ci: check dependencies with composer audit

[roxblnfk]

Q	A
Bugfix?	❌
Breaks BC?	❌
New feature?	❌

Adds a 🔐 Security analysis workflow that runs composer audit on PHP 8.1 with the highest dependencies, on pull requests and pushes to 2.x.

• GHSA-g9pc-8g42-g6vq is ignored in config.audit.ignore: it is declared for spiral/roadrunner < 2025.1.0, and by semver that range also matches RoadRunner 3.x (which is not affected). On 2.x the highest resolution is v2025.1.x, so the ignore only matters once RoadRunner 3 support lands (feat: support RoadRunner v3 #14).
• composer validate --strict, composer update and composer audit pass locally.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: b5d88b8b-9740-4c48-a0c3-65e7c4de0254

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}