ci: audit dependencies with composer audit

[roxblnfk]

🔍 What was changed

• New 🔐 Security analysis workflow runs composer audit on PRs and pushes to 3.x (PHP 8.2, highest dependencies).
• composer.json ignores GHSA-g9pc-8g42-g6vq: the advisory is declared for spiral/roadrunner < 2025.1.0, which by semver also matches RoadRunner 3.x, though 3.x is not affected.

Checklist

• How was this tested:
  • composer validate --strict and composer update + composer audit pass locally

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 41 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: bb578fb7-f9e4-4e49-aa91-c99ea3f51303

---

📥 Commits

Reviewing files that changed from the base of the PR and between e832fe7 and 05bbbef.

---

📒 Files selected for processing (2)

• .github/workflows/security.yml
• composer.json

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}