grasmash / yaml-expander / 27322984840

100%

master: 100%

push

github

Modernize library: PHP 8.1+, PHPUnit 13, security fixes, CI overhaul

Dependencies:
- Require PHP >= 8.1 and declare psr/log explicitly (^2 || ^3)
- symfony/yaml ^6.4.40 || ^7.4.12 || ^8.0.12 (excludes CVE-2026-45304)
- phpunit ^10.5.62 || ^11.5.50 || ^12.5.8 || ^13 (excludes CVE-2026-24765)
- Drop php-coveralls (pulled vulnerable guzzle/psr7 at lowest versions);
  upload coverage via coverallsapp/github-action instead
- grasmash/expander ^3.0.1, php_codesniffer ^3.13, refresh composer.lock

Source:
- Add strict_types and native parameter/return type declarations
- Make the constructor logger optional, defaulting to NullLogger
- parse(): return [] for empty YAML and throw UnexpectedValueException
  for YAML that parses to a non-array, instead of an opaque TypeError

Tests:
- Migrate to PHPUnit 13: attributes, static data provider, new schema
  (the old 9.3-schema config silently ran zero tests under PHPUnit 13)
- Add tests for optional logger, empty input, scalar input, invalid
  YAML, and unresolved-placeholder passthrough

CI:
- Fix prefer-lowest job: the HIGHEST_LOWEST matrix env var was never
  exported, so lowest-deps testing silently never ran
- Test PHP 8.1-8.4, lowest deps on 8.1, coverage on 8.4
- Pin all actions to commit SHAs; add Dependabot for composer/actions

Docs:
- Rewrite README examples to match the actual instance API, document
  exception behavior, add Requirements/Security/Development sections
- Populate empty CONTRIBUTING.md; fix RELEASE.md (referenced
  nonexistent scripts); fix coveralls badge branch; fix typos

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

12 of 12 new or added lines in 1 file covered. (100.0%)

18 of 18 relevant lines covered (100.0%)

3.94 hits per line