[1ma]

Fixes #3476 in the 4.x branch.

I added quotes around the versions because otherwise the YAML parser treats these values as floats instead of strings.

I also pinned the dependencies of the GitHub action to specific digests to mitigate against supply chain attacks. Dependabot is already configured and able to bump tags in this format (example).

Please review the actual digests:
https://github.com/actions/checkout/releases/tag/v7.0.1
https://github.com/shivammathur/setup-php/releases/tag/2.40.0
https://github.com/coverallsapp/github-action/releases/tag/v2.3.8

[coveralls]

coverage: 99.455% (+0.001%) from 99.454% — 1ma:php-8.6-support-4.x into slimphp:4.x

[1ma]

On closer inspection it looks like the 4.x branch also requires laminas/laminas-diactoros, so I don't understand why this pipeline passed and was able to install 3.9.0 for PHP 8.6. Looks like a dependency resolution bug. Maybe it's because the pipeline in 4.x uses an old version of Composer, but I'm not sure.

Despite this I still think the PR could be merged without issues. The only caveat is that PHP 8.6 won't be able to run Slim until Diactoros 3.10 is released, or in other words the blocker stops being Slim and becomes Diactoros. All other versions of PHP remain unaffected, and when Diactoros is tagged the issue would solve itself without further change in Slim.

[1ma]

Ah, there it is 😅 That's why the pipeline passes. The 5.x branch doesn't do this.

https://github.com/slimphp/Slim/blob/4.x/.github/workflows/tests.yml#L24