[renovate-bot-cbcoutinho]

This PR contains the following updates:

Package	Type	Update	Change
shivammathur/setup-php	action	minor	2.37.2 → 2.40.0

---

Release Notes

shivammathur/setup-php

v2.40.0

Compare Source

Changelog

• Added support for PHP 8.7 nightly builds. This installs PHP builds from the master branch of php/php-src.

- name: Setup PHP 8.7
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.7'

• Added support for Ubuntu 26.04 (ubuntu-26.04). (#​1083)

• Added support for pinning tools to SHA-256 and SHA-512 checksums. (#​1098, #​1099)

- name: Setup PHP with tools pinned to checksums
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: >
      composer:2.9.8@sha256:59b2c50e10cafa0d8efc19ede9a326d782f096c674a26baf98cf042ce23de890,
      phpunit:12.5.0@sha512:76430b433bd57f96e5fbbabaefc0c82e3a5b19b1a366bd836614344c441a7a87575d77faa07e0e58ecec52061af67584b036adc4311f0764bd4414bc62be4684

• Fixed support for Couchbase, Oracle, and IBM extensions on Ubuntu 26.04. (#​1123)

• Added support for cpx. (#​1104)

- name: Setup PHP with cpx
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: cpx

• Added support for Laravel Cloud CLI. (#​1106)

- name: Setup PHP with Laravel Cloud CLI
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: laravel-cloud

• Added configurable verbose logging using the verbose environment variable. Set it to true or v to show command output, or vv or vvv to also enable tracing. Also, deprecated the verbose and more-verbose tags in favor of this environment variable. (#​1077, #​1118, #​1119)

- name: Setup PHP with verbose logging
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
  env:
    verbose: true

• Improved support for PHP version files, including version aliases, partial versions, and comments. For example, a .php-version file containing 8.x can now be used to set up the latest stable PHP 8 version. (#​1121)

- name: Checkout
  uses: actions/checkout@v7

- name: Setup PHP from a version file
  uses: shivammathur/setup-php@v2
  with:
    php-version-file: '.php-version'

• Improved PHP installation on macOS using cached builds from shivammathur/php-darwin. This should improve the setup-php runtime from around a minute to 5-10s.

• Improved Homebrew extension installation, timeout handling, and retries. (#​1120)

• Improved PHP installation on Windows using release manifests and cached builds from shivammathur/php-builder-windows.

• Improved caching and validation of versioned extensions on Linux, macOS, and Windows. (#​1108)

• Added opt-in support for cached PHP builds on Blacksmith and Depot runners using use_builds_cache environment variable. This is currently experimental and uses the builds cache that we maintain for GitHub hosted runners. (#​1056, #​1129)

- name: Setup PHP with cached builds
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
  env:
    use_builds_cache: true

• Switched to Homebrew extension packages for Lua and GEOS extensions on supported macOS PHP versions.

• Deprecated support for Intel macOS and macOS 14 arm64 runners. It is recommended to upgrade to arm64 based macOS runners (macos-15 or newer). (#​1112)

• Updated Node.js dependencies and internal GitHub Actions workflows.

For the complete list of changes, please refer to the Full Changelog

Thanks @​kmaeda-rakus, @​jrfnl, @​WendellAdriel, @​damiantw, @​ibrahimlawal-paystack, @​Perlence, and @​Sainan for the contributions.

Follow for updates

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
astrolabe-docs	Ready	Preview	Oct 9, 2026 4:06am UTC

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[claude]

Claude finished @renovate-bot-cbcoutinho[bot]'s task in 14s —— View job

---

Review: setup-php 2.37.2 → 2.40.0

Verdict: looks good to merge once CI is green.

• Scope: The diff is a pure SHA and comment bump (f3e473d… → eb7c497…, # 2.40.0) across 9 uses: lines in ci.yml, e2e.yml, pact.yml and release.yml. No other changes. Pinning to a full SHA with a version comment is consistent with the other actions in these workflows.
• Missed references: Every setup-php reference in the diff was updated consistently. I did not grep the whole repo for leftovers.
• Compatibility: Our inputs (php-version, extensions, coverage) are unaffected by the release notes. The new features (PHP 8.7, checksum pinning, verbose env var, cpx) are all opt-in.
• Runners: The Intel macOS / macOS 14 deprecation doesn't apply, as these workflows use Linux runners.
• Extensions: pact.yml installs ffi and the other jobs install sqlite/pdo_sqlite. The release notes mention improved caching and validation of versioned extensions. This is the one area where behaviour could change, and a green CI run will confirm it.
• Unverified: I couldn't confirm that the SHA eb7c497e… is the commit behind tag 2.40.0, because the network check was blocked in this environment. Renovate normally resolves it correctly. Before merging, check that the tag 2.40.0 points at this commit.
• Test coverage: This change doesn't touch API surface, so the Pact and e2e requirement in CLAUDE.md doesn't apply. The CI, e2e and Pact workflows themselves exercise the new action version. Note that ci.yml's summary gate excludes e2e and Pact, so check those workflows separately before merging.
• Security: No concerns. The action stays pinned to a full commit SHA.