v0.5.0: modernize deps, commit lockfile, add PHP 7.4-8.5 CI matrix

- Bump minimum PHP to 7.4; bump defuse/php-encryption to ^2.4
- Replace abandoned PHPUnit ^5.6 with ^9.6 and satooshi/php-coveralls
  with php-coveralls/php-coveralls ^2.7 (closes open vulnerability)
- Commit composer.lock so Dependabot can raise dependency PRs
- Rewrite CI as a PHP 7.4-8.5 matrix using shivammathur/setup-php;
  CI now actually runs PHPUnit (previously only PHPStan ran)
- Split static analysis into its own job on PHP 8.3
- Annotate Manager session-handler methods with #[\ReturnTypeWillChange]
  to silence PHP 8.1+ tentative-return-type deprecations
- Drop .travis.yml; drop "version" field from composer.json

Author: ericmann

.github/workflows/ci.yml

@@ -1,23 +1,74 @@
 name: CI
 
-on: [push]
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
 
 jobs:
-  build-test:
+  test:
+    name: PHPUnit (PHP ${{ matrix.php }})
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5']
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP ${{ matrix.php }}
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          extensions: mbstring, openssl, sodium
+          coverage: xdebug
+          tools: composer:v2
+
+      - name: Validate composer.json and composer.lock
+        run: composer validate --strict
+
+      - name: Cache Composer dependencies
+        uses: actions/cache@v4
+        with:
+          path: vendor
+          key: composer-${{ matrix.php }}-${{ hashFiles('composer.lock') }}
+          restore-keys: composer-${{ matrix.php }}-
+
+      - name: Install dependencies
+        run: composer install --prefer-dist --no-progress --no-interaction
+
+      - name: Run PHPUnit
+        run: vendor/bin/phpunit --coverage-clover build/logs/clover.xml
+
+      - name: Upload coverage to Coveralls
+        if: matrix.php == '8.3'
+        env:
+          COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: vendor/bin/php-coveralls -v
+        continue-on-error: true
+
+  static-analysis:
+    name: PHPStan
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
-
-    - name: Install dependencies
-      uses: php-actions/composer@v6
-      with:
-        version: 1
-        php_version: 7.4
-
-    - name: PHPStan Static Analysis
-      uses: php-actions/phpstan@v3
-      with:
-        path: php/
-        php_version: 7.4
-        level: 2
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          tools: composer:v2
+
+      - name: Install dependencies
+        run: composer install --prefer-dist --no-progress --no-interaction
+
+      - name: PHPStan Static Analysis
+        uses: php-actions/phpstan@v3
+        with:
+          path: php/
+          php_version: 8.3
+          level: 2

.gitignore

@@ -1,2 +1,5 @@
 /vendor/
-composer.lock
+/build/
+.phpunit.result.cache
+.phpunit.cache/
+.claude/settings.local.json

.travis.yml

@@ -4,6 +4,23 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## 0.5.0 - 2026-04-14
+### Changed
+- Bumped minimum PHP version to 7.4
+- Upgraded `defuse/php-encryption` to `^2.4`
+- Upgraded PHPUnit to `^9.6` (replaces abandoned `^5.6`)
+- Replaced abandoned `satooshi/php-coveralls` with `php-coveralls/php-coveralls ^2.7`
+- Rewrote CI workflow as a PHP 7.4–8.5 matrix using `shivammathur/setup-php`; CI now actually runs PHPUnit in addition to PHPStan
+- Annotated `Manager` session-handler methods with `#[\ReturnTypeWillChange]` so PHP 8.1+ no longer emits tentative-return-type deprecations
+
+### Added
+- Committed `composer.lock` so Dependabot can raise dependency PRs
+- `composer test` / `composer test-coverage` scripts
+
+### Removed
+- `.travis.yml` (superseded by GitHub Actions)
+- `version` field from `composer.json` (versions are defined by git tags)
+
 ## 0.4.0 - 2021-07-21
 ### Changed
 - Add PHPStan static code analysis

CHANGELOG.md

@@ -2,7 +2,6 @@
     "name": "ericmann/sessionz",
     "description": "PHP Session Manager Interface",
     "type": "library",
-    "version": "0.3.1",
     "license": "MIT",
     "authors": [
         {
@@ -17,11 +16,15 @@
         }
     },
     "require": {
-        "php": ">=5.6",
-        "defuse/php-encryption": "^2.0"
+        "php": ">=7.4",
+        "defuse/php-encryption": "^2.4"
     },
     "require-dev": {
-        "phpunit/phpunit": "^5.6",
-        "satooshi/php-coveralls": "^1.0"
+        "phpunit/phpunit": "^9.6",
+        "php-coveralls/php-coveralls": "^2.7"
+    },
+    "scripts": {
+        "test": "phpunit",
+        "test-coverage": "phpunit --coverage-clover build/logs/clover.xml"
     }
 }