chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
gitea/gitea		patch	1.27.2 → 1.27.3
phpstan/phpstan	require-dev	patch	2.2.9 → 2.2.10

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

go-gitea/gitea (gitea/gitea)

v1.27.3

Compare Source

• SECURITY
  • fix(packages): restrict/limited/token-scope access (#​39041, #​39043, #​39044, #​39047, #​39046) (#​39058)
  • fix(attachments): enforce owning repository path (#​39048) (#​39077)
  • fix(markup): enforce same-repository issue access (#​39045) (#​39054)
  • fix(actions): verify raw artifact signatures first (#​39049) (#​39053)
  • fix(api): hide limited users from restricted viewers (#​39004) (#​39039)
  • fix(repo): limit gitignore template selections (#​39027) (#​39040)
  • fix(migrations): cancel GitLab version probes (#​39023) (#​39035)
  • fix(packages): limit Swift package manifests (#​39025) (#​39032)
  • fix(migrations): bound OneDev version responses (#​39024) (#​39033)
  • fix(packages): limit Maven checksum uploads (#​39028) (#​39031)
  • fix(packages): bound Alpine metadata entries (#​39026) (#​39029)
  • fix(actions): enforce fork pull request trust boundaries (#​39005) (#​39018)
  • fix(git): restrict hook permissions (#​39008) (#​39016)
  • fix(api): enforce repository creation token authorization (#​39007) (#​39014)
  • fix(api): enforce public-only scope for compare heads (#​39006) (#​39013)
  • fix(repo): hide repositories of hidden owners (#​39009) (#​39012)
  • fix: avoid enumerating every public repository in issue search (#​38992) (#​39000)
  • refactor: private endpoints (#​38964) (#​38965)
• ENHANCEMENTS
  • enhance: add permalinks to pull request reviews (#​38849) (#​39036)
• BUGFIXES
  • fix: add missing query parameters on runner list page (#​39163)
  • fix(actions): keep step-level continue-on-error expressions unevaluated (#​39141) (#​39148)
  • fix(packages): preserve SemVer prerelease identifiers in Swift Registry (#​39156) (#​39158)
  • fix(repo): prevent MarkAsBrokenEmpty when repository is being migrated (#​39091) (#​39092)
  • fix(asymkey): do not verify OpenPGP signatures with an SSH instance key (#​39073) (#​39086)
  • fix(pull): keep the merged state in sync with git (#​39062) (#​39118)
  • fix(pull): name the head repository in default compare links (#​39075) (#​39079)
  • fix(git): parse co-author trailers that are not RFC 5322 addresses (#​39076) (#​39081)
  • fix(actions): show "Complete job" logs when the last step is skipped (#​38939) (#​39003)
  • fix(actions): Fix how jobs in matrixes are grouped (#​38980) (#​38998)
  • fix: resolve YAML anchors and aliases in Actions workflows (#​38984) (#​38996)
  • fix: honor environment variables during install (#​38974) (#​38976)
  • fix: grant limited-org unit read access to authenticated non-members (#​38871) (#​38963)
  • fix: allow anonymous theme switching when REQUIRE_SIGNIN_VIEW is set (#​38956) (#​38961)
  • fix(actions): drop wrapper span around the action status icon (#​38957) (#​38959)
  • fix(issues): sort scoped labels by exclusive order in dropdowns (#​38893) (#​38954)
  • fix(indexer): correct bleve indexer token filters (#​38853) (#​38951)
  • fix: make "login_name" field optional for API edit user (#​38917) (#​38945)
  • fix(actions): reject non-mapping matrix include/exclude (#​38933)
  • fix(ui): respect FEED_PAGING_NUM on the dashboard feed (#​38935) (#​38936)
• MISC
  • chore: repo compare link (#​39088) (#​39119)
  • ci: remove AWS S3 uploads from release workflows (#​38928) (#​38929)
  • chore: Pre-register a builtin OAuth2 application for the official Gitea mobile app (#​38880) (#​38922)

phpstan/phpstan-phar-composer-source (phpstan/phpstan)

v2.2.10

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov-commenter]

⚠️ Unsupported file format

Upload processing failed due to unsupported file format. Please review the parser error message:

Error parsing JUnit XML in /home/runner/work/worker/worker/drupal-src/core/modules/update/tests/fixtures/release-history/aaa_update_test.no-releases.xml at 2:8
Caused by:

RuntimeError: Error accessing saved testrun

For more help, visit our troubleshooting guide.

[github-actions]

Class A Metrics

Commit 03ece78. Counts and bytes only: no duration is collected here, because an absolute CPU figure comes only from cpuTime on a deployed worker. See docs/measurement-classes.md.

Baseline: the last passing master run at bd454d4.

PASS - 14 check(s) evaluated, 3 skipped

Reading

• Free envelope fits: 100,000 views/day bound by Worker requests, and 2,777 regenerations/day bound by Durable Object requests (10,869 windowed).
• Writes 3,246 charged rows for 1,316 rows of data. 56.1% of every stored row is index maintenance across 157 explicit indexes, and the floor is 1 charged rows per row.
• Pack 1,316 rows in 62 chunks, 2,945,256 payload bytes. Every chunk is a migration step replayed into the object on first boot.
• Driver pack 71 files, 548,027 bytes, +4,307 against the baseline; these are bundled into the worker, so they spend the same ceiling.
• Suites 196 workers spec files and 61 node spec files.

Metric	Baseline	Current	Delta	Rule	Verdict
bundle.gzippedBytes	-	-	-	<= 3,145,728	skipped - the metric was not collected
bundle.gzippedBytes	-	-	-	+32,768 max	skipped - the metric was not collected
driverPack.bytes	543,720	548,027	+4,307	+10.0% max	pass
driverPack.files	70	71	+1	no decrease	pass
indexAudit.explicitIndexes	157	157	0	+0 max	pass
indexAudit.chargedRows	3,246	3,246	0	+2.0% max	pass
indexAudit.indexShare	0.5607	0.5607	0	+0.01 max	pass
indexAudit.minChargePerRow	1	1	0	no decrease	pass
packShape.rows	1,316	1,316	0	+5.0% max	pass
packShape.payloadBytes	2,945,256	2,945,256	0	+5.0% max	pass
packShape.chunks	62	62	0	+4 max	pass
freeEnvelope.verdict	fits	fits	-	== fits	pass
freeEnvelope.servingViewsPerDay	100,000	100,000	0	no decrease	pass
freeEnvelope.regenerationsPerDay	2,777	2,777	0	no decrease	pass
tests.specFiles.workers	196	196	0	no decrease	pass
tests.specFiles.node	61	61	0	no decrease	pass
tests.cases.workers	-	-	-	no decrease	skipped - the metric was not collected

Not Collected

Metric	Reason
bundle	wrangler dry-run failed: Command failed: bunx wrangler deploy -c wrangler.jsonc --dry-run --outdir /home/runner/work/worker/worker/dist/metrics-dry-run
tests.cases	vitest list failed: Command failed: bunx vitest list --project=workers --json