php: upgrade Composer CA bundle to 1.6.0

pkgs/composer/ca-bundle-1.6.0.patch

@@ -0,0 +1,41 @@
+--- a/composer.lock
++++ b/composer.lock
+@@ -8,16 +8,16 @@
+     "packages": [
+         {
+             "name": "composer/ca-bundle",
+-            "version": "1.5.12",
++            "version": "1.6.0",
+             "source": {
+                 "type": "git",
+                 "url": "https://github.com/composer/ca-bundle.git",
+-                "reference": "00a2f4201641d5c53f7fc0195e6c8d9fcc321a78"
++                "reference": "2c99cf2e92516985dea4914812b93d9daf01cdd6"
+             },
+             "dist": {
+                 "type": "zip",
+-                "url": "https://api.github.com/repos/composer/ca-bundle/zipball/00a2f4201641d5c53f7fc0195e6c8d9fcc321a78",
+-                "reference": "00a2f4201641d5c53f7fc0195e6c8d9fcc321a78",
++                "url": "https://api.github.com/repos/composer/ca-bundle/zipball/2c99cf2e92516985dea4914812b93d9daf01cdd6",
++                "reference": "2c99cf2e92516985dea4914812b93d9daf01cdd6",
+                 "shasum": ""
+             },
+             "require": {
+@@ -64,7 +64,7 @@
+             "support": {
+                 "irc": "irc://irc.freenode.org/composer",
+                 "issues": "https://github.com/composer/ca-bundle/issues",
+-                "source": "https://github.com/composer/ca-bundle/tree/1.5.12"
++                "source": "https://github.com/composer/ca-bundle/tree/1.6.0"
+             },
+             "funding": [
+                 {
+@@ -76,7 +76,7 @@
+                     "type": "github"
+                 }
+             ],
+-            "time": "2026-05-19T11:26:22+00:00"
++            "time": "2026-10-20T20:14:05+00:00"
+         },
+         {
+             "name": "composer/class-map-generator",

pkgs/modules/php/default.nix

@@ -3,6 +3,14 @@
 let
   php-version = lib.versions.majorMinor php.version;
   phpactor = pkgs.phpactor.override { inherit php; };
+  composer = php.packages.composer.overrideAttrs (old: {
+    src = pkgs.applyPatches {
+      name = "composer-${old.version}-ca-bundle-1.6.0-source";
+      src = old.src;
+      patches = [ ../../composer/ca-bundle-1.6.0.patch ];
+    };
+    vendorHash = "sha256-OWut8wZ9nq/7EiZecdhc4RsDhFJ2xlx1iTCXuHk7x14=";
+  });
 in
 {
   id = "php-${php-version}";
@@ -14,7 +22,7 @@ in
 
   replit.packages = [
     php
-    php.packages.composer
+    composer
   ];
 
   replit.runners.php = {