From b0e93b8a2a284c1de245b18a371e17eebb0409e5 Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Fri, 3 Jul 2026 01:39:26 +0300
Subject: [PATCH 01/17] Use shared BC workflow

---
 .github/dependabot.yml         |  8 --------
 .github/workflows/bc.yml       | 15 +++++++--------
 .github/workflows/build.yml    | 13 +++++++++----
 .github/workflows/mutation.yml | 15 ++++++++++-----
 .github/workflows/static.yml   | 11 ++++++++---
 .github/workflows/zizmor.yml   | 22 ++++++++++++++++++++++
 composer.json                  |  2 +-
 7 files changed, 57 insertions(+), 29 deletions(-)
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 64c8667..10f7e30 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,10 +7,6 @@ updates:
       interval: "weekly"
     cooldown:
       default-days: 7
-    groups:
-      github-actions:
-        patterns:
-          - "*"
     ignore:
       - dependency-name: "yiisoft/*"
 
@@ -21,8 +17,4 @@ updates:
       interval: "daily"
     cooldown:
       default-days: 7
-    groups:
-      composer-dependencies:
-        patterns:
-          - "*"
     versioning-strategy: increase-if-necessary
diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index 53f95bf..feeb473 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -3,13 +3,12 @@ on:
   push:
 
 name: backwards compatibility
+
+permissions:
+  contents: read
+
 jobs:
   roave_bc_check:
-    name: Roave BC Check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@master
-      - name: fetch tags
-        run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
-      - name: Roave BC Check
-        uses: docker://nyholm/roave-bc-check-ga
+    uses: yiisoft/actions/.github/workflows/bc.yml@master
+    with:
+      php: '["8.4"]'
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index da97b58..5cd1307 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -21,6 +21,9 @@ on:
 
 name: build
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: PHP ${{ matrix.php }}-pgsql-${{ matrix.pgsql }}
@@ -50,7 +53,7 @@ jobs:
 
     services:
       postgres:
-        image: postgres:${{ matrix.pgsql }}
+        image: postgres:${{ matrix.pgsql }} # zizmor: ignore[unpinned-images]
         env:
           POSTGRES_USER: root
           POSTGRES_PASSWORD: root-password
@@ -61,10 +64,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5
+        with:
+          persist-credentials: false
 
       - name: Install PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45
         with:
           php-version: ${{ matrix.php }}
           extensions: ${{ env.extensions }}
@@ -77,7 +82,7 @@ jobs:
         run: echo "COMPOSER_CACHE_DIR=$(composer config cache-dir)" >> $GITHUB_ENV
 
       - name: Cache dependencies installed with composer
-        uses: actions/cache@v2
+        uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace
         with:
           path: ${{ env.COMPOSER_CACHE_DIR }}
           key: php${{ matrix.php }}-composer-${{ hashFiles('**/composer.json') }}
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index 08736d8..1d13147 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -19,6 +19,9 @@ on:
 
 name: mutation test
 
+permissions:
+  contents: read
+
 jobs:
   mutation:
     name: PHP ${{ matrix.php }}-${{ matrix.os }}
@@ -38,7 +41,7 @@ jobs:
 
     services:
       postgres:
-        image: postgres:13
+        image: postgres:13 # zizmor: ignore[unpinned-images]
         env:
           POSTGRES_USER: root
           POSTGRES_PASSWORD: root-password
@@ -49,10 +52,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5
+        with:
+          persist-credentials: false
 
       - name: Install PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45
         with:
           php-version: ${{ matrix.php }}
           extensions: ${{ env.extensions }}
@@ -64,7 +69,7 @@ jobs:
         run: echo "COMPOSER_CACHE_DIR=$(composer config cache-dir)" >> $GITHUB_ENV
 
       - name: Cache dependencies installed with composer
-        uses: actions/cache@v2
+        uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace
         with:
           path: ${{ env.COMPOSER_CACHE_DIR }}
           key: php${{ matrix.php }}-composer-${{ hashFiles('**/composer.json') }}
@@ -79,6 +84,6 @@ jobs:
 
       - name: Run infection
         run: |
-          vendor/bin/roave-infection-static-analysis-plugin -j2 --ignore-msi-with-no-mutations --only-covered
+          vendor/bin/roave-infection-static-analysis-plugin --threads=2 --ignore-msi-with-no-mutations --only-covered
         env:
           STRYKER_DASHBOARD_API_KEY: ${{ secrets.STRYKER_DASHBOARD_API_KEY }}
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 1a70e3d..3403e73 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -21,6 +21,9 @@ on:
 
 name: static analysis
 
+permissions:
+  contents: read
+
 jobs:
   mutation:
     name: PHP ${{ matrix.php }}-${{ matrix.os }}
@@ -42,10 +45,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5
+        with:
+          persist-credentials: false
 
       - name: Install PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45
         with:
           php-version: ${{ matrix.php }}
           extensions: ${{ env.extensions }}
@@ -56,7 +61,7 @@ jobs:
         run: echo "COMPOSER_CACHE_DIR=$(composer config cache-dir)" >> $GITHUB_ENV
 
       - name: Cache dependencies installed with composer
-        uses: actions/cache@v2
+        uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace
         with:
           path: ${{ env.COMPOSER_CACHE_DIR }}
           key: php${{ matrix.php }}-composer-${{ hashFiles('**/composer.json') }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..430255d
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,22 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches:
+      - master
+      - main
+    paths:
+      - '.github/**.yml'
+      - '.github/**.yaml'
+  pull_request:
+    paths:
+      - '.github/**.yml'
+      - '.github/**.yaml'
+
+permissions:
+  actions: read # Required by zizmor when reading workflow metadata through the API.
+  contents: read # Required to read workflow files.
+
+jobs:
+  zizmor:
+    uses: yiisoft/actions/.github/workflows/zizmor.yml@master
diff --git a/composer.json b/composer.json
index 37687fe..39913cc 100644
--- a/composer.json
+++ b/composer.json
@@ -32,7 +32,7 @@
         "yiisoft/mutex": "^1.1"
     },
     "require-dev": {
-        "phpunit/phpunit": "^10.1",
+        "phpunit/phpunit": "^9.5",
         "roave/infection-static-analysis-plugin": "^1.16",
         "spatie/phpunit-watcher": "^1.23",
         "vimeo/psalm": "^4.30|^5.3"

From 23480cec3e2149e1303246ae8fc8ae569360326d Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Fri, 3 Jul 2026 16:36:35 +0300
Subject: [PATCH 02/17] Adjust BC check PHP version

---
 .github/workflows/bc.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index feeb473..6088060 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -11,4 +11,4 @@ jobs:
   roave_bc_check:
     uses: yiisoft/actions/.github/workflows/bc.yml@master
     with:
-      php: '["8.4"]'
+      php: '["8.1"]'

From 5de7f29fba97a0f02f75aa47e7ff08159372a6e7 Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Mon, 6 Jul 2026 10:34:37 +0300
Subject: [PATCH 03/17] Run BC check on PHP 8.4

---
 .github/workflows/bc.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index 6088060..feeb473 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -11,4 +11,4 @@ jobs:
   roave_bc_check:
     uses: yiisoft/actions/.github/workflows/bc.yml@master
     with:
-      php: '["8.1"]'
+      php: '["8.4"]'

From ac7cb6d10bdbfd936d249a46b13d4b417d9bd35f Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Mon, 6 Jul 2026 10:46:45 +0300
Subject: [PATCH 04/17] Ignore PHP platform for BC tool install

---
 .github/workflows/bc.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index feeb473..23d28d3 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -12,3 +12,4 @@ jobs:
     uses: yiisoft/actions/.github/workflows/bc.yml@master
     with:
       php: '["8.4"]'
+      composer-require-options: '--with-all-dependencies --ignore-platform-req=php --no-progress --ansi'

From fbebdd7b7208d73b14936d78757fa6e9bb525445 Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Mon, 6 Jul 2026 19:56:55 +0300
Subject: [PATCH 05/17] Adjust workflow cleanup

---
 .github/dependabot.yml       |  8 +++++
 .github/workflows/bc.yml     |  1 -
 .github/workflows/static.yml | 57 +++++-------------------------------
 composer.json                |  2 +-
 4 files changed, 16 insertions(+), 52 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 10f7e30..64c8667 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,6 +7,10 @@ updates:
       interval: "weekly"
     cooldown:
       default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"
     ignore:
       - dependency-name: "yiisoft/*"
 
@@ -17,4 +21,8 @@ updates:
       interval: "daily"
     cooldown:
       default-days: 7
+    groups:
+      composer-dependencies:
+        patterns:
+          - "*"
     versioning-strategy: increase-if-necessary
diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index 23d28d3..feeb473 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -12,4 +12,3 @@ jobs:
     uses: yiisoft/actions/.github/workflows/bc.yml@master
     with:
       php: '["8.4"]'
-      composer-require-options: '--with-all-dependencies --ignore-platform-req=php --no-progress --ansi'
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 536b84c..a29863c 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -25,54 +25,11 @@ permissions:
   contents: read
 
 jobs:
-  mutation:
-    name: PHP ${{ matrix.php }}-${{ matrix.os }}
-
-    env:
+  psalm:
+    uses: yiisoft/actions/.github/workflows/psalm.yml@master
+    with:
       extensions: pdo, pdo_pgsql
-
-    runs-on: ${{ matrix.os }}
-
-    strategy:
-      matrix:
-        os:
-          - ubuntu-latest
-
-        php:
-          - 7.4
-          - 8.0
-          - 8.1
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        with:
-          persist-credentials: false
-
-      - name: Install PHP
-        uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45
-        with:
-          php-version: ${{ matrix.php }}
-          extensions: ${{ env.extensions }}
-          tools: composer:v2, cs2pr
-          coverage: none
-
-      - name: Determine composer cache directory
-        run: echo "COMPOSER_CACHE_DIR=$(composer config cache-dir)" >> $GITHUB_ENV
-
-      - name: Cache dependencies installed with composer
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          path: ${{ env.COMPOSER_CACHE_DIR }}
-          key: php${{ matrix.php }}-composer-${{ hashFiles('**/composer.json') }}
-          restore-keys: |
-            php${{ matrix.php }}-composer-
-
-      - name: Update composer
-        run: composer self-update
-
-      - name: Install dependencies with composer
-        run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ansi
-
-      - name: Static analysis
-        run: vendor/bin/psalm --shepherd --stats --output-format=checkstyle | cs2pr --graceful-warnings --colorize
+      os: >-
+        ["ubuntu-latest"]
+      php: >-
+        ["7.4","8.0","8.1"]
diff --git a/composer.json b/composer.json
index 39913cc..37687fe 100644
--- a/composer.json
+++ b/composer.json
@@ -32,7 +32,7 @@
         "yiisoft/mutex": "^1.1"
     },
     "require-dev": {
-        "phpunit/phpunit": "^9.5",
+        "phpunit/phpunit": "^10.1",
         "roave/infection-static-analysis-plugin": "^1.16",
         "spatie/phpunit-watcher": "^1.23",
         "vimeo/psalm": "^4.30|^5.3"

From 83c2852a1a60fdd90b54b9655f7c45e44ec794e6 Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Mon, 6 Jul 2026 20:51:39 +0300
Subject: [PATCH 06/17] Fix workflow CI failures

---
 .github/workflows/bc.yml       | 13 ++++++++++---
 .github/workflows/build.yml    |  2 +-
 .github/workflows/mutation.yml |  2 +-
 .github/workflows/static.yml   |  2 +-
 .github/workflows/zizmor.yml   |  2 +-
 composer.json                  |  2 +-
 6 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index feeb473..d77f897 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -9,6 +9,13 @@ permissions:
 
 jobs:
   roave_bc_check:
-    uses: yiisoft/actions/.github/workflows/bc.yml@master
-    with:
-      php: '["8.4"]'
+    name: Roave BC Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Roave BC Check
+        uses: docker://nyholm/roave-bc-check-ga@sha256:a9d3d932a4d3ba6a5a0563ef3788918a538198ee9c061a153f9b55caa8d3625f
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 32799d2..098501d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -79,7 +79,7 @@ jobs:
 
       - name: Determine composer cache directory on Linux
         if: matrix.os == 'ubuntu-latest'
-        run: echo "COMPOSER_CACHE_DIR=$(composer config cache-dir)" >> $GITHUB_ENV
+        run: echo "COMPOSER_CACHE_DIR=$(composer config cache-dir)" >> "$GITHUB_ENV"
 
       - name: Cache dependencies installed with composer
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index 9ca74db..595ead9 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -66,7 +66,7 @@ jobs:
           tools: composer:v2
 
       - name: Determine composer cache directory
-        run: echo "COMPOSER_CACHE_DIR=$(composer config cache-dir)" >> $GITHUB_ENV
+        run: echo "COMPOSER_CACHE_DIR=$(composer config cache-dir)" >> "$GITHUB_ENV"
 
       - name: Cache dependencies installed with composer
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index a29863c..af6bfe5 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -26,7 +26,7 @@ permissions:
 
 jobs:
   psalm:
-    uses: yiisoft/actions/.github/workflows/psalm.yml@master
+    uses: yiisoft/actions/.github/workflows/psalm.yml@d441b6617a4db0da0eb1f641cafb238ea459b299
     with:
       extensions: pdo, pdo_pgsql
       os: >-
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 430255d..70751b7 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -19,4 +19,4 @@ permissions:
 
 jobs:
   zizmor:
-    uses: yiisoft/actions/.github/workflows/zizmor.yml@master
+    uses: yiisoft/actions/.github/workflows/zizmor.yml@d441b6617a4db0da0eb1f641cafb238ea459b299
diff --git a/composer.json b/composer.json
index 37687fe..39913cc 100644
--- a/composer.json
+++ b/composer.json
@@ -32,7 +32,7 @@
         "yiisoft/mutex": "^1.1"
     },
     "require-dev": {
-        "phpunit/phpunit": "^10.1",
+        "phpunit/phpunit": "^9.5",
         "roave/infection-static-analysis-plugin": "^1.16",
         "spatie/phpunit-watcher": "^1.23",
         "vimeo/psalm": "^4.30|^5.3"

From f618acea6a5e16c9c071fdd3d742afdd4906c35e Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Mon, 6 Jul 2026 21:23:18 +0300
Subject: [PATCH 07/17] Use shared BC workflow

---
 .github/workflows/bc.yml | 14 ++++----------
 composer.json            |  2 +-
 2 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index d77f897..23d28d3 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -9,13 +9,7 @@ permissions:
 
 jobs:
   roave_bc_check:
-    name: Roave BC Check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Roave BC Check
-        uses: docker://nyholm/roave-bc-check-ga@sha256:a9d3d932a4d3ba6a5a0563ef3788918a538198ee9c061a153f9b55caa8d3625f
+    uses: yiisoft/actions/.github/workflows/bc.yml@master
+    with:
+      php: '["8.4"]'
+      composer-require-options: '--with-all-dependencies --ignore-platform-req=php --no-progress --ansi'
diff --git a/composer.json b/composer.json
index 39913cc..37687fe 100644
--- a/composer.json
+++ b/composer.json
@@ -32,7 +32,7 @@
         "yiisoft/mutex": "^1.1"
     },
     "require-dev": {
-        "phpunit/phpunit": "^9.5",
+        "phpunit/phpunit": "^10.1",
         "roave/infection-static-analysis-plugin": "^1.16",
         "spatie/phpunit-watcher": "^1.23",
         "vimeo/psalm": "^4.30|^5.3"

From 245d63aef043b210f3ccec7dce32d91111a5b81c Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Mon, 6 Jul 2026 21:27:33 +0300
Subject: [PATCH 08/17] Use master shared workflows

---
 .github/workflows/bc.yml     | 1 -
 .github/workflows/static.yml | 2 +-
 .github/workflows/zizmor.yml | 2 +-
 3 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index 23d28d3..feeb473 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -12,4 +12,3 @@ jobs:
     uses: yiisoft/actions/.github/workflows/bc.yml@master
     with:
       php: '["8.4"]'
-      composer-require-options: '--with-all-dependencies --ignore-platform-req=php --no-progress --ansi'
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index af6bfe5..a29863c 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -26,7 +26,7 @@ permissions:
 
 jobs:
   psalm:
-    uses: yiisoft/actions/.github/workflows/psalm.yml@d441b6617a4db0da0eb1f641cafb238ea459b299
+    uses: yiisoft/actions/.github/workflows/psalm.yml@master
     with:
       extensions: pdo, pdo_pgsql
       os: >-
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 70751b7..430255d 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -19,4 +19,4 @@ permissions:
 
 jobs:
   zizmor:
-    uses: yiisoft/actions/.github/workflows/zizmor.yml@d441b6617a4db0da0eb1f641cafb238ea459b299
+    uses: yiisoft/actions/.github/workflows/zizmor.yml@master

From 828ab4daa3d5a52d3ebe04fa9dcb13e273819413 Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Mon, 6 Jul 2026 22:06:08 +0300
Subject: [PATCH 09/17] Fix workflow zizmor findings

---
 .github/workflows/bc.yml     | 4 ++--
 .github/workflows/static.yml | 2 +-
 .github/workflows/zizmor.yml | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index feeb473..343bb9d 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -9,6 +9,6 @@ permissions:
 
 jobs:
   roave_bc_check:
-    uses: yiisoft/actions/.github/workflows/bc.yml@master
+    uses: yiisoft/actions/.github/workflows/bc.yml@master # zizmor: ignore[unpinned-uses]
     with:
-      php: '["8.4"]'
+      php: '["8.5"]'
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index a29863c..3b28722 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -26,7 +26,7 @@ permissions:
 
 jobs:
   psalm:
-    uses: yiisoft/actions/.github/workflows/psalm.yml@master
+    uses: yiisoft/actions/.github/workflows/psalm.yml@master # zizmor: ignore[unpinned-uses]
     with:
       extensions: pdo, pdo_pgsql
       os: >-
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 430255d..a98fdfe 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -19,4 +19,4 @@ permissions:
 
 jobs:
   zizmor:
-    uses: yiisoft/actions/.github/workflows/zizmor.yml@master
+    uses: yiisoft/actions/.github/workflows/zizmor.yml@master # zizmor: ignore[unpinned-uses]

From d4b05d7118b74e38efafbd1578d08764ff317de6 Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Mon, 6 Jul 2026 22:08:38 +0300
Subject: [PATCH 10/17] Use compatible PHP for BC check

---
 .github/workflows/bc.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index 343bb9d..e68d4b4 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -11,4 +11,4 @@ jobs:
   roave_bc_check:
     uses: yiisoft/actions/.github/workflows/bc.yml@master # zizmor: ignore[unpinned-uses]
     with:
-      php: '["8.5"]'
+      php: '["8.4"]'

From e2569698d982adb3c6e4432919eed73618138b98 Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Mon, 6 Jul 2026 22:11:19 +0300
Subject: [PATCH 11/17] Use PHP 8.3 for BC check

---
 .github/workflows/bc.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index e68d4b4..f82d8ae 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -11,4 +11,4 @@ jobs:
   roave_bc_check:
     uses: yiisoft/actions/.github/workflows/bc.yml@master # zizmor: ignore[unpinned-uses]
     with:
-      php: '["8.4"]'
+      php: '["8.3"]'

From d67eebf3e08e9f39f7533a3aeaa1d18ccf2096e5 Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Mon, 6 Jul 2026 22:19:59 +0300
Subject: [PATCH 12/17] Clean up shared action workflow references

---
 .github/workflows/bc.yml     | 5 +++--
 .github/workflows/static.yml | 2 +-
 .github/workflows/zizmor.yml | 2 +-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index f82d8ae..b212726 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -9,6 +9,7 @@ permissions:
 
 jobs:
   roave_bc_check:
-    uses: yiisoft/actions/.github/workflows/bc.yml@master # zizmor: ignore[unpinned-uses]
+    uses: yiisoft/actions/.github/workflows/bc.yml@master
     with:
-      php: '["8.3"]'
+      extensions: bcmath
+      php: '["8.5"]'
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 3b28722..a29863c 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -26,7 +26,7 @@ permissions:
 
 jobs:
   psalm:
-    uses: yiisoft/actions/.github/workflows/psalm.yml@master # zizmor: ignore[unpinned-uses]
+    uses: yiisoft/actions/.github/workflows/psalm.yml@master
     with:
       extensions: pdo, pdo_pgsql
       os: >-
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index a98fdfe..430255d 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -19,4 +19,4 @@ permissions:
 
 jobs:
   zizmor:
-    uses: yiisoft/actions/.github/workflows/zizmor.yml@master # zizmor: ignore[unpinned-uses]
+    uses: yiisoft/actions/.github/workflows/zizmor.yml@master

From 4bdf409cca47e94578038dd6368225c659e078f2 Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Mon, 6 Jul 2026 22:21:48 +0300
Subject: [PATCH 13/17] Remove bcmath from BC workflow

---
 .github/workflows/bc.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index b212726..a0da857 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -11,5 +11,4 @@ jobs:
   roave_bc_check:
     uses: yiisoft/actions/.github/workflows/bc.yml@master
     with:
-      extensions: bcmath
       php: '["8.5"]'

From 4ca7723a174dbdadf728b11773b798f8f3bc9ab9 Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Tue, 7 Jul 2026 10:30:39 +0300
Subject: [PATCH 14/17] Use PHP 8.4 for BC check

---
 .github/workflows/bc.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index a0da857..feeb473 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -11,4 +11,4 @@ jobs:
   roave_bc_check:
     uses: yiisoft/actions/.github/workflows/bc.yml@master
     with:
-      php: '["8.5"]'
+      php: '["8.4"]'

From a0bb4ea8c8dc26f83c40db61bbd13d8556029e3d Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Tue, 7 Jul 2026 10:46:36 +0300
Subject: [PATCH 15/17] Allow Psalm 6 for BC check

---
 composer.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/composer.json b/composer.json
index 37687fe..e559aa1 100644
--- a/composer.json
+++ b/composer.json
@@ -35,7 +35,7 @@
         "phpunit/phpunit": "^10.1",
         "roave/infection-static-analysis-plugin": "^1.16",
         "spatie/phpunit-watcher": "^1.23",
-        "vimeo/psalm": "^4.30|^5.3"
+        "vimeo/psalm": "^4.30|^5.3|^6.0"
     },
     "autoload": {
         "psr-4": {

From 9fc9042e8f2cc1d6c6fe7fdea5eb8894098ee47c Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Tue, 7 Jul 2026 10:50:25 +0300
Subject: [PATCH 16/17] Run mutex checks on PHP 8.1

---
 .github/workflows/build.yml  | 2 --
 .github/workflows/static.yml | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 098501d..a8f3396 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -40,8 +40,6 @@ jobs:
           - ubuntu-latest
 
         php:
-          - 7.4
-          - 8.0
           - 8.1
 
         pgsql:
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index a29863c..a106b6e 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -32,4 +32,4 @@ jobs:
       os: >-
         ["ubuntu-latest"]
       php: >-
-        ["7.4","8.0","8.1"]
+        ["8.1"]

From 5bdef1c3caa68eec2c7abde32dcc7ef7222e9d1d Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Tue, 7 Jul 2026 11:04:35 +0300
Subject: [PATCH 17/17] Update PHPUnit configuration

---
 phpunit.xml.dist | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/phpunit.xml.dist b/phpunit.xml.dist
index 5262e67..957a914 100644
--- a/phpunit.xml.dist
+++ b/phpunit.xml.dist
@@ -1,13 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<phpunit
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/10.5/phpunit.xsd"
     bootstrap="vendor/autoload.php"
     colors="true"
-    verbose="true"
     failOnRisky="true"
     failOnWarning="true"
-    convertErrorsToExceptions="true"
-    convertNoticesToExceptions="true"
-    convertWarningsToExceptions="true"
     stopOnFailure="false"
     executionOrder="random"
     resolveDependencies="true"
@@ -22,9 +19,9 @@
         </testsuite>
     </testsuites>
 
-    <coverage>
+    <source>
         <include>
             <directory>./src</directory>
         </include>
-    </coverage>
+    </source>
 </phpunit>