fix(deps): patch 12 security advisories and unblock Dependabot

.github/workflows/main.yml

@@ -37,3 +37,22 @@ jobs:
       - name: Composer ${{ matrix.test }}-${{ matrix.os }}
         run: |
           composer ${{ matrix.test }}
+
+  security-audit:
+    # Audits the committed lock file, which is what Dependabot scans. Kept out of
+    # the matrix above because --prefer-lowest deliberately resolves to the oldest
+    # versions the constraints allow, which will always carry advisories.
+    name: Composer audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: 8.4
+          extensions: curl, json
+          coverage: none
+      - name: Audit composer.lock
+        run: |
+          composer audit --locked

.gitignore

@@ -1,5 +1,6 @@
 /vendor/
 /.idea/
 clover.xml
+infection.log
 .phpunit.result.cache
 CLAUDE.md

.mergify.yml

@@ -11,6 +11,7 @@ pull_request_rules:
     conditions:
       - author=dependabot[bot]
       - check-success~=^test*
+      - check-success=Composer audit
     actions:
       merge:
         method: merge

composer.json

@@ -16,7 +16,7 @@
     }
   ],
   "require": {
-    "php": "^8.4",
+    "php": "^8.4.1",
     "guzzlehttp/guzzle": "^7.5",
     "hyperized/value-objects": "^2.0.0"
   },