chore(deps-dev): bump sabre/xml from 2.2.11 to 4.1.0 - #3163
chore(deps-dev): bump sabre/xml from 2.2.11 to 4.1.0#3163dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [sabre/xml](https://github.com/sabre-io/xml) from 2.2.11 to 4.1.0. - [Release notes](https://github.com/sabre-io/xml/releases) - [Changelog](https://github.com/sabre-io/xml/blob/master/CHANGELOG.md) - [Commits](sabre-io/xml@2.2.11...4.1.0) --- updated-dependencies: - dependency-name: sabre/xml dependency-version: 4.1.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Quality Report — ConductionNL/openregister @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| check-specs | ✅ | ||||
| test-l10n | ✅ | ||||
| test-l10n-parity | ✅ | ||||
| format | ✅ | ||||
| check-schema-l10n | ✅ | ||||
| check-l10n-js | ✅ | ||||
| composer | ✅ | ✅ 174/174 | |||
| npm | ✅ | ✅ 547/547 | |||
| app:check-code | ⏭️ | ||||
| info.xml | ✅ | ||||
| REUSE | ❌ | ||||
| PHPUnit | ✅ | ||||
| Newman | ❌ | ||||
| Playwright | 🚨 NO VERDICT — enabled but never ran | ||||
| Hydra gates | ✅ |
Quality workflow — 2026-08-30 23:04 UTC
Download the full PDF report from the workflow artifacts.
|
Closing: this major installs but breaks the code, verified by CI rather than assumed. The dependency resolves cleanly (checked in a PHP container), so this is not a lockfile problem. What fails is the tooling the bump itself changes:
A new major of a static-analysis or parser package changes what it accepts, so the findings are real work rather than a version-pick. Adopting it means fixing what the new version reports, in its own change where the diff can be read. Measured tonight across the fleet: of 51 npm majors, 24 could not install at all and several more installed and then failed at runtime. This one is in the second group — which is exactly what CI is for, and why it was not closed on resolution evidence alone. Dependabot will reopen this when the work is done. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps sabre/xml from 2.2.11 to 4.1.0.
Release notes
Sourced from sabre/xml's releases.
... (truncated)
Changelog
Sourced from sabre/xml's changelog.
... (truncated)
Commits
bec83cbMerge pull request #327 from phil-davis/prepare-4.1.0e9dd7a6chore: prepare release 4.1.0d0b01e8Merge pull request #326 from phil-davis/remove-phpVersiondbec351chore: remove phpVersion from phpstan.neond179f89Merge pull request #325 from phil-davis/support-php8.2-and-up14a0f48chore: enable phpstan-strict-rules ignoring XMLReader XML calls6b3af9ctest: add phpstan-phpunit to phpstan settings67916d0chore: support PHP 8.2 and up53db7baMerge pull request #323 from phil-davis/prepare-4.0.78a32ccachore: prepare 4.0.7Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)