From a4e146c9b7549a45499baaa451399a81dae98614 Mon Sep 17 00:00:00 2001 From: Mark Beech Date: Mon, 11 May 2026 21:21:08 +0100 Subject: [PATCH] Drop PHP 7.1 support; tighten phpunit constraint MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes the open Dependabot alert on phpunit/phpunit (GHSA-vvj3-c3rp-c85p — unsafe deserialization in PHPT code coverage handling, fixed in 8.5.52). The previous require-dev constraint `^4.8|^5.5|^6.5|^7.5|^8.5.52|^9.4` still let composer resolve a vulnerable phpunit on PHP 7.1, because 8.5.52 needs PHP 7.2+. Changes: - composer.json: phpunit/phpunit narrowed to `^8.5.52|^9.4`. - composer.json: runtime requirement bumped from `>=7.1.0` to `>=7.2.0` to reflect that we no longer test or attest PHP 7.1. PHP 7.1 has been EOL since December 2019. - test.yml: PHP 7.1 dropped from the matrix. src/ does not use any PHP 7.2+ syntax, so the library itself is unaffected. Existing 7.1 installs simply won't pull the new release. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/test.yml | 2 +- composer.json | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index d72df8c..3902553 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -12,7 +12,7 @@ jobs: strategy: fail-fast: true matrix: - php: [7.1, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2, 8.3, 8.4] + php: [7.2, 7.3, 7.4, 8.0, 8.1, 8.2, 8.3, 8.4] name: PHP:${{ matrix.php }} diff --git a/composer.json b/composer.json index 68fcc4e..3c3592b 100644 --- a/composer.json +++ b/composer.json @@ -13,10 +13,10 @@ } ], "require": { - "php": ">=7.1.0" + "php": ">=7.2.0" }, "require-dev": { - "phpunit/phpunit": "^4.8|^5.5|^6.5|^7.5|^8.5.52|^9.4" + "phpunit/phpunit": "^8.5.52|^9.4" }, "autoload": { "psr-4": {