[renovate]

This PR contains the following updates:

Package	Update	Change
docker.io/composer (source)	minor	2.10.3 → 2.11.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[artidezi-etke-cc]

Approved: no adaptation is required under the configured project policy.

Approve the Composer Docker helper update from 2.10.3 to 2.11.0 unchanged. The source branches directly from the recorded target and changes only bin/composer; installed plugins and the existing lock work with the new Composer version. Focused Composer, PHP and frontend checks passed. No browser or live-stack tests were run because runtime assets and service configuration are unchanged.

Agent-assessed risk: Low. The change only updates the development dependency installer, and its helper, locked plugins, dependency installation and application checks passed with Composer 2.11.0.

Evidence (8 items)

• Evidence: git merge-base 07bf7ce73dc1b55c3878853048aa358184896c16 refs/artidezi/inputs/source-pr; git diff 07bf7ce73dc1b55c3878853048aa358184896c16...refs/artidezi/inputs/source-pr — Merge base equals recorded target. The entire PR is one image-tag replacement in bin/composer; no target-only changes or workflow changes need adaptation.
• Release notes: source — Stable release includes security fixes for installation path handling, credential disclosure and script argument escaping.
• Release notes: source — The release line removes source-fallback and raises composer-plugin-api to 2.11.0. Project config does not enable source-fallback; locked Flex requires ^2.1 and Runtime requires ^1.0|^2.0, both accepting 2.11.0.
• Local check: git show refs/artidezi/inputs/source-pr:bin/composer > /tmp/artidezi-source-composer; bash /tmp/artidezi-source-composer --version; bash /tmp/artidezi-source-composer validate --strict; bash /tmp/artidezi-source-composer audit --locked; bash /tmp/artidezi-source-composer install --no-interaction --prefer-dist — All exited 0 using the exact source helper from the unchanged target working directory, after creating var/composer-cache. Composer 2.11.0 / PHP 8.5.12; valid manifest, no security vulnerability advisories, all 92 packages installed and autoload generated. Existing lock unchanged; checks did not resolve new versions.
• Local check: docker build --iidfile /tmp/artidezi-assessment-php.id etc/docker/php — Passed using cached build layers. Built the actual application PHP image; no published application image used.
• Local check: docker run --rm --network none --user "$(id -u):$(id -g)" --mount "type=bind,src=$PWD,dst=/code" --workdir /code/app --entrypoint /bin/sh "$(cat /tmp/artidezi-assessment-php.id)" -ec 'vendor/bin/phpstan analyse -c phpstan.neon --no-progress && vendor/bin/php-cs-fixer check --config=.php-cs-fixer.dist.php && vendor/bin/twig-cs-fixer lint --config=.twig-cs-fixer.dist.php' — Passed: PHPStan no errors, PHP style 146 files with no fixes, Twig 38 files with no notices/warnings/errors. An additional PHP probe loaded vendor/autoload.php successfully and reported PHP 8.5.12 and actual MongoDB driver 2.5.5, satisfying mongodb/mongodb 2.5.0 ext-mongodb ^2.5. PHP CS Fixer emitted an informational warning about running on PHP 8.5 versus the declared minimum 8.4; no files were fixed.
• Local check: just js-analyze js-build; ./bin/node /bin/sh -c 'cd /app/src && npm audit' — Both exited 0: ESLint, TypeScript, asset build, and npm audit (zero vulnerabilities). The Node helper built its image successfully. Generated output remains ignored. No interactive browser behavior or Nagios validation was exercised because those integrations are unchanged.
• Local check: git status --short; git rev-parse HEAD — Working tree clean and target HEAD unchanged; no commits created.

Assessed source 0c99d5f76a5a1dc9179709d84804c1e24c76e9bd.