[jutaz]

This closes both open Dependabot alerts, both dev-only: phpunit/phpunit ^4.7 → ^12 (CVE-2026-24765) and squizlabs/php_codesniffer ^2.3 → ^3.13.6 (CVE-2026-67434). Bumps went through composer require, not hand edits. There's no composer.lock here (it's gitignored), so Dependabot only reads composer.json.

composer install was already failing on master, because Composer 2 now refuses to load the vulnerable releases at all. PHPUnit 8.5 is EOL, so this goes to ^12 rather than its one-off CVE backport: the explicit phpunit/php-code-coverage pin is gone (PHPUnit pulls the matching version itself), phpunit.xml.dist is migrated to the 12 schema, and .phpunit.cache is ignored. paragonie/random_compat is dropped too, since random_bytes() is core on the 8.3 this package requires.

.travis.yml was dead (PHP 7.1/7.2/hhvm can never satisfy php-64bit >=8.3), so it's replaced by .github/workflows/build.yml: composer validate/install/audit, make lint, make check-style and make test on 8.3 and 8.4. Both jobs are green on this PR, and the README badge points at it.

There are still no tests in this repo (the README has - [ ] Tests), so phpunit just reports "No tests executed". phpcs --standard=PSR2 src/ tests/ passes all 47 files, composer validate passes and composer audit is clean.

[lucijaff]

Non-blocking:

• .travis.yml is dead (PHP 7.1/7.2/hhvm can never satisfy php-64bit >=8.3), so nothing runs on this or future bumps. Suggest deleting it or replacing it with a small Actions workflow (composer install, composer audit, make check-style, make test) on 8.3/8.4.

[jutaz]

Thanks - replaced .travis.yml with a small Actions workflow in ad80fa0: composer validate, composer install, composer audit, then make lint, make check-style and make test on 8.3 and 8.4. It runs on this PR, so the next bump has something watching it.

[brianmuse]

Looks good. The only require entry is still php-64bit >=8.3.0, so consumers see no change; every bump and removal is dev-only, and dropping the random_compat suggest is safe since NativeRandomByteGenerator calls core random_bytes(). The new workflow runs on plain pull_request on 8.3 and 8.4, uses no secrets, and the make lint, check-style and test targets it calls all exist; both jobs are green at this head.