Bump the dependencies group with 3 updates

[dependabot]

Bumps the dependencies group with 3 updates: composer/semver, phpro/grumphp and phpstan/phpstan.

Updates composer/semver from 3.5.0 to 3.5.1

Release notes

Sourced from composer/semver's releases.

3.5.1

• Fixed Intervals::isSubsetOf() returning false for < 0.0.0, which now correctly matches nothing and so is a subset of any constraint (#192)

Full Changelog: composer/semver@3.5.0...3.5.1

Changelog

Sourced from composer/semver's changelog.

[3.5.1] 2026-10-05

• Fixed Intervals::isSubsetOf() returning false for < 0.0.0, which now correctly matches nothing and so is a subset of any constraint (#192)

Commits

• 5289482 Update changelog
• 7445d2f Fix Intervals::isSubsetOf() returning false for < 0.0.0 (#192)
• 4221b9e Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.4 (#190)
• See full diff in compare view

Updates phpro/grumphp from 2.24.0 to 2.25.0

Release notes

Sourced from phpro/grumphp's releases.

Version 2.25.0

Security

GrumPHP passed repository files to external tools as plain arguments, so a file whose name starts with - could be read as an option, such as --config, instead of a path. Paths starting with - are now prefixed with ./, and the git_blacklist task matches file names literally. See GHSA-fmpp-rfr9-jgpg for details.

Thanks to @​jf0x3a for reporting this responsibly.

What's Changed

• Prevent file paths from being parsed as tool options by @​veewee in phpro/grumphp#1234
• Bump composer/composer from 2.10.2 to 2.10.3 by @​dependabot[bot] in phpro/grumphp#1230

Full Changelog: phpro/grumphp@v2.24.0...v2.25.0

Commits

• 8af6688 2.25.0 release
• 1527e25 Merge pull request #1230 from phpro/dependabot/composer/composer/composer-2.10.3
• 20efaf9 Bump composer/composer from 2.10.2 to 2.10.3
• 107a8e4 Merge pull request #1234 from veewee/bugfix/option-like-file-paths
• 47ced84 Prevent file paths from being parsed as tool options
• See full diff in compare view

Updates phpstan/phpstan from 2.2.16 to 2.3.1

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.77%. Comparing base (fb20a25) to head (1bd583c).

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #2052   +/-   ##
=========================================
  Coverage     92.77%   92.77%           
  Complexity     2037     2037           
=========================================
  Files           126      126           
  Lines          7345     7345           
=========================================
  Hits           6814     6814           
  Misses          531      531           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Try the dev build for this PR: https://acquia-cli.s3.amazonaws.com/build/pr/2052/acli.phar

curl -OL https://acquia-cli.s3.amazonaws.com/build/pr/2052/acli.phar
chmod +x acli.phar