From 1d90af7d17f7088f7158927f66fda55b880a32ba Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 12 Oct 2026 05:17:27 +0000
Subject: [PATCH] Harden Dependabot and add composer audit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

siephp's lock still resolves on its minimum PHP, so Dependabot works
today, but nothing stops a local composer update on a newer PHP from
moving the lock past 8.3 — which silently breaks every Dependabot run,
as happened in TbbcMoneyBundle.

- composer.json: pin config.platform.php to 8.3.0 (the require floor),
  so the lock is always resolved for the lowest supported PHP
- dependabot.yml: group security updates, add a 7-day cooldown and a
  github-actions ecosystem to keep the SHA pins fresh
- CI: add a composer audit job so new advisories turn the nightly run red

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G1B1haEbMV4nwwwdJ4yxmY
---
 .github/dependabot.yml             | 38 +++++++++++++++++++++++++++++-
 .github/workflows/code_checks.yaml | 12 ++++++++++
 composer.json                      |  5 ++++
 composer.lock                      |  7 ++++--
 4 files changed, 59 insertions(+), 3 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index cc53b7b..e18943a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,14 +7,50 @@
 
 version: 2
 updates:
+  # GitHub Actions used in .github/workflows/ — keeps SHA pins fresh.
+  # note: directory: '/' is correct for github-actions even though the workflow
+  # files live in .github/workflows/.
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'monthly'
+    # Ignore releases younger than 7 days so a freshly published,
+    # potentially compromised version is given time to be flagged and yanked before we bump.
+    cooldown:
+      default-days: 7
+    groups:
+      actions-batch:
+        applies-to: version-updates
+        update-types:
+          - 'minor'
+          - 'patch'
+          - 'major'
+      # every security fix in one PR per run, instead of one PR per advisory
+      actions-security:
+        applies-to: security-updates
+        patterns:
+          - '*'
+
+  # composer — Dependabot resolves at config.platform.php from composer.json, so
+  # composer.lock must stay installable on that PHP version, or every update
+  # (security fixes included) fails silently as "update not possible".
   - package-ecosystem: 'composer'
     directory: '/'
     schedule:
       interval: 'monthly'
+    # Ignore releases younger than 7 days so a freshly published,
+    # potentially compromised version is given time to be flagged and yanked before we bump.
+    cooldown:
+      default-days: 7
     groups:
-      # group all updates that are minor or path versions
+      # group all updates that are minor or patch versions
       upgrade-batch:
         applies-to: version-updates
         update-types:
           - 'minor'
           - 'patch'
+      # every security fix in one PR per run, instead of one PR per advisory
+      security:
+        applies-to: security-updates
+        patterns:
+          - '*'
diff --git a/.github/workflows/code_checks.yaml b/.github/workflows/code_checks.yaml
index 4df737e..7a78c6b 100644
--- a/.github/workflows/code_checks.yaml
+++ b/.github/workflows/code_checks.yaml
@@ -113,3 +113,15 @@ jobs:
 
       - run: composer install --prefer-dist --no-progress
       - run: composer phpstan
+
+  # Fails on any advisory against composer.lock, so the nightly run turns red
+  # when Dependabot cannot ship a security fix on its own.
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5
+      - uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f #v2
+        with:
+          php-version: 8.4
+          coverage: none
+      - run: composer audit --locked
diff --git a/composer.json b/composer.json
index 3545f70..cb51ad4 100644
--- a/composer.json
+++ b/composer.json
@@ -40,5 +40,10 @@
         "rector-check": "vendor/bin/rector --dry-run",
         "rector-fix": "vendor/bin/rector",
         "phpunit": "vendor/bin/phpunit"
+    },
+    "config": {
+        "platform": {
+            "php": "8.3.0"
+        }
     }
 }
diff --git a/composer.lock b/composer.lock
index 1a056b0..5ae75d0 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "190c7bcfb2b4120d6dcfa99341ad68f7",
+    "content-hash": "c431dcecdf3d2964731a596fecb15ffe",
     "packages": [],
     "packages-dev": [
         {
@@ -2033,5 +2033,8 @@
         "ext-iconv": "*"
     },
     "platform-dev": {},
-    "plugin-api-version": "2.9.0"
+    "platform-overrides": {
+        "php": "8.3.0"
+    },
+    "plugin-api-version": "2.6.0"
 }