composer (4.x)(deps-dev): bump the development-dependencies group with 3 updates

[dependabot]

Updates the requirements on infection/infection, phpstan/phpstan and rector/rector to permit the latest version.
Updates infection/infection to 0.34.2

Release notes

Sourced from infection/infection's releases.

0.34.2

Fixed:

• Use recordTestRunHistory instead of cacheResult on PHPUnit 13.3 by @​lazerg in infection/infection#3447
• Escape GitHub annotation workflow commands by @​theofidry in infection/infection#3441

Internal:

• Suggest minimizing blast radius of any change + specific guidance for AI by @​sanmai in infection/infection#3426
• Replace deprecated MutantBuilder::materialize(), simplify the builder by @​sanmai in infection/infection#3432
• Record PHPUnit version and CPU steal in performance metrics by @​sanmai in infection/infection#3417
• Refactor GitHub annotation command formatting by @​theofidry in infection/infection#3442
• Fix Rector warning by @​theofidry in infection/infection#3443
• Revert TurboNodeTraverser return type in Analyser by @​sanmai in infection/infection#3434

New Contributors

• @​lazerg made their first contribution in infection/infection#3447

Full Changelog: infection/infection@0.34.1...0.34.2

Commits

• 18d9bef fix(phpunit): Use recordTestRunHistory instead of cacheResult on PHPUnit 13.3...
• 9505953 [Conductor] Update shipmonk/dead-code-detector to 1.3.3 (#3446)
• aa66f5f chore: Fix Rector warning (#3443)
• 2dd27a7 refactor(reporter): Refactor GitHub annotation command formatting (#3442)
• b669894 fix(reporter): Escape GitHub annotation workflow commands (#3441)
• 57605a4 build(deps): bump zizmorcore/zizmor from 1.27.0 to 1.28.0 in the dependencies...
• 6758404 [Conductor] Update carthage-software/mago to 1.46.0 (#3439)
• 9233b25 [Conductor] Update rector/rector to 2.6.1 (#3438)
• 65f79f3 [Conductor] Update all of phpstan (#3437)
• d779f90 feat(test-framework): Add debug test framework and static analysis adapters (...
• Additional commits viewable in compare view

Updates phpstan/phpstan to 2.2.8

Commits

• See full diff in compare view

Updates rector/rector to 2.6.2

Release notes

Sourced from rector/rector's releases.

Released Rector 2.6.2

The 2.6.0 release introduced composer-based sets. This release finishes the job: every extension package now ships a single composer-based set, and the per-version set providers behind the old guessing game are gone.

use Rector\Config\RectorConfig;
return RectorConfig::configure()
->withComposerBased(
doctrine: true,
phpunit: true,
twig: true,
);

Each rule inside checks composer.json/installed.json on its own and runs only if the installed package version matches its constraint. No SymfonySetList::SYMFONY_63, no picking a PHPUnit version by hand. We're working hard to bring Drupal and Laravel community packages to the same system.

Run only the PHP rules (#8322)

A new --php option on the process command runs only rules bound to a minimal PHP version — those implementing MinPhpVersionInterface. Useful to split a PHP upgrade from the rest, without a second config:

vendor/bin/rector process src --php --dry-run

New features 🥳

• [Process] Add --php option to run only PHP version rules (#8322)
• [Configuration] Resolve the composer-based set of extension packages in withComposerBased() (#8332), load Doctrine and Twig composer-based sets (#8313)
• [Configuration] Report explicit error when the --only rule exists but is not registered in rector.php (#8300)
• [DX] Warn on skipped classes that are not Rector rules (#8323), include the skipped class name in the message (#8325)
• [DX] Show previous exceptions during bootstrap (#8287)

 [WARNING] This skipped class is not a Rector rule, so it can never be skipped.
           Only classes that implement "Rector\Contract\Rector\RectorInterface"
           can be used in "->withSkip()"

New rules 🎉

rector-src

• [DeadCode] RemoveRedundantTypeCheckRector (#8307)

... (truncated)

Commits

• 03cd615 Rector 2.6.2
• 112412c Updated Rector to commit d39693f97e95e5dfb160f6d3529b740ac1c24b38
• db9eb19 Updated Rector to commit 29928dd034534323ebf603bd1602b4f20ecd3ac6
• 722336e Updated Rector to commit 09ee9549d7e20c168004ec0111ba165f91350541
• 3654819 Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• f42c503 Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• f7bbc4f Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• 08865fb Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• b00041d Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• 032c857 Updated Rector to commit 768539a46a08410a7e25a643fe3777ab9c17b116
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
composer/infection/infection	>= 0.34.2, < 0.35.0	Unknown	Unknown
composer/phpstan/phpstan	>= 2.2.8, < 3.0.0	Unknown	Unknown
composer/phpstan/phpstan-phpunit	>= 2.0.18, < 3.0.0	Unknown	Unknown
composer/rector/rector	>= 2.6.2, < 3.0.0	Unknown	Unknown

Scanned Files

• composer.json

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	composer/​phpstan/​phpstan-phpunit@​2.0.18.0

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (e944c49) to head (cab2448).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff             @@
##                 4.x      #602   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity        25        25           
===========================================
  Files              3         3           
  Lines            119       123    +4     
===========================================
+ Hits             119       123    +4     

Flag	Coverage Δ
php-8.3	100.00% <100.00%> (ø)
phpunit	100.00% <100.00%> (ø)
ubuntu-latest	100.00% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/AuthorizationMiddleware.php	100.00% <100.00%> (ø)