79:T2e1b,Bumps the actions group with 2 updates in the / directory: [step-security/harden-runner](https://github.com/step-security/harden-runner) and [shivammathur/setup-php](https://github.com/shivammathur/setup-php). Updates `step-security/harden-runner` from 2.20.1 to 2.22.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.22.1

What's Changed

Fixed security rules not initializing on GHES self-hosted runners

Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname

Full Changelog: https://github.com/step-security/harden-runner/compare/v2.22.0...v2.22.1

v2.22.0

What's Changed

Linux ARM64 support for community tier

GHES support for self-hosted VMs (enterprise tier)

MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: https://github.com/step-security/harden-runner/compare/v2.21.1...v2.22.0

v2.21.1

What's Changed

Improved performance of the disable-sudo feature.

Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.

Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.

Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: https://github.com/step-security/harden-runner/compare/v2.21.0...v2.21.1

v2.21.0

What's Changed

Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.

Improved Support for AWS CodeBuild GitHub Actions Runners.

Bug fixes.

Full Changelog: https://github.com/step-security/harden-runner/compare/v2.20.1...v2.21.0

Commits

ccd8616 Merge pull request #704 from h0x0er/jatin/ghes-endp
037ccfd implicitly add ghes endpoint in allowList
e7438c7 Merge pull request #703 from h0x0er/jatin/ghes-codebuild-fixes
afb0b33 fixes for armour rules not getting initialised
351661c Merge pull request #701 from step-security/rc-44
1dc7f2e Merge pull request #702 from h0x0er/jatin/ghes-changes-up
af5ca38 simplified ghes config creation
9a6d710 fix2
74c65ea fix
ceac816 resovled comments
Additional commits viewable in compare view

Updates `shivammathur/setup-php` from 2.37.2 to 2.40.0

Release notes

Sourced from shivammathur/setup-php's releases.

2.40.0

Changelog

Added support for PHP 8.7 nightly builds. This installs PHP builds from the master branch of php/php-src.
- name: Setup PHP 8.7
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.7'
Added support for Ubuntu 26.04 (ubuntu-26.04). (#1083)

Added support for pinning tools to SHA-256 and SHA-512 checksums. (#1098, #1099)
- name: Setup PHP with tools pinned to checksums
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: >
      composer:2.9.8@sha256:59b2c50e10cafa0d8efc19ede9a326d782f096c674a26baf98cf042ce23de890,
      phpunit:12.5.0@sha512:76430b433bd57f96e5fbbabaefc0c82e3a5b19b1a366bd836614344c441a7a87575d77faa07e0e58ecec52061af67584b036adc4311f0764bd4414bc62be4684
Fixed support for Couchbase, Oracle, and IBM extensions on Ubuntu 26.04. (#1123)

Added support for cpx. (#1104)
- name: Setup PHP with cpx
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: cpx
Added support for Laravel Cloud CLI. (#1106)
- name: Setup PHP with Laravel Cloud CLI
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: laravel-cloud
Added configurable verbose logging using the verbose environment variable. Set it to true or v to show command output, or vv or vvv to also enable tracing. Also, deprecated the verbose and more-verbose tags in favor of this environment variable. (#1077, #1118, #1119)

... (truncated)

Commits

eb7c497 Bump version to 2.40.0
7d671ba Resolve PHP formula aliases before invoking Homebrew
57747c1 Allow opt-in builds cache on Blacksmith and Depot runners
421f97f Keep verbose tests in TypeScript
dc7811a Bump Node.js dependencies
7932293 Bump the github-actions group with 3 updates (#1130)
87d00bd Default "Are you willing to submit a PR?" to "No" (#1126)
f458a14 Remove macOS 14 from README runner listings
bc12f5c Switch to homebrew-extensions for geos on macOS [skip ci]
bbf0b63 Try Brew extension installs before refreshing Homebrew
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions

7a:Tfa1,**Review the following changes in direct dependencies.** Learn more about [Socket for GitHub](https://socket.dev?utm_medium=gh).

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 ⏵ eb7c497e18156a6bbabfef1d3a82760b9eda3962	⁺²²

[View full report](https://socket.dev/dashboard/org/vercel/diff-scan/03093b3e-439e-4401-bab6-db06e8fbc1d7?tab=dependencies) 7b:T4fc,Bump the actions group across 1 directory with 2 updates Bumps the actions group with 2 updates in the / directory: [step-security/harden-runner](https://github.com/step-security/harden-runner) and [shivammathur/setup-php](https://github.com/shivammathur/setup-php). Updates `step-security/harden-runner` from 2.20.1 to 2.22.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/b09bb98e06d4d774595224525879c09bc6e98c40...ccd8616d44fd3846e67624a50d5aad6d37bf2d25) Updates `shivammathur/setup-php` from 2.37.2 to 2.40.0 - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](https://github.com/shivammathur/setup-php/compare/f3e473d116dcccaddc5834248c87452386958240...eb7c497e18156a6bbabfef1d3a82760b9eda3962) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: shivammathur/setup-php dependency-version: 2.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] 63:["$","$L76",null,{"entries":[{"key":["platform",{"userId":"anon"},"pulls","page",{"owner":"vercel-labs","repo":"ai-gateway-provider-php","pullNumber":20}],"data":{"repositoryId":"4810","detail":{"author":{"avatarUrl":"https://cdn.trylle.com/media/images/ee9ce3e41ccd83d0d82b44c3a379d115?key=ATdRna3MzMw8Hlfnq4en2QfWXAbcWt7Gs%2B6LJIK5idPcU0A%2BKMm36g5Tn87RFkNzLx0sTBQTbDz6ZwuI50wQwsUFZKKL3VMmSNfiwnzZKqg8A54YBKUuHI2wXCpWkb7sqOYvytoTlV%2FbmplzTzLHxkMr5yQlXx9xXA5X3EIK7cL6DdayqPfO1B6%2B0g%3D%3D","externalProvider":"github","login":"dependabot[bot]","type":"Bot","url":"https://github.com/apps/dependabot"},"authorId":"49699333","baseRefName":"main","closedAt":null,"comments":1,"createdAt":"2026-10-14T20:52:52Z","headRefName":"dependabot/github_actions/actions-37b326b0a3","id":"4935009","isDraft":false,"labels":[{"color":"0366d6","description":"Pull requests that update a dependency file","name":"dependencies"},{"color":"000000","description":"Pull requests that update GitHub Actions code","name":"github_actions"}],"number":20,"repository":{"name":"ai-gateway-provider-php","owner":"vercel-labs","provider":"forgejo"},"state":"open","title":"Bump the actions group across 1 directory with 2 updates","updatedAt":"2026-10-14T20:54:22Z","url":"https://trylle.com/vercel-labs/ai-gateway-provider-php/pulls/20","body":"$79","additions":9,"deletions":9,"changedFiles":4,"commits":1,"reviewComments":0,"headSha":"a40d4abc04f1f960ff46e870926b2eba4486176d","baseSha":"66cde97d848a59aab8b96649bca3fca9514616b0","headRepoOwner":"vercel-labs","headRepoName":"ai-gateway-provider-php","isMerged":false,"mergeCommitSha":null,"mergedBy":null,"mergeable":true,"mergeableState":"clean","conflictingFiles":null,"requestedTeams":[],"requestedReviewers":[],"graphqlId":"issue:20"},"comments":[{"id":26878035,"graphqlId":"26878035","body":"$7a","createdAt":"2026-10-14T20:54:22Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/cf91076218762251b0718dd0217bff7f?key=Aemm%2Fkuxf%2BbNdx34RcucjcwMyS7fZJdw%2Fh0DQmYTKPq6iVUJRFaNwaCFsDoe55qjgL1TmBWgQO%2BL1vVy%2BcjSIbBdRw3YaKe6n7ItSIktuk3fjR4u71v71XUfD6IFrDgzhXfugcd%2BNSZzWj%2B3aWNYeXkxoHsXUwWUbrNdRNXSXp6CVgYnuPs4R%2FwVGw%3D%3D","externalProvider":"github","login":"socket-security[bot]","type":"Bot","url":"https://github.com/apps/socket-security"}}],"commits":[{"sha":"a40d4abc04f1f960ff46e870926b2eba4486176d","message":"$7b","createdAt":"2026-10-14T20:52:48Z","author":{"avatarUrl":"","login":"","name":"dependabot[bot]","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.no_gpg_keys_found"}}],"events":[],"reviews":[],"stackEvents":[],"commentPagination":{"totalCount":1,"perPage":30,"loadedPages":[1]},"eventPagination":{"loadedPages":[1],"hasMore":false},"headRefDeleted":false},"fetchedAt":1794534990058}],"children":"$L7c"}] 65:null 6c:[["$","title","0",{"children":"Commits · Bump the actions group across 1 directory with 2 updates · vercel-labs/ai-gateway-provider-php | Trylle"}],["$","meta","1",{"name":"description","content":"Commits on Bump the actions group across 1 directory with 2 updates (#20) in vercel-labs/ai-gateway-provider-php."}],["$","meta","2",{"name":"application-name","content":"Trylle"}],["$","link","3",{"rel":"manifest","href":"/manifest.json","crossOrigin":"$undefined"}],["$","meta","4",{"name":"keywords","content":"Commits · Bump the actions group across 1 directory with 2 updates · vercel-labs/ai-gateway-provider-php, vercel-labs/ai-gateway-provider-php, vercel-labs/ai-gateway-provider-php repository, ai-gateway-provider-php, PHP repository, source code, trylle, agent-native git platform, git platform for agents and humans, git platform for ai agents, coding agent pull requests, ai code review, repository automation, stacked pull requests, two-way github sync, github-compatible actions, try cli"}],["$","meta","5",{"name":"robots","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","8",{"name":"twitter:domain","content":"trylle.com"}],["$","meta","9",{"name":"twitter:url","content":"https://trylle.com/vercel-labs/ai-gateway-provider-php/pulls/20/commits"}],["$","link","10",{"rel":"canonical","href":"https://trylle.com/vercel-labs/ai-gateway-provider-php/pulls/20/commits"}],["$","meta","11",{"name":"format-detection","content":"telephone=no"}],["$","meta","12",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","13",{"name":"apple-mobile-web-app-title","content":"Trylle"}],["$","meta","14",{"name":"apple-mobile-web-app-status-bar-style","content":"black-translucent"}],["$","meta","15",{"property":"og:title","content":"Commits · Bump the actions group across 1 directory with 2 updates · vercel-labs/ai-gateway-provider-php | Trylle"}],["$","meta","16",{"property":"og:description","content":"Commits on Bump the actions group across 1 directory with 2 updates (#20) in vercel-labs/ai-gateway-provider-php."}],["$","meta","17",{"property":"og:url","content":"https://trylle.com/vercel-labs/ai-gateway-provider-php/pulls/20/commits"}],["$","meta","18",{"property":"og:site_name","content":"Trylle"}],["$","meta","19",{"property":"og:locale","content":"en_US"}],["$","meta","20",{"property":"og:image","content":"https://trylle.com/api/og.png?kind=repo&owner=vercel-labs&repo=ai-gateway-provider-php"}],["$","meta","21",{"property":"og:image:secure_url","content":"https://trylle.com/api/og.png?kind=repo&owner=vercel-labs&repo=ai-gateway-provider-php"}],["$","meta","22",{"property":"og:image:type","content":"image/png"}],["$","meta","23",{"property":"og:image:width","content":"1200"}],["$","meta","24",{"property":"og:image:height","content":"630"}],["$","meta","25",{"property":"og:image:alt","content":"vercel-labs/ai-gateway-provider-php repository preview on Trylle"}],["$","meta","26",{"property":"og:type","content":"website"}],["$","meta","27",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","28",{"name":"twitter:site","content":"@trylle"}],["$","meta","29",{"name":"twitter:title","content":"Commits · Bump the actions group across 1 directory with 2 updates · vercel-labs/ai-gateway-provider-php | Trylle"}],["$","meta","30",{"name":"twitter:description","content":"Commits on Bump the actions group across 1 directory with 2 updates (#20) in vercel-labs/ai-gateway-provider-php."}],["$","meta","31",{"name":"twitter:image","content":"https://trylle.com/api/og.png?kind=repo&owner=vercel-labs&repo=ai-gateway-provider-php"}],["$","meta","32",{"name":"twitter:image:alt","content":"vercel-labs/ai-gateway-provider-php repository preview on Trylle"}],"$L7d","$L7e","$L7f","$L80"]

Commits on Wed, Oct 14, 2026