[turegjorup]

Link to ticket

None

Description

Full composer update before tagging 3.0.0-rc11 (#630).

• 79 packages updated, robrichards/xmlseclibs and ralouphie/getallheaders dropped, symfony/polyfill-php82 added. composer audit goes from five advisories to the two on api-platform/core, which have been reviewed and don't affect us.
• api-platform/core stays on 3.4.17, the latest 3.x. Composer blocks it during update because of those advisories, so the update lists every other locked package rather than turning off policy.advisories.block.
• guzzlehttp/guzzle 7 → 8 (with psr7/promises 2 → 3). league/oauth2-client 2.9.1 widened its range to ^8.0. Our own code uses Symfony HttpClient, but itk-dev/openid-connect sends the OIDC token exchange through oauth2-client's default Guzzle client.
• Applied the two refactors the updated Rector proposes (??= in InstantBook, ?-> in AbstractProcessor).
• Baselined the Slide::$content/$templateOptions nullable JSON column vs array property mismatch that the updated phpstan-doctrine now reports. The mismatch already exists; fixing it needs a schema change, which doesn't belong in a release PR.

Checklist

• My code is covered by test cases.
• My code passes our test (all our tests).
• My code passes our static analysis suite.
• My code passes our continuous integration process.

PHPUnit passes locally (379 tests, 1 skipped), as do PHPStan, Rector and php-cs-fixer. OIDC login against a real provider is still untested with Guzzle 8.