From e72fbecaf9f972ef1c0a6ad4df33b51dc75ed8af Mon Sep 17 00:00:00 2001
From: Marcel Hernandez <e6990620@gmail.com>
Date: Sun, 1 Nov 2026 11:30:24 +0100
Subject: [PATCH 1/2] support and test PHP 8.6

---
 .github/workflows/tests.yml | 6 +++---
 composer.json               | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index e28d6988d..7397f67f2 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -13,13 +13,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php: [7.4, 8.0, 8.1, 8.2, 8.3, 8.4]
+        php: ['7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5']
         experimental: [false]
         composer-options: ['']
         include:
-          - php: 8.2
+          - php: '8.2'
             analysis: true
-          - php: 8.5
+          - php: '8.6'
             experimental: true
             composer-options: '--ignore-platform-req=php+'
           - php: nightly
diff --git a/composer.json b/composer.json
index 5fc397098..3b3bc2496 100644
--- a/composer.json
+++ b/composer.json
@@ -43,7 +43,7 @@
         "wiki": "https://github.com/slimphp/Slim/wiki"
     },
     "require": {
-        "php": "~7.4.0 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0",
+        "php": "~7.4.0 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0 || ~8.6.0",
         "ext-json": "*",
         "nikic/fast-route": "^1.3",
         "psr/container": "^1.0 || ^2.0",

From e214f34a04d432fd13b76afcc54e9da03039c614 Mon Sep 17 00:00:00 2001
From: Marcel Hernandez <e6990620@gmail.com>
Date: Sun, 1 Nov 2026 11:30:53 +0100
Subject: [PATCH 2/2] harden GitHub action against supply-chain attacks

---
 .github/workflows/tests.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 7397f67f2..38af7baa3 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -28,10 +28,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0
         with:
           php-version: ${{ matrix.php }}
           coverage: xdebug
@@ -53,7 +53,7 @@ jobs:
 
       - name: Upload coverage results to Coveralls
         if: matrix.analysis
-        uses: coverallsapp/github-action@v2
+        uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8
         with:
           flag-name: php-${{ matrix.php }}
           files: clover.xml