chore(deps): bump shivammathur/setup-php in / by dependabot[bot] · Pull Request #10201 · codeigniter4/CodeIgniter4

dependabot · 2026-05-14T15:27:58Z

Bumps shivammathur/setup-php in / from 2.37.0 to 2.37.1.

Updates shivammathur/setup-php from 2.37.0 to 2.37.1

Release notes

Sourced from shivammathur/setup-php's releases.

2.37.1

Changelog

Security Updates

Fixed shell command escaping and PHP version input validation. Please see GHSA-pqwm-q9pv-ph8r.

[!NOTE] This can affect workflows that pass values from users or pull requests to setup-php, for example from comments, dispatch inputs, PR titles/branches, generated matrices, or files such as .php-version and composer.json. Be especially careful with pull_request_target workflows that use any value from the pull request. Workflows that only use fixed trusted values are not expected to be affected, but updating to 2.37.1 is recommended.

Fixed GitHub auth handling for Composer versions affected by GHSA-f9f8-rm49-7jv2. It should now skip configuring GitHub OAuth if affected Composer versions are installed and show a warning to upgrade. Please see GHSA-5wxr-w449-57cm

[!NOTE]
This only affects workflows where the composer version is pinned like composer:2.9.7, workflows that do not pin the version or use composer:v2 are not affected as those get automatic updates. In case you pin the version, it is highly recommended to upgrade and have automation to do such timely upgrades in your workflows.

Fixes and Improvements

Fixed support for phalcon on Windows.

Fixed restoring tools when using cached using previous runs.

Improved enabling gearman extension on Linux.

Fixed fallback when installing PhpManager and VcRedist modules on Windows.

Fixed parsing extension inputs with backslash line continuation.

Improved workflow examples

Added workflow examples for Drupal 11 composer-managed projects and WordPress plugins.

Added workflow examples for Yii3 web applications and replaced Yii2 Starter Kit examples.

Updated workflow examples to use currently supported PHP versions.

Updated OS release mappings for newer Ubuntu releases.

Updated internal workflows for Codecov v6 and NPM trusted publishing.

Updated Node.js dependencies.

Fixed composer version in README. (#1081)

Thanks @Pyker for the contribution

For the complete list of changes, please refer to the Full Changelog

Commits

7c071df Bump version to 2.37.1
eeef37e GHSA-pqwm-q9pv-ph8r - Fix CWE-78 [skip ci]
0dc3306 Fix phalcon5 support on Windows
680a983 Fix phalcon version for PHP 8.0 [skip ci]
694649a Fix mutable tool cache restore
46a991b Merge pull request #1081 from Pyker/patch-1
7748c24 GHSA-f9f8-rm49-7jv2: Fix GitHub auth handling for composer in affected versions
ac9c953 Fix composer v2 version in README
7729e41 Improve enabling gearman [skip ci]
af2322b Fix fallback in Install-PSPackage on Windows
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) in `/` from 2.37.0 to 2.37.1. Updates `shivammathur/setup-php` from 2.37.0 to 2.37.1 - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@accd612...7c071df) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-version: 2.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github_actions ... Signed-off-by: dependabot[bot] <support@github.com>

@var

* docs: add changelog and upgrade for v4.7.3 (#10068) * chore: migrate SCSS from deprecated `@import` usage (#10066) * docs: clarify `Model::find()` note for null argument (#10072) * chore: upload as artifacts the debug files of failing random execution tests (#10074) * test: indicate components that already pass random execution tests (#10073) * chore: fix wrong trigger name for manually runnable workflow (#10077) * chore: upgrade to `gvenzl/oracle-free` (#10075) * docs: fix formatting in Time library guide (#10078) * docs: update 014.php (#10083) * chore: resolve PHPStan nullCoalesce and isset errors on Config properties (#10081) * chore: resolve PHPStan nullCoalesce and isset errors on Config properties * fix tests * fix: make Autoloader composer path injectable to fix parallel test race condition (#10082) * chore(deps-dev): update rector/rector requirement Updates the requirements on [rector/rector](https://github.com/rectorphp/rector) to permit the latest version. Updates `rector/rector` to 2.4.0 - [Release notes](https://github.com/rectorphp/rector/releases) - [Commits](rectorphp/rector@2.3.9...2.4.0) --- updated-dependencies: - dependency-name: rector/rector dependency-version: 2.4.0 dependency-type: direct:development dependency-group: composer-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps-dev): update rector/rector requirement Updates the requirements on [rector/rector](https://github.com/rectorphp/rector) to permit the latest version. Updates `rector/rector` to 2.4.1 - [Release notes](https://github.com/rectorphp/rector/releases) - [Commits](rectorphp/rector@2.4.0...2.4.1) --- updated-dependencies: - dependency-name: rector/rector dependency-version: 2.4.1 dependency-type: direct:development dependency-group: composer-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * chore: remove useless @var * refactor: add full testing to `logs:clear` command (#10090) * fix: store SPL closures in register() so unregister() can remove them (#10097) * refactor: add full testing for `debugbar:clear` command (#10093) * refactor: pass `--do-not-cache-result` to prevent shared cache corruption (#10098) Co-authored-by: John Paul E Balandan <paulbalandan@gmail.com> * refactor: add full testing for `cache:clear` command (#10094) * chore: re-comment transiently failing component tests (#10095) * test: group commands tests similar to `system/Commands/` (#10096) * chore(deps): bump actions/github-script in / (#10100) Bumps [actions/github-script](https://github.com/actions/github-script) in `/` from 8.0.0 to 9.0.0. Updates `actions/github-script` from 8.0.0 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@ed59741...3a2844b) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github_actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: ensure output buffer is closed after use of `command()` (#10099) * chore: fix labeler workflow (#10104) * chore: fix labeler workflow * revert now to use pull_request_target * chore: refactor phpunit config file (#10102) * chore: fixes for php-cs-fixer and psalm (#10105) * fix: preserve null values in Validation::getValidated() (#10101) * test: refactor tests on `BaseCommand` and `Commands` (#10103) * fix: Rename phpunit.xml.dist (#10111) * fix: refactor inconsistent behavior on `CLI::write()` and `CLI::error()` (#10106) * test: fix command tests that may hang on linux due to sudo (#10107) * refactor: rename `-h` option of `routes` command as `--handler` (#10113) * fix: ensure calling `env` command with options only would not throw (#10114) * docs: Improve guide (#10109) * docs: Update "Managing your Applications" * docs: Update "Composer Installation" * docs: Update "Worker Mode" * docs: Update "Testing" * fix: Move next line * refactor: start only required services (#10115) * chore(deps): bump actions/upload-artifact in / (#10116) Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) in `/` from 7.0.0 to 7.0.1. Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@bbbca2d...043fb46) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github_actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/cache in / (#10117) Bumps [actions/cache](https://github.com/actions/cache) in `/` from 5.0.4 to 5.0.5. Updates `actions/cache` from 5.0.4 to 5.0.5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@6682284...27d5ce7) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github_actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: fix label-pr verification step (#10118) * chore: fix label-pr verification step * revert to pull request target * chore(deps-dev): update rector/rector requirement Updates the requirements on [rector/rector](https://github.com/rectorphp/rector) to permit the latest version. Updates `rector/rector` to 2.4.2 - [Release notes](https://github.com/rectorphp/rector/releases) - [Commits](rectorphp/rector@2.4.1...2.4.2) --- updated-dependencies: - dependency-name: rector/rector dependency-version: 2.4.2 dependency-type: direct:development dependency-group: composer-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * chore: fix transient random test failures (#10122) * chore(deps): bump actions/setup-node in / (#10123) Bumps [actions/setup-node](https://github.com/actions/setup-node) in `/` from 6.3.0 to 6.4.0. Updates `actions/setup-node` from 6.3.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@53b8394...48b55a0) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github_actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: suppress stty stderr leak in `CLI::generateDimensions()` when stdin is not a TTY (#10124) * refactor: further rename `--handler` to `--sort-by-handler` for `routes` (#10125) * test: optimize AutoReview tests (#10127) * refactor: UX: `ClearLogs::execute()` error message is misleading after interactive `'n'` (#10126) * docs: document Axios header configuration for AJAX (#10069) Added Axios information regarding the X-Requested-With header. * docs: refactor AJAX request and clarify framework examples (#10129) * docs: fix indentation on `4.7.2` and `4.7.3` changelogs (#10131) * docs: add version switcher to docs page (#10135) * fix: reset Kint CSP state in worker mode (#10139) Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com> * refactor: simplify `FileLocator::listFiles()` (#10142) * fix: make Time::createFromTimestamp locale-independent (#10151) * chore(deps): bump actions/labeler in / (#10161) Bumps [actions/labeler](https://github.com/actions/labeler) in `/` from 6.0.1 to 6.1.0. Updates `actions/labeler` from 6.0.1 to 6.1.0 - [Release notes](https://github.com/actions/labeler/releases) - [Commits](actions/labeler@634933e...f27b608) --- updated-dependencies: - dependency-name: actions/labeler dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github_actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: SQLSRV driver's `decrement()` method (#10155) Co-authored-by: Michal Sniatala <michal@sniatala.pl> Co-authored-by: John Paul E. Balandan, CPA <paulbalandan@gmail.com> * fix: suppress tput stderr leak when TERM is not present (#10167) * fix: support third-party loggers in toolbar logs collector (#10173) * fix: PostgreSQL Builder's `increment()` and `decrement()` methods not working for numeric columns (#10172) * test: fix random-order failures in Config, Honeypot, and Test (#10168) * chore: use single class per file when possible on tests/ directory * chore: add return array iterable doc and regenerate baseline * refactor: reduce PHPStan child return type baseline (#10165) Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com> * refactor: remove PHPStan callable signature baseline (#10166) Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com> * fix: preserve cached table list shape (#10179) * fix: preserve cached table list shape * docs: add changelog entry for cached table list fix Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com> --------- Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com> * fix: harden regex matching on `key:generate` command (#10183) * chore: apply `withRootFiles()` on rector config (#10188) * chore: apply withRootFiles() on rector config * chore: run cs fix * test: make random component execution safer (#10169) * test: make random component execution safer * test: remove unnecessary normalization Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com> * fix: stabilize cached table names for random tests Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com> * test: address review feedbacks Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com> * fix: log factories cache write failures Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com> * fix: document best-effort log chmod Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com> --------- Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com> * chore: add Structarmed to QA (#10180) * chore: Add Structarmed to QA * chore: use latest structarmed 0.3.1 * chore: bump structarmed to 0.3.2 * bump structarmed to 0.3.3 to properly fix cache on CI * chore: bump to structarmed 0.3.4 to fix very long list progressbar * chore: bump to structarmed 0.3.5 * chore: bump structarmed to 0.4.0 * chore: remove ignore platform php 8.5 on test-structarmed workflow * chore: use php 8.5 in php-versions * use tools: composer under Setup PHP * docs: fix Bitnami link (#10190) * fix: restore deep dot-notation traversal in `Language::getLine()` (#10189) * fix: make frankenphp-worker.php template idempotent on watcher restart (#10191) * chore: bump structarmed to 0.4.5 * chore: skip system/ThirdParty * fix: `Entity::normalizeValue()` must handle `UnitEnum` before `toArray()` (#10137) * chore: remove checkout step for base branch (#10194) * chore(deps-dev): update rector/rector requirement Updates the requirements on [rector/rector](https://github.com/rectorphp/rector) to permit the latest version. Updates `rector/rector` to 2.4.3 - [Release notes](https://github.com/rectorphp/rector/releases) - [Commits](rectorphp/rector@2.4.2...2.4.3) --- updated-dependencies: - dependency-name: rector/rector dependency-version: 2.4.3 dependency-type: direct:development dependency-group: composer-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump shivammathur/setup-php in / (#10201) Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) in `/` from 2.37.0 to 2.37.1. Updates `shivammathur/setup-php` from 2.37.0 to 2.37.1 - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@accd612...7c071df) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-version: 2.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github_actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Merge pull request #10198 from samsonasik/migrate-deptrac-to-structarmed chore: migrate from `deptrac` to `structarmed` * chore(deps-dev): update boundwize/structarmed requirement (#10202) Updates the requirements on [boundwize/structarmed](https://github.com/boundwize/structarmed) to permit the latest version. Updates `boundwize/structarmed` to 0.5.5 - [Release notes](https://github.com/boundwize/structarmed/releases) - [Commits](boundwize/structarmed@0.5.4...0.5.5) --- updated-dependencies: - dependency-name: boundwize/structarmed dependency-version: 0.5.5 dependency-type: direct:development dependency-group: composer-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(config): recognize disabled zlib compression values (#10193) * fix: escape `--host` option in `serve` command (#10203) * chore: bump phpstan to ^2.1.55 and fix callable docblock notice (#10219) * chore(deps-dev): update boundwize/structarmed requirement (#10218) Updates the requirements on [boundwize/structarmed](https://github.com/boundwize/structarmed) to permit the latest version. Updates `boundwize/structarmed` to 0.6.8 - [Release notes](https://github.com/boundwize/structarmed/releases) - [Commits](boundwize/structarmed@0.5.5...0.6.8) --- updated-dependencies: - dependency-name: boundwize/structarmed dependency-version: 0.6.8 dependency-type: direct:development dependency-group: composer-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Merge commit from fork * fix: validate client extension in ext_in upload rule * add changelog and upgrade notes * chore(deps-dev): bump the composer-dependencies group with 2 updates (#10224) Updates the requirements on [boundwize/structarmed](https://github.com/boundwize/structarmed) and [rector/rector](https://github.com/rectorphp/rector) to permit the latest version. Updates `boundwize/structarmed` to 0.6.15 - [Release notes](https://github.com/boundwize/structarmed/releases) - [Commits](boundwize/structarmed@0.6.8...0.6.15) Updates `rector/rector` to 2.4.4 - [Release notes](https://github.com/rectorphp/rector/releases) - [Commits](rectorphp/rector@2.4.3...2.4.4) --- updated-dependencies: - dependency-name: boundwize/structarmed dependency-version: 0.6.15 dependency-type: direct:development dependency-group: composer-dependencies - dependency-name: rector/rector dependency-version: 2.4.4 dependency-type: direct:development dependency-group: composer-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Prep for 4.7.3 release (#10227) --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com> Co-authored-by: Michal Sniatala <michal@sniatala.pl> Co-authored-by: Toto <totoprayogo1916@gmail.com> Co-authored-by: Robson Jonathas <68930311+robsonjonathas@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Abdul Malik Ikhsan <samsonasik@gmail.com> Co-authored-by: neznaika0 <ozornick.ks@gmail.com> Co-authored-by: Asad <asadkhan4230@gmail.com> Co-authored-by: memleakd <121398829+memleakd@users.noreply.github.com> Co-authored-by: Vansh Patel <developer.patelvansh@gmail.com> Co-authored-by: maniaba <61078470+maniaba@users.noreply.github.com>

dependabot Bot added dependencies Pull requests that update external dependencies github_actions Pull requests that update Github_actions code labels May 14, 2026

paulbalandan approved these changes May 14, 2026

View reviewed changes

paulbalandan merged commit 306871b into develop May 14, 2026
61 checks passed

dependabot Bot deleted the dependabot/github_actions/github_actions-636cd4b091 branch May 14, 2026 16:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump shivammathur/setup-php in /#10201

chore(deps): bump shivammathur/setup-php in /#10201
paulbalandan merged 1 commit into
developfrom
dependabot/github_actions/github_actions-636cd4b091

dependabot Bot commented on behalf of github May 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github May 14, 2026

2.37.1

Changelog

Security Updates

Fixes and Improvements

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant