Bump the all-dependencies group with 3 updates

[dependabot]

Bumps the all-dependencies group with 3 updates: composer/composer, phpstan/phpstan and rector/rector.

Updates composer/composer from 2.10.1 to 2.10.2

Release notes

Sourced from composer/composer's releases.

2.10.2

• Security: Validate package names (GHSA-499r-g7pc-vmp9)
• Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
• Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
• Security: Only follow HTTP redirects from HTTP responses (#12948)
• Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
• Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
• Added warning output in self-update command when using a soon-to-be EOL version (#12920)
• Added download retry when a GitHub codeload URL returns a 400 (#12962)
• Fixed audit command to output the audit result to stdout (#12904)
• Fixed backspace characters being output to non-decorated output (#12925)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)
• Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)

Full Changelog: composer/composer@2.10.1...2.10.2

Changelog

Sourced from composer/composer's changelog.

[2.10.2] 2026-07-01

• Security: Validate package names (GHSA-499r-g7pc-vmp9)
• Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
• Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
• Security: Only follow HTTP redirects from HTTP responses (#12948)
• Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
• Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
• Added warning output in self-update command when using a soon-to-be EOL version (#12920)
• Added download retry when a GitHub codeload URL returns a 400 (#12962)
• Fixed audit command to output the audit result to stdout (#12904)
• Fixed backspace characters being output to non-decorated output (#12925)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)
• Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)

Commits

• 8d4439f Release 2.10.2
• 79d92f0 Update changelog
• 8887ad7 Merge commit from fork
• 502c6c4 Merge commit from fork
• 145e74d Update deps
• e42b4f1 Retry downloads failing with HTTP 400 on a fresh connection (#12962)
• 8c3eba8 Add basic command level telemetry (#12952)
• c5f92a0 Bump actions/checkout from 6.0.3 to 7.0.0 (#12949)
• b7c4e39 Sanitize JSON parse errors in Http\Response to avoid leaking response bodies ...
• 6665153 Add VersionsTest for self update behavior
• Additional commits viewable in compare view

Updates phpstan/phpstan from 2.2.2 to 2.2.5

Commits

• See full diff in compare view

Updates rector/rector from 2.5.2 to 2.5.3

Release notes

Sourced from rector/rector's releases.

Released Rector 2.5.3

New Features 🥳

withTypeGuardedClasses()

Are you an open-source project or package used by others? Do you want to make type changes, but keep BC?

Guard the listed classes and their non-final descendants against method signature changes - e.g. adding a return type or a param type — that would break child classes (#8135)

return RectorConfig::configure()
    ->withTypeGuardedClasses([SomeContract::class]);

New Rules 🎉

NegatedAndsToPositiveOrsRector

(CodeQuality) — simplify a negated "and" to "or" via de Morgan (#8082)

 $a = 5;
 $b = 10;
-$result = !($a > 20 && $b <= 50);
+$result = $a <= 20 || $b > 50;

ExplicitAttributeNamedArgsRector

(CodeQuality) — positional attribute args → named args (#8079), Thanks @​DaveLiddament!

-#[SomeAttribute(SomeClass::class, null, ['home'])]
+#[SomeAttribute(value: SomeClass::class, only: null, except: ['home'])]
 class SomeClass
 {
 }

SwitchTrueToMatchRector

(CodeQuality) — switch (true) of returning cases → match (true), replaces deprecated SwitchTrueToIfRector (#8113)

-        switch (true) {
-            case $value === 0:
-                return 'no';
</tr></table> 

... (truncated)

Commits

• 3d3577a Rector 2.5.3
• 0c7c402 Updated Rector to commit 4a1bd1209069775e773ffa3948bccf8207a3fa3b
• 9ebd51d Updated Rector to commit a3e6be70886edcd0e7dfa2147714018daf27f7e8
• d7de43f Updated Rector to commit 96ff0040b16e3fc1405af69b98b1edc75d85024d
• 40c7216 Updated Rector to commit eb3eb215f7594accf81a5c673c267770fbd5a8d0
• c8fdb53 Updated Rector to commit eb3eb215f7594accf81a5c673c267770fbd5a8d0
• 3a84931 Updated Rector to commit 62e4045169d30d086acd11261dbb890bb20ce6a9
• 84ca40f Updated Rector to commit 5f16b59e166d13a0a9f1d6b181b2a3a577ba5c5f
• 3b63024 Updated Rector to commit f1aefb66f6f6ee92c97bd621f716853a0269a449
• 21820fe Updated Rector to commit 4cb9b9eea43dc00c1f4f13a2f7fc006fbea0760b
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions