chore(deps): refresh Go and PHP dependencies, align CI tooling

[pjcdawkins]

Routine dependency hygiene across the Go and PHP halves of the CLI, plus a couple of CI fixes uncovered along the way. Each step is a separate commit, in order:

Go (./)

• Bumped the go directive from 1.25 to 1.26.2. CI picks the toolchain up via go-version-file: ./go.mod.
• Ran go get -u ./... and go mod tidy to take the latest minor/patch of every dependency. Direct module bumps:
  • alecthomas/chroma/v2 v2.20.0 → v2.23.1
  • fatih/color v1.18.0 → v1.19.0
  • go-chi/chi/v5 v5.2.3 → v5.2.5
  • go-playground/validator/v10 v10.27.0 → v10.30.2
  • gofrs/flock v0.12.1 → v0.13.0
  • spf13/cobra v1.10.1 → v1.10.2
  • symfony-cli/terminal v1.0.7 → v1.0.9
  • upsun/whatsun v0.1.0 → v0.2.0
  • golang.org/x/crypto v0.42.0 → v0.50.0
  • golang.org/x/oauth2 v0.31.0 → v0.36.0
  • golang.org/x/sync v0.17.0 → v0.20.0
  • golang.org/x/term v0.35.0 → v0.42.0

PHP (./legacy)

• composer update for the latest minor/patch of every dependency. Direct package bumps:
  • composer/ca-bundle 1.5.5 → 1.5.11
  • friendsofphp/php-cs-fixer 3.92.3 → 3.95.1
  • giggsey/libphonenumber-for-php-lite 8.13.52 → 8.13.55
  • guzzlehttp/guzzle 7.9.2 → 7.10.0
  • phpunit/phpunit 11.5.1 → 11.5.55
  • symfony/config 7.2.0 → 7.4.8
  • symfony/console 7.4.1 → 7.4.8
  • symfony/dependency-injection 7.2.0 → 7.4.8
  • symfony/event-dispatcher 7.4.0 → 7.4.8
  • symfony/filesystem 7.4.0 → 7.4.8
  • symfony/finder 7.4.0 → 7.4.8
  • symfony/polyfill-iconv 1.31.0 → 1.37.0
  • symfony/polyfill-mbstring 1.33.0 → 1.37.0
  • symfony/process 7.4.0 → 7.4.8
  • symfony/var-dumper 7.3.0 → 7.4.8
  • symfony/yaml 7.2.0 → 7.4.8
• Refreshed one phpstan-baseline.neon pattern after the bump from phpstan 1.12.13 to 1.12.33 (one ignored error pattern needed updating to match phpstan's refined message).
• Took the four php-cs-fixer auto-fixes that 3.95 introduced (single-line closures expanded to multi-line) in AutoscalingSettingsSetCommand.php, OrganizationCreateCommand.php, ResourcesCommandBase.php, and ActivityMonitor.php.

Three direct PHP packages had a major version available that I deliberately did not take under the routine-hygiene framing — worth tracking separately: doctrine/cache 1 → 2 (and abandoned upstream), giggsey/libphonenumber-for-php-lite 8 → 9, and rector/rector 1 → 2.

Bundled PHP runtime

Bumped the PHP runtime that ships with the CLI from 8.4.16 to 8.4.20 by updating PHP_VERSION in the Makefile. Binaries are downloaded at build time from upsun/cli-php-builds, so this is a one-line change.

CI alignment + new gosec findings

CI was pinning golangci/golangci-lint-action@v9 to version: v2.7 (resolves to v2.7.2), while contributors running newer versions locally were hitting nine gosec findings that CI never surfaced. Bumped the pinned version to v2.11 so the two stay in step.

Addressed the nine new findings as follows:

• Excluded pkg/mockapi/, pkg/mockssh/, and integration-tests/ from gosec in .golangci.yml. Those directories are mock servers and the integration test harness, where gosec's taint analysis is just noise. Removed four inline //nolint:gosec directives that the path exclusion makes redundant.
• Three production-code findings get inline //nolint:gosec with reasons:
  • internal/config/config.go G304: the config path comes from $CLI_CONFIG_FILE, which the operator is deliberately pointing the CLI at.
  • internal/config/dir.go G301: 0o700 already restricts to the user, and the path is the user's own cache dir.
  • internal/init/command.go G115: file descriptors fit in an int on all supported platforms (standard idiom for term.IsTerminal).

Workflow action versions

Audit found one broken pin and several actions a major or two behind. Split into two commits so the higher-risk release-path bumps can be reverted independently if the next tagged release surfaces an issue.

Safe bumps (04ae5082):

• actions/checkout v4 → v6 (in ci.yml, security.yml, release.yml; test-installer.yml was already on v6)
• actions/cache v4 → v5
• actions/add-to-project RELEASE_VERSION → v1 — the placeholder from the upstream README example was never substituted, so the issue-to-project workflow has been failing silently
• trufflesecurity/trufflehog left on @main intentionally, with a comment explaining why. I initially tried to pin it to @v3, but trufflehog only ships specific patch tags (no moving major-version tag). Since this is a secret scanner we want every run to use the latest detector set rather than freezing the rule set on the day a tag was cut.

Release-path bumps (417878dc):

• aws-actions/configure-aws-credentials v4 → v6
• actions/create-github-app-token v2 → v3
• docker/setup-buildx-action v3 → v4
• docker/login-action v3 → v4
• docker/build-push-action v5 → v7

The common breaking change across those five is Node 24 + small input/env cleanup. None of the removed inputs or envs are referenced in release.yml, and the GitHub-hosted runners already exceed the required runner version, so this should be transparent on the next release.

Supersedes

This PR rolls eleven open Dependabot PRs into one consistent update so they can be closed together: #1, #3, #4, #5, #6, #7, #8, #9, #10, #11, #12. Two of those (#3 libphonenumber 8 → 9 and #7 rector 1 → 2) are major-version bumps that this PR does not take — leaving them for a deliberate, separate look.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Routine dependency updates across the Go and legacy PHP codebases, plus CI/workflow alignment (including updated golangci-lint pinning and gosec handling) to keep local and CI tooling consistent.

Changes:

• Updated Go module dependencies and adjusted gosec handling (path exclusions + targeted inline suppressions).
• Updated legacy PHP dependencies (composer.lock), refreshed phpstan baseline, and applied php-cs-fixer formatting changes.
• Refreshed GitHub Actions workflow versions and fixed a broken action pin.

Reviewed changes

Copilot reviewed 18 out of 20 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
go.mod	Bumps Go version directive and updates Go dependencies.
.golangci.yml	Excludes mock/integration paths from gosec to reduce false positives.
internal/config/config.go	Adds scoped gosec suppression for reading config path from env.
internal/config/dir.go	Adds scoped gosec suppression for MkdirAll permissions finding.
internal/init/command.go	Adds scoped gosec suppression for terminal FD conversion (G115).
integration-tests/tests.go	Removes redundant inline gosec suppression in excluded test harness.
pkg/mockapi/id.go	Removes redundant inline gosec suppressions in excluded mock code.
pkg/mockapi/auth_server.go	Removes redundant inline gosec suppressions in excluded mock code.
pkg/mockssh/server.go	Removes redundant inline gosec suppression in excluded mock code.
legacy/composer.lock	Updates PHP dependencies to latest minor/patch versions.
legacy/phpstan-baseline.neon	Updates an ignore pattern to match phpstan’s refined message.
legacy/src/Service/ActivityMonitor.php	php-cs-fixer formatting changes (closure expansion).
legacy/src/Command/Resources/ResourcesCommandBase.php	php-cs-fixer formatting changes (closure expansion).
legacy/src/Command/Organization/OrganizationCreateCommand.php	php-cs-fixer formatting changes (closure expansion).
legacy/src/Command/Autoscaling/AutoscalingSettingsSetCommand.php	php-cs-fixer formatting changes (closure expansion).
.github/workflows/ci.yml	Updates checkout/cache actions and golangci-lint version pin.
.github/workflows/security.yml	Updates checkout and trufflehog action pins.
.github/workflows/release.yml	Updates checkout/cache/docker/aws/app-token action pins.
.github/workflows/add-to-project.yml	Fixes broken actions/add-to-project pin.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.