[renovate]

This PR contains the following updates:

Package	Update	Change
docker.io/composer (source)	patch	2.11.0 → 2.11.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[artidezi-etke-cc]

Approved: no adaptation is required under the configured project policy.

Approve the Composer image patch update from 2.11.0 to 2.11.1 unchanged. Its sole change applies directly to the recorded target and works with the existing user/cache helper; upstream notes indicate fixes without a migration requirement. Focused Composer, PHP and frontend checks passed. No tracked files changed.

Agent-assessed risk: Low. A single build-tool image patch passed installation, validation, security audits and application checks; no application runtime or dependency lock changes are proposed.

Evidence (8 items)

• Local check: git merge-base 4ee743251b957f05e806582ca98a63ffa7b10e00 refs/artidezi/inputs/source-pr; git diff 4ee743251b957f05e806582ca98a63ffa7b10e00...refs/artidezi/inputs/source-pr — Merge base equals recorded target. Only bin/composer changes, replacing docker.io/composer:2.11.0 with 2.11.1; no integration conflict or unrelated target changes.
• Release notes: source — Official patch notes cover GitLab authentication, invalid extension names, manifest key preservation, authentication headers, a PHP deprecation and WSL cache warning; no migration requirement identified.
• Local check: git show refs/artidezi/inputs/source-pr:bin/composer | bash -s -- <arguments> — Ran source helper directly from git without modifying checkout, with --version, validate --strict, audit --locked, and install --no-interaction --prefer-dist. All exited 0: Composer 2.11.1 on PHP 8.5.12; valid manifest; no vulnerability advisories; locked dependencies installed successfully. Image digest sha256:537fb03057ed901ae06bde7ef25af348903485ae1acc7fc789b80d8bac666f35.
• Local check: docker build --iidfile /tmp/artidezi-php-image.id etc/docker/php — Passed using available cached layers. Built repository-owned runtime reports PHP 8.5.12 and MongoDB driver 2.5.5; runtime was not changed by this PR.
• Local check: docker run --rm --network none --user "$(id -u):$(id -g)" --mount "type=bind,src=$PWD,dst=/code" --workdir /code/app --entrypoint /bin/sh "$(cat /tmp/artidezi-php-image.id)" -ec 'vendor/bin/phpstan analyse -c phpstan.neon --no-progress && vendor/bin/php-cs-fixer check --config=.php-cs-fixer.dist.php && vendor/bin/twig-cs-fixer lint --config=.twig-cs-fixer.dist.php' — All passed: PHPStan no errors, PHP CS Fixer zero changes among 146 files, Twig lint 38 files with no notices/warnings/errors. PHP CS Fixer emitted an advisory that runtime PHP 8.5 is newer than composer.json minimum PHP 8.4; check mode changed no source files.
• Local check: ./bin/node /bin/sh -c 'cd /app/src && npm audit'; just js-analyze js-build — All exited 0: zero npm vulnerabilities, ESLint, TypeScript checking and asset build passed through repository Docker helper. Generated assets/dependencies remain ignored. Browser and Nagios behavior were not exercised because this PR changes neither browser assets nor monitoring runtime/configuration.
• Local check: git show refs/artidezi/inputs/source-pr:bin/composer | bash -n; git diff --check 4ee743251b957f05e806582ca98a63ffa7b10e00...refs/artidezi/inputs/source-pr; git status --short — Shell syntax and patch whitespace checks passed; final tracked/untracked working tree is clean. No live stack, database, notifications or deployment was used.
• Evidence: Supplied source CI snapshot for 987683ad1de96ccb6c730486bbc1776c15299e1f — Reported frontend and PHP checks successful; snapshot is supporting context only and does not replace controller refresh of forge gates.

Assessed source 987683ad1de96ccb6c730486bbc1776c15299e1f.