chore(deps): bump the production-dependencies group with 3 updates

[dependabot]

Bumps the production-dependencies group with 3 updates: dedoc/scramble, farzai/color-palette and lychee-org/lycheeverify.

Updates dedoc/scramble from 0.13.26 to 0.13.28

Release notes

Sourced from dedoc/scramble's releases.

v0.13.28

What's Changed

• Fix pre-serialized class map (failed in some cases due to new data on property definition)

Full Changelog: dedoc/scramble@v0.13.27...v0.13.28

v0.13.27

What's Changed

• Silence some PHP 8.5 deprecations (null array offset, preg_replace null) by @​dabrandstetter in dedoc/scramble#1155
• Add ability to cache OpenAPI document by @​romalytvynenko in dedoc/scramble#1178
• Plain objects documnetation by @​romalytvynenko in dedoc/scramble#1181

New Contributors

• @​dabrandstetter made their first contribution in dedoc/scramble#1155

Full Changelog: dedoc/scramble@v0.13.26...v0.13.27

Commits

• e50927c Fix styling
• 3a4b813 improved class definition serialization
• fc49ce9 fix test
• 5b067b1 Plain objects documnetation (#1181)
• d89bf45 Add ability to cache OpenAPI document (#1178)
• ad1233f fix: silence PHP 8.5 deprecations for null array offset and preg_replace null...
• See full diff in compare view

Updates farzai/color-palette from 1.2.1 to 2.0.0

Release notes

Sourced from farzai/color-palette's releases.

2.0.0

A major release that drops the bundled HTTP stack for a lighter, PSR-driven dependency footprint, raises the minimum PHP to 8.2, makes Theme a proper value object, and adds security hardening to image loading. A default install now pulls only 5 PSR/discovery packages — no Symfony, no Nyholm — unless you load images from URLs.

See https://github.com/parsilver/color-palette-php/blob/HEAD/UPGRADING.md for step-by-step migration.

⚠️ Breaking Changes

• PHP 8.2+ is now required (was 8.1; 8.1 reached security EOL on 2025-12-31).
• The HTTP client is no longer bundled. symfony/http-client and nyholm/psr7 are no longer hard dependencies. Local-file extraction and all color operations need no HTTP client. Loading images from a URL now requires a PSR-18 client (auto-discovered via php-http/discovery); install one with composer require symfony/http-client (recommended) or any PSR-18 client. A clear RuntimeException is thrown if you load a URL without one.
  • As part of this, ImageLoader::__construct() / ImageLoaderFactory::__construct() no longer accept the StreamFactoryInterface / $streamFactory argument (it was unused) and their client/factory arguments are now optional.
• Theme is now a validated five-role value object. It always defines primary, secondary, accent, background, surface, and its getters never throw. The constructor and Theme::fromColors() now throw InvalidArgumentException if a role is missing. ThemeGenerator::generate() drops the second $colorNames argument (its signature now matches the interface) and derives/lifts all five roles instead of requiring an exact color/name count.
• ImageInterface now declares getResource(): mixed. Custom implementations must add the method (the bundled GdImage/ImagickImage already have it).
• Removed ImageConstants::HTTP_OK (was unreferenced; use the literal 200).
• GdImage::__destruct() removed (PHP 8 frees \GdImage automatically — internal cleanup only).
• Extracted palettes may differ slightly from 1.x. The extraction algorithm and public API are unchanged, but k-means centroid seeding moved off PHP's global mt_rand() to a locally-seeded \Random\Randomizer(new Mt19937($seed)). Exact colors can change for the same image when count > 1; results remain deterministic and idempotent within 2.0. Re-baseline any cached/snapshotted palettes.

🔒 Security

• Per-redirect-hop SSRF re-validation — transport redirects are disabled and every Location hop is re-validated against the SSRF rules, closing redirect-based bypasses.
• Decompression-bomb / pixel-flood protection — decoded-dimension caps (12000 px/side, 50 MP) reject oversized images before decode on both GD and Imagick.
• Imagick path hardened to GD parity — now enforces the same size / MIME / dimension validation it previously skipped.
• k-means seeding no longer mutates PHP's global RNG.

✨ Features

• A Driver enum (Farzai\ColorPalette\Enums\Driver) — pass Driver::Gd / Driver::Imagick anywhere a driver string was accepted (make(), fromPath(), fromImage(), withDriver()); strings keep working.
• Color::fromHex() accepts 3-character shorthand (e.g. #abc).
• ColorPalette implements IteratorAggregate (palettes are foreach-iterable).
• New ColorPaletteBuilder::withDriver() and Theme::fromRoles() / Theme::fromPalette().
• Spelling-insensitive scheme names via the consolidated StrategyRegistry (previously-valid names keep working).
• Expanded accepted image types (image/jpg, image/bmp, image/tiff).

🐛 Fixes

• Hue normalized to [0, 360) in toHsl() / toHsv() (fixes toHsv()→fromHsv() round-trips).
• count = 1 no longer throws DivisionByZeroError in the Monochromatic / Shades / Tints strategies.
• Local-file loading works without an HTTP client through the loader and ColorPaletteBuilder (previously threw on a default install).
• ColorPaletteBuilder no longer silently returns a grayscale palette when the loader's auto-detected driver differs from the extractor's.
• ImagickImage destructor no longer raises a fatal when clear() fails.
• Theme getters no longer throw on generated themes, and ThemeGenerator no longer corrupts string-keyed palettes.
• Guard k-means clustering against a zero total weight.

🧱 Internal / Tooling

• psr/log promoted to a direct dependency; minimum-stability set to stable.
• Single-source color logic (Color delegates to ColorAnalyzer / ColorManipulator); consolidated StrategyRegistry; ImageLoader implements ImageLoaderInterface; corrected interface @throws.
• PHPStan (level 6) + Mockery expectation verification wired into CI; slimmer distributed package (examples, assets and dev config are export-ignored).
• Redesigned example/web-ui demo (not shipped to installs).

Full migration guide: https://github.com/parsilver/color-palette-php/blob/HEAD/UPGRADING.md

Changelog

Sourced from farzai/color-palette's changelog.

2.0.0 - 2026-06-14

A major release that drops the bundled HTTP stack for a lighter, PSR-driven dependency footprint, raises the minimum PHP to 8.2, makes Theme a proper value object, and adds security hardening to image loading. A default install now pulls only 5 PSR/discovery packages — no Symfony, no Nyholm — unless you load images from URLs.

See https://github.com/parsilver/color-palette-php/blob/main/UPGRADING.md for step-by-step migration.

⚠️ Breaking Changes

• PHP 8.2+ is now required (was 8.1; 8.1 reached security EOL on 2025-12-31).

• The HTTP client is no longer bundled. symfony/http-client and nyholm/psr7 are no longer hard dependencies. Local-file extraction and all color operations need no HTTP client. Loading images from a URL now requires a PSR-18 client (auto-discovered via php-http/discovery); install one with composer require symfony/http-client (recommended) or any PSR-18 client. A clear RuntimeException is thrown if you load a URL without one.

  • As part of this, ImageLoader::__construct() / ImageLoaderFactory::__construct() no longer accept the StreamFactoryInterface / $streamFactory argument (it was unused) and their client/factory arguments are now optional.

• Theme is now a validated five-role value object. It always defines primary, secondary, accent, background, surface, and its getters never throw. The constructor and Theme::fromColors() now throw InvalidArgumentException if a role is missing. ThemeGenerator::generate() drops the second $colorNames argument (its signature now matches the interface) and derives/lifts all five roles instead of requiring an exact color/name count.

• ImageInterface now declares getResource(): mixed. Custom implementations must add the method (the bundled GdImage/ImagickImage already have it).

• Removed ImageConstants::HTTP_OK (was unreferenced; use the literal 200).

• GdImage::__destruct() removed (PHP 8 frees \GdImage automatically — internal cleanup only).

• Extracted palettes may differ slightly from 1.x. The extraction algorithm and public API are unchanged, but k-means centroid seeding moved off PHP's global mt_rand() to a locally-seeded \Random\Randomizer(new Mt19937($seed)). Exact colors can change for the same image when count > 1; results remain deterministic and idempotent within 2.0. Re-baseline any cached/snapshotted palettes.

🔒 Security

• Per-redirect-hop SSRF re-validation — transport redirects are disabled and every Location hop is re-validated against the SSRF rules, closing redirect-based bypasses.
• Decompression-bomb / pixel-flood protection — decoded-dimension caps (12000 px/side, 50 MP) reject oversized images before decode on both GD and Imagick.
• Imagick path hardened to GD parity — now enforces the same size / MIME / dimension validation it previously skipped.
• k-means seeding no longer mutates PHP's global RNG.

✨ Features

• A Driver enum (Farzai\ColorPalette\Enums\Driver) — pass Driver::Gd / Driver::Imagick anywhere a driver string was accepted (make(), fromPath(), fromImage(), withDriver()); strings keep working.
• Color::fromHex() accepts 3-character shorthand (e.g. #abc).
• ColorPalette implements IteratorAggregate (palettes are foreach-iterable).
• New ColorPaletteBuilder::withDriver() and Theme::fromRoles() / Theme::fromPalette().
• Spelling-insensitive scheme names via the consolidated StrategyRegistry (previously-valid names keep working).
• Expanded accepted image types (image/jpg, image/bmp, image/tiff).

🐛 Fixes

• Hue normalized to [0, 360) in toHsl() / toHsv() (fixes toHsv()→fromHsv() round-trips).
• count = 1 no longer throws DivisionByZeroError in the Monochromatic / Shades / Tints strategies.
• Local-file loading works without an HTTP client through the loader and ColorPaletteBuilder (previously threw on a default install).
• ColorPaletteBuilder no longer silently returns a grayscale palette when the loader's auto-detected driver differs from the extractor's.
• ImagickImage destructor no longer raises a fatal when clear() fails.
• Theme getters no longer throw on generated themes, and ThemeGenerator no longer corrupts string-keyed palettes.
• Guard k-means clustering against a zero total weight.

🧱 Internal / Tooling

• psr/log promoted to a direct dependency; minimum-stability set to stable.
• Single-source color logic (Color delegates to ColorAnalyzer / ColorManipulator); consolidated StrategyRegistry; ImageLoader implements ImageLoaderInterface; corrected interface @throws.
• PHPStan (level 6) + Mockery expectation verification wired into CI; slimmer distributed package (examples, assets and dev config are export-ignored).
• Redesigned example/web-ui demo (not shipped to installs).

... (truncated)

Commits

• 4e86914 Merge pull request #51 from parsilver/fix/webui-json-errors
• 917e612 fix(example): make the web-ui API always return JSON (file upload was broken)
• 8424f3d Merge pull request #50 from parsilver/feat/webui-redesign
• 8b5e060 feat(example): redesign the web-ui demo and fix the redirect-broken Demo
• 2ee7bb0 Merge pull request #49 from parsilver/chore/exclude-assets-from-dist
• 484dc12 chore: exclude /assets from the distributed package
• 62f1cac Merge pull request #48 from parsilver/feat/theme-system-unification
• 699502f feat!: make Theme a validated five-role value object and fix ThemeGenerator
• 95a1470 Merge pull request #47 from parsilver/feat/driver-enum-and-getresource
• 5567a52 feat!: add a Driver enum and formalize ImageInterface::getResource()
• Additional commits viewable in compare view

Updates lychee-org/lycheeverify from 2.0.7 to 2.0.8

Release notes

Sourced from lychee-org/lycheeverify's releases.

Support Laravel 13

What's Changed

• Support for Laravel 13 by @​ildyria in LycheeOrg/verify#9

Full Changelog: LycheeOrg/verify@2.0.7...2.0.8

Commits

• be2814a Support for Laravel 13 (#9)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions