Modernize library for 4.x: security fixes, strict types, tooling updates

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 4
+trim_trailing_whitespace = true
+
+[*.{yml,yaml,json}]
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/php.yml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [ main ]
+    branches: [ main, "*.x" ]
   pull_request:
-    branches: [ main ]
+    branches: [ main, "*.x" ]
 
 permissions:
   contents: read
@@ -25,9 +25,12 @@ jobs:
           - os: "ubuntu-latest"
             php: "8.4"
             coverage: "pcov"
+          - os: "ubuntu-latest"
+            php: "8.5"
+            coverage: "none"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: shivammathur/setup-php@v2
         with:
@@ -41,6 +44,9 @@ jobs:
       - name: Install dependencies
         run: composer -n update --prefer-dist -o
 
+      - name: Security audit
+        run: composer audit
+
       - name: Run test suite
         if: matrix.coverage == 'none'
         run: composer run-script test

.gitignore

@@ -48,4 +48,9 @@
 */Entity/*~
 
 .idea
-.phpunit.result.cachecomposer.lock
+.phpunit.result.cache
+.phpunit.cache/
+composer.lock
+.DS_Store
+
+build/.phpcs-cache

README.md

@@ -66,21 +66,21 @@ $array = [
 $expander = new Expander();
 // Optionally set a logger.
 $expander->setLogger(new Psr\Log\NullLogger());
-// Optionally set a Stringfier, used to convert array placeholders into strings. Defaults to using implode() with `,` delimeter.
+// Optionally set a Stringifier, used to convert array placeholders into strings. Defaults to using implode() with `,` delimiter.
 // @see StringifierInterface.
 $expander->setStringifier(new Grasmash\Expander\Stringifier());
 
 // Parse an array, expanding internal property references.
 $expanded = $expander->expandArrayProperties($array);
 
 // Parse an array, expanding references using both internal and supplementary values.
-$reference_properties =  'book' => ['sequel' => 'Dune Messiah'];
+$reference_properties = ['book' => ['sequel' => 'Dune Messiah']];
 // Set an environmental variable.
 putenv("test=gomjabbar");
 $expanded = $expander->expandArrayProperties($array, $reference_properties);
 
 print_r($expanded);
-````
+```
 
 Resultant array:
 

RELEASE.md

@@ -2,10 +2,29 @@
 
 ### Execute tests
 
-    ./scripts/run-tests.sh
+    composer test
+
+This runs linting (`composer lint`), unit tests (`composer unit`), coding
+standards checks (`composer cs`), and static analysis (`composer stan`).
 
 To quickly fix PHPCS issues:
 
-    ./scripts/clean-code.sh
-
+    composer cbf
+
+## 4.0 upgrade notes
 
+- PHP 8.2+ is required.
+- All source files now declare `strict_types=1`.
+- `StringifierInterface::stringifyArray()` is now an instance method rather
+  than a static method. Custom `StringifierInterface` implementations and any
+  callers of `Stringifier::stringifyArray()` as a static method must update.
+- `Expander::expandArrayProperties()` now requires `$reference_array` to be an
+  array.
+- `Expander::expandPropertyWithReferenceData()` returns `mixed` instead of
+  `?string`, so non-string values (booleans, integers, floats) retain their
+  types when expanded via reference data.
+- `${env.*}` placeholders no longer read `HTTP_*` keys from `$_SERVER`, since
+  those originate from client-supplied request headers in a web context.
+- Environment variables with falsy values (e.g. `0`) now expand correctly.
+- Expansion of a single string is capped at 25 passes and 1 MiB to prevent
+  runaway growth from circular references with surrounding text.

composer.json

@@ -1,11 +1,24 @@
 {
     "name": "grasmash/expander",
-    "description": "Expands internal property references in PHP arrays file.",
+    "description": "Expands internal property references in PHP arrays.",
     "type": "library",
+    "keywords": [
+        "array",
+        "configuration",
+        "dot-notation",
+        "expansion",
+        "placeholder",
+        "yaml"
+    ],
+    "homepage": "https://github.com/grasmash/expander",
+    "support": {
+        "issues": "https://github.com/grasmash/expander/issues",
+        "source": "https://github.com/grasmash/expander"
+    },
     "require": {
         "php": ">=8.2",
         "dflydev/dot-access-data": "^3.0.0",
-        "psr/log": "^2 | ^3"
+        "psr/log": "^2 || ^3"
     },
     "license": "MIT",
     "authors": [
@@ -25,14 +38,15 @@
         }
     },
     "require-dev": {
-        "greg-1-anderson/composer-test-scenarios": "^1",
-        "php-coveralls/php-coveralls": "^2.5",
-        "phpunit/phpunit": "^9",
-        "squizlabs/php_codesniffer": "^3.3"
+        "php-coveralls/php-coveralls": "^2.8",
+        "phpstan/phpstan": "^2.0",
+        "phpunit/phpunit": "^10.5 || ^11 || ^12 || ^13",
+        "squizlabs/php_codesniffer": "^3.13"
     },
     "scripts": {
         "cs": "phpcs",
         "cbf": "phpcbf",
+        "stan": "phpstan",
         "unit": "phpunit",
         "lint": [
             "find src -name '*.php' -print0 | xargs -0 -n1 php -l",
@@ -41,7 +55,8 @@
         "test": [
             "@lint",
             "@unit",
-            "@cs"
+            "@cs",
+            "@stan"
         ],
         "coverage": "php -d pcov.enabled=1 vendor/bin/phpunit tests/src --coverage-clover build/logs/clover.xml",
         "coveralls": [
@@ -51,10 +66,5 @@
     "config": {
         "optimize-autoloader": true,
         "sort-packages": true
-    },
-    "extra": {
-        "branch-alias": {
-            "dev-master": "4.x-dev"
-        }
     }
 }

phpstan.neon.dist

@@ -0,0 +1,5 @@
+parameters:
+    level: 5
+    paths:
+        - src
+        - tests/src

phpunit.xml.dist

@@ -1,18 +1,14 @@
 <?xml version="1.0"?>
 <!-- phpunit.xml.dist -->
-<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/9.3/phpunit.xsd">
-  <coverage processUncoveredFiles="true">
-    <include>
-      <directory suffix=".php">src</directory>
-    </include>
-    <report>
-      <clover outputFile="build/logs/clover.xml"/>
-    </report>
-  </coverage>
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/13.2/phpunit.xsd" cacheDirectory=".phpunit.cache">
   <testsuites>
-    <testsuite name="Yaml Expander Test Suite">
+    <testsuite name="Expander Test Suite">
       <directory>tests/src</directory>
     </testsuite>
   </testsuites>
-  <logging/>
+  <source>
+    <include>
+      <directory suffix=".php">src</directory>
+    </include>
+  </source>
 </phpunit>