chore: bump version to 2.1.1

chore(deps-dev): bump pestphp/pest from 3.x-dev to 4.7.0

.github/dependabot.yml

@@ -1,17 +1,33 @@
 version: 2
-
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
-    target-branch: "master"
     schedule:
       interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    groups:
+      actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: "chore"
+      include: "scope"
     labels:
-      - "deps"
+      - "dependencies"
+
   - package-ecosystem: "composer"
     directory: "/"
-    target-branch: "master"
     schedule:
       interval: "weekly"
+      day: "tuesday"
+    open-pull-requests-limit: 10
+    groups:
+      php-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
     labels:
-      - "deps"
+      - "dependencies"

.github/workflows/dependabot-auto-merge.yml

@@ -13,7 +13,7 @@ jobs:
 
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2.2.0
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 

.github/workflows/tests.yml

@@ -9,19 +9,19 @@ on:
 jobs:
   tests:
     name: Tests
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: true
       matrix:
-        php: ['8.3', '8.4', '8.5']
+        php: ["8.3", "8.4", "8.5"]
         stability: [prefer-stable]
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2
         with:
           php-version: ${{ matrix.php }}
           extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, gd, redis, memcached
@@ -29,12 +29,11 @@ jobs:
           coverage: none
 
       - name: Install dependencies
-        uses: nick-fields/retry@v3
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
         with:
           timeout_minutes: 5
           max_attempts: 5
           command: composer update --${{ matrix.stability }} --prefer-dist --no-interaction --no-progress ${{ matrix.flags }}
 
-
       - name: Execute tests
         run: vendor/bin/pest

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+**PLEASE DON'T DISCLOSE SECURITY-RELATED ISSUES PUBLICLY, [SEE BELOW](#reporting-a-vulnerability).**
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it privately using the below channel:
+
+**GitHub Private Vulnerability Reporting** — go to the repository's **Security** tab and click **"Report a vulnerability"**. This creates a private advisory visible only to maintainers and provides a structured workflow for triage, fix coordination, and CVE assignment.
+
+All security vulnerabilities will be promptly addressed.

composer.json

@@ -1,6 +1,6 @@
 {
   "name": "wearepixel/laravel-cart",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "A cart implementation for Laravel",
   "keywords": [
     "laravel",
@@ -29,7 +29,7 @@
   "require-dev": {
     "mockery/mockery": "^2.0",
     "laravel/pint": "^1.21",
-    "pestphp/pest": "^3.0",
+    "pestphp/pest": "^4.7",
     "larapack/dd": "dev-master"
   },
   "autoload": {