Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/checkout	action	patch	v7.0.0 → v7.0.1
github/codeql-action	action	minor	v4.35.5 → v4.37.1
icanhazstring/composer-unused	require	minor	^0.8 → ^0.8 || ^0.9
psalm/plugin-phpunit	require-dev	minor	^0.19.5 → ^0.20.0
shivammathur/setup-php	action	patch	2.37.1 → 2.37.2

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

github/codeql-action (github/codeql-action)

v4.37.1

Compare Source

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #​3956
• Update default CodeQL bundle version to 2.26.1. #​4019

v4.37.0

Compare Source

• Update default CodeQL bundle version to 2.26.0. #​3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@​ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973

v4.36.3

Compare Source

No user facing changes.

v4.36.2

Compare Source

• Cache CodeQL CLI version information across Actions steps. #​3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #​3937
• Update default CodeQL bundle version to 2.25.6. #​3948

v4.36.1

Compare Source

No user facing changes.

v4.36.0

Compare Source

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #​3894
• Add support for SHA-256 Git object IDs. #​3893
• Update default CodeQL bundle version to 2.25.5. #​3926

composer-unused/composer-unused (icanhazstring/composer-unused)

v0.9.6

Compare Source

What's Changed

• github-actions(deps): bump the dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​700
• Add realpath for SymfonyConfigurationSet by @​ToshY in #​702
• composer(deps-dev): bump the dependencies group with 2 updates by @​dependabot[bot] in #​703
• composer(deps-dev): bump the dependencies group across 1 directory with 2 updates by @​dependabot[bot] in #​707
• composer(deps-dev): bump the dependencies group across 1 directory with 4 updates by @​dependabot[bot] in #​712
• Add support for webmozart/assert 2.0 by @​OskarStark in #​723
• composer(deps-dev): bump the dependencies group across 1 directory with 4 updates by @​dependabot[bot] in #​726
• build(deps-dev): bump symfony/process from 5.4.47 to 5.4.51 in /vendor-bin/box by @​dependabot[bot] in #​725
• build(deps-dev): bump paragonie/sodium_compat from 1.21.1 to 1.24.0 in /vendor-bin/box by @​dependabot[bot] in #​715
• Use major version tag for shivammathur/setup-php action by @​OskarStark in #​727
• github-actions(deps): bump the dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​728
• Symfony 8 support by @​dmitryuk in #​729
• chore: Drop composer.lock by @​icanhazstring in #​730
• Up CI php 8.5 by @​dmitryuk in #​720

New Contributors

• @​ToshY made their first contribution in #​702

Full Changelog: composer-unused/composer-unused@0.9.5...0.9.6

v0.9.5

Compare Source

What's Changed

• chore: Use 8.1 for build and phar validation by @​icanhazstring in #​699

Full Changelog: composer-unused/composer-unused@0.9.4...0.9.5

v0.9.4

Compare Source

Added

• ConfigurationSet system for framework-specific scanning by @​dmitryuk in #​691

Fixed

• Automatically disable XDebug to prevent segmentation faults by @​icanhazstring in #​692

Changed

Removed

• Extra dev files from vendor by @​dmitryuk in #​690

Security

Deprecation

v0.9.3

Compare Source

Added

• Compact formatter by @​gisostallenberg in #​683
• Set unused command as default when no other commands are specified by @​MarcinGladkowski in #​608

Fixed

Changed

• Updated symbol-parser to resolve PHP 8.4 compatibility by @​icanhazstring in #​678
• Updated PHPStan dependencies by @​icanhazstring in #​679
• Limited PHAR signature check to main repository PRs by @​icanhazstring in #​684

Removed

Security

Deprecation

v0.9.2

Compare Source

Added

• Allow __root__ as default package name by @​icanhazstring in #​671

Fixed

• Added tests to cover extensions marked unused by @​icanhazstring in #​673
• Resolved issue with memcached marked unused by @​icanhazstring in #​674

Changed

• Combined action status by @​icanhazstring in #​672

Removed

• Dropped support for Symfony 5 by @​icanhazstring in #​675

Security

Deprecation

v0.9.1

Compare Source

Added

• Support for phpstan/phpdoc-parser v2 by @​WyriHaximus in #​670

Fixed

Changed

Removed

Security

Deprecation

v0.9.0

Compare Source

Added

• "--output-file" option to write formatted result output directly by @​temp in #​629
• Support for PHP-Parser v5 by @​llaville in #​628
• Update to PHP 8.4 compatibility by @​bobvandevijver in #​668

Fixed

Changed

• Dropped Symfony 4 support by @​llaville in #​634
• Sort results of debug:provided-symbols command by @​llaville in #​626
• Display package processing on right side of progress bar in verbose mode by @​llaville in #​632
• Require composer-unused/symbol-parser v0.2.2 by @​simPod in #​605

Removed

Security

Deprecation

psalm/psalm-plugin-phpunit (psalm/plugin-phpunit)

v0.20.2

Compare Source

What's Changed

• Fix #[Test] attribute detection for inherited and fully-qualified attributes by @​alies-dev in #​160

New Contributors

• @​alies-dev made their first contribution in #​160

Full Changelog: psalm/psalm-plugin-phpunit@0.20.1...0.20.2

v0.20.1

Compare Source

v0.20.0

Compare Source

What's Changed

• Switch to psalm/psalm-plugin-api 0.1.0 (targeting Psalm v7 beta)
• Bump actions/cache from 3 to 4 by @​dependabot[bot] in #​153
• Bump actions/checkout from 3 to 4 by @​dependabot[bot] in #​152
• Bump actions/cache from 4 to 5 by @​dependabot[bot] in #​157
• Bump actions/checkout from 4 to 6 by @​dependabot[bot] in #​156

Full Changelog: psalm/psalm-plugin-phpunit@0.19.5...0.20.0

shivammathur/setup-php (shivammathur/setup-php)

v2.37.2

Compare Source

Changelog

• Fixed macOS setup by marking shivammathur/php and shivammathur/extensions as trusted taps.

• Switched to Visual Studio 18 (vs18) builds for PHP 8.6 on Windows.

• Improved looking up environment variables.

• Tightened security in internal GitHub action workflows.

• Updated Node.js dependencies.

For the complete list of changes, please refer to the Full Changelog

Follow for updates

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

Read more information about the use of Renovate Bot within Laminas.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer update psalm/plugin-phpunit:0.20.2 --with-dependencies --ignore-platform-req=ext-* --ignore-platform-req=lib-* --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires psalm/plugin-phpunit ^0.20.0 -> satisfiable by psalm/plugin-phpunit[0.20.2].
    - vimeo/psalm is locked to version 6.16.1 and an update of this package was not requested.
    - psalm/plugin-phpunit 0.20.2 requires psalm/psalm-plugin-api ^0.1 -> satisfiable by psalm/psalm-plugin-api[0.1.0].
    - psalm/psalm-plugin-api 0.1.0 conflicts with vimeo/psalm <7.0.0.

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.