chore(deps): bump the actions group across 1 directory with 2 updates

Bumps the actions group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [shivammathur/setup-php](https://github.com/shivammathur/setup-php).


Updates `actions/checkout` from 4.3.1 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...3d3c42e5aac5ba805825da76410c181273ba90b1)

Updates `shivammathur/setup-php` from 2.37.1 to 2.37.2
- [Release notes](https://github.com/shivammathur/setup-php/releases)
- [Commits](https://github.com/shivammathur/setup-php/compare/7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc...f3e473d116dcccaddc5834248c87452386958240)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: shivammathur/setup-php
  dependency-version: 2.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[docker-compose.yml]
+indent_size = 4

.gitattributes

@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+*.blade.php diff=html
+*.css diff=css
+*.html diff=html
+*.md diff=markdown
+*.php diff=php
+
+/.github export-ignore
+CHANGELOG.md export-ignore
+.styleci.yml export-ignore

.github/dependabot.yml

@@ -0,0 +1,38 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    groups:
+      actions:
+        applies-to: version-updates
+        patterns: ["*"]
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    labels:
+      - "dependencies"
+
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "tuesday"
+    open-pull-requests-limit: 10
+    groups:
+      php-minor-patch:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
+      php-security:
+        applies-to: security-updates
+        patterns: ["*"]
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    labels:
+      - "dependencies"

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,59 @@
+name: Dependabot Auto-merge
+
+on:
+  workflow_run:
+    workflows: ["Tests"]
+    types: [completed]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    if: |
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.actor.login == 'dependabot[bot]'
+
+    steps:
+      - name: Find PR and check update type
+        id: check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+        run: |
+          PR_DATA=$(gh pr list --repo "${{ github.repository }}" --head "$HEAD_BRANCH" --json number,title,url,author --jq '.[0]')
+
+          PR_URL=$(echo "$PR_DATA" | jq -r '.url')
+          PR_AUTHOR=$(echo "$PR_DATA" | jq -r '.author.login')
+          PR_TITLE=$(echo "$PR_DATA" | jq -r '.title')
+
+          echo "pr_url=$PR_URL" >> $GITHUB_OUTPUT
+
+          if [ "$PR_AUTHOR" != "app/dependabot" ]; then
+            echo "is_safe=false" >> $GITHUB_OUTPUT
+            echo "Not a Dependabot PR, skipping."
+            exit 0
+          fi
+
+          # Parse major version numbers from title: "bump X from A[.B.C] to D[.E.F]"
+          # Works for both "from 4.0.0 to 4.1.0" and "from 4 to 6" (GitHub Actions)
+          FROM_MAJOR=$(echo "$PR_TITLE" | grep -oP 'from \K[0-9]+')
+          TO_MAJOR=$(echo "$PR_TITLE" | grep -oP 'to \K[0-9]+')
+
+          echo "PR: $PR_TITLE (major: $FROM_MAJOR -> $TO_MAJOR)"
+
+          if [ "$FROM_MAJOR" = "$TO_MAJOR" ]; then
+            echo "is_safe=true" >> $GITHUB_OUTPUT
+          else
+            echo "is_safe=false" >> $GITHUB_OUTPUT
+            echo "Major version bump, skipping auto-merge."
+          fi
+
+      - name: Merge minor and patch updates
+        if: steps.check.outputs.is_safe == 'true'
+        run: gh pr merge --merge "${{ steps.check.outputs.pr_url }}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/dependabot-slack-alert.yml

@@ -0,0 +1,98 @@
+name: Dependabot Slack Alert
+
+on:
+  pull_request_target:
+    types: [opened]
+
+jobs:
+  notify:
+    name: Notify Slack of major update
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Check if major version bump
+        id: check
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          from_major=$(echo "$PR_TITLE" | grep -oP 'from \K[0-9]+' | head -1)
+          to_major=$(echo "$PR_TITLE" | grep -oP 'to \K[0-9]+' | head -1)
+
+          if [ -n "$from_major" ] && [ -n "$to_major" ] && [ "$from_major" != "$to_major" ]; then
+            echo "is_major=true" >> $GITHUB_OUTPUT
+            echo "Major bump detected: $from_major -> $to_major"
+          else
+            echo "is_major=false" >> $GITHUB_OUTPUT
+            echo "Minor/patch bump, skipping"
+          fi
+
+      - name: Send Slack alert
+        if: steps.check.outputs.is_major == 'true'
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          if [ -z "$SLACK_WEBHOOK_URL" ]; then
+            echo "SLACK_WEBHOOK_URL not configured for this repo, skipping"
+            exit 0
+          fi
+
+          payload=$(jq -n \
+            --arg repo "$REPO" \
+            --arg title "$PR_TITLE" \
+            --arg url "$PR_URL" \
+            --arg pr "#$PR_NUMBER" \
+            '{
+              blocks: [
+                {
+                  type: "section",
+                  text: {
+                    type: "mrkdwn",
+                    text: ":dependabot: *Major dependency update requires review*"
+                  }
+                },
+                {
+                  type: "section",
+                  fields: [
+                    {type: "mrkdwn", text: ("*Repository*\n`" + $repo + "`")},
+                    {type: "mrkdwn", text: ("*Pull Request*\n<" + $url + "|" + $pr + ">") }
+                  ]
+                },
+                {
+                  type: "section",
+                  text: {
+                    type: "mrkdwn",
+                    text: $title
+                  }
+                },
+                {
+                  type: "context",
+                  elements: [
+                    {
+                      type: "mrkdwn",
+                      text: "Major version bumps are not auto-merged as they may contain breaking changes."
+                    }
+                  ]
+                },
+                {
+                  type: "actions",
+                  elements: [
+                    {
+                      type: "button",
+                      text: {type: "plain_text", text: "Review PR"},
+                      url: $url,
+                      style: "primary"
+                    }
+                  ]
+                }
+              ]
+            }')
+
+          curl -s -o /dev/null -w "%{http_code}" -X POST "$SLACK_WEBHOOK_URL" \
+            -H "Content-type: application/json" \
+            --data "$payload" | grep -q "^200$" \
+            && echo "Slack notification sent" \
+            || echo "Slack notification failed"

.github/workflows/tests.yml

@@ -18,10 +18,10 @@ jobs:
     name: PHP ${{ matrix.php }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: ${{ matrix.php }}
           extensions: dom, curl, libxml, mbstring, zip

README.md

@@ -1,33 +1,84 @@
-Laravel Google Shopping Feed
-==============
+![Laravel Google Shopping Feed](docs/laravel-google-shopping-feed.png)
 
-A simple package to easily create an XML feed for Google Merchant Center to parse and retrieve your products on a frequent basis.
+[![Latest Version on Packagist](https://img.shields.io/packagist/v/wearepixel/laravel-google-shopping-feed.svg)](https://packagist.org/packages/wearepixel/laravel-google-shopping-feed)
+[![Tests](https://img.shields.io/github/actions/workflow/status/wearepixel/laravel-google-shopping-feed/tests.yml?label=tests)](https://github.com/wearepixel/laravel-google-shopping-feed/actions/workflows/tests.yml)
+[![PHP Version](https://img.shields.io/packagist/php-v/wearepixel/laravel-google-shopping-feed.svg)](https://packagist.org/packages/wearepixel/laravel-google-shopping-feed)
+[![Total Downloads](https://img.shields.io/packagist/dt/wearepixel/laravel-google-shopping-feed.svg)](https://packagist.org/packages/wearepixel/laravel-google-shopping-feed)
+[![License](https://img.shields.io/packagist/l/wearepixel/laravel-google-shopping-feed.svg)](https://packagist.org/packages/wearepixel/laravel-google-shopping-feed)
 
-We recommend adding this to an API controller and generating it on the fly each time so you can be sure your products are always up to date within your merchant center.
+A simple package to easily create an XML feed for Google Merchant Center to parse and retrieve your products.
+
+We recommend adding this to an API controller and generating it on the fly so your feed is always up to date.
+
+## Requirements
+
+- PHP 8.4+
+- Laravel 10, 11, or 12
 
 ## Installation
 
-```
+```bash
 composer require wearepixel/laravel-google-shopping-feed
 ```
 
-## Example
+## Usage
+
 ```php
 use Wearepixel\LaravelGoogleShoppingFeed\LaravelGoogleShoppingFeed;
 
-$feed = LaravelGoogleShopping::init(
-	'Product Feed',
-	'App product Feed',
-	'https://mystore.com'
+$feed = LaravelGoogleShoppingFeed::init(
+    title: 'My Store',
+    description: 'My store product feed',
+    link: 'https://mystore.com',
 );
 
 $feed->addItem([
-	'id' => 'item_001',
-	'title' => 'Blue Nikes',
-	'link' => 'https://mystore.com/products/blue-nikes',
-	'g:image_link' => 'https://mystore.com/images/blue-nikes-001.jpg',
-	'g:price' => 29.99,
+    'id'           => 'item_001',
+    'title'        => 'Blue Nikes',
+    'link'         => 'https://mystore.com/products/blue-nikes',
+    'g:price'      => '29.99 AUD',
+    'g:image_link' => 'https://mystore.com/images/blue-nikes-001.jpg',
 ]);
 
 return $feed->generate();
 ```
+
+### Required item fields
+
+| Field          | Description                                      |
+| -------------- | ------------------------------------------------ |
+| `id`           | Unique product identifier                        |
+| `title`        | Product name                                     |
+| `link`         | URL to the product page                          |
+| `g:price`      | Price including currency code (e.g. `29.99 AUD`) |
+| `g:image_link` | URL to the main product image                    |
+
+Any additional fields supported by the [Google Product Data Specification](https://support.google.com/merchants/answer/7052112) can be passed alongside the required fields.
+
+### Methods
+
+**`LaravelGoogleShoppingFeed::init(string $title, string $description, string $link): static`**
+
+Creates a new feed instance with channel metadata.
+
+**`$feed->addItem(array $item): void`**
+
+Adds a product to the feed. Throws `MissingRequiredFieldException` if any required field is absent.
+
+**`$feed->toXml(): string`**
+
+Returns the feed as an XML string.
+
+**`$feed->generate(): Response`**
+
+Returns an HTTP response with the XML content and `application/rss+xml` content type. Suitable for returning directly from a controller.
+
+## Testing
+
+```bash
+composer test
+```
+
+## License
+
+MIT

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+**PLEASE DON'T DISCLOSE SECURITY-RELATED ISSUES PUBLICLY, [SEE BELOW](#reporting-a-vulnerability).**
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it privately using the below channel:
+
+**GitHub Private Vulnerability Reporting** — go to the repository's **Security** tab and click **"Report a vulnerability"**. This creates a private advisory visible only to maintainers and provides a structured workflow for triage, fix coordination, and CVE assignment.
+
+All security vulnerabilities will be promptly addressed.

composer.json

@@ -6,7 +6,7 @@
     "laravel",
     "google-shopping-feed"
   ],
-  "version": "5.1.0",
+  "version": "5.1.1",
   "homepage": "https://github.com/wearepixel/laravel-google-shopping-feed",
   "license": "MIT",
   "authors": [

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "8c8b76b927132317803d1d36f0bd3f03",
+    "content-hash": "dd11fae2cb1d5cdec45f84e2d01a232a",
     "packages": [
         {
             "name": "brick/math",
@@ -6481,16 +6481,16 @@
         },
         {
             "name": "laravel/pint",
-            "version": "v1.29.0",
+            "version": "v1.32.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/pint.git",
-                "reference": "bdec963f53172c5e36330f3a400604c69bf02d39"
+                "reference": "006bd7825eb01daf92959d060b89cd9514fe4253"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/pint/zipball/bdec963f53172c5e36330f3a400604c69bf02d39",
-                "reference": "bdec963f53172c5e36330f3a400604c69bf02d39",
+                "url": "https://api.github.com/repos/laravel/pint/zipball/006bd7825eb01daf92959d060b89cd9514fe4253",
+                "reference": "006bd7825eb01daf92959d060b89cd9514fe4253",
                 "shasum": ""
             },
             "require": {
@@ -6498,17 +6498,19 @@
                 "ext-mbstring": "*",
                 "ext-tokenizer": "*",
                 "ext-xml": "*",
-                "php": "^8.2.0"
+                "php": "^8.3.0"
             },
             "require-dev": {
-                "friendsofphp/php-cs-fixer": "^3.94.2",
-                "illuminate/view": "^12.54.1",
-                "larastan/larastan": "^3.9.3",
-                "laravel-zero/framework": "^12.0.5",
-                "mockery/mockery": "^1.6.12",
+                "composer/semver": "^3.4.4",
+                "friendsofphp/php-cs-fixer": "^3.95.25",
+                "illuminate/view": "^13.31.0",
+                "larastan/larastan": "^3.11.0",
+                "laravel-zero/framework": "^13.0.0",
+                "laravel/agent-detector": "^2.0.2",
+                "laravel/prompts": "^0.3.24",
+                "mockery/mockery": "^1.6.15",
                 "nunomaduro/termwind": "^2.4.0",
-                "pestphp/pest": "^3.8.6",
-                "shipfastlabs/agent-detector": "^1.1.0"
+                "pestphp/pest": "^4.7.8"
             },
             "bin": [
                 "builds/pint"
@@ -6545,7 +6547,7 @@
                 "issues": "https://github.com/laravel/pint/issues",
                 "source": "https://github.com/laravel/pint"
             },
-            "time": "2026-03-12T15:51:39+00:00"
+            "time": "2026-09-10T10:47:55+00:00"
         },
         {
             "name": "laravel/tinker",
@@ -9777,7 +9779,7 @@
     "prefer-stable": true,
     "prefer-lowest": false,
     "platform": {
-        "php": ">=8.3"
+        "php": ">=8.4"
     },
     "platform-dev": {},
     "plugin-api-version": "2.9.0"