[lhbarrientosz]

Summary

• Require PHP 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+, restricted to those supported branches, excluding versions affected by CVE-2026-109618 and CVE-2026-109619.
• Update GitHub Actions and Travis CI to validate against the minimum patched PHP versions.
• Make nullable parameters explicit to avoid deprecation notices in PHP 8.4 and PHP 8.5.
• Document supported PHP versions and deployment requirements.

Validation

• ✅ PHP 8.5.12: 68 tests passed, 172 assertions.
• ✅ All 17 PHP version constraint boundary checks passed.
• ✅ Composer validation and production platform requirement checks passed.
• ✅ composer audit reported no known security advisories.

Known Issues

• Full code-quality checks remain blocked by:
  • 3 pre-existing formatting differences.
  • 1 pre-existing PHPStan error in FixedTypedCollection::matching().

Deployment Notes

Updating this library does not patch the PHP runtime.

Deployments must upgrade the PHP interpreter to a supported patched version and restart all application workers/processes affected by the change.

Breaking Change

PHP 8.1 and earlier versions are no longer supported. Additionally, unpatched releases within the supported PHP branches are now explicitly rejected.

[lhbarrientosz]

fixed