Lock file maintenance (cakephp-5.x)

[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "before 4am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Neluxx]

@ravage84 Here we have a case where the CI check for the lowest possible dependencies fails.
We could now identify which dependency is causing the failure and bump it to a version where all checks pass again.

The question that arises here is: Is it worth the effort, and are we responsible for ensuring that even the lowest possible dependencies work, or can we ignore this?

[ravage84]

@ravage84 Here we have a case where the CI check for the lowest possible dependencies fails. We could now identify which dependency is causing the failure and bump it to a version where all checks pass again.

The question that arises here is: Is it worth the effort, and are we responsible for ensuring that even the lowest possible dependencies work, or can we ignore this?

Once we start ignoring build errors, the whole setup becomes questionable.

The error comes from Slevomat's PHP CS Standard:

> phpcs
ERROR: Property "newlinesCountAfterDeclare" does not exist on sniff SlevomatCodingStandard.TypeHints.DeclareStrictTypes.
ERROR: Property "newlinesCountBetweenOpenTagAndDeclare" does not exist on sniff SlevomatCodingStandard.TypeHints.DeclareStrictTypes.
ERROR: Property "enableStaticTypeHint" does not exist on sniff SlevomatCodingStandard.TypeHints.PropertyTypeHint.

Run "phpcs --help" for usage information

Script phpcs handling the cs-check event returned with error code 3
Script @cs-check was called via check
Error: Process completed with exit code 3.

Apparently, even with PHP 8.4 with the lowest dependencies, some CS config properties which are referenced somewhere aren't available.

[...]
    - Downgrading cakephp/cakephp-codesniffer (5.3.1 => 5.0.0)
[...]
    - Downgrading slevomat/coding-standard (8.31.1 => 8.4.0)
[...]

With the lowest dependencies in the CI matrix, the lowest dependencies will be fetched through composer update --prefer-lowest..

prefer-lowest:

Prefer lowest versions of dependencies. Useful for testing minimal versions of requirements, generally used with --prefer-stable. [...]

That likely means our lower bound requirement for cakephp/cakephp-codesniffer is too low.

Likely, the CakePHP Codesniffer ruleset references these config properties mentioned above., at some point.

E.g. newlinesCountAfterDeclare was introduced in commit slevomat/coding-standard@52cca43 and released in 8.31.1 but CakePHP's CodeSniffer lowest bound requirement is 8.23 of Slevomat's., even in the newest version.
CakePHP CodeSniffer had it removed in commit cakephp/cakephp-codesniffer@4728b69, again .

Solution: Bump the requirement of cakephp/cakephp-codesniffer to the version after the removal of all config properties mentioned above. Version 5.1.1 still contains references to enableStaticTypeHint.

FYI, @orca-services

[Neluxx]

Once we start ignoring build errors, the whole setup becomes questionable.

Not quite. We would still have the CI checks, which use the highest possible dependencies. This is also the situation most users encounter. Checking for the lowest possible dependencies is a nice-to-have feature, but it only affects a small niche.

But sure, we can bump the affected dependency so that no more errors are thrown.

[Neluxx]

I've bumped the minimum version of cakephp/cakephp-codesniffer to 5.2.1. This is the lowest version for which all tests passed successfully.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.