Bump composer/composer from 2.1.8 to 2.1.12

[dependabot[bot]]

Bumps composer/composer from 2.1.8 to 2.1.12.

Release notes

Sourced from composer/composer's releases.

2.1.12

• Fixed issues in proxied binary files relying on __FILE__ / __DIR__ on php <8 (#10261)
• Fixed 9999999-dev being shown in some cases by the show command (#10260)
• Fixed GitHub Actions output escaping regression on PHP 8.1 (#10250)

2.1.11

• Fixed issues in proxied binary files when using declare() on php <8 (#10249)
• Fixed GitHub Actions output escaping issues (#10243)

2.1.10

• Added type annotations to all classes, which may have an effect on CI/static analysis for people using Composer as a dependency (#10159)
• Fixed CurlDownloader requesting gzip encoding even when no gzip support is present (#10153)
• Fixed regression in 2.1.6 where the help command was not working for plugin commands (#10147)
• Fixed warning showing when an invalid cache dir is configured but unused (#10125)
• Fixed require command reverting changes even though dependency resolution succeeded when something fails in scripts for example (#10118)
• Fixed require not finding the right package version when some newly required extension is missing from the system (#10167)
• Fixed proxied binary file issues, now using output buffering (e1dbd65aff)
• Fixed and improved error reporting in several edge cases (#9804, #10136, #10163, #10224, #10209)
• Fixed some more Windows CLI parameter escaping edge cases

2.1.9

• Security: Fixed command injection vulnerability on Windows (GHSA-frqg-7g38-6gcf / CVE-2021-41116)
• Fixed classmap parsing with a new class parser which does not rely on regexes anymore (#10107)
• Fixed inline git credentials showing up in output in some conditions (#10115)
• Fixed support for running updates while offline as long as the cache contains enough information (#10116)
• Fixed show --all foo/bar which as of 2.0.0 was not showing all versions anymore but only the installed one (#10095)
• Fixed VCS repos ignoring some versions silently when the API rate limit is reached (#10132)
• Fixed CA bundle to remove the expired Let's Encrypt root CA

Changelog

Sourced from composer/composer's changelog.

[2.1.12] 2021-11-09

• Fixed issues in proxied binary files relying on FILE / DIR on php <8 (#10261)
• Fixed 9999999-dev being shown in some cases by the show command (#10260)
• Fixed GitHub Actions output escaping regression on PHP 8.1 (#10250)

[2.1.11] 2021-11-02

• Fixed issues in proxied binary files when using declare() on php <8 (#10249)
• Fixed GitHub Actions output escaping issues (#10243)

[2.1.10] 2021-10-29

• Added type annotations to all classes, which may have an effect on CI/static analysis for people using Composer as a dependency (#10159)
• Fixed CurlDownloader requesting gzip encoding even when no gzip support is present (#10153)
• Fixed regression in 2.1.6 where the help command was not working for plugin commands (#10147)
• Fixed warning showing when an invalid cache dir is configured but unused (#10125)
• Fixed require command reverting changes even though dependency resolution succeeded when something fails in scripts for example (#10118)
• Fixed require not finding the right package version when some newly required extension is missing from the system (#10167)
• Fixed proxied binary file issues, now using output buffering (e1dbd65aff)
• Fixed and improved error reporting in several edge cases (#9804, #10136, #10163, #10224, #10209)
• Fixed some more Windows CLI parameter escaping edge cases

[2.1.9] 2021-10-05

• Security: Fixed command injection vulnerability on Windows (GHSA-frqg-7g38-6gcf / CVE-2021-41116)
• Fixed classmap parsing with a new class parser which does not rely on regexes anymore (#10107)
• Fixed inline git credentials showing up in output in some conditions (#10115)
• Fixed support for running updates while offline as long as the cache contains enough information (#10116)
• Fixed show --all foo/bar which as of 2.0.0 was not showing all versions anymore but only the installed one (#10095)
• Fixed VCS repos ignoring some versions silently when the API rate limit is reached (#10132)
• Fixed CA bundle to remove the expired Let's Encrypt root CA

Commits

• 6e3c2b1 Release 2.1.12
• 8a63018 Update changelog
• 28c3412 Fix php proxies to resolve FILE and DIR using realpath on PHP <8, fix...
• 3bb78fd Make new phar filename random to avoid possible concurrency issues, refs #10252
• 6a7264f Trigger autoloading of a few classes before executing self-update command, fi...
• abf832a Update what GitHub token scope is needed and what it implies (#10257)
• 4c9e567 Provide different URL options to encourage users to create low-privilege GitH...
• 9f433ab Fix 9999999-dev showing on composer show when no branch alias is defined for ...
• 5b47fa1 Add back abandoned key in repository search results (#10259)
• d7154c2 Fix GithubActionError on php 8.1 (#10250)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/dshoreman/servidor/network/alerts).

[codecov[bot]]

Codecov Report

Merging #517 (6da8363) into develop (f495ecd) will not change coverage. The diff coverage is n/a.

@@            Coverage Diff             @@
##             develop     #517   +/-   ##
==========================================
  Coverage      99.56%   99.56%           
  Complexity       411      411           
==========================================
  Files             84       84           
  Lines           1162     1162           
==========================================
  Hits            1157     1157           
  Misses             5        5           

---

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update f495ecd...6da8363. Read the comment docs.

[dependabot[bot]]

Looks like composer/composer is up-to-date now, so this is no longer needed.