Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Abandoned Dependencies

The following dependencies have not received updates for an extended period and may be unmaintained.

View abandoned dependencies (9)

[!NOTE]
Packages are marked as abandoned when they exceed the abandonmentThreshold since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.

Datasource	Package	Last Updated
composer	mikey179/vfsstream	2024-08-29
composer	nyholm/psr7-server	2023-11-08
composer	php-http/mock-client	2024-10-31
composer	psalm/plugin-mockery	2025-03-20
composer	psr/http-client	2023-09-23
composer	psr/http-message	2023-04-04

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• chore(deps): update composer:2.9 docker digest to dc292c5
• chore(deps): update debian:trixie docker digest to 35b8ff7
• chore(deps): update otel/opentelemetry-collector-contrib docker digest to d57bfe8
• chore(deps): update prom/prometheus docker digest to e425440
• chore(deps): update actions/cache action to v4.3.0
• chore(deps): update actions/checkout action to v4.3.1
• chore(deps): update fossas/fossa-action action to v1.9.0
• chore(deps): update github/codeql-action action to v4.35.2
• chore(deps): update actions/cache action to v5
• chore(deps): update actions/checkout action to v6
• chore(deps): update actions/configure-pages action to v6
• chore(deps): update actions/deploy-pages action to v5
• chore(deps): update actions/upload-pages-artifact action to v5
• chore(deps): update codecov/codecov-action action to v6
• chore(deps): update dependency phpunit/phpunit to v13
• chore(deps): update docker/build-push-action action to v7
• chore(deps): update docker/login-action action to v4
• chore(deps): update docker/setup-buildx-action action to v4
• chore(deps): update phpstan packages to v2 (major) (phpstan/phpstan, phpstan/phpstan-mockery, phpstan/phpstan-phpunit)
• fix(deps): update dependency google/protobuf to v5
• chore(deps): lock file maintenance
• 🔐 Create all rate-limited PRs at once 🔐

---

Warning

Renovate failed to look up the following dependencies: Failed to look up packagist package psr/http-client-implementation: no-result, Failed to look up packagist package psr/http-factory-implementation: no-result, Failed to look up packagist package php-http/async-client-implementation: no-result.

Files affected: composer.json, src/Contrib/Zipkin/composer.json, src/Contrib/composer.json, src/SDK/composer.json

---

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): pin dependencies (actions/cache, actions/checkout, nhedger/setup-mago, opentelemetry-php/gh-workflows)
• chore(deps): update nginx:alpine docker digest to 5616878
• chore(deps): update openzipkin/zipkin-slim docker digest to fc29b98
• chore(deps): update redis docker digest to 832d778
• chore(deps): update all patch versions (actions/cache, actions/upload-artifact, codecov/codecov-action, debian, gacts/run-and-post-run)
• chore(deps): update dependency phpspec/prophecy to 1.26.*
• chore(deps): update dependency psalm/plugin-phpunit to ^0.20
• chore(deps): update shivammathur/cache-extensions action to v1.14.4
• chore(deps): update shivammathur/setup-php action to v2.37.0
• chore(deps): update dependency phpdocumentor/reflection-docblock to v6
• Click on this checkbox to rebase all open PRs at once

Detected Dependencies

composer (21)

composer.json (38)

• php ^8.1
• google/protobuf ^3.22 || ^4.0 || ^5.0
• nyholm/psr7-server ^1.1
• php-http/discovery ^1.14
• psr/http-client ^1.0
• psr/http-client-implementation ^1.0
• psr/http-factory-implementation ^1.0
• psr/http-message ^1.0.1|^2.0
• psr/log ^1.1|^2.0|^3.0
• ramsey/uuid ^3.0 || ^4.0
• symfony/config ^5.4 || ^6.4 || ^7.0 || ^8.0
• symfony/polyfill-mbstring ^1.23
• symfony/polyfill-php82 ^1.26
• symfony/polyfill-php83 ^1.32
• symfony/polyfill-php84 ^1.32
• tbachert/spi ^1.0.x-dev
• amphp/amp ^3
• bamarni/composer-bin-plugin ^1.8
• dg/bypass-finals ^1.4
• grpc/grpc ^1.30
• guzzlehttp/guzzle ^7.4
• guzzlehttp/psr7 ^2.1
• mikey179/vfsstream ^1.6.11
• mockery/mockery ^1.5.1
• monolog/monolog ^3.0
• nyholm/psr7 ^1.4
• php-http/mock-client ^1.5
• phpdocumentor/reflection-docblock ^5.2 → [Updates: ^6.0]
• phpspec/prophecy 1.22.* → [Updates: 1.26.*]
• phpspec/prophecy-phpunit ^2
• phpstan/phpstan ^1.10.13 → [Updates: ^2.0.0]
• phpstan/phpstan-mockery ^1.1 → [Updates: ^2.0]
• phpstan/phpstan-phpunit ^1.3 → [Updates: ^2.0]
• phpunit/phpunit ^10 || ^11 → [Updates: ^10 || ^11 || ^13]
• sebastian/exporter <= 6.0.1 || >= 6.1.3
• symfony/http-client ^5.2 || ^6.4 || ^7.0 || ^8.0
• symfony/var-exporter ^5.4 || ^6.4 || ^7.0 || ^8.0
• symfony/yaml ^5.4 || ^6.4 || ^7.0 || ^8.0

proto/otel/composer.json (2)

• php ^8.0
• google/protobuf ^3.22 || ^4.0 → [Updates: ^3.22 || ^4.0 || ^5.0]

src/API/composer.json (4)

• php ^8.1
• open-telemetry/context ^1.4
• psr/log ^1.1|^2.0|^3.0
• symfony/polyfill-php82 ^1.26

src/Config/SDK/composer.json (6)

• php ^8.1
• open-telemetry/api ^1.8
• open-telemetry/context ^1.4
• open-telemetry/sdk ^1.14
• symfony/config ^5.4 || ^6.4 || ^7.0 || ^8.0
• tbachert/spi ^1.0.5

src/Context/composer.json (2)

• php ^8.1
• symfony/polyfill-php82 ^1.26

src/Contrib/composer.json (12)

• php ^8.1
• open-telemetry/api ^1.0
• open-telemetry/context ^1.0
• open-telemetry/gen-otlp-protobuf ^1.2
• open-telemetry/sdk ^1.0
• open-telemetry/sem-conv ^1.0
• php-http/async-client-implementation ^1.0
• php-http/discovery ^1.14
• psr/http-factory-implementation ^1.0
• psr/log ^1.1|^2.0|^3.0
• symfony/polyfill-mbstring ^1.23
• symfony/polyfill-php82 ^1.26

src/Contrib/Grpc/composer.json (3)

• php ^8.1
• grpc/grpc *
• open-telemetry/sdk ^1.0

src/Contrib/Otlp/composer.json (5)

• php ^8.1
• php-http/discovery ^1.14
• open-telemetry/gen-otlp-protobuf ^1.1
• open-telemetry/api ^1.0
• open-telemetry/sdk ^1.0

src/Contrib/Zipkin/composer.json (6)

• php ^8.1
• open-telemetry/api ^1.0
• open-telemetry/sdk ^1.0
• php-http/async-client-implementation ^1.0
• php-http/discovery ^1.14
• psr/http-factory-implementation ^1.0

src/Extension/Propagator/B3/composer.json (3)

• php ^8.1
• open-telemetry/api ^1.0
• open-telemetry/context ^1.0

src/Extension/Propagator/CloudTrace/composer.json (3)

• php ^8.1
• open-telemetry/api ^1.0
• open-telemetry/context ^1.0

src/SDK/composer.json (15)

• php ^8.1
• nyholm/psr7-server ^1.1
• open-telemetry/api ^1.8
• open-telemetry/context ^1.4
• open-telemetry/sem-conv ^1.0
• php-http/discovery ^1.14
• psr/http-client-implementation ^1.0
• psr/http-factory-implementation ^1.0
• psr/http-client ^1.0
• psr/http-message ^1.0.1|^2.0
• psr/log ^1.1|^2.0|^3.0
• ramsey/uuid ^3.0 || ^4.0
• symfony/polyfill-mbstring ^1.23
• symfony/polyfill-php82 ^1.26
• tbachert/spi ^1.0.5

src/SemConv/composer.json (1)

• php ^8.0

vendor-bin/deptrac/composer.json (1)

• qossmic/deptrac-shim ^1.0

vendor-bin/infection/composer.json (1)

• infection/infection ^0.32.0

vendor-bin/phan/composer.json (1)

• phan/phan ^6.0

vendor-bin/php-cs-fixer/composer.json (1)

• friendsofphp/php-cs-fixer ^3.54

vendor-bin/phpbench/composer.json (1)

• phpbench/phpbench ^1.2

vendor-bin/phpmetrics/composer.json (1)

• phpmetrics/phpmetrics ^2.8

vendor-bin/psalm/composer.json (3)

• vimeo/psalm ^6
• psalm/plugin-mockery ^1
• psalm/plugin-phpunit ^0.19 → [Updates: ^0.20]

vendor-bin/rector/composer.json (1)

• rector/rector ^2.0

docker-compose (7)

docker-compose.collector.yaml (3)

• openzipkin/zipkin-slim sha256:d951994017185bce1c859b62e13adf640e26c37e08b90ca2e4de2669dc1aad87 → [Updates: undefined]
• jaegertracing/all-in-one sha256:ab6f1a1f0fb49ea08bcd19f6b84f6081d0d44b364b6de148e1798eb5816bacac
• otel/opentelemetry-collector-contrib sha256:8164eab2e6bca9c9b0837a8d2f118a6618489008a839db7f9d6510e66be3923c → [Updates: undefined]

docker-compose.fiber-ffi.yaml (1)

• nginx alpine@sha256:f46cb72c7df02710e693e863a983ac42f6a9579058a59a35f1ae36c9958e4ce0 → [Updates: alpine]

docker-compose.phpDocumentor.yaml (2)

• phpdoc/phpdoc 3@sha256:2b36e4f74937e40246d54ed12dfa4f988f21ed8d19e46f426ac3dc32eac2ff1d
• nginx alpine@sha256:f46cb72c7df02710e693e863a983ac42f6a9579058a59a35f1ae36c9958e4ce0 → [Updates: alpine]

docker-compose.prometheus.yaml (3)

• prom/prometheus sha256:4a61322ac1103a0e3aea2a61ef1718422a48fa046441f299d71e660a3bc71ae9 → [Updates: undefined]
• redis sha256:315270d166080f537bbdf1b489b603aaaa213cb55a544acfa51feb7481abb1c0 → [Updates: undefined]
• nginx alpine@sha256:f46cb72c7df02710e693e863a983ac42f6a9579058a59a35f1ae36c9958e4ce0 → [Updates: alpine]

docker-compose.w3cTraceContext.yaml

docker-compose.yaml (3)

• openzipkin/zipkin-slim sha256:d951994017185bce1c859b62e13adf640e26c37e08b90ca2e4de2669dc1aad87 → [Updates: undefined]
• jaegertracing/all-in-one sha256:ab6f1a1f0fb49ea08bcd19f6b84f6081d0d44b364b6de148e1798eb5816bacac
• otel/opentelemetry-collector-contrib sha256:8164eab2e6bca9c9b0837a8d2f118a6618489008a839db7f9d6510e66be3923c → [Updates: undefined]

docker/gitsplit/docker-compose.yaml (1)

• jderusse/gitsplit sha256:ca619e08d0608d7ab8067be02db13409ec63a0e241c6308be42593f0c0ac705d

dockerfile (1)

docker/Dockerfile (2)

• composer 2.9@sha256:743aebe48ca67097c36819040633ea77e44a561eca135e4fc84c002e63a1ba07 → [Updates: 2.9]
• debian trixie@sha256:55a15a112b42be10bfc8092fcc40b6748dc236f7ef46a358d9392b339e9d60e8 → [Updates: trixie-20260421, trixie]

github-actions (8)

.github/workflows/fossa.yml (2)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• fossas/fossa-action v1.8.0@c414b9ad82eaad041e47a7cf62a4f02411f427a0 → [Updates: v1.9.0]

.github/workflows/mago.yml (3)

• actions/checkout v4 → [Updates: v4.3.1, v6.0.2, v4]
• actions/cache v4 → [Updates: v4.3.0, v5.0.5, v4]
• nhedger/setup-mago v1 → [Updates: v1]

.github/workflows/ossf-scorecard.yml (4)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• ossf/scorecard-action v2.4.3@4eaacf0543bb3f2c246792bd56e8cdeffafb205a
• actions/upload-artifact v7.0.0@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f → [Updates: v7.0.1]
• github/codeql-action v4.34.0@c6f931105cb2c34c8f901cc885ba1e2e259cf745 → [Updates: v4.35.2]

.github/workflows/php.yml (9)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• gacts/run-and-post-run v1.4.3@81b6ce503cde93862cec047c54652e45c5dca991 → [Updates: v1.4.4]
• shivammathur/cache-extensions 1.13.0@4595bea7d6630821b0a3a4894f816402faaf324c → [Updates: 1.14.4]
• actions/cache v5.0.3@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 → [Updates: v5.0.5]
• shivammathur/setup-php 2.36.0@44454db4f0199b8b9685a5d763dc37cbf79108e1 → [Updates: 2.37.0]
• actions/cache v5.0.3@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 → [Updates: v5.0.5]
• actions/cache v5.0.3@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 → [Updates: v5.0.5]
• codecov/codecov-action v5.5.2@671740ac38dd9b0130fbe1cec585b89eea48d3de → [Updates: v5.5.4, v6.0.0]
• opentelemetry-php/gh-workflows main → [Updates: main]

.github/workflows/phpdoc-to-github-pages.yml (5)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• phpDocumentor/phpDocumentor v3.9.1@4d3daedcffb747791b212545da819bfc81252ea9
• actions/configure-pages v5@983d7736d9b0ae728b81ab479565c72886d7745b → [Updates: v6.0.0]
• actions/upload-pages-artifact v4@7b1f4a764d45c48632c6b24a0339c27f5614fb0b → [Updates: v5.0.0]
• actions/deploy-pages v4.0.5@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e → [Updates: v5.0.0]

.github/workflows/publish-otel-php-base-docker-image.yml (5)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• docker/setup-buildx-action v3.12.0@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f → [Updates: v4.0.0]
• docker/login-action v3.7.0@c94ce9fb468520275223c153574b00df6fe4bcc9 → [Updates: v4.1.0]
• docker/build-push-action v6.19.2@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 → [Updates: v7.1.0]
• docker/build-push-action v6.19.2@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 → [Updates: v7.1.0]

.github/workflows/shellcheck.yml (1)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd

.github/workflows/split-monorepo.yaml (1)

• jderusse/gitsplit latest@sha256:ca619e08d0608d7ab8067be02db13409ec63a0e241c6308be42593f0c0ac705d

---

• Check this box to trigger a request for Renovate to run again on this repository