[wu-sheng]

Bumps dependencies flagged by open Dependabot alerts, plus the GitHub Actions used by CI.

Rust extension (Cargo.lock)

• rustls 0.23.43 -> 0.23.46 (GHSA-2mjx-qc3c-rqvc). Done with cargo update -p rustls, which kept the Rust 1.85 MSRV (rust-version = "1.85"). Cargo also re-pointed a few Windows-only dependency edges from windows-sys 0.52.0 to 0.60.2. Both versions were already in the lockfile.
• dist-material/LICENSE updated to match. license-eye dependency resolve --summary (the License workflow's check) regenerates it with no diff.

PHP test project (tests/php/composer.lock, test-only)

• guzzlehttp/guzzle 7.4.5 -> 7.16.1: GHSA-v5mv-p594-2x33 (CVE-2026-69246), GHSA-f7vp-7xgx-4w4r (CVE-2026-69245), GHSA-h95v-h523-3mw8 (CVE-2026-67354), GHSA-f283-ghqc-fg79 (CVE-2026-67353), GHSA-wm3w-8rrp-j577 (CVE-2026-67355), GHSA-g446-98w2-8p5w (CVE-2026-59883), GHSA-94pj-82f3-465w (CVE-2026-67339), GHSA-cwxw-98qj-8qjx (CVE-2026-55767), GHSA-wpwq-4j6v-78m3 (CVE-2026-55568)
• guzzlehttp/psr7 2.5.0 -> 2.13.2: GHSA-c2w2-prh8-qm98 (CVE-2026-59882), GHSA-vm85-hxw5-5432 (CVE-2026-55766), GHSA-hq7v-mx3g-29hw (CVE-2026-49214), GHSA-34xg-wgjx-8xph (CVE-2026-48998)
• phpseclib/phpseclib 3.0.35 -> 3.0.57: GHSA-q97c-8qh3-fpc6 (CVE-2026-84308), GHSA-m557-wrgg-6rp4 (CVE-2026-55599), GHSA-f2qx-66wf-wvvx (CVE-2024-27355), GHSA-2528-jw5q-ww88 (CVE-2024-27354), GHSA-3qpq-r242-jqj7 (CVE-2026-44167), GHSA-r854-jrxh-36qx (CVE-2026-40194), GHSA-94g3-g5v7-q4jg (CVE-2026-32935)
• Transitive updates: guzzlehttp/promises 1.5.1 -> 2.6.0, psr/http-message 1.1 -> 2.0, psr/http-client 1.0.1 -> 1.0.3, psr/http-factory 1.0.2 -> 1.1.0, paragonie/constant_time_encoding v2.6.3 -> v2.8.2, symfony/deprecation-contracts v2.5.2 -> v2.5.4. New: symfony/polyfill-php80 v1.43.0.

Produced with composer update guzzlehttp/guzzle guzzlehttp/psr7 phpseclib/phpseclib --with-all-dependencies. The resolution used a temporary platform.php = 7.2.5 so the lock stays installable on the lowest PHP in the CI matrix (7.2). That override is not committed: composer.json is unchanged and the content-hash matches it. composer why-not --locked php 7.2.5 reports no blockers.

GitHub Actions

• actions/checkout v2 -> v7 (all workflows). The workflows only use push, pull_request and release triggers, so the v7 fork-checkout block for pull_request_target/workflow_run does not apply.
• Swatinem/rust-cache 9d47c6ad4b02e050fd481d890b2ea34778fd09d6 (v2.7.8) -> d1527c8f67ef9af357290475d4af4b0fab8f12e0 (v2.9.3)
• shivammathur/setup-php stays on @v2, which is already its latest major.
• apache/skywalking-eyes stays on d299844e. With v0.9.0, license-eye dependency check fails locally on this repo's config ("Apache-2.0 unknown or incompatible"). Moving to it needs a separate config change.

This repo has no skywalking-infra-e2e usage. The Linux jobs already call docker compose (v2), and the runners are pinned to ubuntu-24.04 / macos-14, so no Docker 29 changes were needed.

Left as is

• time 0.3.45 (GHSA-r6v5-fh4h-64xc, CVE-2026-25727): every patched release (>= 0.3.47) requires Rust 1.88. This repo's documented MSRV and CI toolchain are 1.85, so the fix needs an MSRV bump, which is out of scope for this PR.

Verified locally

• cargo check --locked -p skywalking-php-worker: passes. This builds the skywalking/tonic/tokio-rustls/rustls path.
• cargo check --workspace: blocked locally because bindgen 0.71.1 (from phper-sys) panics on the macOS PHP 8.5.4 headers ("unknown calling convention"). This also happens without these changes. CI covers the full build.
• license-eye header check, dependency check and dependency resolve --summary: all pass, and dist-material/LICENSE has no diff.
• composer validate --no-check-publish: valid. composer audit --locked: no advisories. composer install --dry-run --ignore-platform-req=ext-swoole: resolves.
• Not run locally: clippy on the 1.85 toolchain, cargo test (needs docker compose services), and the PECL build. CI on this PR covers them.