallel requests failing with "Invalid credentials" instead of retrying with credentials obtained by another request (#13135)
  • Fixed the GitHub API rate limit not being reported when the clone fallback fails (#13059)
  • Fixed outdated reporting packages with no installable version as outdated (#13138)
  • Fixed update --minimal-changes with wildcard package names (#13118)
  • Fixed bump not handling >=10 style constraints and loosening OR constraints (#13133)
  • Fixed security advisories wrongly applying to named dev branches like dev-main (#13089)
  • Fixed the vendor dir not being excluded from root classmap scanning in some cases (#13018)
  • Fixed self-update failing with a class not found error while swapping the phar (#13079)
  • Fixed clear-cache --no-cache reporting missing dirs instead of the cache being disabled (#13092)
  • Fixed empty script commands not being treated as a no-op (#13053)

... (truncated)

Changelog

Sourced from composer/composer's changelog.

[2.11.0] 2026-10-29

  • Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
  • Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
  • Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
  • Security: Fixed svn passwords not being redacted from debug output (#13171)
  • Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
  • Improved dependency resolution performance and memory usage (#13174)
  • Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
  • Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
  • Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

[2.11.0-RC1] 2026-10-22

  • BC Break: Removed the source-fallback config option which was added in 2.10 as a temporary measure, dist installs no longer fall back to source (#13050)
  • Security: Reject TLS connections presenting distrusted intermediate certificates (the compromised eMudhra ones) even if the system CA store trusts their roots (#13146)
  • Security: Fixed bin proxies embedding package-controlled bin paths and shebangs unescaped, and bin paths containing shell metacharacters are now rejected (#13056)
  • Security: Fixed secure-http not catching insecure URLs that are not strictly valid or use git's <transport>::<address> syntax (#13144)
  • Security: Fixed repository options like custom http headers being sent along to dist URLs on other hosts whose name starts with the repository host (#13142)
  • Bumped composer-plugin-api to 2.11.0
  • Added a cooldown policy to withhold newly released package versions for a configurable period, reducing exposure to compromised releases (#12692, #13098, #13099, #13100, #13102, #13153)
  • Added block-scope option to custom policies so they can also block during install (#12990)
  • Added terminal progress/status reporting via OSC 7501 and OSC 9 escape sequences, which can be configured with COMPOSER_TERMINAL_STATUS (#13117)
  • Added --direct (-D) option to audit to only audit direct dependencies (#13121)
  • Added support for Bitbucket Cloud's new ssh.bitbucket.org SSH hostname, which is also used for the SSH fallback now (#13152)
  • Added strict-psr-autoloader config option, the equivalent of the --strict-psr-autoloader flag (#12893)
  • Added a warning when an optimized autoload dump contains paths only differing in casing (#13085)
  • Added only-branches option to VCS repositories to restrict which branches are loaded (#13086)
  • Added installed versions of sub-dependencies in show --tree --format=json output (#13049)
  • Added batching of security advisory API queries for projects with a very large number of dependencies (#13051)
  • Added support for 429 responses and Retry-After headers, Composer now waits and retries when a repository asks for it (#13082)
  • Added AI coding agent to the User-Agent (#13073, #13087)
  • Added a prompt in init to add composer.lock to .gitattributes with export-ignore when creating a library (#13127)
  • Improved dependency resolution performance and memory usage (#13071, #13072, #13103, #13123, #13124, #13132)
  • Improved performance by not requesting HTTP/3 anymore, which added a delay on every new connection with recent curl versions (#13096)
  • Improved performance of outdated and show --latest by loading package metadata in parallel (#13113)
  • Improved explanations for versions blocked by security advisories in dependency conflict errors (#13108, #13075)
  • Fixed the lock file not being flagged as outdated when the policy config changes - this will trigger a lock file change warning if you have a policy config defined (#13149)
  • Fixed install to fail when composer.lock has a content-hash merge conflict (#13105)
  • Fixed truncated zip downloads failing at extraction, they are now retried and never cached (#13094)
  • Fixed generated files (autoloader, composer.json, ...) being rewritten in place, which affected hardlinked copies and concurrent readers (#13069)
  • Fixed SSH URLs losing their user in git commands, causing auth failures since 2.10.3 (#13081)
  • Fixed GitLab CI job token authentication (#12916)
  • Fixed custom-headers from a project auth.json or COMPOSER_AUTH replacing the global ones instead of being merged (#13141)
  • Fixed parallel requests failing with "Invalid credentials" instead of retrying with credentials obtained by another request (#13135)
  • Fixed the GitHub API rate limit not being reported when the clone fallback fails (#13059)
  • Fixed outdated reporting packages with no installable version as outdated (#13138)
  • Fixed update --minimal-changes with wildcard package names (#13118)
  • Fixed bump not handling >=10 style constraints and loosening OR constraints (#13133)
  • Fixed security advisories wrongly applying to named dev branches like dev-main (#13089)

... (truncated)

Commits
  • e52c65b Release 2.11.0
  • b573283 Update changelog
  • 3aaa62b PoolOptimizer: Reduce Intervals::compactConstraint() calls (#13174)
  • 770ea89 Merge commit from fork
  • 64455e4 Merge commit from fork
  • aa438b3 Escape additional arguments passed to @​composer scripts (#13169)
  • 0bd5840 Sanitize URLs in hg and fossil error output (#13172)
  • 20b469c Fix svn password redaction in debug output (#13171)
  • b56a3f5 Fix composer config corrupting composer.json when extra/scripts is a JSON arr...
  • c05cfb3 Ignore OS/editor metadata entries when locating a package archive top-level d...
  • Additional commits viewable in compare view

Updates ergebnis/json-normalizer from 4.11.0 to 4.12.0

Release notes

Sourced from ergebnis/json-normalizer's releases.

4.12.0

What's Changed

Full Changelog: ergebnis/json-normalizer@4.11.0...4.12.0

Changelog

Sourced from ergebnis/json-normalizer's changelog.

[4.12.0][4.12.0]

For a full diff see [4.11.0...4.12.0][4.11.0...4.12.0].

Added

Fixed

  • Adjusted Vendor\Composer\VersionConstraintNormalizer to replace a tilde version range with a caret version range only where both are equivalent (#1247), by [@​fredden]
  • Adjusted Vendor\Composer\VersionConstraintNormalizer to remove a version constraint only when it is a subset of another version constraint (#1345), by [@​localheinz]
  • Adjusted SchemaNormalizer and Vendor\Composer\ComposerJsonNormalizer to keep an empty only-branches list in a repository (#1368), by [@​localheinz]
Commits
  • b1a2340 Enhancement: Prepare release
  • 8bfa590 Merge pull request #1368 from ergebnis/fix/keep-empty-only-branches-in-reposi...
  • e2d1a72 Fix: Do not prune empty only-branches from repositories
  • ab5c6d9 Merge pull request #1367 from ergebnis/dependabot/github_actions/stefanzweife...
  • cbcb4db Merge pull request #1366 from ergebnis/dependabot/composer/ergebnis/data-prov...
  • e678717 github-actions(deps): Bump stefanzweifel/git-auto-commit-action
  • e95eac2 composer(deps-dev): Bump ergebnis/data-provider from 3.7.0 to 3.7.1
  • c6d41e2 Merge pull request #1363 from ergebnis/enhancement/schema
  • 51d89b0 Enhancement: Update schema.json
  • f61d93b Merge pull request #1365 from ergebnis/dependabot/github_actions/zizmorcore/z...
  • Additional commits viewable in compare view

Updates phpstan/phpstan from 2.3.3 to 2.3.4

Commits

Updates rector/rector from 2.8.2 to 2.8.3

Release notes

Sourced from rector/rector's releases.

Released Rector 2.8.3

Faster node traversal and updated PHPStan stack 🚀

This release brings performance improvements to node visitors, reducing unnecessary traversals and reflection resolution during analysis.

It also updates PHPStan to 2.3.4 and phpstan/phpdoc-parser to 2.4, with compatibility fixes for the updated PHPDoc type nodes.

Performance Improvements 🚀

  • Avoid nested traversals in ByRefNodeVisitor by tracking by-reference variable names per FunctionLike (#8879) Thanks @​samsonasik
  • Only resolve call reflection for 2-item array arguments in CallLikeReflectionNodeVisitor (#8880) Thanks @​samsonasik

Bugfixes 🐛

  • [TypeDeclaration] AddArrayFunctionClosureParamTypeRector: resolve array item types from unions of arrays (#8877) Thanks @​SanderMuller
  • Lock the fixture directory itself to prevent conflicts between parallel test workers using different TMPDIR values (#8878) Thanks @​SanderMuller

Internals ⚙️

  • Bump PHPStan to 2.3.4 and phpstan/phpdoc-parser to 2.4, adapting PHPDoc node handling for the new NameNode, FullyQualifiedNameNode, and RelativeNameNode types (#8883) Thanks @​ondrejmirtes
Commits
  • 12ddb68 Rector 2.8.3
  • 768a3dc Updated Rector to commit 8323e93e55a40fb408fae7af4e5ba8b770fa8441
  • 7c07b79 Updated Rector to commit 62e0fccbe42cebe7d5b3281b687aa404e6120ede
  • b8a1dca Updated Rector to commit 62e0fccbe42cebe7d5b3281b687aa404e6120ede
  • 0207c40 Updated Rector to commit 62e0fccbe42cebe7d5b3281b687aa404e6120ede
  • 85ff869 Updated Rector to commit 6f8df55c5210ab07b644da15a57111bd65d3690e
  • 066425d Updated Rector to commit e291f0d9bc43002279494134a993abc59a27d465
  • 69d19ec Updated Rector to commit 8271f5dd75261f4532e3ba6d9ae34649d3d9cffb
  • ebc7e41 Updated Rector to commit 7aef6aac3302fe53bf0a3cd8369d496f3a0c84c1
  • See full diff in compare view

Updates symfony/console from 7.4.21 to 7.4.22

Release notes

Sourced from symfony/console's releases.

v7.4.22

Changelog (symfony/console@v7.4.21...v7.4.22)

[SECURITY] Security release

Commits
  • 8012f84 [Console] Skip the QuestionHelper tests that need a terminal when there is none
  • 5bbba80 Merge branch '6.4' into 7.4
  • e918c95 Merge branch '5.4' into 6.4
  • 21f7501 [Console] Fix raw token stripping when an option value matches the command
  • 0b8208c [Console] Don't format escaped tags again when sections measure their lines
  • eb9cf1e Merge branch '6.4' into 7.4
  • f64690a [Console] Keep the case of href values in OutputFormatter
  • 08fa16e bug #67542 [Console] Fix style names with uppercase letters not being applied...
  • f3e0b1e [Console] Fix style names with uppercase letters not being applied
  • 5644c42 Merge branch '6.4' into 7.4
  • Additional commits viewable in compare view

Updates symfony/process from 7.4.21 to 7.4.22

Release notes

Sourced from symfony/process's releases.

v7.4.22

Changelog (symfony/process@v7.4.21...v7.4.22)

[SECURITY] Security release

Commits
  • a5a6912 Merge branch '6.4' into 7.4
  • f83dad5 [Process] Keep the script of PhpProcess when a forked child exits under phpdbg
  • a9fff7e Merge branch '6.4' into 7.4
  • 967422e [DomCrawler][HttpKernel][Process][Translation] Fix cleanup after forking
  • 5447017 Merge branch '6.4' into 7.4
  • e6bcb99 [Process] Fix flaky testWaitUntilSeesOutputWrittenBeforeItIsCalled on Windows
  • See full diff in compare view

Updates symplify/easy-coding-standard from 13.3.9 to 13.3.12

Release notes

Sourced from symplify/easy-coding-standard's releases.

ECS 13.3.12

Bugfixes 🐛

Anonymous class with inline attribute kept in parity

blink reformatted an anonymous class carrying a class-level attribute (new #[AsEventListener(...)] class() {}) differently from the PHP engine - it broke the attribute onto standalone lines and moved the class brace to its own line. The anon-class detection now steps over the leading attribute in both BracesPosition and ClassDefinition, ClassDefinition flattens a multiline attribute in the header, and StandaloneLineSymfonyAttributeParamFixer runs at its PHP-CS-Fixer priority so both engines produce identical output.

ecsphp/ecs-src#230

Released ECS 13.3.11

Improvements 🎉

New RemoveSlashFromNativeConstantFixer

Removes the leading backslash from true, false and null, turning \true into true. Only standalone keywords are touched - namespace segments like Foo\true or \true\Bar are left intact. Added to the namespaces set.

ecsphp/ecs-src#220

blink parity

The new fixer is ported to the blink Go runner, keeping both engines in sync.

ecsphp/ecs-src#221

Released ECS 13.3.10

Improvements 🎉

Leading-space console output

Bumps entropy/entropy to ^0.4.35. Listing items and success/warning/error status lines now start with a leading space, matching Rector / Symfony console output.

ecsphp/ecs-src#219

Commits
  • 712df94 Updated ECS to commit acc01d24bb042318a9e9c18c828db449fd261af4
  • d2107e9 Updated ECS to commit b1bc280296e308c8a6604141c498465eeff08d71
  • 4018871 Updated ECS to commit a87df3fb9d82a806fa73a049a90bd332e702b389
  • 26db322 Updated ECS to commit 50f00382acbc27b3ac559045e3c646ef83bf46f0
  • 8b4d12d Updated ECS to commit eaf0287d814a0abd0af100581c831accf6b885a9
  • 7af03d0 Updated ECS to commit d95cd4d43cd5c6f92f1db5a791fd2c5ba8dcb59a
  • 84acc0a Updated ECS to commit f9544ca2d9d6c6b225d0cb97c9dbdc5a0331d02b
  • bec9cc3 Updated ECS to commit 2bf154b3affabd2a2fed8891a4f763af2fd8631d
  • 3e1b33d ECS 13.3.11
  • 23c1173 Updated ECS to commit 816aa0bb8e659c09430e2fc108c6e0b7f83b9334
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Composer(deps): bump the composer-production group with 7 updates
3cba960 
Bumps the composer-production group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [composer/composer](https://github.com/composer/composer) | `2.10.3` | `2.11.0` |
| [ergebnis/json-normalizer](https://github.com/ergebnis/json-normalizer) | `4.11.0` | `4.12.0` |
| [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) | `2.3.3` | `2.3.4` |
| [rector/rector](https://github.com/rectorphp/rector) | `2.8.2` | `2.8.3` |
| [symfony/console](https://github.com/symfony/console) | `7.4.21` | `7.4.22` |
| [symfony/process](https://github.com/symfony/process) | `7.4.21` | `7.4.22` |
| [symplify/easy-coding-standard](https://github.com/ecsphp/ecs) | `13.3.9` | `13.3.12` |


Updates `composer/composer` from 2.10.3 to 2.11.0
- [Release notes](https://github.com/composer/composer/releases)
- [Changelog](https://github.com/composer/composer/blob/main/CHANGELOG.md)
- [Commits](composer/composer@2.10.3...2.11.0)

Updates `ergebnis/json-normalizer` from 4.11.0 to 4.12.0
- [Release notes](https://github.com/ergebnis/json-normalizer/releases)
- [Changelog](https://github.com/ergebnis/json-normalizer/blob/main/CHANGELOG.md)
- [Commits](ergebnis/json-normalizer@4.11.0...4.12.0)

Updates `phpstan/phpstan` from 2.3.3 to 2.3.4
- [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits)

Updates `rector/rector` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/rectorphp/rector/releases)
- [Commits](rectorphp/rector@2.8.2...2.8.3)

Updates `symfony/console` from 7.4.21 to 7.4.22
- [Release notes](https://github.com/symfony/console/releases)
- [Changelog](https://github.com/symfony/console/blob/8.2/CHANGELOG.md)
- [Commits](symfony/console@v7.4.21...v7.4.22)

Updates `symfony/process` from 7.4.21 to 7.4.22
- [Release notes](https://github.com/symfony/process/releases)
- [Changelog](https://github.com/symfony/process/blob/8.2/CHANGELOG.md)
- [Commits](symfony/process@v7.4.21...v7.4.22)

Updates `symplify/easy-coding-standard` from 13.3.9 to 13.3.12
- [Release notes](https://github.com/ecsphp/ecs/releases)
- [Commits](ecsphp/ecs@13.3.9...13.3.12)

---
updated-dependencies:
- dependency-name: composer/composer
  dependency-version: 2.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: composer-production
- dependency-name: ergebnis/json-normalizer
  dependency-version: 4.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: composer-production
- dependency-name: phpstan/phpstan
  dependency-version: 2.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: composer-production
- dependency-name: rector/rector
  dependency-version: 2.8.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: composer-production
- dependency-name: symfony/console
  dependency-version: 7.4.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: composer-production
- dependency-name: symfony/process
  dependency-version: 7.4.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: composer-production
- dependency-name: symplify/easy-coding-standard
  dependency-version: 13.3.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: composer-production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Nov 2, 2026
@coderabbitai

coderabbitai Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 72dee389-8d87-4e9b-92f9-78e298a3570e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

CodeRabbit Verify

  • Run CodeRabbit Verify to test the changes in this pull request.

@coisa
coisa merged commit cf1f179 into main Nov 6, 2026
6 of 9 checks passed
@coisa
coisa deleted the dependabot/composer/composer-production-1c0ec6461d branch November 6, 2026 03:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@coisa