Skip to content

chore(deps): bump the composer group across 1 directory with 6 updates - #135

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/composer/dev/composer-0972e6bfbb
Open

chore(deps): bump the composer group across 1 directory with 6 updates#135
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/composer/dev/composer-0972e6bfbb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown

Bumps the composer group with 6 updates in the / directory:

Package From To
composer/ca-bundle 1.5.14 1.6.0
mobiledetect/mobiledetectlib 3.74.3 4.11.0
phpoffice/phpspreadsheet 1.30.6 5.10.0
tecnickcom/tcpdf 6.8.2 7.0.19
behat/behat 3.26.0 4.0.0
spaze/phpstan-disallowed-calls 4.14.0 4.15.0

Updates composer/ca-bundle from 1.5.14 to 1.6.0

Release notes

Sourced from composer/ca-bundle's releases.

1.6.0

What's Changed

Full Changelog: composer/ca-bundle@1.5.14...1.6.0

Commits

Updates mobiledetect/mobiledetectlib from 3.74.3 to 4.11.0

Release notes

Sourced from mobiledetect/mobiledetectlib's releases.

4.11.0

What's Changed

Full Changelog: serbanghita/Mobile-Detect@4.10.0...4.11.0

4.10.0

What's Changed

Full Changelog: serbanghita/Mobile-Detect@4.9.0...4.10.0

4.9.0

Minor release.

Added

  • Lenovo: broad Lenovo TB prefix match for modern tablets (#1013).
  • Samsung: 2025 tablet models (Tab S11, S10 Lite, A11).
  • MobileDetect::VERSION_TYPE_STRING and VERSION_TYPE_FLOAT constants promoted to public (#991).

Changed

  • Consistent late static binding for subclass extensibility (#1012).
  • Dropped PHP 8.0 and 8.1 from the CI matrix.

Fixed

  • PHP 8.4 compatibility: explicit type hints where the engine now requires them.
  • Cache::getTimestamp() method name typo (was getTimeStamp) (#1007).
  • Version regex now accepts multi-char pre-release suffixes.
  • Pinned composer dependencies to exact versions.
  • GitHub Actions workflow actions updated to their latest versions.

Full changelog: serbanghita/Mobile-Detect@4.8.10...4.9.0

Empty userAgent string doesn't throw an Exception anymore, instead it returns false.

  • [bug] No user-agent has been set serbanghita/Mobile-Detect#946
  • added docker-compose.yml with images: setup (composer), runUnitTests, runPerfTests, runLinting, generateModel

Added back implicit $_SERVER scanning for setting the User-Agent string.

  • added optional $config to MobileDetect constructor.
  • added autoInitOfHttpHeaders configuration which is by default true. This enabled the old behavior from 3.x and 2.x that allows automatic detection of HTTP headers and User Agent from $_SERVER.
  • refactored internal CloudFront related methods and the way setHttpHeaders work. It no longer falls back on $_SERVER. The method still calls setUserAgent in case HTTP_USER_AGENT and friends are present.
  • added maximumUserAgentLength to the $config, by default the limit is 500.

4.8.01: MobileDetect version with PSR-16 Cache support.

... (truncated)

Changelog

Sourced from mobiledetect/mobiledetectlib's changelog.

4.11.0

Security

  • GHSA-mgj4-qjmw-v56v — the bundled Detection\Cache\Cache is now bounded (default 1000 entries, FIFO eviction). Prevents unbounded in-memory growth when one MobileDetect instance is reused across many distinct User-Agents in a long-running PHP runtime (RoadRunner, Laravel Octane, FrankenPHP worker mode, Swoole, ReactPHP, queue workers). Not applicable to classic PHP-FPM / mod_php deployments — the cache dies with the request. Custom PSR-16 adapters (Redis, APCu, Memcached, Filesystem) are out of scope; their eviction policy is the operator's responsibility.

Added

  • Detection\Cache\Cache::__construct(int $maxEntries = Cache::DEFAULT_MAX_ENTRIES) — tune the in-memory cap via new MobileDetect(new Cache($n)).
  • Cache::DEFAULT_MAX_ENTRIES constant (1000) and Cache::getMaxEntries() accessor.

Changed

  • README-EXAMPLES.md "Long-Running Processes" — worker example now uses clear() (was evictExpired(), which is a no-op against fresh entries under the default 86 400 s TTL); added explicit note framing in-memory cache bounding as a systems-level concern with the bundled cap, and pointing operators at their own adapter's eviction for custom PSR-16 backends.
  • Cache::evictExpired() docblock — clarified that it bounds by expiration, not by cardinality. Method behavior is unchanged.

4.10.0

Changed

  • Detection\Cache\Cache method signatures widened to be Liskov-compatible with psr/simple-cache v1, v2, and v3 simultaneously. Resolves #989 — the class no longer fatals at load time on hosts where another package has already registered an older CacheInterface (common in WordPress stacks).
  • composer.json: psr/simple-cache constraint widened to ^1.0 || ^2.0 || ^3.0.
  • Minimum PHP version raised to 8.2 in composer.json (was >=8.0). PHP 8.0 and 8.1 are both end-of-life and had already been dropped from CI in 4.9.0 because phpbench/phpbench: 1.6.1 requires PHP ^8.2.

Added

  • psr16-compat CI matrix that verifies Cache remains LSP-compatible with every supported major of psr/simple-cache (1.x, 2.x, 3.x).

BC note

  • Subclasses of Detection\Cache\Cache that overrode get/set/has/delete/getMultiple/setMultiple/deleteMultiple (or protected checkKey) with narrowed parameter types (e.g. function get(string $key, …)) will fatal at class load on this version. Drop the scalar type from the override, or widen to mixed, to restore LSP compatibility.

4.9.0

Added

  • Lenovo: broad Lenovo TB prefix match for modern tablets (#1013).
  • Samsung: 2025 tablet models (Tab S11, S10 Lite, A11).
  • MobileDetect::VERSION_TYPE_STRING and VERSION_TYPE_FLOAT constants promoted to public (#991).

Changed

  • Consistent late static binding for subclass extensibility (#1012).
  • Dropped PHP 8.0 and 8.1 from the CI matrix.

Fixed

  • PHP 8.4 compatibility: explicit type hints where the engine now requires them.
  • Cache::getTimestamp() method name typo (was getTimeStamp) (#1007).
  • Version regex now accepts multi-char pre-release suffixes.
  • Pinned composer dependencies to exact versions.
  • GitHub Actions workflow actions updated to their latest versions.

4.8.10

Fixed

  • Cache::has() now properly checks TTL expiration before returning true (PSR-16 compliance fix). Previously, has() returned true for expired items.

Added

... (truncated)

Commits
  • ab39168 fix(cache): bound in-memory Cache to prevent unbounded growth (GHSA-mgj4-qjmw...
  • 6e6937e perf(bench): overhaul phpbench suite + advisory CI + release hygiene (#1015)
  • 21277ca docs(known-limitations): add full-page edge cache incompatibility note
  • c91cc4b docs(readme): point 2.x/3.x Tests badges at the renamed workflows
  • 55bdfab docs(readme): restore badge links, add packagist version + workflow badges
  • 1473bd9 chore(release): 4.10.0
  • 7d8c146 Merge pull request #1014 from serbanghita/fix/989-psr16-v1-compat
  • f701e9f chore: adopt rolling 4.x branch scheme (one branch per major)
  • e7744fe ci: auto-publish GitHub Release on tag push
  • 8d43ac8 docs(readme): add 4.9.x row, mark 4.8.x as maintenance, update main CI badge
  • Additional commits viewable in compare view

Updates phpoffice/phpspreadsheet from 1.30.6 to 5.10.0

Release notes

Sourced from phpoffice/phpspreadsheet's releases.

5.10.0

Added

Changed

Fixed

5.9.0

Removed

Added

Changed

Fixed

... (truncated)

Changelog

Sourced from phpoffice/phpspreadsheet's changelog.

2026-09-15 - 5.10.0

Added

Changed

Fixed

2026-07-12 - 5.9.0

Removed

Added

Changed

Fixed

... (truncated)

Commits

Updates tecnickcom/tcpdf from 6.8.2 to 7.0.19

Release notes

Sourced from tecnickcom/tcpdf's releases.

7.0.19

Full Changelog: tecnickcom/TCPDF@7.0.18...7.0.19

7.0.18

Full Changelog: tecnickcom/TCPDF@7.0.17...7.0.18

7.0.17

Full Changelog: tecnickcom/TCPDF@7.0.16...7.0.17

7.0.16

Full Changelog: tecnickcom/TCPDF@7.0.15...7.0.16

7.0.15

Full Changelog: tecnickcom/TCPDF@7.0.13...7.0.15

7.0.13

Full Changelog: tecnickcom/TCPDF@7.0.12...7.0.13

7.0.12

Full Changelog: tecnickcom/TCPDF@7.0.11...7.0.12

7.0.11

Full Changelog: tecnickcom/TCPDF@7.0.10...7.0.11

7.0.10

Full Changelog: tecnickcom/TCPDF@7.0.9...7.0.10

7.0.9

Full Changelog: tecnickcom/TCPDF@7.0.8...7.0.9

7.0.8

Full Changelog: tecnickcom/TCPDF@7.0.7...7.0.8

Changelog

Sourced from tecnickcom/tcpdf's changelog.

7.0.20 (2026-10-24)

  • Fixed Image() with a mask handle ($imgmask) reading the image and the mask outside the local path allowlist: both files are now read through the engine file helper, as for a plain Image() call.
  • Fixed writeHTML() copying files referenced by CSS url() values and legacy list image bullets into the system temp directory: paths with uppercase characters were copied, without an allowlist check, to a predictable file name readable through the allowlisted temp directory. The copy is removed; the engine resolves these paths directly.
  • Resources referenced by HTML, CSS and SVG markup are no longer read from the system temp directory. List the directory in K_ALLOWED_PATHS to allow it. Image(), ImageSVG() and the other API methods keep access to it.
  • Image() reports an unknown size for paths outside the allowlist instead of probing the file. Annotation() file attachments and setHyphenPatterns() treat such paths as missing files.
  • Fixed writeHTML() ignoring the legacy list-style-type:img|type|width|height|path list bullets: they are converted to list-style-image:url(path). The marker size follows the font size; the width and height fields are ignored.
  • Requires tecnickcom/tc-lib-pdf ^8.82.1, which applies the path allowlist to PDF import and the host allowlist to signature timestamp requests.

7.0.15 (2026-10-03)

  • Fixed headers and footers drawn with writeHTML() (or other flowing content) in an overridden Header() or Footer(): content placed below the automatic page break margin, such as a footer, was moved to another page. On the last page an extra page was added; on the other pages the footer was drawn at the top of the next page. The graphics state was also left unbalanced (poppler: "Restoring state when no valid states to pop").
    • Headers and footers are now always drawn on their own page, over the full page width, also on pages with columns. Content that does not fit is clipped at the page edge, as in TCPDF 6.
  • Fixed the automatic K_PATH_FONTS detection when Composer\InstalledVersions is loaded before TCPDF: the install path may contain '..' segments (e.g. 'vendor/composer/../'), which the file helper rejects. The detected font directory is now resolved with realpath().
  • Requires tecnickcom/tc-lib-pdf ^8.78.

7.0.13 (2026-10-03)

  • Fixed Cell() with text wider than the cell: the text is drawn on a single line, as in TCPDF 6, while the cell box and border keep the requested geometry. L, C and R alignment are anchored to the cell edges (left, center, right).
  • Fixed Cell() stretched text to start at the cell position.
  • Fixed the example 52 certificate path and regenerated the example certificate files.
  • Requires tecnickcom/tc-lib-pdf ^8.77.

7.0.12 (2026-09-26)

  • Updated the development tooling (mago 1.50.0). No library changes.

7.0.11 (2026-09-21)

  • Requires tecnickcom/tc-lib-pdf ^8.76.

7.0.10 (2026-09-14)

  • Fixed Output() with the 'F', 'FI' and 'FD' destinations, which failed for every call: the caller's file path was passed to Output::savePDF(), which takes a directory. The path is now split into the directory and the file name.
    • The file name is sanitized by the engine, so the file written may differ from the name given ('my_report.final.pdf' is written as 'my_report_final.pdf'). Use TCPDF::getPDFFilename() for the effective name.
    • The output directory is subject to the same allowlist as local reads: directories outside the built-in defaults (system temp dir, K_PATH_MAIN, the working directory, K_PATH_FONTS, K_PATH_IMAGES, the script directory) must be added to K_ALLOWED_PATHS before tcpdf.php is loaded. Failures now report that instead of 'invalid file'.
  • Fixed Output() with a boolean destination: true is 'D' and false is 'F', as in TCPDF 6. Output($name, false) previously streamed the document to the browser instead of saving it.
  • Fixed the 'FD' destination to send download headers instead of rendering inline.
  • Requires tecnickcom/tc-lib-pdf ^8.75.

7.0.0 (2026-06-18) [BREAKING CHANGE]

  • TCPDF IS DEPRECATED AND IN MAINTENANCE-ONLY MODE
  • TCPDF is now a compatibility facade over the modern tecnickcom/tc-lib-pdf engine. It does not reproduce legacy output exactly, and some methods are adapters, shims, or no-ops (see MAPPING.md); both new and existing projects are encouraged to migrate to tecnickcom/tc-lib-pdf.
    • The TCPDF class no longer contains its own PDF engine; every public method delegates rendering to \Com\Tecnick\Pdf\Tcpdf, while a small internal state layer reproduces the legacy cursor/page model (X/Y, margins, fonts, colors, automatic page breaks, headers/footers).

... (truncated)

Commits
  • c60c7bd chore: update dependencies
  • dd8fe38 fix: repair malformed hex colors only in color attributes and CSS values so w...
  • 08da065 fix: keep every cell bounding box so MultiCell() frames continue across pages...
  • 5b4fb77 fix: keep large tables in writeHTML() by dropping table image align without a...
  • 5245af0 chore: update and pin dependencies
  • 77d3eab fix: keep writeHTML() headers and footers on their own page
  • 1102179 fix: resolve '..' segments in K_PATH_FONTS when Composer\InstalledVersions is...
  • 4bef3e8 Fix Cell() overflow and certificate example (v7.0.13)
  • c128344 bump version
  • 0c1d3ba build: update mago to 1.50.0
  • Additional commits viewable in compare view

Updates behat/behat from 3.26.0 to 4.0.0

Release notes

Sourced from behat/behat's releases.

v4.0.0

If upgrading to 4.0.0 for the first time, please also review the release notes for 4.0.0-alpha1.

This release includes changes that were also included in 3.33.0 or 3.34.0 - they are also listed in these release notes.

Behat has no corporate backing - the 4.0 release has taken a huge effort from the volunteer maintainers over the last 12 months. If you use Behat for work, please consider showing your appreciation by supporting the project - even small contributions make a big difference.

Changed

Added

  • Support Rule nodes in >= GHERKIN_32 compatibility mode. NB: Scenarios within Rules will be parsed, filtered, and executed as expected with any caller. However, Behat's formatters and hooks will receive a modified Feature and node tree with all Rule details stripped out. This will behave as though any Scenarios were a direct child of the Feature - with any Rule Background steps repeated as the first steps of each Scenario. This will be improved in future releases. By @​acoulton in #1879
  • Support steps with both DocString and DataTable arguments in GHERKIN_42 mode. This is the only difference in GHERKIN_42 mode, which is now the default mode for Behat 4.x. By @​acoulton in #1896 and #1902
  • Add 'inline_failures' option to progress formatter by @​AlexSkrypnyk in #1861
  • Add support for filtering on Cucumber tag expressions by @​Amoifr in #1863
  • Add DataTable and DocString step argument types to reduce coupling to the Gherkin TableNode / PyStringNode by @​Amoifr in #1864 and #1878
  • Add hasStdOut() and getStdOut() to ExecutedStepResult by @​carlos-granados in #1874
  • Mark reachable interfaces and value objects as @api by @​carlos-granados in #1868

Fixed

  • Explain the relationship between --format and --out by @​Amoifr in #1889
  • Rerun should count scenarios as failed if before / after hooks failed. Previously, scenarios that only failed due to a Scenario, Feature, or Suite hook were never re-run, potentially causing incorrect passing builds. By @​Amoifr in #1877
  • Handle aborted suites when printing unused definitions by @​Amoifr in #1882

Internal

... (truncated)

Changelog

Sourced from behat/behat's changelog.

[4.0.0] - 2026-09-28

If upgrading to 4.0.0 for the first time, please also review the release notes for 4.0.0-alpha1.

This release includes changes that were also included in 3.33.0 or 3.34.0 - they are also listed in these release notes.

Behat has no corporate backing - the 4.0 release has taken a huge effort from the volunteer maintainers over the last 12 months. If you use Behat for work, please consider showing your appreciation by supporting the project

  • even small contributions make a big difference.

Changed

Added

  • Support Rule nodes in >= GHERKIN_32 compatibility mode. NB: Scenarios within Rules will be parsed, filtered, and executed as expected with any caller. However, Behat's formatters and hooks will receive a modified Feature and node tree with all Rule details stripped out. This will behave as though any Scenarios were a direct child of the Feature - with any Rule Background steps repeated as the first steps of each Scenario. This will be improved in future releases. By @​acoulton in #1879
  • Support steps with both DocString and DataTable arguments in GHERKIN_42 mode. This is the only difference in GHERKIN_42 mode, which is now the default mode for Behat 4.x. By @​acoulton in #1896 and #1902
  • Add 'inline_failures' option to progress formatter by @​AlexSkrypnyk in #1861
  • Add support for filtering on Cucumber tag expressions by @​Amoifr in #1863
  • Add DataTable and DocString step argument types to reduce coupling to the Gherkin TableNode / PyStringNode by @​Amoifr in #1864 and #1878
  • Add hasStdOut() and getStdOut() to ExecutedStepResult by @​carlos-granados in #1874
  • Mark reachable interfaces and value objects as @api by @​carlos-granados in #1868

Fixed

  • Explain the relationship between --format and --out by @​Amoifr

... (truncated)

Commits
  • 3f65b57 docs: Add changelog for 4.0.0 🎆 (#1903)
  • 3f739ad feat: Change default gherkin parsing mode to GHERKIN_42 (#1902)
  • 2b6012b Merge pull request #1901 from acoulton/4.x-merge-up-20260927
  • 6868fbb test: Update expected output for Rules features in 4.x
  • af7a98f refactor: Apply Rector fixes for the 4.x branch
  • 506c235 Merge remote-tracking branch 'upstream/3.x' into 4.x-merge-up-20260927
  • 044fea2 docs: Add CHANGELOG for 3.34.0 (#1900)
  • b9419df ci: Run Behat's own suites in GHERKIN_42 mode instead of GHERKIN_32 (#1899)
  • baa0837 test: Prove that Behat supports multiple step args (#1896)
  • aab0602 feat: Support gherkin features with Rule: nodes (#1879)
  • Additional commits viewable in compare view

Updates spaze/phpstan-disallowed-calls from 4.14.0 to 4.15.0

Release notes

Sourced from spaze/phpstan-disallowed-calls's releases.

More class usages reported and labelled by what they are, property hook fixes

New

  • More usages of classes, interfaces, enums and traits disallowed with disallowedClasses or disallowedNamespaces are reported: instanceof, first-class callables like Foo::bar(...), DNF types like (A&B)|null, types of class constants, and interfaces extended by interfaces or implemented by enums (#444)
  • Disallowed names are labelled by what they are, Class, Interface (with the new disallowed.interface identifier), Enum or Trait, also in static calls, extends and implements, which said Namespace before; only use imports keep Namespace because they can also import a namespace (#440, #443 - possible BC break)
  • Property...

    Description has been truncated

@dependabot
chore(deps): bump the composer group across 1 directory with 6 updates
b8ceab1 
Bumps the composer group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [composer/ca-bundle](https://github.com/composer/ca-bundle) | `1.5.14` | `1.6.0` |
| [mobiledetect/mobiledetectlib](https://github.com/serbanghita/Mobile-Detect) | `3.74.3` | `4.11.0` |
| [phpoffice/phpspreadsheet](https://github.com/PHPOffice/PhpSpreadsheet) | `1.30.6` | `5.10.0` |
| [tecnickcom/tcpdf](https://github.com/tecnickcom/TCPDF) | `6.8.2` | `7.0.19` |
| [behat/behat](https://github.com/Behat/Behat) | `3.26.0` | `4.0.0` |
| [spaze/phpstan-disallowed-calls](https://github.com/spaze/phpstan-disallowed-calls) | `4.14.0` | `4.15.0` |



Updates `composer/ca-bundle` from 1.5.14 to 1.6.0
- [Release notes](https://github.com/composer/ca-bundle/releases)
- [Commits](composer/ca-bundle@1.5.14...1.6.0)

Updates `mobiledetect/mobiledetectlib` from 3.74.3 to 4.11.0
- [Release notes](https://github.com/serbanghita/Mobile-Detect/releases)
- [Changelog](https://github.com/serbanghita/Mobile-Detect/blob/4.x/CHANGELOG.md)
- [Commits](serbanghita/Mobile-Detect@3.74.3...4.11.0)

Updates `phpoffice/phpspreadsheet` from 1.30.6 to 5.10.0
- [Release notes](https://github.com/PHPOffice/PhpSpreadsheet/releases)
- [Changelog](https://github.com/PHPOffice/PhpSpreadsheet/blob/master/CHANGELOG.md)
- [Commits](PHPOffice/PhpSpreadsheet@1.30.6...5.10.0)

Updates `tecnickcom/tcpdf` from 6.8.2 to 7.0.19
- [Release notes](https://github.com/tecnickcom/TCPDF/releases)
- [Changelog](https://github.com/tecnickcom/TCPDF/blob/main/CHANGELOG.TXT)
- [Commits](tecnickcom/TCPDF@6.8.2...7.0.19)

Updates `behat/behat` from 3.26.0 to 4.0.0
- [Release notes](https://github.com/Behat/Behat/releases)
- [Changelog](https://github.com/Behat/Behat/blob/4.x/CHANGELOG.md)
- [Commits](Behat/Behat@v3.26.0...v4.0.0)

Updates `spaze/phpstan-disallowed-calls` from 4.14.0 to 4.15.0
- [Release notes](https://github.com/spaze/phpstan-disallowed-calls/releases)
- [Commits](spaze/phpstan-disallowed-calls@v4.14.0...v4.15.0)

---
updated-dependencies:
- dependency-name: composer/ca-bundle
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: composer
- dependency-name: mobiledetect/mobiledetectlib
  dependency-version: 4.11.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: composer
- dependency-name: phpoffice/phpspreadsheet
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: composer
- dependency-name: tecnickcom/tcpdf
  dependency-version: 7.0.19
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: composer
- dependency-name: behat/behat
  dependency-version: 4.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: composer
- dependency-name: spaze/phpstan-disallowed-calls
  dependency-version: 4.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants