Update dependencies to address security advisories, #PG-5387 (#644)

* Update dependencies to address security advisories, #PG-5387

* Downgrade the scoped dependencies to PHP 8.1

* Resolve dependencies against the minimum PHP this branch supports

* Date the 6.0.0 changelog entry for the next release Monday

Author: snake14

.github/workflows/min-php-lint.yml

@@ -0,0 +1,49 @@
+name: Minimum PHP lint
+
+# The scoped dependencies in vendor/prefixed are transpiled down to the oldest PHP this plugin supports. Tests do not
+# prove that worked, because a file is only parsed when something loads it, so lint every file against that PHP.
+
+on: pull_request
+
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: none
+  issues: read
+  packages: none
+  pull-requests: read
+  repository-projects: none
+  security-events: none
+  statuses: read
+
+jobs:
+  min-php-lint:
+    name: Lint scoped dependencies on minimum PHP
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          lfs: false
+          persist-credentials: false
+      - name: Setup PHP
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
+        with:
+          php-version: '8.1'
+      - name: Lint vendor/prefixed
+        run: |
+          if [ ! -d vendor/prefixed ]; then
+            echo "No vendor/prefixed directory to lint."
+            exit 0
+          fi
+          status=0
+          while IFS= read -r file; do
+            if ! error=$(php -l "$file" 2>&1); then
+              echo "::error file=${file}::${error}"
+              status=1
+            fi
+          done < <(find vendor/prefixed -name '*.php')
+          if [ "$status" -ne 0 ]; then
+            echo "Scoped dependencies do not parse on PHP 8.1. Re-run the scoper."
+          fi
+          exit $status

CHANGELOG.md

@@ -1,8 +1,9 @@
 ## Changelog
 
-# 6.0.0 - 2026-08-11
+# 6.0.0 - 2026-08-24
 
 - Compatibility with Matomo 6
+- Updated dependencies to address security advisories
 
 # 5.2.1 - 2026-08-03
 - Added PHPStan static analysis (CI check and pre-push hook)

README.md

@@ -27,9 +27,9 @@ This is done using the [Rector library](https://github.com/rectorphp/rector-down
 use Rector\Config\RectorConfig;
 
 return static function (RectorConfig $rectorConfig): void {
-    // Matomo requires PHP >= 7.2.5, but PHP 7.3 is close enough. We don't want to downgrade further than necessary.
+    // Matomo 6 requires PHP >= 8.1. We don't want to downgrade further than necessary.
     $rectorConfig->sets([
-        \Rector\Set\ValueObject\DowngradeLevelSetList::DOWN_TO_PHP_73
+        \Rector\Set\ValueObject\DowngradeLevelSetList::DOWN_TO_PHP_81
     ]);
 
     $rectorConfig->skip([
@@ -39,4 +39,8 @@ return static function (RectorConfig $rectorConfig): void {
 ```
 With all that in place, you should be able to run Rector like so: `vendor/bin/rector process {path_to_this_plugin/vendor/prefixed} --config={path_to_config_file}`
 
+The downgrade level has to match this branch's minimum PHP, not Matomo 5's.
+
+Before updating anything, note that `composer.json` pins `config.platform.php` to this branch's minimum. Composer otherwise resolves against whatever PHP you happen to be running, and a newer one silently produces a lock that will not install on the minimum — `ramsey/uuid` pulls in `brick/math`, whose recent releases require PHP 8.2. Keep that pin in place when regenerating. The `min-php-lint` workflow is the backstop, since tests only parse a file when something loads it.
+
 > **_NOTE:_**  For Matomo developers, there's an internal DevPluginCommands plugin with a command that handles scoping and running Rector. See the SearchEngineKeywordsPerformance plugin's README.md for more details.

composer.json

@@ -1,21 +1,23 @@
 {
     "require": {
         "php": ">=8.1.0",
-        "google/apiclient": "^2.15.3",
-        "google/apiclient-services": "^0.224.1",
-        "guzzlehttp\/guzzle": "7.10.1",
-        "guzzlehttp\/psr7": "2.10.4",
+        "google/apiclient": "^2.19.4",
+        "google/apiclient-services": "^0.454.0",
+        "guzzlehttp\/guzzle": "7.15.3",
+        "guzzlehttp\/psr7": "2.13.0",
         "guzzlehttp\/promises": "^2.3",
-        "paragonie/constant_time_encoding": "2.5.0",
-        "phpseclib/phpseclib": "3.0.52",
+        "phpseclib/phpseclib": "3.0.56",
         "phpseclib/bcmath_compat": "^2.0",
         "google/analytics-admin": "^0.22.2",
         "google/analytics-data": "^0.17.1",
         "google/protobuf": "4.33.6",
         "symfony/deprecation-contracts": "^2.5"
     },
     "config": {
-        "platform-check": false
+        "platform-check": false,
+        "platform": {
+            "php": "8.1.0"
+        }
     },
     "replace": {
         "monolog/monolog": "*"