Bump the github-actions group across 1 directory with 2 updates (#1088 )

Bumps the github-actions group with 2 updates in the / directory: [shivammathur/setup-php](https://github.com/shivammathur/setup-php) and [shivammathur/cache-extensions](https://github.com/shivammathur/cache-extensions). Updates `shivammathur/setup-php` from 2.37.1 to 2.37.2 - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](https://github.com/shivammathur/setup-php/compare/7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc...f3e473d116dcccaddc5834248c87452386958240) Updates `shivammathur/cache-extensions` from 1.14.5 to 1.14.6 - [Release notes](https://github.com/shivammathur/cache-extensions/releases) - [Commits](https://github.com/shivammathur/cache-extensions/compare/256729b5fef535345e27904657f78048c0990f81...9b476298b44f2e4d4268dd103ff4c3e216314e27) --- updated-dependencies: - dependency-name: shivammathur/cache-extensions dependency-version: 1.14.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: shivammathur/setup-php dependency-version: 2.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Update Node.js dependencies
2026-06-22 00:46:13 +07:00 · 2026-06-20 19:54:30 +05:30 · 2026-06-20 18:43:15 +05:30 · 2026-06-18 10:13:14 +05:30 · 2026-06-18 04:28:47 +05:30 · 2026-06-13 18:06:26 +05:30
59 changed files with 1823 additions and 1199 deletions
@@ -0,0 +1 @@
+* @shivammathur
@@ -1,3 +1,4 @@
 # These are supported funding model platforms

 github: shivammathur
+open_collective: setup-php
@@ -10,10 +10,10 @@ This security policy only applies to the latest patch releases of the following

 | Version | Supported          |
 |---------|--------------------|
-| 8.1     | :white_check_mark: |
 | 8.2     | :white_check_mark: |
 | 8.3     | :white_check_mark: |
 | 8.4     | :white_check_mark: |
+| 8.5     | :white_check_mark: |

 ## Reporting a Vulnerability

@@ -1,7 +1,13 @@
 version: 2
 updates:
- package-ecosystem: "github-actions"
-  directory: "/"
-  target-branch: "develop"
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    target-branch: 'develop'
    schedule:
-      interval: "weekly"
+      interval: 'weekly'
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+    cooldown:
+      default-days: 7
@@ -5,9 +5,13 @@ on:
    - cron: '0 15 * * 6'
 permissions:
  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true

 jobs:
  codeql:
+    name: CodeQL Analysis
    if: github.event.repository.fork == false
    permissions:
      actions: read  # for github/codeql-action/init to get workflow details
@@ -16,18 +20,19 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          fetch-depth: 2
+          persist-credentials: false

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
        with:
          config-file: ./.github/codeql/codeql-configuration.yml
          languages: javascript

      - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
@@ -5,12 +5,15 @@ on:
    - cron: '0 15 * * 6'
 permissions:
  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true

 jobs:
  create:
    if: github.event.repository.fork == false
    permissions:
-      contents: none
+      contents: none # this job only prepares artifacts and uploads them, no repository writes
    name: Create
    runs-on: ${{ matrix.operating-system }}
    strategy:
@@ -20,7 +23,7 @@ jobs:
        php-versions: ['5.3', '5.4', '5.5', '5.6', '7.0', '7.1', '7.2', '7.3', '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5', '8.6']
    steps:
      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
        with:
          php-version: ${{ matrix.php-versions }}
          tools: none
@@ -39,7 +42,7 @@ jobs:
        run: |
          php -m | Out-File -FilePath "$env:file.all" -Append
      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
        with:
          php-version: ${{ matrix.php-versions }}
          extensions: none
@@ -72,7 +75,7 @@ jobs:
          version: ${{ matrix.php-versions }}
        if: matrix.operating-system == 'windows-2022'
        run: |
-          Write-Output "## PHP ${{ matrix.php-versions }}`n" | Out-File -FilePath "$env:file"
+          Write-Output "## PHP $env:version`n" | Out-File -FilePath "$env:file"
          Write-Output "``````" | Out-File -FilePath "$env:file" -Append
          php -m | Out-File -FilePath "$env:file.builtin" -Append
          Get-Content "$env:file.all" | ForEach-Object {
@@ -88,7 +91,7 @@ jobs:
          Remove-Item "$env:file.all" -Force
          Remove-Item "$env:file.builtin" -Force
      - name: Upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: lists-php${{ matrix.php-versions }}-${{ matrix.operating-system }}.md
          path: php${{ matrix.php-versions }}-${{ matrix.operating-system }}.md
@@ -101,19 +104,23 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          repository: ${{ github.repository }}.wiki
+          persist-credentials: false
      - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: ${{ github.workspace }}/lists
          pattern: lists-*
          merge-multiple: true
      - name: Configure Git
+        env:
+          GIT_USER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
+          GIT_USER_NAME: github-actions[bot]
        run : |
-          git config --local user.email "${{ secrets.email }}"
-          git config --local user.name "${{ github.repository_owner }}"
+          git config --local user.email "$GIT_USER_EMAIL"
+          git config --local user.name "$GIT_USER_NAME"
      - name: Combine
        run: |
          for os in ubuntu-24.04 ubuntu-22.04 windows-2025 windows-2022 windows-2019 macos-13 macos-14 macos-15 macos-26; do
@@ -130,9 +137,12 @@ jobs:
          done
          rm -rf ./lists
      - name: Update
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          WIKI_REPOSITORY: ${{ github.repository }}
        run: |
          if [ "$(git status --porcelain=v1 2>/dev/null | wc -l)" != "0" ]; then
            git add .
            git commit -m "Update PHP extensions on wiki - $(date +'%d-%m-%y')"
-            git push -f https://${{ github.repository_owner }}:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.wiki.git master || true
+            git push -f https://x-access-token:${GITHUB_TOKEN}@github.com/${WIKI_REPOSITORY}.wiki.git master || true
          fi
@@ -18,10 +18,14 @@ on:
      - 'examples/**'
 permissions:
  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true

 jobs:
  run:
    name: Run
+    environment: codecov
    runs-on: ${{ matrix.operating-system }}
    strategy:
      fail-fast: false
@@ -29,12 +33,13 @@ jobs:
        operating-system: [ubuntu-latest, windows-latest, macos-latest]
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          fetch-depth: 2
+          persist-credentials: false

      - name: Setup Node.js 24.x
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 24.x

@@ -54,7 +59,7 @@ jobs:
        run: npm audit

      - name: Send Coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: coverage/lcov.info
@@ -19,8 +19,11 @@ on:
      - 'examples/**'
 permissions:
  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 env:
-  default-php-version: '8.2'
+  default-php-version: '8.5'
 jobs:
  run:
    name: Run
@@ -39,18 +42,20 @@ jobs:
      key: cache-v5
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false

      - name: Setup cache environment
        id: cache-env
-        uses: shivammathur/cache-extensions@develop
+        uses: shivammathur/cache-extensions@9b476298b44f2e4d4268dd103ff4c3e216314e27 # v1
        with:
          php-version: ${{ matrix.php-versions || env.default-php-version }}
          extensions: ${{ env.extensions }}
          key: ${{ env.key }}

      - name: Cache extensions
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ steps.cache-env.outputs.dir }}
          key: ${{ steps.cache-env.outputs.key }}
@@ -58,8 +63,10 @@ jobs:

      - name: Stage php-version-file
        if: ${{ matrix.php-version-file == 'php-version-file' }}
+        env:
+          DEFAULT_PHP_VERSION: ${{ env.default-php-version }}
        run: |
-          echo ${{ env.default-php-version }} > php-version-file
+          echo "$DEFAULT_PHP_VERSION" > php-version-file

      - name: Setup PHP with extensions and custom config
        run: node dist/index.js
@@ -70,9 +77,11 @@ jobs:
          ini-values: post_max_size=256M, short_open_tag=On, date.timezone=Asia/Kolkata

      - name: Testing PHP version
+        env:
+          EXPECTED_PHP_VERSION: ${{ matrix.php-versions || env.default-php-version }}
        run: |
          php -v
-          php -r "if(strpos(phpversion(), '${{ matrix.php-versions || env.default-php-version }}') === false) {throw new Exception('Wrong PHP version Installed');}"
+          php -r '$expected = getenv("EXPECTED_PHP_VERSION"); if(strpos(phpversion(), $expected) === false) {throw new Exception("Wrong PHP version Installed");}'

      - name: Testing Composer version
        run: |
@@ -10,28 +10,39 @@ on:
      tag:
        description: Tag name
        required: true
-jobs:
-  build:
-    runs-on: ubuntu-latest
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
 permissions:
  contents: read
-      packages: write
+jobs:
+  build:
+    name: Build and Publish
+    permissions:
+      contents: read # for actions/checkout
+      packages: write # For publishing to GitHub Packages
+      id-token: write # For authentication with npm registry
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout release
        if: github.event_name != 'workflow_dispatch'
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false

      - name: Checkout tag
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        if: github.event_name == 'workflow_dispatch'
        with:
          ref: ${{ github.event.inputs.tag }}
+          persist-credentials: false

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
-          node-version: '20.x'
+          node-version: '24.x'
          registry-url: https://registry.npmjs.org
+          package-manager-cache: false

      - name: Install dependencies and add lib
        run: |
@@ -42,13 +53,12 @@ jobs:
      - name: Publish to NPM
        if: "!contains(github.event.inputs.skip, 'skip-npm')"
        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Change to GitHub Packages registry
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          registry-url: https://npm.pkg.github.com
+          package-manager-cache: false
          scope: '@shivammathur'

      - name: Patch package.json
@@ -18,7 +18,7 @@
  <a href="https://status.setup-php.com" title="setup-php status"><img alt="setup-php status" src="https://img.shields.io/badge/status-subscribe-28A745?logo=statuspage&logoColor=28A745&labelColor=555555"></a>
 </p>

-Setup PHP with required extensions, php.ini configuration, code-coverage support and various tools like composer in [GitHub Actions](https://github.com/features/actions "GitHub Actions"). This action gives you a cross-platform interface to set up the PHP environment you need to test your application. Refer to [Usage](#memo-usage "How to use this") section and [examples](#examples "Examples of use") to see how to use this.
+Setup PHP with required extensions, php.ini configuration, code-coverage support, and various tools like composer in [GitHub Actions](https://github.com/features/actions "GitHub Actions"). This action gives you a cross-platform interface to set up the PHP environment you need to test your application. Refer to the [Usage](#memo-usage "How to use this") section and [examples](#examples "Examples of use") to see how to use this.

 ## Contents

@@ -70,8 +70,10 @@ Both `GitHub-hosted` and `self-hosted` runners are supported by `setup-php` on t

 | Virtual environment | Arch    | YAML workflow label                | Pre-installed PHP |
 |---------------------|---------|------------------------------------|-------------------|
+| Ubuntu 26.04        | x86_64  | `ubuntu-26.04`                     | `PHP 8.5`         |
 | Ubuntu 24.04        | x86_64  | `ubuntu-latest` or `ubuntu-24.04`  | `PHP 8.3`         |
 | Ubuntu 22.04        | x86_64  | `ubuntu-22.04`                     | `PHP 8.1`         |
+| Ubuntu 26.04        | aarch64 | `ubuntu-26.04-arm`                 | `PHP 8.5`         |
 | Ubuntu 24.04        | aarch64 | `ubuntu-24.04-arm`                 | `PHP 8.3`         |
 | Ubuntu 22.04        | aarch64 | `ubuntu-22.04-arm`                 | `PHP 8.1`         |
 | Windows Server 2025 | x64     | `windows-2025`                     | `PHP 8.5`         |
@@ -86,6 +88,7 @@ Both `GitHub-hosted` and `self-hosted` runners are supported by `setup-php` on t

 | Host OS/Virtual environment      | YAML workflow label        |
 |----------------------------------|----------------------------|
+| Ubuntu 26.04                     | `self-hosted` or `Linux`   |
 | Ubuntu 24.04                     | `self-hosted` or `Linux`   |
 | Ubuntu 22.04                     | `self-hosted` or `Linux`   |
 | Debian 13                        | `self-hosted` or `Linux`   |
@@ -98,7 +101,7 @@ Both `GitHub-hosted` and `self-hosted` runners are supported by `setup-php` on t
 | macOS Sonoma 14.x x86_64/arm64   | `self-hosted` or `macOS`   |

 - Refer to the [self-hosted setup](#self-hosted-setup) to use the action on self-hosted runners.
- Operating systems based on the above Ubuntu and Debian versions are also supported on best effort basis.
+- Operating systems based on the above Ubuntu and Debian versions are also supported on a best effort basis.
 - If the requested PHP version is pre-installed, `setup-php` switches to it, otherwise it installs the PHP version.

 ## :tada: PHP Support
@@ -155,7 +158,7 @@ PHP extensions can be set up using the `extensions` input. It accepts a `string`

 - Extensions installed along with PHP if specified are enabled.

- Specific versions of extensions available on `PECL` can be set up by suffixing the extension's name with the version. This is useful for installing old versions of extensions which support end of life PHP versions.
+- Specific versions of extensions available on `PECL` can be set up by suffixing the extension's name with the version. This is useful for installing old versions of extensions which support end-of-life PHP versions.

 ```yaml
 - name: Setup PHP with specific version of PECL extension
@@ -180,14 +183,14 @@ PHP extensions can be set up using the `extensions` input. It accepts a `string`
 - Shared extensions can be disabled by prefixing them with a `:`. All extensions depending on the specified extension will also be disabled.

 ```yaml
- name: Setup PHP and disable opcache
+- name: Setup PHP and disable mbstring
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    extensions: :mbstring
 ```

- All shared extensions can be disabled by specifying `none`. When `none` is specified along with other extensions, it is hoisted to the start of the input. So, all the shared extensions will be disabled first, then rest of the extensions in the input will be processed.
+- All shared extensions can be disabled by specifying `none`. When `none` is specified along with other extensions, it is hoisted to the start of the input. So, all the shared extensions will be disabled first, then the rest of the extensions in the input will be processed.

 This disables all core and third-party shared extensions and thus, can break some tools that need them. Required extensions are enabled again when the tools are set up on a best-effort basis. So it is recommended to add the extensions required for your tools after `none` in the `extensions` input to avoid any issues.

@@ -216,7 +219,7 @@ This disables all core and third-party shared extensions and thus, can break som
  - `event`, `gearman`, `geos` and `relay` on `Ubuntu` and `macOS`.
  - `blackfire`, `couchbase`, `ibm_db2`, `ioncube`, `oci8`, `pdo_firebird`, `pdo_ibm`, `pdo_oci`, `pecl_http`, `phalcon3`, `phalcon4`, `phalcon5`, and `zephir_parser` on all supported OS.

- By default, extensions which cannot be added or disabled gracefully leave an error message in the logs, the execution is not interrupted. To change this behaviour you can set `fail-fast` flag to `true`.
+- By default, extensions which cannot be added or disabled gracefully leave an error message in the logs. The execution is not interrupted. To change this behaviour you can set `fail-fast` flag to `true`.

 ```yaml
 - name: Setup PHP with fail-fast
@@ -242,7 +245,7 @@ These tools can be set up globally using the `tools` input. It accepts a string
    tools: php-cs-fixer, phpunit
 ```

- In addition to above tools any composer tool or package can also be set up globally by specifying it as `vendor/package` matching the listing on Packagist. This format accepts the same [version constraints](https://getcomposer.org/doc/articles/versions.md#writing-version-constraints "Composer version constraints") as `composer`.
+- In addition to the above tools, any composer tool or package can also be set up globally by specifying it as `vendor/package` matching the listing on Packagist. This format accepts the same [version constraints](https://getcomposer.org/doc/articles/versions.md#writing-version-constraints "Composer version constraints") as `composer`.

 ```yaml
 - name: Setup PHP with tools
@@ -268,7 +271,7 @@ These tools can be set up globally using the `tools` input. It accepts a string
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
-    tools: composer:v1
+    tools: composer:v2
 ```

 - If you do not use composer in your workflow, you can specify `tools: none` to skip it.
@@ -342,7 +345,7 @@ Runs on all [PHP versions supported](#tada-php-support "List of PHP versions sup
 ```

 - When you specify `coverage: xdebug`, the latest version of Xdebug compatible with the PHP version is set up by default.
- If you need Xdebug 2.x on PHP 7.2, 7.3 or 7.4, you can specify `coverage: xdebug2`.
+- If you need Xdebug 2.x on PHP 7.2, 7.3, or 7.4, you can specify `coverage: xdebug2`.

 ```yaml
 - name: Setup PHP with Xdebug 2.x
@@ -353,7 +356,7 @@ Runs on all [PHP versions supported](#tada-php-support "List of PHP versions sup
 ```

 > [!NOTE]
-> Xdebug is enabled by default on Ubuntu GitHub Actions images, so if you are not using it in your workflow it is recommended to disable it as that will have a positive impact on your PHP performance. Please refer to the [disable coverage](#disable-coverage) section for details.
+> Xdebug is enabled by default on Ubuntu GitHub Actions images, so if you are not using it in your workflows, it is recommended to disable it as that will have a positive impact on your PHP performance. Please refer to the [disable coverage](#disable-coverage) section for details.

 ### PCOV

@@ -372,7 +375,7 @@ Runs on PHP 7.1 and newer PHP versions.
 ```

 - PHPUnit 8.x and above support PCOV out of the box.
- If you are using PHPUnit 5.x, 6.x or 7.x, you need to set up `pcov/clobber` before executing your tests.
+- If you are using PHPUnit 5.x, 6.x, or 7.x, you need to set up `pcov/clobber` before executing your tests.

 ```yaml
 - name: Setup PCOV
@@ -390,7 +393,7 @@ Disable coverage for these reasons:
 - You are not generating coverage reports while testing.
 - You are using `phpdbg` for running your tests.
 - You are profiling your code using `blackfire`.
- You are using PHP in JIT mode. Please refer to [JIT configuration](#jit-configuration) section for more details.
+- You are using PHP in JIT mode. Please refer to the [JIT configuration](#jit-configuration) section for more details.

 ```yaml
 - name: Setup PHP with no coverage driver
@@ -653,7 +656,7 @@ To debug any issues, you can use the `verbose` tag instead of `v2`.

 ### Multi-Arch Setup

-> Set up PHP on multiple architecture on Ubuntu GitHub Runners.
+> Set up PHP on multiple architectures on Ubuntu GitHub Runners.

 - `PHP 5.6` to `PHP 8.5` are supported by `setup-php` on multiple architecture on `Ubuntu` and `Debian`.
 - For this, you can use `shivammathur/node` images as containers. These have compatible `Nodejs` and `PHP` installed for `setup-php`.
@@ -683,7 +686,7 @@ jobs:

 > Set up PHP on a self-hosted runner.

- To set up a containerised self-hosted runner, refer to the following guides as per your base operating system.
+- To set up a containerized self-hosted runner, refer to the following guides as per your base operating system.
  - [Linux](https://github.com/shivammathur/setup-php/wiki/Dockerized-self-hosted-runner-on-Linux)
  - [Windows](https://github.com/shivammathur/setup-php/wiki/Dockerized-self-hosted-runner-on-Windows)

@@ -710,7 +713,7 @@ jobs:
 ```

 > [!NOTE]
-> - Do not set up multiple self-hosted runners on a single server instance as parallel workflow will conflict with each other.
+> - Do not set up multiple self-hosted runners on a single server instance as parallel workflows will conflict with each other.
 > - Do not set up self-hosted runners on the side of your development environment or your production server.
 > - Avoid using the same labels for your `self-hosted` runners which are used by `GitHub-hosted` runners.

@@ -753,7 +756,7 @@ act -P ubuntu-22.04=shivammathur/node:22.04
 - By default, `opcache.jit=1235` and `opcache.jit_buffer_size=256M` (`opcache.jit_buffer_size=128M` on ARM-based environments) are set which can be changed using `ini-values` input.
 - For detailed information about JIT related directives refer to the [`official PHP documentation`](https://www.php.net/manual/en/opcache.configuration.php#ini.opcache.jit "opcache.jit documentation").

-For example to enable JIT in `tracing` mode with buffer size of `64 MB`.
+For example, to enable JIT in `tracing` mode with buffer size of `64 MB`.

 ```yaml
 - name: Setup PHP with JIT in tracing mode
@@ -833,7 +836,7 @@ If you use Private Packagist for your private composer dependencies, you can set

 ### Manual Composer Authentication

-In addition to GitHub or Private Packagist, if you want to authenticate private repositories hosted elsewhere, you can set the `COMPOSER_AUTH_JSON` environment variable with the authentication methods and the credentials in json format.
+In addition to GitHub or Private Packagist, if you want to authenticate private repositories hosted elsewhere, you can set the `COMPOSER_AUTH_JSON` environment variable with the authentication methods and the credentials in JSON format.
 Please refer to the authentication section in [`composer documentation`](https://getcomposer.org/doc/articles/authentication-for-private-packages.md "composer documentation") for more details.

 ```yaml
@@ -950,11 +953,12 @@ Examples of using `setup-php` with various PHP frameworks and packages.
 | Framework/Package                      | Runs on                         | Workflow                                                                                                      |
 |----------------------------------------|---------------------------------|---------------------------------------------------------------------------------------------------------------|
 | Blackfire                              | `macOS`, `ubuntu` and `windows` | [blackfire.yml](./examples/blackfire.yml "GitHub Action using Blackfire")                                     |
-| Blackfire Player                       | `macOS`, `ubuntu` and `windows` | [blackfire-player.yml](./examples/blackfire-player.yml "GitHub Action using Blackfire Player")                |
+| Blackfire Player                       | `macOS` and `ubuntu`            | [blackfire-player.yml](./examples/blackfire-player.yml "GitHub Action using Blackfire Player")                |
 | CakePHP with `MySQL` and `Redis`       | `ubuntu`                        | [cakephp-mysql.yml](./examples/cakephp-mysql.yml "GitHub Action for CakePHP with MySQL and Redis")            |
 | CakePHP with `PostgreSQL` and `Redis`  | `ubuntu`                        | [cakephp-postgres.yml](./examples/cakephp-postgres.yml "GitHub Action for CakePHP with Postgres and Redis")   |
 | CakePHP without services               | `macOS`, `ubuntu` and `windows` | [cakephp.yml](./examples/cakephp.yml "GitHub Action for CakePHP without services")                            |
 | CodeIgniter                            | `macOS`, `ubuntu` and `windows` | [codeigniter.yml](./examples/codeigniter.yml "GitHub Action for CodeIgniter")                                 |
+| Drupal 11 (Composer-managed)           | `ubuntu`                        | [drupal.yml](./examples/drupal.yml "GitHub Action for Drupal 11 composer-managed projects")                   |
 | Laminas MVC                            | `macOS`, `ubuntu` and `windows` | [laminas-mvc.yml](./examples/laminas-mvc.yml "GitHub Action for Laminas Framework MVC Projects")              |
 | Laravel with `MySQL` and `Redis`       | `ubuntu`                        | [laravel-mysql.yml](./examples/laravel-mysql.yml "GitHub Action for Laravel with MySQL and Redis")            |
 | Laravel with `PostgreSQL` and `Redis`  | `ubuntu`                        | [laravel-postgres.yml](./examples/laravel-postgres.yml "GitHub Action for Laravel with PostgreSQL and Redis") |
@@ -964,23 +968,25 @@ Examples of using `setup-php` with various PHP frameworks and packages.
 | Lumen without services                 | `macOS`, `ubuntu` and `windows` | [lumen.yml](./examples/lumen.yml "GitHub Action for Lumen without services")                                  |
 | Phalcon with `MySQL`                   | `ubuntu`                        | [phalcon-mysql.yml](./examples/phalcon-mysql.yml "GitHub Action for Phalcon with MySQL")                      |
 | Phalcon with `PostgreSQL`              | `ubuntu`                        | [phalcon-postgres.yml](./examples/phalcon-postgres.yml "GitHub Action for Phalcon with PostgreSQL")           |
-| Roots/bedrock                          | `ubuntu`                        | [bedrock.yml](./examples/bedrock.yml "GitHub Action for Wordpress Development using @roots/bedrock")          |
-| Roots/sage                             | `ubuntu`                        | [sage.yml](./examples/sage.yml "GitHub Action for Wordpress Development using @roots/sage")                   |
 | Slim Framework                         | `macOS`, `ubuntu` and `windows` | [slim-framework.yml](./examples/slim-framework.yml "GitHub Action for Slim Framework")                        |
 | Symfony with `MySQL`                   | `ubuntu`                        | [symfony-mysql.yml](./examples/symfony-mysql.yml "GitHub Action for Symfony with MySQL")                      |
 | Symfony with `PostgreSQL`              | `ubuntu`                        | [symfony-postgres.yml](./examples/symfony-postgres.yml "GitHub Action for Symfony with PostgreSQL")           |
 | Symfony without services               | `macOS`, `ubuntu` and `windows` | [symfony.yml](./examples/symfony.yml "GitHub Action for Symfony without services")                            |
-| Yii2 Starter Kit with `MySQL`          | `ubuntu`                        | [yii2-mysql.yml](./examples/yii2-mysql.yml "GitHub Action for Yii2 Starter Kit with MySQL")                   |
-| Yii2 Starter Kit with `PostgreSQL`     | `ubuntu`                        | [yii2-postgres.yml](./examples/yii2-postgres.yml "GitHub Action for Yii2 Starter Kit with PostgreSQL")        |
+| WordPress plugin                       | `ubuntu`                        | [wordpress.yml](./examples/wordpress.yml "GitHub Action for WordPress plugins")                               |
+| WordPress with Roots/Bedrock           | `ubuntu`                        | [bedrock.yml](./examples/bedrock.yml "GitHub Action for WordPress development using @roots/bedrock")          |
+| WordPress with Roots/Sage              | `ubuntu`                        | [sage.yml](./examples/sage.yml "GitHub Action for WordPress development using @roots/sage")                   |
+| Yii3 web application with `MySQL`      | `ubuntu`                        | [yii3-mysql.yml](./examples/yii3-mysql.yml "GitHub Action for Yii3 web application with MySQL")               |
+| Yii3 web application with `PostgreSQL` | `ubuntu`                        | [yii3-postgres.yml](./examples/yii3-postgres.yml "GitHub Action for Yii3 web application with PostgreSQL")    |
+| Yii3 web application                   | `ubuntu` and `windows`          | [yii3.yml](./examples/yii3.yml "GitHub Action for Yii3 web application")                                      |

 ## :bookmark: Versioning

- Use the `v2` tag as `setup-php` version. It is a rolling tag and is synced with the latest minor and patch releases. With `v2` you automatically get the bug fixes, security patches, new features and support for latest PHP releases.
+- Use the `v2` tag as `setup-php` version. It is a rolling tag and is synced with the latest minor and patch releases. With `v2` you automatically get the bug fixes, security patches, new features, and support for latest PHP releases.
 - Semantic release versions can also be used. It is recommended to [use dependabot](https://docs.github.com/en/github/administering-a-repository/keeping-your-actions-up-to-date-with-github-dependabot "Setup Dependabot with GitHub Actions") with semantic versioning to keep the actions in your workflows up to date.
- Commit SHA can also be used, but are not recommended unless you set up tooling to update them with each release of the action.
- A new major version of the action will only be tagged when there are breaking changes in the setup-php API i.e. inputs, outputs, and environment flags.
+- Commit SHA can also be used, but is not recommended unless you set up tooling to update them with each release of the action.
+- A new major version of the action will only be tagged when there are breaking changes in the setup-php API i.e. - inputs, outputs, and environment flags.
 - For debugging any issues `verbose` tag can be used temporarily. It outputs all the logs and is also synced with the latest releases.
- It is highly discouraged to use the `main` branch as version, it might break your workflow after major releases as they have breaking changes.
+- It is highly discouraged to use the `main` branch as the version, it might break your workflow after major releases as they have breaking changes.
 - If you are using the `v1` tag or a `1.x.y` version, you should [switch to v2](https://github.com/shivammathur/setup-php/wiki/Switch-to-v2 "Guide for switching from setup-php v1 to v2") as `v1` is not supported anymore.

 ## :scroll: License
@@ -1042,7 +1048,7 @@ Many users and organizations support setup-php via [GitHub Sponsors](https://git

 <a href="https://github.com/sponsors/shivammathur"><img src="https://setup-php.com/sponsors.svg?" alt="Sponsor shivammathur"></a>

- If you use setup-php, please consider starring the project and share it. 
+- If you use setup-php, please consider starring the project and sharing it. 
 - If you blog, please share your experience of using `setup-php`.
 - Please [reach out](mailto:contact@setup-php.com) if you have any questions about sponsoring setup-php.

@@ -9,6 +9,10 @@ describe('Config tests', () => {
    ${'a=b & ~c'}                        | ${'win32'}   | ${'Add-Content "$php_dir\\php.ini" "a=\'b & ~c\'"'}
    ${'a="~(b)"'}                        | ${'win32'}   | ${'Add-Content "$php_dir\\php.ini" "a=\'~(b)\'"'}
    ${'a="b, c"'}                        | ${'win32'}   | ${'Add-Content "$php_dir\\php.ini" "a=b, c"'}
+    ${'disable_functions="exec,system"'} | ${'linux'}   | ${'echo "disable_functions=exec,system" | sudo tee -a'}
+    ${'disable_functions="exec,system"'} | ${'win32'}   | ${'Add-Content "$php_dir\\php.ini" "disable_functions=exec,system"'}
+    ${'a=$(id)'}                         | ${'linux'}   | ${'echo "a=\'\\$(id)\'"'}
+    ${'a=$(id)'}                         | ${'win32'}   | ${'Add-Content "$php_dir\\php.ini" "a=\'`$(id)\'"'}
    ${'a=b, c=d'}                        | ${'openbsd'} | ${'Platform openbsd is not supported'}
  `('checking addINIValues on $os', async ({ini_values, os, output}) => {
    expect(await config.addINIValues(ini_values, os)).toContain(output);
@@ -31,6 +31,12 @@ function getData(data: Partial<ToolData>): ToolData {
  };
 }

+function unsetComposerAuthEnv(): void {
+  delete process.env['GITHUB_TOKEN'];
+  delete process.env['COMPOSER_TOKEN'];
+  delete process.env['COMPOSER_AUTH_JSON'];
+}
+
 /**
 * Mock fetch.ts
 */
@@ -181,6 +187,7 @@ describe('Tools tests', () => {
    ${'1.2.3-dev'}     | ${'tool'}     | ${'phar'}     | ${'1.2.3-dev'}
    ${'1.2.3-alpha1'}  | ${'tool'}     | ${'phar'}     | ${'1.2.3-alpha1'}
    ${'1.2.3-alpha.1'} | ${'tool'}     | ${'phar'}     | ${'1.2.3-alpha.1'}
+    ${'1.>=0'}         | ${'tool'}     | ${'phar'}     | ${'1.0'}
  `(
    'checking getVersion: $version, $tool, $type',
    async ({version, tool, type, expected}) => {
@@ -298,22 +305,30 @@ describe('Tools tests', () => {
  });

  it.each`
-    os           | script                                              | scope
-    ${'linux'}   | ${'add_composer_tool tool tool:1.2.3 user/ global'} | ${'global'}
-    ${'darwin'}  | ${'add_composer_tool tool tool:1.2.3 user/ scoped'} | ${'scoped'}
-    ${'win32'}   | ${'Add-ComposerTool tool tool:1.2.3 user/ scoped'}  | ${'scoped'}
-    ${'openbsd'} | ${'Platform openbsd is not supported'}              | ${'global'}
-  `('checking addPackage: $os, $scope', async ({os, script, scope}) => {
+    os           | release           | scope       | script
+    ${'linux'}   | ${'tool:1.2.3'}   | ${'global'} | ${'add_composer_tool tool tool:1.2.3 user/ global'}
+    ${'darwin'}  | ${'tool:1.2.3'}   | ${'scoped'} | ${'add_composer_tool tool tool:1.2.3 user/ scoped'}
+    ${'win32'}   | ${'tool:1.2.3'}   | ${'scoped'} | ${'Add-ComposerTool tool tool:1.2.3 user/ scoped'}
+    ${'linux'}   | ${'tool:>=1.2'}   | ${'global'} | ${'add_composer_tool tool "tool:>=1.2" user/ global'}
+    ${'win32'}   | ${'tool:>=1.2'}   | ${'global'} | ${'Add-ComposerTool tool "tool:>=1.2" user/ global'}
+    ${'linux'}   | ${'tool:1.*'}     | ${'global'} | ${'add_composer_tool tool "tool:1.*" user/ global'}
+    ${'linux'}   | ${'psalm:^5||^6'} | ${'global'} | ${'add_composer_tool tool "psalm:^5||^6" user/ global'}
+    ${'linux'}   | ${'psalm:>=5,<6'} | ${'global'} | ${'add_composer_tool tool "psalm:>=5,<6" user/ global'}
+    ${'openbsd'} | ${'tool:1.2.3'}   | ${'global'} | ${'Platform openbsd is not supported'}
+  `(
+    'checking addPackage: $os, $release',
+    async ({os, release, scope, script}) => {
      const data = getData({
        tool: 'tool',
        version: '1.2.3',
        repository: 'user/tool',
-      os: os,
-      scope: scope
+        os,
+        scope
      });
-    data['release'] = [data['tool'], data['version']].join(':');
+      data['release'] = release;
      expect(await tools.addPackage(data)).toContain(script);
-  });
+    }
+  );

  it.each`
    version     | php_version | os          | script
@@ -423,6 +438,118 @@ describe('Tools tests', () => {
    }
  );

+  it.each`
+    version            | affected
+    ${'1'}             | ${false}
+    ${'1.0.0-alpha1'}  | ${true}
+    ${'1.0.0-alpha2'}  | ${true}
+    ${'1.0.0-alpha3'}  | ${true}
+    ${'1.0.0-alpha4'}  | ${true}
+    ${'1.0.0-alpha5'}  | ${true}
+    ${'1.0.0-alpha6'}  | ${true}
+    ${'1.0.0-alpha7'}  | ${true}
+    ${'1.0.0-alpha8'}  | ${true}
+    ${'1.0.0-alpha9'}  | ${true}
+    ${'1.0.0-alpha10'} | ${true}
+    ${'1.0.0-alpha11'} | ${true}
+    ${'1.0.0-beta1'}   | ${true}
+    ${'1.0.0-beta2'}   | ${true}
+    ${'1.0.0'}         | ${true}
+    ${'1.10.27'}       | ${true}
+    ${'1.10.28'}       | ${false}
+    ${'2.0.0-alpha1'}  | ${true}
+    ${'2.0.0-alpha2'}  | ${true}
+    ${'2.0.0-alpha3'}  | ${true}
+    ${'2.0.0-RC1'}     | ${true}
+    ${'2.0.0-RC2'}     | ${true}
+    ${'2.2.27'}        | ${true}
+    ${'2.2.28'}        | ${false}
+    ${'2.3.0-RC1'}     | ${true}
+    ${'2.3.0-RC2'}     | ${true}
+    ${'2.9.7'}         | ${true}
+    ${'2.9.7-RC1'}     | ${true}
+    ${'2.9.8'}         | ${false}
+    ${'2.9.0RC1'}      | ${false}
+    ${'2.9.x-dev'}     | ${false}
+  `('checking affected composer version: $version', ({version, affected}) => {
+    expect(tools.skipGitHubAuthForComposerVersion(version)).toBe(affected);
+  });
+
+  it('checking affected composer version with CRLF ranges', async () => {
+    let affected = false;
+    let fixed = true;
+    await jest.isolateModulesAsync(async () => {
+      jest.doMock('fs', () => ({
+        ...jest.requireActual('fs'),
+        readFileSync: (
+          filePath: fs.PathOrFileDescriptor,
+          options?: unknown
+        ) => {
+          if (String(filePath).includes('composer-gh-auth-no-op')) {
+            return '1.0.0-0 1.10.28\r\n2.0.0-0 2.2.28\r\n2.3.0-0 2.9.8';
+          }
+          return (jest.requireActual('fs') as typeof fs).readFileSync(
+            filePath,
+            options as fs.ObjectEncodingOptions & {flag?: string}
+          );
+        }
+      }));
+      const isolatedTools = await import('../src/tools');
+      affected = isolatedTools.skipGitHubAuthForComposerVersion('2.9.7');
+      fixed = isolatedTools.skipGitHubAuthForComposerVersion('2.9.8');
+    });
+    expect(affected).toBe(true);
+    expect(fixed).toBe(false);
+  });
+
+  it.each`
+    auth_json                                                                                                          | expected
+    ${'{"github-oauth":{"github.com":"ghs_new-token"},"http-basic":{"repo.example":{"username":"u","password":"p"}}}'} | ${'{"http-basic":{"repo.example":{"username":"u","password":"p"}}}'}
+    ${'{"github-oauth":{"github.com":"ghs_new-token"}}'}                                                               | ${undefined}
+    ${'{"http-basic":{"repo.example":{"username":"u","password":"p"}}}'}                                               | ${'{"http-basic":{"repo.example":{"username":"u","password":"p"}}}'}
+    ${'{"nested":{"github-oauth":{"github.com":"ghs_new-token"}}}'}                                                    | ${'{"nested":{"github-oauth":{"github.com":"ghs_new-token"}}}'}
+    ${'{"github-oauth":'}                                                                                              | ${'{"github-oauth":'}
+  `('cleaning composer auth json', ({auth_json, expected}) => {
+    unsetComposerAuthEnv();
+    process.env['COMPOSER_AUTH_JSON'] = auth_json;
+    tools.cleanComposerAuthJson();
+    expect(process.env['COMPOSER_AUTH_JSON']).toBe(expected);
+    unsetComposerAuthEnv();
+  });
+
+  it.each`
+    version     | os         | envs                                                                                       | skip_github_auth
+    ${'latest'} | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${false}
+    ${'1'}      | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${false}
+    ${'2'}      | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${false}
+    ${'2.9.7'}  | ${'linux'} | ${{}}                                                                                      | ${true}
+    ${'2.9.7'}  | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${true}
+    ${'2.9.7'}  | ${'linux'} | ${{COMPOSER_TOKEN: 'ghs_token'}}                                                           | ${true}
+    ${'2.9.7'}  | ${'linux'} | ${{COMPOSER_AUTH_JSON: '{"github-oauth":{"github.com":"ghs_new-token"}}'}}                 | ${true}
+    ${'2.9.7'}  | ${'linux'} | ${{COMPOSER_AUTH_JSON: '{"http-basic":{"repo.example":{"username":"u","password":"p"}}}'}} | ${true}
+    ${'2.9.8'}  | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${false}
+    ${'2.9.7'}  | ${'win32'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${true}
+  `(
+    'checking composer github auth skip flag: $version, $os',
+    async ({version, os, envs, skip_github_auth}) => {
+      unsetComposerAuthEnv();
+      Object.assign(process.env, envs);
+      const data = getData({
+        tool: 'composer',
+        os: os,
+        php_version: '7.4',
+        domain: 'https://getcomposer.org',
+        repository: 'composer/composer',
+        version: version
+      });
+      const script = await tools.addComposer(data);
+      expect(script).toContain(
+        `composer ${version}${skip_github_auth ? ' true' : ''}`
+      );
+      unsetComposerAuthEnv();
+    }
+  );
+
  it.each`
    version     | uri
    ${'latest'} | ${'wp-cli/builds/blob/gh-pages/phar/wp-cli.phar?raw=true'}
@@ -533,7 +660,7 @@ describe('Tools tests', () => {
        'add_devtools phpize',
        'add_tool https://github.com/phpmd/phpmd/releases/latest/download/phpmd.phar phpmd "--version"',
        'add_tool https://github.com/phpspec/phpspec/releases/latest/download/phpspec.phar phpspec "-V"',
-        'add_composer_tool phpunit-bridge phpunit-bridge:5.6.* symfony/ global',
+        'add_composer_tool phpunit-bridge "phpunit-bridge:5.6.*" symfony/ global',
        'add_composer_tool phpunit-polyfills phpunit-polyfills:1.0.1 yoast/ global',
        'add_protoc 1.2.3',
        'add_tool https://github.com/vimeo/psalm/releases/latest/download/psalm.phar psalm "-v"',
@@ -593,7 +720,7 @@ describe('Tools tests', () => {
        'Add-ComposerTool codeception codeception codeception/ global',
        'Add-ComposerTool prestissimo prestissimo hirak/ global',
        'Add-ComposerTool automatic-composer-prefetcher automatic-composer-prefetcher narrowspark/ global',
-        'Add-ComposerTool phinx phinx:1.2.* robmorgan/ scoped',
+        'Add-ComposerTool phinx "phinx:1.2.*" robmorgan/ scoped',
        'Add-ComposerTool phinx phinx:^1.2 robmorgan/ global',
        'Add-ComposerTool tool tool:1.2.3 user/ global',
        'Add-ComposerTool tool tool:~1.2 user/ global'
@@ -642,6 +769,7 @@ describe('Tools tests', () => {
    ${'composer:preview'}                                 | ${'add_tool https://github.com/shivammathur/composer-cache/releases/latest/download/composer-7.4-preview.phar,https://artifacts.setup-php.com/composer/composer-7.4-preview.phar,https://dl.cloudsmith.io/public/shivammathur/composer-cache/raw/files/composer-7.4-preview.phar,https://getcomposer.org/composer-preview.phar composer preview'}
    ${'composer, composer:v1'}                            | ${'add_tool https://github.com/shivammathur/composer-cache/releases/latest/download/composer-7.4-1.phar,https://artifacts.setup-php.com/composer/composer-7.4-1.phar,https://dl.cloudsmith.io/public/shivammathur/composer-cache/raw/files/composer-7.4-1.phar,https://getcomposer.org/composer-1.phar composer'}
    ${'composer:v1, composer:preview, composer:snapshot'} | ${'add_tool https://github.com/shivammathur/composer-cache/releases/latest/download/composer-7.4-snapshot.phar,https://artifacts.setup-php.com/composer/composer-7.4-snapshot.phar,https://dl.cloudsmith.io/public/shivammathur/composer-cache/raw/files/composer-7.4-snapshot.phar,https://getcomposer.org/composer.phar composer snapshot'}
+    ${'composer:2.9.7'}                                   | ${'add_tool https://github.com/composer/composer/releases/download/2.9.7/composer.phar,https://getcomposer.org/download/2.9.7/composer.phar composer 2.9.7 true'}
  `('checking composer setup: $tools_csv', async ({tools_csv, script}) => {
    expect(await tools.addTools(tools_csv, '7.4', 'linux')).toContain(script);
  });
@@ -11,6 +11,12 @@ describe('Utils tests', () => {
    expect(await utils.readEnv('TEST')).toBe('setup-php');
    expect(await utils.readEnv('test_hyphen')).toBe('setup-php');
    expect(await utils.readEnv('TEST_HYPHEN')).toBe('setup-php');
+    expect(await utils.readEnv('test invalid')).toBe('');
+    process.env['conflict_hyphen'] = 'setup-php';
+    process.env['conflict-hyphen'] = 'wrong';
+    expect(await utils.readEnv('conflict_hyphen')).toBe('setup-php');
+    delete process.env['conflict_hyphen'];
+    delete process.env['conflict-hyphen'];
    expect(await utils.readEnv('undefined')).toBe('');
  });

@@ -40,7 +46,19 @@ describe('Utils tests', () => {
    expect(await utils.parseVersion('7')).toBe('7.0');
    expect(await utils.parseVersion('7.4')).toBe('7.4');
    expect(await utils.parseVersion('5.x')).toBe('5.6');
-    expect(await utils.parseVersion('4.x')).toBe(undefined);
+    expect(await utils.parseVersion('pre')).toBe('pre');
+    expect(await utils.parseVersion('pre-installed')).toBe('pre');
+    await expect(utils.parseVersion('4.x')).rejects.toThrow(
+      'Invalid PHP version: 4.x'
+    );
+    await expect(utils.parseVersion('foo')).rejects.toThrow(
+      'Invalid PHP version:'
+    );
+
+    fetchSpy.mockResolvedValue({data: '{ "latest": "8.1.0" }'});
+    await expect(utils.parseVersion('latest')).rejects.toThrow(
+      'Invalid PHP version in manifest:'
+    );

    fetchSpy.mockReset();
    fetchSpy.mockResolvedValueOnce({}).mockResolvedValueOnce({});
@@ -56,6 +74,12 @@ describe('Utils tests', () => {
    expect(await utils.parseIniFile('none')).toBe('none');
    expect(await utils.parseIniFile('php.ini-production')).toBe('production');
    expect(await utils.parseIniFile('php.ini-development')).toBe('development');
+    expect(await utils.parseIniFile('/etc/php.ini-production')).toBe(
+      'production'
+    );
+    expect(await utils.parseIniFile('/a-b/php.ini-development')).toBe(
+      'development'
+    );
    expect(await utils.parseIniFile('invalid')).toBe('production');
  });

@@ -85,6 +109,26 @@ describe('Utils tests', () => {

    expect(await utils.extensionArray('')).toEqual([]);
    expect(await utils.extensionArray(' ')).toEqual([]);
+
+    expect(
+      await utils.extensionArray('apcu, mbstring, \\ pdo_pgsql, posix, session')
+    ).toEqual(['apcu', 'mbstring', 'pdo_pgsql', 'posix', 'session']);
+  });
+
+  it('checking shell helpers', () => {
+    expect(utils.escapeForShell('a$b`c\\d"e', 'linux')).toBe(
+      'a\\$b\\`c\\\\d\\"e'
+    );
+    expect(utils.escapeForShell('a$b`c"d', 'win32')).toBe('a`$b``c`"d');
+    expect(utils.safeArg('vendor-pkg/repo@v1.0.0', 'linux')).toBe(
+      'vendor-pkg/repo@v1.0.0'
+    );
+    expect(utils.safeArg('phpcs:>=3.0', 'linux')).toBe('"phpcs:>=3.0"');
+    expect(utils.safeArg('foo$bar', 'win32')).toBe('"foo`$bar"');
+    expect(utils.sanitizeShellInput('foo;$(`ls`)bar')).toBe('foolsbar');
+    expect(utils.sanitizeShellInput('vendor/foo:1.*', true)).toBe(
+      'vendor/foo:1.'
+    );
  });

  it('checking INIArray', async () => {
@@ -278,6 +322,9 @@ describe('Utils tests', () => {
    process.env['php-version'] = '8.2';
    expect(await utils.readPHPVersion()).toBe('8.2');

+    process.env['php-version'] = 'pre-installed';
+    expect(await utils.readPHPVersion()).toBe('pre-installed');
+
    delete process.env['php-version-file'];
    delete process.env['php-version'];

@@ -287,7 +334,7 @@ describe('Utils tests', () => {

    existsSync.mockReturnValue(true);
    readFileSync.mockReturnValue('setup-php');
-    expect(await utils.readPHPVersion()).toBe('setup-php');
+    await expect(utils.readPHPVersion()).rejects.toThrow('Invalid PHP version');

    existsSync.mockReturnValueOnce(false).mockReturnValueOnce(true);
    readFileSync.mockReturnValue(
@@ -308,6 +355,37 @@ describe('Utils tests', () => {
    readFileSync.mockClear();
  });

+  it('readPHPVersion rejects unsupported values from each source', async () => {
+    const existsSync = jest.spyOn(fs, 'existsSync').mockImplementation();
+    const readFileSync = jest.spyOn(fs, 'readFileSync').mockImplementation();
+
+    process.env['php-version'] = 'bogus';
+    await expect(utils.readPHPVersion()).rejects.toThrow('php-version input');
+    delete process.env['php-version'];
+
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue('bogus');
+    await expect(utils.readPHPVersion()).rejects.toThrow('.php-version');
+
+    existsSync.mockReturnValueOnce(false).mockReturnValueOnce(true);
+    readFileSync.mockReturnValue('{"platform-overrides":{"php":"bogus"}}');
+    await expect(utils.readPHPVersion()).rejects.toThrow(
+      'composer.lock platform-overrides.php'
+    );
+
+    existsSync
+      .mockReturnValueOnce(false)
+      .mockReturnValueOnce(false)
+      .mockReturnValueOnce(true);
+    readFileSync.mockReturnValue('{"config":{"platform":{"php":"bogus"}}}');
+    await expect(utils.readPHPVersion()).rejects.toThrow(
+      'composer.json config.platform.php'
+    );
+
+    existsSync.mockClear();
+    readFileSync.mockClear();
+  });
+
  it('checking setVariable', async () => {
    let script: string = await utils.setVariable('var', 'command', 'linux');
    expect(script).toEqual('\nvar="$(command)"\n');
@@ -8,7 +8,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -4,6 +4,9 @@ on: [push, pull_request]
 jobs:
  blackfire-player:
    name: Blackfire (PHP ${{ matrix.php-versions }})
+    defaults:
+      run:
+        shell: bash
    # Add your Blackfire credentials securely using GitHub Secrets
    env:
      BLACKFIRE_SERVER_ID: ${{ secrets.BLACKFIRE_SERVER_ID }}
@@ -14,9 +17,9 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
-        # blackfire-player supports PHP >= 5.5
+        operating-system: [ubuntu-latest, macos-latest]
+        php-versions: ['8.3', '8.4', '8.5']
+        # Blackfire Player supports PHP 8.5 and is available on Ubuntu and macOS.
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -31,6 +34,14 @@ jobs:
          tools: blackfire, blackfire-player
          coverage: none

-      # Refer to https://blackfire.io/docs/player/index#usage
+      - name: Start local endpoint
+        run: |
+          php -S 127.0.0.1:8080 > "$RUNNER_TEMP/blackfire-player.log" 2>&1 &
+          sleep 5
+
+      - name: Validate scenario
+        run: blackfire-player validate scenario.bkf
+
+      # Refer to https://docs.blackfire.io/builds-cookbooks/player
      - name: Play the scenario
-        run: blackfire-player run scenario.bkf
+        run: blackfire-player run scenario.bkf --endpoint=http://127.0.0.1:8080
@@ -15,8 +15,8 @@ jobs:
      fail-fast: false
      matrix:
        operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
-        # Blackfire supports PHP >= 5.3 on Ubuntu and macOS, and PHP >= 5.4 on Windows
+        php-versions: ['8.3', '8.4', '8.5']
+        # Blackfire supports the current PHP releases on Ubuntu, macOS, and Windows.
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -26,12 +26,24 @@ jobs:
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php-versions }}
-          # Setup Blackfire extension and CLI
-          extensions: blackfire
+          # Setup Blackfire extension and CLI.
+          extensions: blackfire, :xdebug
          tools: blackfire
          # Disable Xdebug and PCOV coverage drivers
          coverage: none

      # Refer to https://blackfire.io/docs/cookbooks/profiling-cli
      - name: Profile
-        run: blackfire run php my-script.php
+        shell: bash
+        run: |
+          set +e
+          output=$(blackfire run php my-script.php 2>&1)
+          exit_code=$?
+          printf '%s\n' "$output"
+          if [ "$exit_code" -ne 0 ]; then
+            if printf '%s' "$output" | grep -q "upgrade your subscription"; then
+              echo "Blackfire profiling reached the repository quota limit; treating this as a known non-fatal condition."
+              exit 0
+            fi
+            exit "$exit_code"
+          fi
@@ -6,7 +6,8 @@ jobs:
  tests:
    strategy:
      matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5']
+        # The latest cakephp/app release resolves dev dependencies that require PHP 8.4+.
    runs-on: ubuntu-latest

    # Docs: https://docs.github.com/en/actions/using-containerized-services
@@ -37,7 +38,7 @@ jobs:
          php-version: ${{ matrix.php-versions }}
          # You can also use ext-apcu or ext-memcached instead of ext-redis
          # Install memcached if using ext-memcached
-          extensions: mbstring, intl, redis, pdo_mysql
+          extensions: mbstring, intl, redis, apcu, pdo_mysql
          coverage: pcov

      # Local MySQL service in GitHub hosted environments is disabled by default.
@@ -61,14 +62,15 @@ jobs:
      - name: Install dependencies
        run: |
          composer install --no-progress --prefer-dist --optimize-autoloader
-          composer run-script post-install-cmd
+          composer run-script post-install-cmd --no-interaction

      # Add a step to run migrations if required
      - name: Test with phpunit
        run: vendor/bin/phpunit --coverage-text
        env:
          REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
-          DB_DSN: "mysql://root:password@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/cakephp?init[]=SET sql_mode = \"STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION\""
+          DATABASE_URL: "mysql://root:password@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/cakephp?init[]=SET sql_mode = \"STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION\""
+          DATABASE_TEST_URL: "mysql://root:password@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/cakephp?init[]=SET sql_mode = \"STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION\""

  coding-standard:
    name: Coding Standard
@@ -81,7 +83,7 @@ jobs:
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
-          php-version: '8.1'
+          php-version: '8.5'
          extensions: mbstring, intl

      - name: Get composer cache directory
@@ -114,7 +116,7 @@ jobs:
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
-          php-version: '8.1'
+          php-version: '8.5'
          extensions: mbstring, intl
          tools: phpstan

@@ -132,7 +134,9 @@ jobs:
          restore-keys: ${{ runner.os }}-composer-

      - name: Install dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: |
+          composer install --no-progress --prefer-dist --optimize-autoloader
+          composer run-script post-install-cmd --no-interaction

      - name: Static Analysis using PHPStan
        run: phpstan analyse --no-progress src/
@@ -5,8 +5,10 @@ on: [push, pull_request]
 jobs:
  tests:
    strategy:
+      fail-fast: false
      matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5']
+        # The latest cakephp/app release resolves dev dependencies that require PHP 8.4+.
    runs-on: ubuntu-latest

    # Docs: https://docs.github.com/en/actions/using-containerized-services
@@ -37,7 +39,7 @@ jobs:
          php-version: ${{ matrix.php-versions }}
          # You can also use ext-apcu or ext-memcached instead of ext-redis
          # Install memcached if using ext-memcached
-          extensions: mbstring, intl, redis, pdo_pgsql
+          extensions: mbstring, intl, redis, apcu, pdo_pgsql
          coverage: pcov

      # Local PostgreSQL service in GitHub hosted environments is disabled by default.
@@ -61,14 +63,15 @@ jobs:
      - name: Install dependencies
        run: |
          composer install --no-progress --prefer-dist --optimize-autoloader
-          composer run-script post-install-cmd
+          composer run-script post-install-cmd --no-interaction

      # Add a step to run migrations if required
      - name: Test with phpunit
        run: vendor/bin/phpunit --coverage-text
        env:
          REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
-          DB_DSN: postgres://postgres@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/postgres
+          DATABASE_URL: postgres://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/postgres?encoding=UTF8
+          DATABASE_TEST_URL: postgres://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/postgres?encoding=UTF8

  coding-standard:
    name: Coding Standard
@@ -81,8 +84,8 @@ jobs:
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
-          php-version: '8.1'
-          extensions: mbstring, intl
+          php-version: '8.5'
+          extensions: mbstring, intl, apcu

      - name: Get composer cache directory
        id: composer-cache
@@ -114,8 +117,8 @@ jobs:
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
-          php-version: '8.1'
-          extensions: mbstring, intl
+          php-version: '8.5'
+          extensions: mbstring, intl, apcu
          tools: phpstan

      - name: Get composer cache directory
@@ -132,7 +135,9 @@ jobs:
          restore-keys: ${{ runner.os }}-composer-

      - name: Install dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: |
+          composer install --no-progress --prefer-dist --optimize-autoloader
+          composer run-script post-install-cmd --no-interaction

      - name: Static Analysis using PHPStan
        run: phpstan analyse --no-progress src/
@@ -7,7 +7,8 @@ jobs:
    strategy:
      matrix:
        operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5']
+        # The latest cakephp/app release resolves dev dependencies that require PHP 8.4+.
    runs-on: ${{ matrix.operating-system }}
    steps:
      - name: Checkout
@@ -23,6 +24,7 @@ jobs:

      - name: Get composer cache directory
        id: composer-cache
+        shell: bash
        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache composer dependencies
@@ -37,7 +39,7 @@ jobs:
      - name: Install dependencies
        run: |
          composer install --no-progress --prefer-dist --optimize-autoloader
-          composer run-script post-install-cmd
+          composer run-script post-install-cmd --no-interaction

      - name: Test with phpunit
        run: vendor/bin/phpunit --coverage-text
@@ -53,10 +55,11 @@ jobs:
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
-          php-version: '8.1'
+          php-version: '8.5'
          extensions: mbstring, intl
      - name: Get composer cache directory
        id: composer-cache
+        shell: bash
        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache composer dependencies
@@ -85,12 +88,13 @@ jobs:
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
-          php-version: '8.1'
+          php-version: '8.5'
          extensions: mbstring, intl
          tools: phpstan

      - name: Get composer cache directory
        id: composer-cache
+        shell: bash
        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache composer dependencies
@@ -103,7 +107,9 @@ jobs:
          restore-keys: ${{ runner.os }}-composer-

      - name: Install dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: |
+          composer install --no-progress --prefer-dist --optimize-autoloader
+          composer run-script post-install-cmd --no-interaction

      - name: Static Analysis using PHPStan
        run: phpstan analyse --no-progress src/
@@ -6,7 +6,7 @@ jobs:
    strategy:
      matrix:
        operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
    runs-on: ${{ matrix.operating-system }}
    steps:
      - name: Checkout
@@ -17,12 +17,13 @@ jobs:
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php-versions }}
-          extensions: mbstring, intl, curl, dom
+          extensions: mbstring, intl, curl, dom, sqlite3, pdo_sqlite
          coverage: xdebug

      - name: Get composer cache directory
        id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"

      - name: Cache composer dependencies
        uses: actions/cache@v5
@@ -0,0 +1,59 @@
+# GitHub Action for Drupal 11 composer-managed projects
+# Requires drupal/core-dev in require-dev for vendor/bin/phpunit
+name: Testing Drupal
+on: [push, pull_request]
+jobs:
+  drupal:
+    name: Drupal (PHP ${{ matrix.php-versions }})
+    runs-on: ubuntu-latest
+    env:
+      SIMPLETEST_BASE_URL: http://127.0.0.1:8080
+      SIMPLETEST_DB: sqlite://localhost/sites/default/files/.ht.sqlite
+      BROWSERTEST_OUTPUT_DIRECTORY: /tmp/browser_output
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: ['8.3', '8.4', '8.5']
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: apcu, ctype, curl, dom, gd, iconv, intl, mbstring, pdo_sqlite, simplexml, xml, zip
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install Composer dependencies
+        run: |
+          if [ "${{ matrix.php-versions }}" = "8.3" ]; then
+            composer require --dev drupal/core-dev:11.2.10 doctrine/instantiator:^2.0.0 --no-interaction --no-update
+            composer update drupal/core-dev doctrine/instantiator --with-all-dependencies --no-interaction --no-progress --prefer-dist --optimize-autoloader
+          else
+            composer install --no-interaction --no-progress --prefer-dist --optimize-autoloader
+          fi
+
+      - name: Prepare Drupal test directories
+        run: mkdir -p web/sites/default/files "$BROWSERTEST_OUTPUT_DIRECTORY"
+
+      - name: Start Drupal web server
+        run: php -S 127.0.0.1:8080 -t web >/tmp/php-server.log 2>&1 &
+
+      - name: Test with phpunit
+        # Adjust the test path to match your custom modules or themes.
+        run: vendor/bin/phpunit -c web/core web/modules/custom
@@ -1,12 +1,12 @@
 # GitHub Action for Laminas framework MVC projects
-name: Testing Zend Framework
+name: Testing Laminas MVC
 on: [push, pull_request]
 jobs:
  build:
    strategy:
      matrix:
        operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.1', '8.2', '8.3']
    runs-on: ${{ matrix.operating-system }}
    steps:
      - name: Checkout
@@ -21,6 +21,7 @@ jobs:

      - name: Get composer cache directory
        id: composer-cache
+        shell: bash
        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache composer dependencies
@@ -6,11 +6,13 @@ jobs:
    name: Laravel (PHP ${{ matrix.php-versions }})
    runs-on: ubuntu-latest
    env:
+      DB_CONNECTION: mysql
+      DB_HOST: 127.0.0.1
      DB_DATABASE: laravel
      DB_USERNAME: root
      DB_PASSWORD: password
-      BROADCAST_DRIVER: log
-      CACHE_DRIVER: redis
+      BROADCAST_CONNECTION: log
+      CACHE_STORE: redis
      QUEUE_CONNECTION: redis
      SESSION_DRIVER: redis

@@ -34,7 +36,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -11,7 +11,7 @@ jobs:
      QUEUE_CONNECTION: redis
      SESSION_DRIVER: redis
      DB_CONNECTION: pgsql
-      DB_HOST: localhost
+      DB_HOST: 127.0.0.1
      DB_PASSWORD: postgres
      DB_USERNAME: postgres
      DB_DATABASE: postgres
@@ -36,7 +36,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -81,11 +81,11 @@ jobs:
      - name: Run Migration
        run: php artisan migrate -v
        env:
-          DB_PORT: ${{ job.services.postgres.ports[5432] }}
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
          REDIS_PORT: ${{ job.services.redis.ports['6379'] }}

      - name: Test with phpunit
        run: vendor/bin/phpunit --coverage-text
        env:
-          DB_PORT: ${{ job.services.postgres.ports[5432] }}
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
          REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
@@ -9,7 +9,7 @@ jobs:
      fail-fast: false
      matrix:
        operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -24,6 +24,7 @@ jobs:

      - name: Get composer cache directory
        id: composer-cache
+        shell: bash
        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache composer dependencies
@@ -34,7 +34,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -83,7 +83,7 @@ jobs:
          REDIS_PORT: ${{ job.services.redis.ports['6379'] }}

      - name: Test with phpunit
-        run: vendor/bin/phpunit --coverage-text
+        run: vendor/bin/phpunit --coverage-text --coverage-filter app
        env:
          DB_PORT: ${{ job.services.mysql.ports['3306'] }}
          REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
@@ -11,7 +11,7 @@ jobs:
      QUEUE_CONNECTION: redis
      SESSION_DRIVER: redis
      DB_CONNECTION: pgsql
-      DB_HOST: localhost
+      DB_HOST: 127.0.0.1
      DB_PASSWORD: postgres
      DB_USERNAME: postgres
      DB_DATABASE: postgres
@@ -36,7 +36,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -47,7 +47,7 @@ jobs:
        with:
          php-version: ${{ matrix.php-versions }}
          extensions: mbstring, dom, fileinfo, pgsql
-          coverage: xdebug
+          coverage: none

      # Local PostgreSQL service in GitHub hosted environments is disabled by default.
      # If you are using it instead of service containers, make sure you start it.
@@ -81,11 +81,11 @@ jobs:
      - name: Run Migration
        run: php artisan migrate -v
        env:
-          DB_PORT: ${{ job.services.postgres.ports[5432] }}
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
          REDIS_PORT: ${{ job.services.redis.ports['6379'] }}

      - name: Test with phpunit
-        run: vendor/bin/phpunit --coverage-text
+        run: vendor/bin/phpunit
        env:
-          DB_PORT: ${{ job.services.postgres.ports[5432] }}
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
          REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
@@ -9,7 +9,7 @@ jobs:
      fail-fast: false
      matrix:
        operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -24,6 +24,7 @@ jobs:

      - name: Get composer cache directory
        id: composer-cache
+        shell: bash
        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache composer dependencies
@@ -42,4 +43,4 @@ jobs:
        run: php -r "file_exists('.env') || copy('.env.example', '.env');"

      - name: Test with phpunit
-        run: vendor/bin/phpunit --coverage-text
+        run: vendor/bin/phpunit --coverage-text --coverage-filter app
@@ -11,7 +11,7 @@ jobs:
    env:
      DB_ADAPTER: mysql
      DB_HOST: 127.0.0.1
-      DB_NAME: phalcon
+      DB_NAME: vokuro
      DB_USERNAME: root
      DB_PASSWORD: password
      CODECEPTION_URL: 127.0.0.1
@@ -20,11 +20,11 @@ jobs:
    # Docs: https://docs.github.com/en/actions/using-containerized-services
    services:
      mysql:
-        image: mysql:latest
+        image: mysql:5.7
        env:
          MYSQL_ALLOW_EMPTY_PASSWORD: false
          MYSQL_ROOT_PASSWORD: password
-          MYSQL_DATABASE: phalcon
+          MYSQL_DATABASE: vokuro
        ports:
          - 3306/tcp
        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
@@ -32,8 +32,6 @@ jobs:
      fail-fast: false
      matrix:
        php-versions: ['7.2', '7.3', '7.4']
-        # For phalcon 3.x, use
-        # php-versions: ['7.0', '7.1', '7.2', '7.3']
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -43,7 +41,7 @@ jobs:
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php-versions }}
-          # Use phalcon3 for the phalcon 3.x.
+          # Use phalcon4 for the latest compatible Vokuro sample release.
          extensions: mbstring, dom, zip, phalcon4, mysql
          coverage: xdebug

@@ -73,7 +71,6 @@ jobs:

      - name: Run Migration
        run: |
-          if [ ! -e phinx.yml ]; then vendor/bin/phinx init; fi
          vendor/bin/phinx migrate
          vendor/bin/phinx seed:run
        env:
@@ -11,21 +11,18 @@ jobs:
    env:
      DB_ADAPTER: pgsql
      DB_HOST: 127.0.0.1
-      DB_NAME: postgres
+      DB_NAME: vokuro
      DB_USERNAME: postgres
      DB_PASSWORD: postgres
      CODECEPTION_URL: 127.0.0.1
      CODECEPTION_PORT: 8888
-      DB_CONNECTION: pgsql
-
-    # Docs: https://docs.github.com/en/actions/using-containerized-services
    services:
      postgres:
        image: postgres:latest
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: postgres
+          POSTGRES_DB: vokuro
        ports:
          - 5432/tcp
        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 3
@@ -33,8 +30,6 @@ jobs:
      fail-fast: false
      matrix:
        php-versions: ['7.2', '7.3', '7.4']
-        # For phalcon 3.x, use
-        # php-versions: ['7.0', '7.1', '7.2', '7.3']
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -44,40 +39,39 @@ jobs:
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php-versions }}
-          # Use phalcon3 for the phalcon 3.x
          extensions: mbstring, dom, zip, phalcon4, pgsql
          coverage: xdebug

-      # Local PostgreSQL service in GitHub hosted environments is disabled by default.
-      # If you are using it instead of service containers, make sure you start it.
-      # - name: Start postgresql service
-      #   run: sudo systemctl start postgresql.service
-
      - name: Get composer cache directory
        id: composer-cache
        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
      - name: Cache composer dependencies
        uses: actions/cache@v5
        with:
          path: ${{ steps.composer-cache.outputs.dir }}
-          # Use composer.json for key, if composer.lock is not committed.
-          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
          restore-keys: ${{ runner.os }}-composer-
+
      - name: Install Composer dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: composer install --no-progress --prefer-dist --optimize-autoloader --no-security-blocking
+
      - name: Prepare the application
-        run: php -r "file_exists('.env') || copy('.env.example', '.env');"
+        run: |
+          php -r "file_exists('.env') || copy('.env.example', '.env');"
+          mkdir -p var/cache/acl var/cache/metaData var/cache/session var/cache/volt var/logs
+          chmod -R 777 var/cache var/logs
+
      - name: Run Migration
        run: |
-          if [ ! -e phinx.yml ]; then vendor/bin/phinx init; fi
          vendor/bin/phinx migrate
          vendor/bin/phinx seed:run
        env:
          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
+
      - name: Run Tests
        run: |
-          (cd public && nohup php -S $CODECEPTION_URL:$CODECEPTION_PORT > phalcon.log 2>&1 &)
+          (cd public && nohup php -S $CODECEPTION_URL:$CODECEPTION_PORT > vokuro.log 2>&1 &)
          vendor/bin/codecept build
          vendor/bin/codecept run
        env:
@@ -8,8 +8,8 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        php-versions: ['7.4', '8.0', '8.1']
-        node-versions: ['16']
+        php-versions: ['8.3', '8.4', '8.5']
+        node-versions: ['20']
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -53,17 +53,10 @@ jobs:
          restore-keys: ${{ runner.os }}-composer-

      - name: Install yarn dependencies
-        run: yarn -V
+        run: yarn install --frozen-lockfile --non-interactive

      - name: Install Composer dependencies
        run: composer install --no-progress --prefer-dist --optimize-autoloader

-      - name: Yarn test and build
-        run: |
-          yarn run test
-          yarn run build
-          yarn run rmdist
-          yarn run "build:production"
-
-      - name: PHP test
-        run: composer test
+      - name: Yarn build
+        run: yarn build
@@ -6,7 +6,7 @@ jobs:
    strategy:
      matrix:
        operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
    runs-on: ${{ matrix.operating-system }}
    steps:
      - name: Checkout
@@ -22,6 +22,7 @@ jobs:

      - name: Get composer cache directory
        id: composer-cache
+        shell: bash
        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache composer dependencies
@@ -5,11 +5,13 @@ jobs:
  symfony:
    name: Symfony (PHP ${{ matrix.php-versions }})
    runs-on: ubuntu-latest
+    env:
+      APP_ENV: test

    # Docs: https://docs.github.com/en/actions/using-containerized-services
    services:
      mysql:
-        image: mysql:latest
+        image: mysql:8.4
        env:
          MYSQL_ALLOW_EMPTY_PASSWORD: false
          MYSQL_ROOT_PASSWORD: symfony
@@ -20,7 +22,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5', '8.6']
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -30,7 +32,6 @@ jobs:
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php-versions }}
-          tools: phpunit-bridge
          extensions: mbstring, xml, ctype, iconv, intl, pdo_sqlite, mysql
          coverage: xdebug

@@ -53,18 +54,17 @@ jobs:
          restore-keys: ${{ runner.os }}-composer-

      - name: Install Composer dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: composer install --no-interaction --no-progress --prefer-dist --optimize-autoloader

-      - name: Run Migration
+      - name: Prepare database
        run: |
-          composer require --dev symfony/orm-pack
-          php bin/console doctrine:schema:update --force || echo "No migrations found or schema update failed"
-          php bin/console doctrine:migrations:migrate || echo "No migrations found or migration failed"
+          php bin/console doctrine:database:create --if-not-exists --no-interaction
+          php bin/console doctrine:schema:create --no-interaction
+          php bin/console doctrine:fixtures:load --no-interaction
        env:
-          DATABASE_URL: mysql://root:symfony@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/symfony
-
-      - name: Install PHPUnit
-        run: simple-phpunit install
+          DATABASE_URL: mysql://root:symfony@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/symfony?serverVersion=8.4&charset=utf8mb4

      - name: Run tests
-        run: simple-phpunit --coverage-text
+        run: php bin/phpunit --coverage-text
+        env:
+          DATABASE_URL: mysql://root:symfony@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/symfony?serverVersion=8.4&charset=utf8mb4
@@ -5,11 +5,13 @@ jobs:
  symfony:
    name: Symfony (PHP ${{ matrix.php-versions }})
    runs-on: ubuntu-latest
+    env:
+      APP_ENV: test

    # Docs: https://docs.github.com/en/actions/using-containerized-services
    services:
      postgres:
-        image: postgres:latest
+        image: postgres:16
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
@@ -20,7 +22,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5', '8.6']
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -30,8 +32,7 @@ jobs:
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php-versions }}
-          tools: phpunit-bridge
-          extensions: mbstring, xml, ctype, iconv, intl, pdo_sqlite, pgsql
+          extensions: mbstring, xml, ctype, iconv, intl, pdo_pgsql, pgsql
          coverage: xdebug

      # Local PostgreSQL service in GitHub hosted environments is disabled by default.
@@ -55,16 +56,15 @@ jobs:
      - name: Install Composer dependencies
        run: composer install --no-progress --prefer-dist --optimize-autoloader

-      - name: Run Migration
+      - name: Prepare database
        run: |
-          composer require --dev symfony/orm-pack
-          php bin/console doctrine:schema:update --force || echo "No migrations found or schema update failed"
-          php bin/console doctrine:migrations:migrate || echo "No migrations found or migration failed"
+          php bin/console doctrine:database:create --if-not-exists --no-interaction
+          php bin/console doctrine:schema:create --no-interaction
+          php bin/console doctrine:fixtures:load --no-interaction
        env:
-          DATABASE_URL: postgres://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports[5432] }}/postgres?charset=UTF-8
-
-      - name: Install PHPUnit
-        run: simple-phpunit install
+          DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports[5432] }}/postgres?serverVersion=16.0.0&charset=utf8

      - name: Run tests
-        run: simple-phpunit --coverage-text
+        run: php bin/phpunit --coverage-text
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports[5432] }}/postgres?serverVersion=16.0.0&charset=utf8
@@ -9,7 +9,7 @@ jobs:
      fail-fast: false
      matrix:
        operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5', '8.6']
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -19,12 +19,12 @@ jobs:
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php-versions }}
-          tools: phpunit-bridge
-          extensions: mbstring, xml, ctype, iconv, intl, pdo_sqlite
+          extensions: mbstring, xml, ctype, iconv, intl, pdo_sqlite, zip
          coverage: xdebug

      - name: Get composer cache directory
        id: composer-cache
+        shell: bash
        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache composer dependencies
@@ -39,8 +39,5 @@ jobs:
      - name: Install Composer dependencies
        run: composer install --no-progress --prefer-dist --optimize-autoloader

-      - name: Install PHPUnit
-        run: simple-phpunit install
-
      - name: Run tests
-        run: simple-phpunit --coverage-text
+        run: ./bin/phpunit --coverage-text
@@ -0,0 +1,68 @@
+# GitHub Action for WordPress plugins
+# Tested with files scaffolded by wp scaffold plugin-tests --ci=github
+# Requires phpunit/phpunit and yoast/phpunit-polyfills in require-dev for vendor/bin/phpunit
+name: Testing WordPress
+on: [push, pull_request]
+jobs:
+  wordpress:
+    name: WordPress (PHP ${{ matrix.php-versions }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: ['8.3', '8.4', '8.5']
+
+    # Docs: https://docs.github.com/en/actions/using-containerized-services
+    services:
+      mysql:
+        image: mysql:latest
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: false
+          MYSQL_ROOT_PASSWORD: root
+          MYSQL_DATABASE: wordpress_test
+        ports:
+          - 3306/tcp
+        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: mbstring, xml, zip, intl, mysql
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y subversion default-mysql-client
+
+      - name: Install Composer dependencies
+        run: |
+          if [ "${{ matrix.php-versions }}" = "8.3" ]; then
+            composer require --dev doctrine/instantiator:^2.0.0 --no-interaction --no-update
+            composer update doctrine/instantiator --with-all-dependencies --no-interaction --no-progress --prefer-dist --optimize-autoloader
+          else
+            composer install --no-interaction --no-progress --prefer-dist --optimize-autoloader
+          fi
+
+      - name: Install WordPress test environment
+        run: bash bin/install-wp-tests.sh wordpress_test root root 127.0.0.1:${{ job.services.mysql.ports['3306'] }} latest true
+
+      - name: Test with phpunit
+        run: vendor/bin/phpunit
@@ -1,86 +0,0 @@
-# GitHub Action for Yii Framework with MySQL
-name: Testing Yii2 with MySQL
-on: [push, pull_request]
-jobs:
-  yii:
-    name: Yii2 (PHP ${{ matrix.php-versions }})
-    runs-on: ubuntu-latest
-    env:
-      DB_USERNAME: root
-      DB_PASSWORD: yii
-      TEST_DB_USERNAME: root
-      TEST_DB_PASSWORD: yii
-      DB_CHARSET: utf8
-
-    # Docs: https://docs.github.com/en/actions/using-containerized-services
-    services:
-      mysql:
-        image: mysql:latest
-        env:
-          MYSQL_ALLOW_EMPTY_PASSWORD: false
-          MYSQL_ROOT_PASSWORD: yii
-          MYSQL_DATABASE: yii
-        ports:
-          - 3306/tcp
-        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
-    strategy:
-      fail-fast: false
-      matrix:
-        php-versions: ['7.4', '8.0']
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set Node.js 10.x
-        uses: actions/setup-node@v5
-        with:
-          node-version: 10.x
-
-      # Docs: https://github.com/shivammathur/setup-php
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php-versions }}
-          extensions: mbstring, intl, gd, imagick, zip, dom, mysql
-          coverage: xdebug
-
-      # Local MySQL service in GitHub hosted environments is disabled by default.
-      # If you are using it instead of service containers, make sure you start it.
-      # - name: Start mysql service
-      #   run: sudo systemctl start mysql.service
-
-      - name: Get composer cache directory
-        id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
-
-      - name: Cache composer dependencies
-        uses: actions/cache@v5
-        with:
-          path: ${{ steps.composer-cache.outputs.dir }}
-          # Use composer.json for key, if composer.lock is not committed.
-          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
-          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
-          restore-keys: ${{ runner.os }}-composer-
-
-      - name: Install Composer dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
-
-      - name: Prepare the application
-        run: |
-          php -r "file_exists('.env') || copy('.env.dist', '.env');"
-          php console/yii app/setup
-          npm install --development
-          npm run build
-        env:
-          DB_DSN: mysql:host=127.0.0.1;port=${{ job.services.mysql.ports['3306'] }};dbname=yii
-          TEST_DB_DSN: mysql:host=127.0.0.1;port=${{ job.services.mysql.ports['3306'] }};dbname=yii
-
-      - name: Run Tests
-        run: |
-          vendor/bin/codecept build
-          php tests/bin/yii app/setup --interactive=0
-          nohup php -S localhost:8080 > yii.log 2>&1 &
-          vendor/bin/codecept run
-        env:
-          DB_DSN: mysql:host=127.0.0.1;port=${{ job.services.mysql.ports['3306'] }};dbname=yii
-          TEST_DB_DSN: mysql:host=127.0.0.1;port=${{ job.services.mysql.ports['3306'] }};dbname=yii
@@ -1,86 +0,0 @@
-# GitHub Action for Yii Framework with PostgreSQL
-name: Testing Yii2 with PostgreSQL
-on: [push, pull_request]
-jobs:
-  yii:
-    name: Yii2 (PHP ${{ matrix.php-versions }})
-    runs-on: ubuntu-latest
-    env:
-      DB_USERNAME: postgres
-      DB_PASSWORD: postgres
-      TEST_DB_USERNAME: postgres
-      TEST_DB_PASSWORD: postgres
-      DB_CHARSET: utf8
-
-    # Docs: https://docs.github.com/en/actions/using-containerized-services
-    services:
-      postgres:
-        image: postgres:latest
-        env:
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: postgres
-        ports:
-          - 5432/tcp
-        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 3
-    strategy:
-      fail-fast: false
-      matrix:
-        php-versions: ['7.4', '8.0']
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set Node.js 10.x
-        uses: actions/setup-node@v5
-        with:
-          node-version: 10.x
-
-      # Docs: https://github.com/shivammathur/setup-php
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php-versions }}
-          extensions: mbstring, intl, gd, imagick, zip, dom, pgsql
-          coverage: xdebug
-
-      # Local PostgreSQL service in GitHub hosted environments is disabled by default.
-      # If you are using it instead of service containers, make sure you start it.
-      # - name: Start postgresql service
-      #   run: sudo systemctl start postgresql.service
-
-      - name: Get composer cache directory
-        id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
-
-      - name: Cache composer dependencies
-        uses: actions/cache@v5
-        with:
-          path: ${{ steps.composer-cache.outputs.dir }}
-          # Use composer.json for key, if composer.lock is not committed.
-          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
-          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
-          restore-keys: ${{ runner.os }}-composer-
-
-      - name: Install Composer dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
-
-      - name: Prepare the application
-        run: |
-          php -r "file_exists('.env') || copy('.env.dist', '.env');"
-          php console/yii app/setup
-          npm install --development
-          npm run build
-        env:
-          DB_DSN: pgsql:host=127.0.0.1;port=${{ job.services.postgres.ports['5432'] }};dbname=postgres
-          TEST_DB_DSN: pgsql:host=127.0.0.1;port=${{ job.services.postgres.ports['5432'] }};dbname=postgres
-
-      - name: Run Tests
-        run: |
-          vendor/bin/codecept build
-          php tests/bin/yii app/setup --interactive=0
-          nohup php -S localhost:8080 > yii.log 2>&1 &
-          vendor/bin/codecept run
-        env:
-          DB_DSN: pgsql:host=127.0.0.1;port=${{ job.services.postgres.ports['5432'] }};dbname=postgres
-          TEST_DB_DSN: pgsql:host=127.0.0.1;port=${{ job.services.postgres.ports['5432'] }};dbname=postgres
@@ -0,0 +1,78 @@
+# GitHub Action for Yii3 web application with MySQL
+# Tested with https://github.com/yiisoft/app
+name: Testing Yii3 with MySQL
+on: [push, pull_request]
+jobs:
+  yii:
+    name: Yii3 (PHP ${{ matrix.php-versions }})
+    runs-on: ubuntu-latest
+    env:
+      APP_C3: true
+      APP_ENV: test
+      APP_DEBUG: false
+
+    # Docs: https://docs.github.com/en/actions/using-containerized-services
+    services:
+      mysql:
+        image: mysql:8.4
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: false
+          MYSQL_ROOT_PASSWORD: password
+          MYSQL_DATABASE: app
+        ports:
+          - 3306/tcp
+        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: ['8.4', '8.5']
+        # The latest yiisoft/app release resolves Symfony 8.0 packages that require PHP 8.4+.
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: fileinfo, intl, pdo_mysql
+          ini-values: date.timezone='UTC', register_argc_argv=On
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --prefer-dist --optimize-autoloader
+
+      - name: Run migrations
+        run: php yii migrate:up --no-interaction
+        env:
+          DB_HOST: 127.0.0.1
+          DB_PORT: ${{ job.services.mysql.ports['3306'] }}
+          DB_NAME: app
+          DB_USERNAME: root
+          DB_PASSWORD: password
+
+      - name: Run codeception build
+        run: vendor/bin/codecept build
+
+      - name: Run tests with Codeception
+        run: vendor/bin/codecept run
+        env:
+          DB_HOST: 127.0.0.1
+          DB_PORT: ${{ job.services.mysql.ports['3306'] }}
+          DB_NAME: app
+          DB_USERNAME: root
+          DB_PASSWORD: password
@@ -0,0 +1,78 @@
+# GitHub Action for Yii3 web application with PostgreSQL
+# Tested with https://github.com/yiisoft/app
+name: Testing Yii3 with PostgreSQL
+on: [push, pull_request]
+jobs:
+  yii:
+    name: Yii3 (PHP ${{ matrix.php-versions }})
+    runs-on: ubuntu-latest
+    env:
+      APP_C3: true
+      APP_ENV: test
+      APP_DEBUG: false
+
+    # Docs: https://docs.github.com/en/actions/using-containerized-services
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: app
+        ports:
+          - 5432/tcp
+        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 3
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: ['8.4', '8.5']
+        # The latest yiisoft/app release resolves Symfony 8.0 packages that require PHP 8.4+.
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: fileinfo, intl, pdo_pgsql
+          ini-values: date.timezone='UTC', register_argc_argv=On
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --prefer-dist --optimize-autoloader
+
+      - name: Run migrations
+        run: php yii migrate:up --no-interaction
+        env:
+          DB_HOST: 127.0.0.1
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
+          DB_NAME: app
+          DB_USERNAME: postgres
+          DB_PASSWORD: postgres
+
+      - name: Run codeception build
+        run: vendor/bin/codecept build
+
+      - name: Run tests with Codeception
+        run: vendor/bin/codecept run
+        env:
+          DB_HOST: 127.0.0.1
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
+          DB_NAME: app
+          DB_USERNAME: postgres
+          DB_PASSWORD: postgres
@@ -0,0 +1,53 @@
+# GitHub Action for Yii3 web application
+# Tested with https://github.com/yiisoft/app
+name: Testing Yii3
+on: [push, pull_request]
+jobs:
+  yii:
+    name: Yii3 (PHP ${{ matrix.php-versions }} on ${{ matrix.operating-system }})
+    runs-on: ${{ matrix.operating-system }}
+    env:
+      APP_C3: true
+      APP_ENV: test
+      APP_DEBUG: false
+    strategy:
+      fail-fast: false
+      matrix:
+        operating-system: [ubuntu-latest, windows-latest]
+        php-versions: ['8.4', '8.5']
+        # The latest yiisoft/app release resolves Symfony 8.0 packages that require PHP 8.4+.
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: fileinfo, intl
+          ini-values: date.timezone='UTC', register_argc_argv=On
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --prefer-dist --optimize-autoloader
+
+      - name: Run codeception build
+        run: vendor/bin/codecept build
+
+      - name: Run tests with Codeception
+        run: vendor/bin/codecept run
@@ -1,6 +1,6 @@
 {
  "name": "setup-php",
-  "version": "2.37.0",
+  "version": "2.37.2",
  "private": false,
  "description": "Setup PHP for use with GitHub Actions",
  "main": "lib/install.js",
@@ -38,29 +38,31 @@
    "compare-versions": "^6.1.1"
  },
  "devDependencies": {
-    "@eslint/compat": "^2.0.3",
+    "@eslint/compat": "^2.1.0",
    "@eslint/js": "^10.0.1",
    "@types/jest": "^30.0.0",
-    "@types/node": "^25.5.0",
-    "@typescript-eslint/eslint-plugin": "^8.57.0",
-    "@typescript-eslint/parser": "^8.57.0",
+    "@types/node": "^25.9.2",
+    "@typescript-eslint/eslint-plugin": "^8.60.1",
+    "@typescript-eslint/parser": "^8.60.1",
    "@vercel/ncc": "^0.38.4",
-    "eslint": "^10.0.3",
+    "eslint": "^10.4.1",
    "eslint-config-prettier": "^10.1.8",
-    "eslint-import-resolver-typescript": "^4.4.4",
+    "eslint-import-resolver-typescript": "^4.4.5",
    "eslint-plugin-import-x": "^4.16.2",
-    "eslint-plugin-jest": "^29.15.0",
-    "eslint-plugin-prettier": "^5.5.5",
-    "globals": "^17.4.0",
-    "jest": "^30.3.0",
-    "jest-circus": "^30.3.0",
-    "nock": "^14.0.11",
-    "prettier": "^3.8.1",
+    "eslint-plugin-jest": "^29.15.2",
+    "eslint-plugin-prettier": "^5.5.6",
+    "globals": "^17.6.0",
+    "jest": "^30.4.2",
+    "jest-circus": "^30.4.2",
+    "nock": "^14.0.15",
+    "prettier": "^3.8.3",
    "simple-git-hooks": "^2.13.1",
-    "ts-jest": "^29.4.6",
+    "ts-jest": "^29.4.11",
    "typescript": "^5.9.3"
  },
  "overrides": {
+    "@babel/core": "^7.29.7",
+    "js-yaml": "^4.2.0",
    "test-exclude": "^7.0.1",
    "glob": "^13.0.6",
    "minimatch": "^10.2.1"
@@ -16,7 +16,7 @@ export async function addINIValuesUnix(
  });
  return (
    'echo "' +
-    ini_values.join('\n') +
+    ini_values.map(v => utils.escapeForShell(v, 'linux')).join('\n') +
    '" | sudo tee -a "${pecl_file:-${ini_file[@]}}" >/dev/null 2>&1' +
    script
  );
@@ -37,7 +37,10 @@ export async function addINIValuesWindows(
      (await utils.addLog('$tick', line, 'Added to php.ini', 'win32')) + '\n';
  });
  return (
-    'Add-Content "$php_dir\\php.ini" "' + ini_values.join('\n') + '"' + script
+    'Add-Content "$php_dir\\php.ini" "' +
+    ini_values.map(v => utils.escapeForShell(v, 'win32')).join('\n') +
+    '"' +
+    script
  );
 }

@@ -0,0 +1,3 @@
+1.0.0-0 1.10.28
+2.0.0-0 2.2.28
+2.3.0-0 2.9.8
@@ -0,0 +1 @@
+Composer %s has a known GitHub token parsing bug that exposes GitHub tokens in the error output. So, GitHub authentication has not been configured for this Composer version. Please update to the latest version of Composer. See: https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2
@@ -21,4 +21,7 @@
 23.10,mantic
 24.04,noble
 24.10,oracular
-25.10,plucky
+25.05,plucky
+25.10,questing
+26.04,resolute
+26.10,stonking
@@ -18,7 +18,10 @@ export async function getScript(os: string): Promise<string> {
  const filename = os + (await utils.scriptExtension(os));
  const script_path = path.join(__dirname, '../src/scripts', filename);
  const run_path = script_path.replace(os, 'run');
-  const extension_csv: string = await utils.getInput('extensions', false);
+  const extension_csv: string = utils.sanitizeShellInput(
+    await utils.getInput('extensions', false),
+    true
+  );
  const ini_values_csv: string = await utils.getInput('ini-values', false);
  const coverage_driver: string = await utils.getInput('coverage', false);
  const tools_csv: string = await utils.getInput('tools', false);
@@ -28,7 +31,7 @@ export async function getScript(os: string): Promise<string> {
  const ini_file: string = await utils.parseIniFile(
    await utils.getInput('ini-file', false)
  );
-  let script = await utils.joins('.', script_path, version, ini_file);
+  let script = await utils.joins('.', script_path, `'${version}'`, ini_file);
  if (extension_csv) {
    script += await extensions.addExtension(extension_csv, version, os);
  }
@@ -1,9 +1,9 @@
 # Helper function to add gearman extension.
 add_gearman_helper() {
-  install_packages libgearman-dev
  enable_extension gearman extension
  if ! check_extension gearman; then
    status="Installed and enabled"
+    install_packages libgearman-dev
    if [[ "${version:?}" =~ 5.[3-6] ]]; then
      pecl_install gearman-1.1.2
    elif [[ "${version:?}" =~ 7.0 ]]; then
@@ -19,26 +19,6 @@ Function Get-PhalconReleaseAssetUrl() {
        $match = (Get-File -Url "$github/$releases/expanded_assets/v$Semver").Links.href | Select-String -Pattern "(phalcon_${arch}_.*_php${version}_${extension_version}.*[0-9]${nts}.zip)"
      } catch { }
    }
-  } else {
-    $nts = if (!$installed.ThreadSafe) { "-nts" } else { "-ts" }
-    try {
-      $match = (Invoke-RestMethod -Uri "$domain/$releases/tags/v$Semver").assets | Select-String -Pattern "browser_download_url=.*(php_phalcon-php${version}${nts}-windows.*-x64.zip)"
-    } catch { }
-    if($null -eq $match) {
-      try {
-        $match = (Get-File -Url "$github/$releases/expanded_assets/v$Semver").Links.href | Select-String -Pattern "(php_phalcon-php${version}${nts}-windows.*-x64.zip)"
-      } catch { }
-    }
-    if($null -eq $match) {
-      try {
-        $match = (Invoke-RestMethod -Uri "$domain/$releases/tags/v$Semver").assets | Select-String -Pattern "browser_download_url=.*(phalcon-php${version}${nts}-windows.*-x64.zip)"
-      } catch { }
-    }
-    if($null -eq $match) {
-      try {
-        $match = (Get-File -Url "$github/$releases/expanded_assets/v$Semver").Links.href | Select-String -Pattern "(phalcon-php${version}${nts}-windows.*-x64.zip)"
-      } catch { }
-    }
  }
  if($NULL -ne $match) {
    return "$github/$releases/download/v$Semver/$($match.Matches[0].Groups[1].Value)"
@@ -73,6 +53,8 @@ Function Get-PhalconSemver() {
    return '4.1.0'
  } elseif (($extension_version -eq '5') -and ($version -eq '7.4')) {
    return '5.4.0'
+  } elseif (($extension_version -eq '5') -and ($version -eq '8.0')) {
+    return '5.10.0'
  }
  return Get-PeclPackageVersion phalcon $extension_version stable stable | Select-Object -First 1
 }
@@ -80,7 +62,7 @@ Function Get-PhalconSemver() {
 # Function to install phalcon
 Function Add-PhalconHelper() {
  $semver = Get-PhalconSemver
-  if ($extension_version -eq '3') {
+  if ($extension_version -match '[3-4]') {
    Add-PhalconFromGitHub $semver
  } else {
    Add-Extension -Extension phalcon -Stability stable -Extension_version $semver
@@ -3,6 +3,8 @@ get_phalcon_version() {
  if [ "$extension" = "phalcon5" ]; then
    if [ "${version:?}" = "7.4" ]; then
      echo '5.4.0'
+    elif [ "${version:?}" = "8.0" ]; then
+      echo '5.10.0'
    else
      get_pecl_version phalcon stable 5
    fi
@@ -3,6 +3,7 @@ $composer_home = "$env:APPDATA\Composer"
 $composer_bin = "$composer_home\vendor\bin"
 $composer_json = "$composer_home\composer.json"
 $composer_lock = "$composer_home\composer.lock"
+$skip_composer_github_auth = $false

 # Function to configure composer.
 Function Edit-ComposerConfig() {
@@ -23,6 +24,7 @@ Function Edit-ComposerConfig() {
  if (-not(Test-Path $composer_json)) {
    Set-Content -Path $composer_json -Value "{}"
  }
+  Get-ToolVersion "composer" $null | Out-Null
  Set-ComposerEnv
  Add-Path $composer_bin
  Set-ComposerAuth
@@ -74,8 +76,18 @@ function Test-GitHubPublicAccess {
  }
 }

+Function Write-ComposerGhAuthNoOpWarning() {
+  $message = (Get-Content (Join-Path $src 'configs\composer-gh-auth-warn') -Raw).Trim().Replace('%s', $composer_version)
+  if($env:fail_fast -eq 'true') {
+    Add-Log "$cross" "composer" $message
+  } else {
+    Write-Output "::warning::$message"
+  }
+}
+
 # Function to setup authentication in composer.
 Function Set-ComposerAuth() {
+  $token = if ($env:COMPOSER_TOKEN) { $env:COMPOSER_TOKEN } else { $env:GITHUB_TOKEN }
  if(Test-Path env:COMPOSER_AUTH_JSON) {
    if(Test-Json -JSON $env:COMPOSER_AUTH_JSON) {
      Set-Content -Path $composer_home\auth.json -Value $env:COMPOSER_AUTH_JSON
@@ -83,13 +95,18 @@ Function Set-ComposerAuth() {
      Add-Log "$cross" "composer" "Could not parse COMPOSER_AUTH_JSON as valid JSON"
    }
  }
+  if($skip_composer_github_auth) {
+    Write-ComposerGhAuthNoOpWarning
+  }
  $composer_auth = @()
  if(Test-Path env:PACKAGIST_TOKEN) {
    $composer_auth += '"http-basic": {"repo.packagist.com": { "username": "token", "password": "' + $env:PACKAGIST_TOKEN + '"}}'
  }
  $write_token = $true
-  $token = if ($env:COMPOSER_TOKEN) { $env:COMPOSER_TOKEN } else { $env:GITHUB_TOKEN }
  if ($token) {
+    if ($skip_composer_github_auth) {
+      $write_token = $false
+    }
    if ($env:GITHUB_SERVER_URL -ne "https://github.com" -and -not(Test-GitHubPublicAccess $token)) {
      $write_token = $false
    }
@@ -210,8 +227,13 @@ Function Add-Tool() {
    [ValidateNotNull()]
    $tool,
    [Parameter(Position = 2, Mandatory = $false)]
-    $ver_param
+    $ver_param,
+    [Parameter(Position = 3, Mandatory = $false)]
+    $skip_composer_github_auth
  )
+  if($tool -eq "composer") {
+    $script:skip_composer_github_auth = $skip_composer_github_auth -eq 'true'
+  }
  $urls = $urls -split ','
  $tool_path = "$bin_dir\$tool"
  $is_exe = ((($urls[0] | Split-Path -Extension).ToLowerInvariant()) -eq '.exe')
@@ -3,6 +3,7 @@ export composer_home="$HOME/.composer"
 export composer_bin="$composer_home/vendor/bin"
 export composer_json="$composer_home/composer.json"
 export composer_lock="$composer_home/composer.lock"
+skip_composer_github_auth=false

 # Function to extract tool version.
 get_tool_version() {
@@ -41,6 +42,7 @@ configure_composer() {
    echo '{}' | tee "$composer_json" >/dev/null
    chmod 644 "$composer_json"
  fi
+  get_tool_version composer >/dev/null
  set_composer_env
  add_path "$composer_bin"
  set_composer_auth
@@ -70,22 +72,39 @@ can_access_public_github() {
  curl --fail -s -H "Authorization: token $1" 'https://api.github.com/' >/dev/null 2>&1
 }

+composer_gh_auth_no_op() {
+  local message
+  message="$(<"${src:?}"/configs/composer-gh-auth-warn)"
+  message="${message//%s/$composer_version}"
+  if [ "${fail_fast:-false}" = "true" ]; then
+    add_log "${cross:?}" "composer" "$message"
+  else
+    echo "::warning::$message"
+  fi
+}
+
 # Function to setup authentication in composer.
 set_composer_auth() {
-  if [ -n "$COMPOSER_AUTH_JSON" ]; then
-    if php -r "json_decode('$COMPOSER_AUTH_JSON'); if(json_last_error() !== JSON_ERROR_NONE) { throw new Exception('invalid json'); }"; then
-      echo "$COMPOSER_AUTH_JSON" | tee "$composer_home/auth.json" >/dev/null
+  token="${COMPOSER_TOKEN:-$GITHUB_TOKEN}"
+  if [ -n "${COMPOSER_AUTH_JSON:-}" ]; then
+    if printf '%s' "$COMPOSER_AUTH_JSON" | jq -e . >/dev/null; then
+      printf '%s' "$COMPOSER_AUTH_JSON" | tee "$composer_home/auth.json" >/dev/null
    else
      add_log "${cross:?}" "composer" "Could not parse COMPOSER_AUTH_JSON as valid JSON"
    fi
  fi
+  if [ "$skip_composer_github_auth" = "true" ]; then
+    composer_gh_auth_no_op
+  fi
  composer_auth=()
  if [ -n "$PACKAGIST_TOKEN" ]; then
    composer_auth+=( '"http-basic": {"repo.packagist.com": { "username": "token", "password": "'"$PACKAGIST_TOKEN"'"}}' )
  fi
-  token="${COMPOSER_TOKEN:-$GITHUB_TOKEN}"
  if [ -n "$token" ]; then
    write_token=true
+    if [ "$skip_composer_github_auth" = "true" ]; then
+      write_token=false
+    fi
    if [ "$GITHUB_SERVER_URL" != "https://github.com" ]; then
      can_access_public_github "$token" || write_token=false
    fi
@@ -182,6 +201,9 @@ add_tool() {
  url=$1
  tool=$2
  ver_param=$3
+  if [ "$tool" = "composer" ]; then
+    skip_composer_github_auth="${4:-false}"
+  fi
  tool_path="$tool_path_dir/$tool"
  if ! [ -d "$tool_path_dir" ]; then
    sudo mkdir -p "$tool_path_dir"
@@ -206,8 +228,8 @@ add_tool() {
      url[0]="${url[0]//releases\/latest\/download/releases/download/$(get -s -n "" "$(echo "${url[0]}" | cut -d '/' -f '1-5')/releases" | grep -Eo -m 1 "([0-9]+\.[0-9]+\.[0-9]+)/$(echo "${url[0]}" | sed -e "s/.*\///")" | cut -d '/' -f 1)}"
      status_code=$(get -v -e "$tool_path" "${url[0]}")
    fi
-    if [ "$status_code" = "200" ] && [ "$use_cache" = "true" ]; then
-      sudo cp -a "$tool_path" "$cache_path"
+    if [ "$status_code" = "200" ]; then
+      [ "$use_cache" = "true" ] && sudo cp -a "$tool_path" "$cache_path"
    elif [ -f "$tool_path.bak" ]; then
      sudo mv "$tool_path.bak" "$tool_path"
    fi
@@ -215,8 +237,8 @@ add_tool() {
  fi
  if [ "$status_code" = "200" ]; then
    add_tools_helper "$tool"
-    [ -L "$tool_cache_path_dir/$tool" ] || sudo ln -s "$tool_path" "$tool_cache_path_dir/$tool" 2>/dev/null || true
    tool_version=$(get_tool_version "$tool" "$ver_param")
+    sudo ln -sfn "$tool_path" "$tool_cache_path_dir/$tool" 2>/dev/null || true
    add_log "${tick:?}" "$tool" "Added $tool $tool_version"
  else
    if [ "$tool" = "composer" ]; then
@@ -22,6 +22,7 @@ add_brew_tap() {
      fi
    fi
  fi
+  brew trust "$tap" >/dev/null 2>&1
 }

 # Function to get brew prefix.
@@ -343,11 +343,20 @@ add_ppa_sp_mirror() {
  add_list sp/"$ppa_name" "$ppa_sp/$ppa/ubuntu" "$ppa_sp/$ppa/ubuntu/key.gpg"
 }

+add_sury_list() {
+  ppa=${1:-ondrej/php}
+  [ "${debug:?}" = "debug" ] && add_list "$ppa" "$sury"/"${ppa##*/}"/ "$sury"/"${ppa##*/}"/apt.gpg "$VERSION_CODENAME" "main/debug"
+  add_list "$ppa" "$sury"/"${ppa##*/}"/ "$sury"/"${ppa##*/}"/apt.gpg
+}
+
 # Function to add a PPA.
 add_ppa() {
  set_base_version
  ppa=${1:-ondrej/php}
  if [[ "$ID" = "ubuntu" || "$ID_LIKE" =~ ubuntu ]] && [[ "$ppa" =~ "ondrej/" ]]; then
+    if [ "$VERSION_ID" = "26.04" ]; then
+      add_sury_list
+    else
      if is_ubuntu_ppa_up "$ppa" ; then
        [ "${runner:?}" = "self-hosted" ] && find "$list_dir" -type f -name 'sp*' -exec grep -qF "${sp/https:\/\/}" {} \; -delete
        [ "${debug:?}" = "debug" ] && add_list "$ppa" "$lpc_ppa/$ppa/ubuntu" "$lpc_ppa/$ppa/ubuntu" "$VERSION_CODENAME" "main/debug"
@@ -357,9 +366,9 @@ add_ppa() {
      else
        add_log "${cross:?}" "$ppa" "PPA $ppa is not available"
      fi
+    fi
  elif [[ "$ID" = "debian" || "$ID_LIKE" =~ debian ]] && [[ "$ppa" =~ "ondrej/" ]]; then
-    [ "${debug:?}" = "debug" ] && add_list "$ppa" "$sury"/"${ppa##*/}"/ "$sury"/"${ppa##*/}"/apt.gpg "$VERSION_CODENAME" "main/debug"
-    add_list "$ppa" "$sury"/"${ppa##*/}"/ "$sury"/"${ppa##*/}"/apt.gpg
+    add_sury_list
  else
    add_list "$ppa"
  fi
@@ -203,16 +203,20 @@ Function Install-PSPackage() {
    $cmdlet
  )
  $module_path = "$bin_dir\$psm1_path.psm1"
+  $imported = $false
+  try {
    if(-not (Test-Path $module_path -PathType Leaf)) {
      $zip_file = "$bin_dir\$package.zip"
      Get-File -Url $url -OutFile $zip_file
-    Expand-Archive -Path $zip_file -DestinationPath $bin_dir -Force
+      Expand-Archive -Path $zip_file -DestinationPath $bin_dir -Force -ErrorAction Stop
    }
-  Import-Module $module_path
-  if($null -eq (Get-Command $cmdlet -ErrorAction SilentlyContinue)) {
-    Install-Module -Name $package -Force
-  } else {
+    Import-Module $module_path -ErrorAction Stop
+    $imported = $null -ne (Get-Command $cmdlet -ErrorAction SilentlyContinue)
+  } catch { }
+  if($imported) {
    Add-ToProfile $current_profile "$package-search" "Import-Module $module_path"
+  } else {
+    Install-Module -Name $package -Force
  }
 }

@@ -95,6 +95,42 @@ interface DeployerManifestEntry {
  url: string;
 }

+export function skipGitHubAuthForComposerVersion(version: string): boolean {
+  if (!/^\d+\.\d+\.\d+(?:-[\w-]+)?$/.test(version)) {
+    return false;
+  }
+  return fs
+    .readFileSync(
+      path.join(__dirname, '../src/configs/composer-gh-auth-no-op'),
+      'utf8'
+    )
+    .trim()
+    .split(/\r?\n/)
+    .some(range => {
+      const [min, max] = range.trim().split(/\s+/);
+      return (
+        cv.compareVersions(version, min) >= 0 &&
+        cv.compareVersions(version, max) < 0
+      );
+    });
+}
+
+export function cleanComposerAuthJson(): void {
+  try {
+    const auth_json = process.env['COMPOSER_AUTH_JSON'] || '';
+    if (!auth_json.includes('github-oauth')) return;
+    const auth = JSON.parse(auth_json);
+    delete auth['github-oauth'];
+    if (!Object.keys(auth).length) {
+      delete process.env['COMPOSER_AUTH_JSON'];
+    } else {
+      process.env['COMPOSER_AUTH_JSON'] = JSON.stringify(auth);
+    }
+  } catch {
+    return;
+  }
+}
+
 /**
 * Function to get version in semver format.
 *
@@ -195,7 +231,7 @@ export async function getVersion(
    case !!data.repository && major_minor_regex.test(data.version):
      return await getSemverVersion(data);
    default:
-      return data.version.replace(/[><=^~]*/, '');
+      return data.version.replace(/[^a-zA-Z0-9_.:@+,/-]/g, '');
  }
 }

@@ -311,12 +347,9 @@ export async function addArchive(data: ToolData): Promise<string> {
 export async function addPackage(data: ToolData): Promise<string> {
  const command = await utils.getCommand(data.os, 'composer_tool');
  const parts: string[] = data.repository.split('/');
-  const args: string = await utils.joins(
-    parts[1],
-    data.release,
-    parts[0] + '/',
-    data.scope
-  );
+  const args = [parts[1], data.release, parts[0] + '/', data.scope]
+    .map(a => utils.safeArg(a, data.os))
+    .join(' ');
  return command + args;
 }

@@ -383,6 +416,7 @@ export async function addComposer(data: ToolData): Promise<string> {
  const version_source_url = `${getcomposer}/download/${channel}/composer.phar`;
  let cache_url = `${releases_url},${spc_url},${cds_url}`;
  let source_url = `${getcomposer}/composer.phar`;
+  let skip_composer_github_auth = '';
  switch (true) {
    case /^snapshot$/.test(channel):
      source_url = is_lts ? lts_url : source_url;
@@ -393,7 +427,11 @@ export async function addComposer(data: ToolData): Promise<string> {
    case /^1$/.test(channel):
      source_url = channel_source_url;
      break;
-    case /^\d+\.\d+\.\d+[\w-]*$/.test(data.version):
+    case /^\d+\.\d+\.\d+(?:-[\w-]+)?$/.test(data.version):
+      if (skipGitHubAuthForComposerVersion(data.version)) {
+        cleanComposerAuthJson();
+        skip_composer_github_auth = ' true';
+      }
      cache_url = `${github}/${data.repository}/releases/download/${data.version}/composer.phar`;
      source_url = version_source_url;
      break;
@@ -402,7 +440,7 @@ export async function addComposer(data: ToolData): Promise<string> {
  }
  const use_cache: boolean = (await utils.readEnv('NO_TOOLS_CACHE')) !== 'true';
  data.url = use_cache ? `${cache_url},${source_url}` : source_url;
-  data.version_parameter = data.version;
+  data.version_parameter = data.version + skip_composer_github_auth;
  return await addArchive(data);
 }

@@ -9,16 +9,19 @@ import * as fetch from './fetch';
 * @param property
 */
 export async function readEnv(property: string): Promise<string> {
+  if (!/^[A-Za-z0-9_-]+$/.test(property)) {
+    return '';
+  }
  const property_lc: string = property.toLowerCase();
  const property_uc: string = property.toUpperCase();
-  return (
-    process.env[property] ||
-    process.env[property_lc] ||
-    process.env[property_uc] ||
-    process.env[property_lc.replace('_', '-')] ||
-    process.env[property_uc.replace('_', '-')] ||
-    ''
-  );
+  const candidates = [
+    property,
+    property_lc,
+    property_uc,
+    property_lc.replace('_', '-'),
+    property_uc.replace('_', '-')
+  ].filter((value, index, array) => array.indexOf(value) === index);
+  return candidates.map(name => process.env[name] || '').find(Boolean) || '';
 }

 /**
@@ -62,15 +65,31 @@ export async function getManifestURLS(): Promise<string[]> {
 */
 export async function parseVersion(version: string): Promise<string> {
  switch (true) {
+    case /^pre(-installed)?$/.test(version):
+      return 'pre';
    case /^(latest|lowest|highest|nightly|master|\d+\.x)$/.test(version):
      for (const manifestURL of await getManifestURLS()) {
        const fetchResult = await fetch.fetch(manifestURL);
        if (fetchResult['data'] ?? false) {
-          return JSON.parse(fetchResult['data'])[version];
+          const resolved: string | undefined = JSON.parse(fetchResult['data'])[
+            version
+          ];
+          if (resolved === undefined) {
+            throw new Error(`Invalid PHP version: ${version.slice(0, 20)}`);
+          }
+          if (!/^\d+\.\d+$/.test(resolved)) {
+            throw new Error(
+              `Invalid PHP version in manifest: ${resolved.slice(0, 10)}`
+            );
+          }
+          return resolved;
        }
      }
      throw new Error(`Could not fetch the PHP version manifest.`);
    default:
+      if (!/^\d+(\.\d+){0,2}$/.test(version)) {
+        throw new Error(`Invalid PHP version: ${version.slice(0, 20)}`);
+      }
      switch (true) {
        case version.length > 1:
          return version.slice(0, 3);
@@ -86,14 +105,11 @@ export async function parseVersion(version: string): Promise<string> {
 * @param ini_file
 */
 export async function parseIniFile(ini_file: string): Promise<string> {
-  switch (true) {
-    case /^(production|development|none)$/.test(ini_file):
+  if (/^(production|development|none)$/.test(ini_file)) {
    return ini_file;
-    case /php\.ini-(production|development)$/.test(ini_file):
-      return ini_file.split('-')[1];
-    default:
-      return 'production';
  }
+  const match = ini_file.match(/php\.ini-(production|development)$/);
+  return match ? match[1] : 'production';
 }

 /**
@@ -172,10 +188,10 @@ export async function log(
 export async function stepLog(message: string, os: string): Promise<string> {
  switch (os) {
    case 'win32':
-      return 'Step-Log "' + message + '"';
+      return 'Step-Log "' + escapeForShell(message, os) + '"';
    case 'linux':
    case 'darwin':
-      return 'step_log "' + message + '"';
+      return 'step_log "' + escapeForShell(message, os) + '"';
    default:
      return await log('Platform ' + os + ' is not supported', os, 'error');
  }
@@ -194,17 +210,40 @@ export async function addLog(
  message: string,
  os: string
 ): Promise<string> {
+  const sub = escapeForShell(subject, os);
+  const msg = escapeForShell(message, os);
  switch (os) {
    case 'win32':
-      return 'Add-Log "' + mark + '" "' + subject + '" "' + message + '"';
+      return `Add-Log "${mark}" "${sub}" "${msg}"`;
    case 'linux':
    case 'darwin':
-      return 'add_log "' + mark + '" "' + subject + '" "' + message + '"';
+      return `add_log "${mark}" "${sub}" "${msg}"`;
    default:
      return await log('Platform ' + os + ' is not supported', os, 'error');
  }
 }

+export function escapeForShell(value: string, os: string): string {
+  if (os === 'win32') {
+    return value.replace(/[`$"]/g, '`$&');
+  }
+  return value.replace(/[\\`$"]/g, '\\$&');
+}
+
+export function safeArg(value: string, os: string): string {
+  if (!/^[a-zA-Z0-9_./:@+,~^-]*$/.test(value)) {
+    return '"' + escapeForShell(value, os) + '"';
+  }
+  return value;
+}
+
+export function sanitizeShellInput(value: string, strict = false): string {
+  const pattern = strict
+    ? /[$`"';|&(){}[\]\\<>*?\n\r\t]/g
+    : /[$`"';|&(){}[\]\\\n\r\t]/g;
+  return value.replace(pattern, '');
+}
+
 /**
 * Function to break extension csv into an array
 *
@@ -224,11 +263,11 @@ export async function extensionArray(
          .split(',')

          .map(function (extension: string) {
+            extension = extension.trim().replace(/^\\\s*/, '');
            if (/.+-.+\/.+@.+/.test(extension)) {
              return extension;
            }
            return extension
-              .trim()
              .toLowerCase()
              .replace(/^(:)?(php[-_]|none|zend )|(-[^-]*)-/, '$1$3');
          })
@@ -431,22 +470,35 @@ export async function parseExtensionSource(
  );
 }

+const VERSION_INPUT_REGEX =
+  /^(latest|lowest|highest|nightly|master|pre|pre-installed|\d+\.x|\d+(\.\d+){0,2})$/;
+
+function validatePHPVersionInput(version: string, source: string): string {
+  if (!VERSION_INPUT_REGEX.test(version)) {
+    throw new Error(
+      `Invalid PHP version in ${source}: ${version.slice(0, 20)}`
+    );
+  }
+  return version;
+}
+
 /**
 * Read php version from input or file
 */
 export async function readPHPVersion(): Promise<string> {
  const version = await getInput('php-version', false);
  if (version) {
-    return version;
+    return validatePHPVersionInput(version, 'php-version input');
  }
  const versionFile =
    (await getInput('php-version-file', false)) || '.php-version';
  if (fs.existsSync(versionFile)) {
    const contents: string = fs.readFileSync(versionFile, 'utf8');
-    const match: RegExpMatchArray | null = contents.match(
-      /^(?:php\s)?(\d+\.\d+\.\d+)$/m
+    const match = contents.match(/^(?:php\s)?(\d+\.\d+\.\d+)$/m);
+    return validatePHPVersionInput(
+      match ? match[1] : contents.trim(),
+      versionFile
    );
-    return match ? match[1] : contents.trim();
  } else if (versionFile !== '.php-version') {
    throw new Error(`Could not find '${versionFile}' file.`);
  }
@@ -456,11 +508,11 @@ export async function readPHPVersion(): Promise<string> {
  if (fs.existsSync(composerLock)) {
    const lockFileContents = JSON.parse(fs.readFileSync(composerLock, 'utf8'));
    /* istanbul ignore next */
-    if (
-      lockFileContents['platform-overrides'] &&
-      lockFileContents['platform-overrides']['php']
-    ) {
-      return lockFileContents['platform-overrides']['php'];
+    if (lockFileContents['platform-overrides']?.['php']) {
+      return validatePHPVersionInput(
+        lockFileContents['platform-overrides']['php'],
+        'composer.lock platform-overrides.php'
+      );
    }
  }

@@ -470,12 +522,11 @@ export async function readPHPVersion(): Promise<string> {
      fs.readFileSync(composerJson, 'utf8')
    );
    /* istanbul ignore next */
-    if (
-      composerFileContents['config'] &&
-      composerFileContents['config']['platform'] &&
-      composerFileContents['config']['platform']['php']
-    ) {
-      return composerFileContents['config']['platform']['php'];
+    if (composerFileContents['config']?.['platform']?.['php']) {
+      return validatePHPVersionInput(
+        composerFileContents['config']['platform']['php'],
+        'composer.json config.platform.php'
+      );
    }
  }
Author	SHA1	Message	Date
dependabot[bot]	3fa88f2494	Bump the github-actions group across 1 directory with 2 updates (#1088 ) Bumps the github-actions group with 2 updates in the / directory: [shivammathur/setup-php](https://github.com/shivammathur/setup-php) and [shivammathur/cache-extensions](https://github.com/shivammathur/cache-extensions). Updates `shivammathur/setup-php` from 2.37.1 to 2.37.2 - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](https://github.com/shivammathur/setup-php/compare/7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc...f3e473d116dcccaddc5834248c87452386958240) Updates `shivammathur/cache-extensions` from 1.14.5 to 1.14.6 - [Release notes](https://github.com/shivammathur/cache-extensions/releases) - [Commits](https://github.com/shivammathur/cache-extensions/compare/256729b5fef535345e27904657f78048c0990f81...9b476298b44f2e4d4268dd103ff4c3e216314e27) --- updated-dependencies: - dependency-name: shivammathur/cache-extensions dependency-version: 1.14.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: shivammathur/setup-php dependency-version: 2.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-20 19:54:30 +05:30
Shivam Mathur	0c10338998	Update Node.js dependencies	2026-06-20 18:43:15 +05:30
Shivam Mathur	805dfa40c1	Improve README [skip ci]	2026-06-18 10:13:14 +05:30
Shivam Mathur	1b1cce8c66	Add initial support for Ubuntu 26.04 [skip ci]	2026-06-18 04:28:47 +05:30
dependabot[bot]	95edd72557	Bump the github-actions group with 3 updates (#1087 ) Bumps the github-actions group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [github/codeql-action](https://github.com/github/codeql-action) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `actions/checkout` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10) Updates `github/codeql-action` from 4.36.0 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e) Updates `codecov/codecov-action` from 6.0.1 to 7.0.0 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/e79a6962e0d4c0c17b229090214935d2e33f8354...fb8b3582c8e4def4969c97caa2f19720cb33a72f) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: codecov/codecov-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-13 18:06:26 +05:30
Shivam Mathur	f3e473d116	Bump version to 2.37.2 Update Node.js dependencies	2026-06-08 20:54:40 +05:30
Shivam Mathur	8be473cdc3	Trust brew taps	2026-06-08 20:54:32 +05:30
dependabot[bot]	083d5237d9	Bump the github-actions group with 2 updates (#1085 ) Bumps the github-actions group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `github/codeql-action` from 4.35.5 to 4.36.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9e0d7b8d25671d64c341c19c0152d693099fb5ba...7211b7c8077ea37d8641b6271f6a365a22a5fbfa) Updates `codecov/codecov-action` from 6.0.0 to 6.0.1 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2...e79a6962e0d4c0c17b229090214935d2e33f8354) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: codecov/codecov-action dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-30 16:35:36 +05:30
Shivam Mathur	a919ff576a	Update FUNDING.yml	2026-05-19 03:02:31 +05:30
Shivam Mathur	deb2299a77	Harden GitHub Actions workflows	2026-05-18 00:56:40 +05:30
Shivam Mathur	5825be4b77	Harden environment lookup	2026-05-18 00:56:40 +05:30
Shivam Mathur	8d45593ff3	Add CODEOWNERS	2026-05-15 23:46:09 +05:30
Shivam Mathur	ba8d1631c1	Update PHP versions in SECURITY.md	2026-05-15 01:33:20 +05:30
Shivam Mathur	7c071dfe9d	Bump version to 2.37.1 Update Node.js dependencies	2026-05-14 08:58:36 +05:30
Shivam Mathur	eeef37e059	GHSA-pqwm-q9pv-ph8r - Fix CWE-78 [skip ci]	2026-05-14 08:58:36 +05:30
Shivam Mathur	0dc33069a3	Fix phalcon5 support on Windows	2026-05-14 03:00:30 +05:30
Shivam Mathur	680a983990	Fix phalcon version for PHP 8.0 [skip ci]	2026-05-14 03:00:29 +05:30
Shivam Mathur	694649a4a3	Fix mutable tool cache restore	2026-05-13 19:43:21 +05:30
Shivam Mathur	46a991b6aa	Merge pull request #1081 from Pyker/patch-1 Fix composer v2 version in README	2026-05-13 16:22:14 +05:30
Shivam Mathur	7748c24380	GHSA-f9f8-rm49-7jv2: Fix GitHub auth handling for composer in affected versions	2026-05-13 16:19:11 +05:30
Pedro Cunha	ac9c953234	Fix composer v2 version in README	2026-05-13 10:26:15 +01:00
Shivam Mathur	7729e411ec	Improve enabling gearman [skip ci]	2026-04-29 01:00:16 +05:30
Shivam Mathur	af2322b95c	Fix fallback in Install-PSPackage on Windows	2026-04-26 23:49:26 +05:30
Shivam Mathur	45e37a5311	Update os_releases.csv [skip ci]	2026-04-26 15:12:30 +05:30
Shivam Mathur	690cb7c9d8	Merge pull request #1074 from shivammathur/dependabot/github_actions/develop/codecov/codecov-action-6 Bump codecov/codecov-action from 5 to 6	2026-03-30 17:04:06 +05:30
dependabot[bot]	b2cf73f5fa	Bump codecov/codecov-action from 5 to 6 Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5 to 6. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/v5...v6) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-03-30 11:19:53 +00:00
Shivam Mathur	64e2975255	Update dependencies	2026-03-29 20:51:51 +05:30
Shivam Mathur	106fd0866c	Strip backslash line continuation from extension inputs	2026-03-29 20:46:19 +05:30
Shivam Mathur	44724c9282	Merge pull request #1072 from shivammathur/dependabot/npm_and_yarn/npm_and_yarn-66413a1f6e Bump picomatch from 2.3.1 to 2.3.2 in the npm_and_yarn group across 1 directory	2026-03-26 07:42:11 +05:30
dependabot[bot]	2fa35d2e4e	Bump picomatch in the npm_and_yarn group across 1 directory Bumps the npm_and_yarn group with 1 update in the / directory: [picomatch](https://github.com/micromatch/picomatch). Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2) --- updated-dependencies: - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>	2026-03-26 00:21:48 +00:00
Shivam Mathur	29e04e0a1d	Add workflow examples for Drupal and WordPress plugins	2026-03-23 14:33:38 +05:30
Shivam Mathur	ea13793c13	Merge pull request #1071 from shivammathur/dependabot/npm_and_yarn/npm_and_yarn-e5a595f223 Bump flatted from 3.4.1 to 3.4.2 in the npm_and_yarn group across 1 directory	2026-03-22 02:27:26 +05:30
dependabot[bot]	fd580061e0	Bump flatted in the npm_and_yarn group across 1 directory Bumps the npm_and_yarn group with 1 update in the / directory: [flatted](https://github.com/WebReflection/flatted). Updates `flatted` from 3.4.1 to 3.4.2 - [Commits](https://github.com/WebReflection/flatted/compare/v3.4.1...v3.4.2) --- updated-dependencies: - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>	2026-03-21 20:14:26 +00:00
Shivam Mathur	90d81e2adc	Update examples	2026-03-21 21:47:58 +05:30
Shivam Mathur	93cb3149d2	Fix permission for OIDC tokens in publish.yml for trusted publishing [skip ci]	2026-03-15 22:01:57 +05:30
				`@@ -0,0 +1 @@`
				`Composer %s has a known GitHub token parsing bug that exposes GitHub tokens in the error output. So, GitHub authentication has not been configured for this Composer version. Please update to the latest version of Composer. See: https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2`