Drop the bare command aliases, and group dependabot action updates

.github/workflows/browser.yml

@@ -41,6 +41,29 @@ jobs:
           extensions: dom, curl, libxml, mbstring, zip, pdo, sqlite, pdo_sqlite, bcmath, intl
           coverage: none
 
+      - name: Resolve composer cache directory
+        id: composer-cache
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore composer cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }}
+          restore-keys: composer-${{ runner.os }}-${{ matrix.php }}-
+
+      - name: Drop cached laranail archives
+        # laranail/* resolve through a single MOVING v0.1.0 tag, so composer's dist
+        # cache is keyed on a name whose contents change underneath it. A restored
+        # archive is then silently stale: the install reports success and unpacks
+        # whatever was cached the first time. Everything else is immutable per
+        # version and stays cached.
+        # POSIX command via bash: Windows runners default to PowerShell, where this
+        # would be a parse error rather than a no-op.
+        shell: bash
+        run: rm -rf "$(composer config cache-files-dir)/laranail"
+
       - name: Install PHP dependencies
         run: composer update --prefer-dist --no-interaction --no-progress
 

.github/workflows/security.yml

@@ -31,6 +31,29 @@ jobs:
           php-version: '8.4'
           coverage: none
 
+      - name: Resolve composer cache directory
+        id: composer-cache
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore composer cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }}
+          restore-keys: composer-${{ runner.os }}-${{ matrix.php }}-
+
+      - name: Drop cached laranail archives
+        # laranail/* resolve through a single MOVING v0.1.0 tag, so composer's dist
+        # cache is keyed on a name whose contents change underneath it. A restored
+        # archive is then silently stale: the install reports success and unpacks
+        # whatever was cached the first time. Everything else is immutable per
+        # version and stays cached.
+        # POSIX command via bash: Windows runners default to PowerShell, where this
+        # would be a parse error rather than a no-op.
+        shell: bash
+        run: rm -rf "$(composer config cache-files-dir)/laranail"
+
       - name: Install dependencies
         run: composer update --prefer-dist --no-interaction --no-progress
 

.github/workflows/static-analysis.yml

@@ -29,6 +29,29 @@ jobs:
           extensions: dom, curl, libxml, mbstring, zip, pdo, sqlite, pdo_sqlite, bcmath, intl
           coverage: none
 
+      - name: Resolve composer cache directory
+        id: composer-cache
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore composer cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }}
+          restore-keys: composer-${{ runner.os }}-${{ matrix.php }}-
+
+      - name: Drop cached laranail archives
+        # laranail/* resolve through a single MOVING v0.1.0 tag, so composer's dist
+        # cache is keyed on a name whose contents change underneath it. A restored
+        # archive is then silently stale: the install reports success and unpacks
+        # whatever was cached the first time. Everything else is immutable per
+        # version and stays cached.
+        # POSIX command via bash: Windows runners default to PowerShell, where this
+        # would be a parse error rather than a no-op.
+        shell: bash
+        run: rm -rf "$(composer config cache-files-dir)/laranail"
+
       - name: Install dependencies
         run: composer update --prefer-dist --no-interaction --no-progress
 
@@ -51,6 +74,29 @@ jobs:
           php-version: '8.4'
           coverage: none
 
+      - name: Resolve composer cache directory
+        id: composer-cache
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore composer cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }}
+          restore-keys: composer-${{ runner.os }}-${{ matrix.php }}-
+
+      - name: Drop cached laranail archives
+        # laranail/* resolve through a single MOVING v0.1.0 tag, so composer's dist
+        # cache is keyed on a name whose contents change underneath it. A restored
+        # archive is then silently stale: the install reports success and unpacks
+        # whatever was cached the first time. Everything else is immutable per
+        # version and stays cached.
+        # POSIX command via bash: Windows runners default to PowerShell, where this
+        # would be a parse error rather than a no-op.
+        shell: bash
+        run: rm -rf "$(composer config cache-files-dir)/laranail"
+
       - name: Install dependencies
         run: composer update --prefer-dist --no-interaction --no-progress
 
@@ -74,6 +120,29 @@ jobs:
           extensions: dom, curl, libxml, mbstring, zip, pdo, sqlite, pdo_sqlite, bcmath, intl
           coverage: none
 
+      - name: Resolve composer cache directory
+        id: composer-cache
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore composer cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }}
+          restore-keys: composer-${{ runner.os }}-${{ matrix.php }}-
+
+      - name: Drop cached laranail archives
+        # laranail/* resolve through a single MOVING v0.1.0 tag, so composer's dist
+        # cache is keyed on a name whose contents change underneath it. A restored
+        # archive is then silently stale: the install reports success and unpacks
+        # whatever was cached the first time. Everything else is immutable per
+        # version and stays cached.
+        # POSIX command via bash: Windows runners default to PowerShell, where this
+        # would be a parse error rather than a no-op.
+        shell: bash
+        run: rm -rf "$(composer config cache-files-dir)/laranail"
+
       - name: Install dependencies
         run: composer update --prefer-dist --no-interaction --no-progress
 
@@ -102,6 +171,29 @@ jobs:
           extensions: dom, curl, libxml, mbstring, zip, pdo, sqlite, pdo_sqlite, bcmath, intl
           coverage: none
 
+      - name: Resolve composer cache directory
+        id: composer-cache
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore composer cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }}
+          restore-keys: composer-${{ runner.os }}-${{ matrix.php }}-
+
+      - name: Drop cached laranail archives
+        # laranail/* resolve through a single MOVING v0.1.0 tag, so composer's dist
+        # cache is keyed on a name whose contents change underneath it. A restored
+        # archive is then silently stale: the install reports success and unpacks
+        # whatever was cached the first time. Everything else is immutable per
+        # version and stays cached.
+        # POSIX command via bash: Windows runners default to PowerShell, where this
+        # would be a parse error rather than a no-op.
+        shell: bash
+        run: rm -rf "$(composer config cache-files-dir)/laranail"
+
       - name: Install dependencies
         run: composer update --prefer-dist --no-interaction --no-progress
 

.github/workflows/tests.yml

@@ -16,15 +16,14 @@ jobs:
   # dependency precisely so the ALTCHA adapter is integration-tested against the real
   # library rather than a hand-written approximation of its challenge format.
   test:
-    name: PHP ${{ matrix.php }} · L${{ matrix.laravel }} · ${{ matrix.stability }}
+    name: PHP ${{ matrix.php }} · ${{ matrix.stability }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
     strategy:
       fail-fast: false
       matrix:
         php: ['8.4', '8.5']
-        laravel: ['13']
         stability: [prefer-stable]
         include:
           # One lowest-dependency run, on the floor. This is what catches a constraint that
@@ -34,7 +33,6 @@ jobs:
           # on symfony/tui. setup-php resolves '8.4' to the latest 8.4.x, so this run does not
           # prove 8.4.1 specifically — the constraint in composer.json is what does.
           - php: '8.4'
-            laravel: '13'
             stability: prefer-lowest
 
     steps:
@@ -49,9 +47,31 @@ jobs:
           extensions: dom, curl, libxml, mbstring, zip, pdo, sqlite, pdo_sqlite, bcmath, intl
           coverage: none
 
+      - name: Resolve composer cache directory
+        id: composer-cache
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore composer cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }}
+          restore-keys: composer-${{ runner.os }}-${{ matrix.php }}-
+
+      - name: Drop cached laranail archives
+        # laranail/* resolve through a single MOVING v0.1.0 tag, so composer's dist
+        # cache is keyed on a name whose contents change underneath it. A restored
+        # archive is then silently stale: the install reports success and unpacks
+        # whatever was cached the first time. Everything else is immutable per
+        # version and stays cached.
+        # POSIX command via bash: Windows runners default to PowerShell, where this
+        # would be a parse error rather than a no-op.
+        shell: bash
+        run: rm -rf "$(composer config cache-files-dir)/laranail"
+
       - name: Install dependencies
         run: |
-          composer require "illuminate/contracts:^${{ matrix.laravel }}.0" --no-interaction --no-update
           composer update --${{ matrix.stability }} --prefer-dist --no-interaction --no-progress
 
       - name: Run the suite
@@ -88,6 +108,29 @@ jobs:
       - name: Remove the optional integration
         run: composer remove --dev --no-update --no-interaction altcha-org/altcha
 
+      - name: Resolve composer cache directory
+        id: composer-cache
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore composer cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }}
+          restore-keys: composer-${{ runner.os }}-${{ matrix.php }}-
+
+      - name: Drop cached laranail archives
+        # laranail/* resolve through a single MOVING v0.1.0 tag, so composer's dist
+        # cache is keyed on a name whose contents change underneath it. A restored
+        # archive is then silently stale: the install reports success and unpacks
+        # whatever was cached the first time. Everything else is immutable per
+        # version and stays cached.
+        # POSIX command via bash: Windows runners default to PowerShell, where this
+        # would be a parse error rather than a no-op.
+        shell: bash
+        run: rm -rf "$(composer config cache-files-dir)/laranail"
+
       - name: Install dependencies
         run: composer update --prefer-dist --no-interaction --no-progress
 
@@ -125,6 +168,29 @@ jobs:
           extensions: dom, curl, libxml, mbstring, zip, pdo, sqlite, pdo_sqlite, bcmath, intl
           coverage: none
 
+      - name: Resolve composer cache directory
+        id: composer-cache
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore composer cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }}
+          restore-keys: composer-${{ runner.os }}-${{ matrix.php }}-
+
+      - name: Drop cached laranail archives
+        # laranail/* resolve through a single MOVING v0.1.0 tag, so composer's dist
+        # cache is keyed on a name whose contents change underneath it. A restored
+        # archive is then silently stale: the install reports success and unpacks
+        # whatever was cached the first time. Everything else is immutable per
+        # version and stays cached.
+        # POSIX command via bash: Windows runners default to PowerShell, where this
+        # would be a parse error rather than a no-op.
+        shell: bash
+        run: rm -rf "$(composer config cache-files-dir)/laranail"
+
       - name: Install dependencies
         run: composer update --prefer-dist --no-interaction --no-progress
 

src/Commands/CacheClearCommand.php

@@ -27,9 +27,6 @@ final class CacheClearCommand extends Command
 
     protected $name = 'laranail::captcha.cache-clear';
 
-    /** @var list<string> */
-    protected array $commandAliases = ['captcha:cache-clear'];
-
     protected $signature = 'laranail::captcha.cache-clear {--environment= : Clear another environment’s entries}';
 
     protected $description = 'Forget cached captcha credentials so database changes apply immediately.';

src/Commands/DoctorCommand.php

@@ -26,9 +26,6 @@ final class DoctorCommand extends Command
 
     protected $name = 'laranail::captcha.doctor';
 
-    /** @var list<string> */
-    protected array $commandAliases = ['captcha:doctor'];
-
     protected $description = 'Report the active captcha provider, where its credentials come from, and anything unsafe.';
 
     public function handle(

src/Commands/InstallCommand.php

@@ -22,9 +22,6 @@ final class InstallCommand extends Command
 
     protected $name = 'laranail::captcha.install';
 
-    /** @var list<string> */
-    protected array $commandAliases = ['captcha:install'];
-
     protected $signature = 'laranail::captcha.install {--migrations : Also publish the optional settings-table migration}';
 
     protected $description = 'Publish the captcha config file, and optionally the settings migration.';

src/Commands/KeysCommand.php

@@ -25,9 +25,6 @@ final class KeysCommand extends Command
 
     protected $name = 'laranail::captcha.keys';
 
-    /** @var list<string> */
-    protected array $commandAliases = ['captcha:keys'];
-
     protected $description = 'Show which source each provider’s credentials resolve from, redacted.';
 
     public function handle(ResolveCredentials $resolveCredentials): int

tests/Feature/BrowserRuntimeTest.php

@@ -28,7 +28,7 @@
  */
 function browserDir(): string
 {
-    return dirname(__DIR__) . '/Browser';
+    return __DIR__ . '/../Browser';
 }
 
 /**

tests/Feature/RuntimeScriptTest.php

@@ -83,7 +83,7 @@ function node(): ?string
     $file = tempnam(sys_get_temp_dir(), 'captcha-runtime') . '.js';
     file_put_contents($file, extractRuntime());
 
-    $process = new Process([(string) node(), dirname(__DIR__) . '/js/harness.mjs', $file]);
+    $process = new Process([(string) node(), __DIR__ . '/../js/harness.mjs', $file]);
     $process->run();
 
     @unlink($file);

tests/TestCase.php

@@ -47,7 +47,7 @@ protected function defineEnvironment($app): void
      */
     protected function defineDatabaseMigrations(): void
     {
-        $migration = require dirname(__DIR__) . '/database/migrations/create_captcha_settings_table.php.stub';
+        $migration = require __DIR__ . '/../database/migrations/create_captcha_settings_table.php.stub';
 
         $migration->up();
     }