chore(deps): allow utopia-php/lock 0.3

[abnegate]

Why

utopia-php/lock 0.3.0 adds DistributedLock::adopt(), which lets a holder delegate token-guarded commands such as refresh() to an instance backed by a different Redis connection.

appwrite/cloud needs it to close a live production defect: its lock refresher coroutine currently shares the action's borrowed Redis connection with the action itself, so two coroutines command one socket. The result is a Swoole fatal that takes the worker process down with every in-flight message already popped, which has meant acknowledged deletes that tore nothing down and left compute running and billing.

Composer resolves the intersection of every constraint on a package, so cloud cannot reach 0.3.0 while anything in its tree pins ^0.2. Three do: cloud's root, appwrite/server-ce, and this package. This is the first of the three.

Why it is safe

lock 0.3.0 is purely additive over 0.2.4: git diff 0.2.4 0.3.0 is 123 insertions and 0 deletions across README.md, src/Distributed.php and tests/DistributedTest.php. The only functional change is the new adopt() method. No signature or behaviour change to anything that existed.

This package uses only Utopia\Lock\Lock and Utopia\Lock\Mutex (src/Queue/Connection/Locking.php:5-6). It does not touch Distributed at all, so the added method is invisible here.

The lock file refresh

composer.lock on main could not resolve as committed, independently of this change:

Root composer.json requires utopia-php/validators ^0.4
utopia-php/servers 0.4.6 requires utopia-php/validators 0.3.*

servers was pinned at 0.4.6 in the lock while the root already allowed ^0.4, and servers 0.4.7 requires validators ^0.4. So the lock only needed refreshing to become resolvable. Exactly three packages move:

Package	Before	After
utopia-php/lock	0.2.3	0.3.0
utopia-php/servers	0.4.6	0.4.7
utopia-php/validators	0.3.1	0.4.2

validators 0.3 to 0.4 is additive for this package's purposes: 0.4.0 adds a phone validator, 0.4.1 is a no-op re-release, 0.4.2 makes Identifier reject a trailing newline. This package's only use is an instanceof Validator check at src/Queue/Server.php:460.

Verification

composer validate --no-check-publish
./composer.json is valid

composer update utopia-php/lock utopia-php/servers utopia-php/validators -W
No security vulnerability advisories found.

vendor/bin/pint is not installed in this package, so linting is whatever CI provides. I did not run the Tests job locally: it needs the Redis and Swoole services from CI, and the standing rule here is to report what was observed rather than imply a pass. CI is the gate.

[github-actions]

Thanks for contributing! This repository is a read-only mirror; development for this library happens in packages/queue in the utopia-php monorepo. Please open this pull request there instead.

[greptile-apps]

Greptile Summary

Updates the Composer constraint and lock file to permit utopia-php/lock 0.3.

• Locks utopia-php/lock at 0.3.0.
• Refreshes utopia-php/servers to 0.4.7 and utopia-php/validators to 0.4.2 to restore compatible dependency resolution.

Confidence Score: 5/5

The dependency refresh appears safe to merge, with no concrete compatibility, security, or runtime failures identified.

The queue uses only the unchanged lock interface and mutex surface, the upgraded packages satisfy the repository's PHP requirement, and no reachable incompatible behavior was established for the transitive updates.

Important Files Changed

Filename	Overview
composer.json	Changes the lock dependency constraint from ^0.2 to the compatible 0.3.* release line; no actionable issue identified.
composer.lock	Refreshes lock, servers, and validators to mutually compatible versions with package requirements consistent with PHP 8.5; no actionable issue identified.

_{Reviews (1): Last reviewed commit: "chore(deps): allow utopia-php/lock 0.3" | Re-trigger Greptile}