[dependabot]

Bumps the action-runners group with 5 updates:

Package	From	To
PHPCSStandards/.github/.github/workflows/reusable-yamllint.yml	1.2.2	1.3.0
PHPCSStandards/.github/.github/workflows/reusable-markdownlint.yml	1.2.2	1.3.0
streetsidesoftware/cspell-action	9.1.0	9.2.0
shivammathur/setup-php	2.37.2	2.40.0
actions/upload-artifact	7.0.1	7.0.2

Updates PHPCSStandards/.github/.github/workflows/reusable-yamllint.yml from 1.2.2 to 1.3.0

Release notes

Sourced from PHPCSStandards/.github/.github/workflows/reusable-yamllint.yml's releases.

v1.3.0 - 2026-10-04

Added

• New reusable workflow: "reusable-pinact". #52 This workflow will verify that any action runners used in GitHub actions workflows are pinned and that these pins are correct and follow specified "cooldown" rules. To start using this workflow, add a .pinact.yaml file to a repository and add a GHA job referencing the reusable workflow.

Changed

• Clarified thread model in the security policy (which applies to all repos in this org). #49 Props @​edorian.
• All workflows: the permissions needed for each (reusable) job are now explicitly set and documented. #53 It is recommended for repositories using the reusable workflows to apply the recommended permissions to their jobs as well. The recommended permissions are as follows:
  • reusable-findtokenprops.yml: contents: read
  • reusable-markdownlint.yml: contents: read
  • reusable-pinact.yml: contents: read
  • reusable-phpstan.yml: contents: read
  • reusable-remark.yml: contents: read
  • reusable-yamllint.yml: contents: read
• All workflows will now respect a 10 day "cooldown" period before external action runners are updated to a new version. #50
• reusable-phpstan.yml: the workflow will now fail early if PHPStan could not be acquired. #48
• reusable-markdownlint.yml: DavidAnson/markdownlint-cli2-action was bumped from v24.1.0 to v24.2.0.
• reusable-remark.yml: reviewdog/action-remark-lint was bumped from v5.18.0 to v5.20.0.
• Minor documentation improvements.

Commits

• 559f404 README: list available reusable workflows alphabetically
• ac0489b GH Actions: Bump reviewdog/action-remark-lint
• ee193c0 README: improve formatting for readability
• 47f9487 QA: add pinact GHA job and configuration
• 37fff7f New reusable workflow to run the Pinact tool
• b1c1d33 GH Actions: set permissions for each workflow/job (#53)
• 2a9d449 Propose Trust/Thread model section in SECURITY.md (#49)
• 5544c3c GH Actions: Bump DavidAnson/markdownlint-cli2-action
• 58b7623 Dependabot: add cooldown period
• 1f74e60 GH Actions: fail "setup-php" if requested tooling could not be installed
• See full diff in compare view

Updates PHPCSStandards/.github/.github/workflows/reusable-markdownlint.yml from 1.2.2 to 1.3.0

Release notes

Sourced from PHPCSStandards/.github/.github/workflows/reusable-markdownlint.yml's releases.

v1.3.0 - 2026-10-04

Added

• New reusable workflow: "reusable-pinact". #52 This workflow will verify that any action runners used in GitHub actions workflows are pinned and that these pins are correct and follow specified "cooldown" rules. To start using this workflow, add a .pinact.yaml file to a repository and add a GHA job referencing the reusable workflow.

Changed

• Clarified thread model in the security policy (which applies to all repos in this org). #49 Props @​edorian.
• All workflows: the permissions needed for each (reusable) job are now explicitly set and documented. #53 It is recommended for repositories using the reusable workflows to apply the recommended permissions to their jobs as well. The recommended permissions are as follows:
  • reusable-findtokenprops.yml: contents: read
  • reusable-markdownlint.yml: contents: read
  • reusable-pinact.yml: contents: read
  • reusable-phpstan.yml: contents: read
  • reusable-remark.yml: contents: read
  • reusable-yamllint.yml: contents: read
• All workflows will now respect a 10 day "cooldown" period before external action runners are updated to a new version. #50
• reusable-phpstan.yml: the workflow will now fail early if PHPStan could not be acquired. #48
• reusable-markdownlint.yml: DavidAnson/markdownlint-cli2-action was bumped from v24.1.0 to v24.2.0.
• reusable-remark.yml: reviewdog/action-remark-lint was bumped from v5.18.0 to v5.20.0.
• Minor documentation improvements.

Commits

• 559f404 README: list available reusable workflows alphabetically
• ac0489b GH Actions: Bump reviewdog/action-remark-lint
• ee193c0 README: improve formatting for readability
• 47f9487 QA: add pinact GHA job and configuration
• 37fff7f New reusable workflow to run the Pinact tool
• b1c1d33 GH Actions: set permissions for each workflow/job (#53)
• 2a9d449 Propose Trust/Thread model section in SECURITY.md (#49)
• 5544c3c GH Actions: Bump DavidAnson/markdownlint-cli2-action
• 58b7623 Dependabot: add cooldown period
• 1f74e60 GH Actions: fail "setup-php" if requested tooling could not be installed
• See full diff in compare view

Updates streetsidesoftware/cspell-action from 9.1.0 to 9.2.0

Release notes

Sourced from streetsidesoftware/cspell-action's releases.

v9.2.0

9.2.0 (2026-10-14)

Features

• Update CSpell version (10.4.0) (#2765) (7c68ec4)

Updates and Bug Fixes

• Workflow Bot -- Update ALL Dependencies (main) (#2760) (21cf57f)

Changelog

Sourced from streetsidesoftware/cspell-action's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

9.2.0 (2026-10-14)

Features

• Update CSpell version (10.4.0) (#2765) (7c68ec4)

Updates and Bug Fixes

• Workflow Bot -- Update ALL Dependencies (main) (#2760) (21cf57f)

9.1.0 (2026-09-04)

Features

• Update CSpell version (10.1.0) (#2746) (16fdd45)
• Update CSpell version (10.2.0) (#2755) (61bcff2)

Updates and Bug Fixes

• Update CSpell version (10.1.1) (#2748) (705b9d5)
• Update CSpell version (10.2.1) (#2756) (ff193e1)
• Update CSpell version (10.2.2) (#2758) (86da7af)
• Update Dictionaries and Dependencies (#2743) (13f222e)
• Update Dictionaries and Dependencies (#2753) (2f47bea)
• Workflow Bot -- Update ALL Dependencies (main) (#2747) (388fa3e)
• Workflow Bot -- Update ALL Dependencies (main) (#2752) (c0b97ad)

9.0.1 (2026-08-15)

Updates and Bug Fixes

• make sure the dictionaries are up to date. (#2733) (ed61a9e)

9.0.0 (2026-08-15)

⚠ BREAKING CHANGES

• Update CSpell version (10.0.0) (#2675)

Features

... (truncated)

Commits

• ce1816e chore(main): release 9.2.0 (#2763)
• 16ee533 chore: Update PNPM (#2742)
• 06c3500 ci: Workflow Bot -- Update ALL Dependencies (main) (#2764)
• 347d092 chore(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 (#2772)
• 7c68ec4 feat: Update CSpell version (10.4.0) (#2765)
• 21cf57f fix: Workflow Bot -- Update ALL Dependencies (main) (#2760)
• 4a0b063 chore(deps-dev): bump tsdown from 0.22.14 to 0.23.0 (#2761)
• d774735 chore: Workflow Bot -- Update ALL Dependencies (main) (#2759)
• See full diff in compare view

Updates shivammathur/setup-php from 2.37.2 to 2.40.0

Release notes

Sourced from shivammathur/setup-php's releases.

2.40.0

Changelog

• Added support for PHP 8.7 nightly builds. This installs PHP builds from the master branch of php/php-src.

- name: Setup PHP 8.7
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.7'

• Added support for Ubuntu 26.04 (ubuntu-26.04). (#1083)

• Added support for pinning tools to SHA-256 and SHA-512 checksums. (#1098, #1099)

- name: Setup PHP with tools pinned to checksums
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: >
      composer:2.9.8@sha256:59b2c50e10cafa0d8efc19ede9a326d782f096c674a26baf98cf042ce23de890,
      phpunit:12.5.0@sha512:76430b433bd57f96e5fbbabaefc0c82e3a5b19b1a366bd836614344c441a7a87575d77faa07e0e58ecec52061af67584b036adc4311f0764bd4414bc62be4684

• Fixed support for Couchbase, Oracle, and IBM extensions on Ubuntu 26.04. (#1123)

• Added support for cpx. (#1104)

- name: Setup PHP with cpx
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: cpx

• Added support for Laravel Cloud CLI. (#1106)

- name: Setup PHP with Laravel Cloud CLI
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: laravel-cloud

• Added configurable verbose logging using the verbose environment variable. Set it to true or v to show command output, or vv or vvv to also enable tracing. Also, deprecated the verbose and more-verbose tags in favor of this environment variable. (#1077, #1118, #1119)

... (truncated)

Commits

• eb7c497 Bump version to 2.40.0
• 7d671ba Resolve PHP formula aliases before invoking Homebrew
• 57747c1 Allow opt-in builds cache on Blacksmith and Depot runners
• 421f97f Keep verbose tests in TypeScript
• dc7811a Bump Node.js dependencies
• 7932293 Bump the github-actions group with 3 updates (#1130)
• 87d00bd Default "Are you willing to submit a PR?" to "No" (#1126)
• f458a14 Remove macOS 14 from README runner listings
• bc12f5c Switch to homebrew-extensions for geos on macOS [skip ci]
• bbf0b63 Try Brew extension installs before refreshing Homebrew
• Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

=== This is an auto-generated comment ===

Thank you for your PR.
A dry-run has been executed on your PR, executing all markdown pre-processing for the wiki files.

Please review the resulting final markdown files via the created artifact.
This is especially important when adding new pages or updating auto-generated output blocks.

N.B.: the above link will automatically be updated when this PR is updated.