chore(deps): update igor-php/igor-php requirement from ^0.9.7 to ^0.10.0

[dependabot]

Updates the requirements on igor-php/igor-php to permit the latest version.

Release notes

Sourced from igor-php/igor-php's releases.

v0.10.0

🧟‍♂️⚡ Igor-PHP — Release Notes (v0.10.0)

This release brings Igor into your editor with the official PhpStorm / JetBrains plugin, makes the Symfony service map match what the compiled container really keeps, and widens the detection of process-wide state mutations.

---

⚠️ Upgrade notes

• Clear your Symfony cache after upgrading (php bin/console cache:clear) so that IgorPhpBundle regenerates igor_service_map.json with the new discovery logic (#88). An old map keeps working, but without the cleanup described below.
• igor-baseline.json is now loaded automatically from the project root when no baseline is configured and no --baseline flag is passed (#89). If you keep that file without using it, findings it lists will now be ignored.
• Twig\ and ApiPlatform\ are now default safe namespaces (#86). If your igor.json defines its own safe_namespaces, add them there to benefit from it.

---

🚀 Improvements & Features

1. Editor integration: single-file audits, stdin buffers and ignored findings (#89)

• What: Igor can now audit a single file, including the unsaved content of an editor buffer. This powers the official PhpStorm / JetBrains plugin.
• How it works:
  • Passing a file instead of a directory (igor-php src/Service/MyService.php) audits only that file. The project root is resolved from the nearest composer.json, bin/console or igor.json (or from the host application for files under vendor/), so configuration, baselines and Symfony discovery behave as in a full audit.
  • --stdin-filepath <path> reads the file content from standard input and audits it as if it were located at <path>.
  • --include-ignored keeps baseline-exempt findings in the output, flagged with "ignored": true and their "ignore_reason". They never affect the audit status or the exit code, and the CLI output shows them dimmed with an [IGNORED] tag.
  • In Symfony projects, a single file is audited only if one of its classes backs a shared service, or is a parent class or trait of one, exactly as in a full audit.
  • Baseline management flags (--generate-baseline, --check-baseline, --prune-baseline) are rejected with a single-file target.

2. Wider detection of process state mutations (#85)

• What: The ProcessStateMutation rule now detects many more native functions whose effect outlives the request in a persistent worker:
  • Filesystem: chdir, umask
  • Multibyte encoding: mb_internal_encoding, mb_regex_encoding
  • Math precision: bcscale
  • Error handling: set_error_handler, set_exception_handler
  • Lifecycle: register_shutdown_function, gc_disable
  • SAPI output: header, http_response_code
  • Native sessions: session_start, session_id, session_destroy
• Precision: getter calls without arguments (e.g. mb_internal_encoding(), umask()) are ignored, and functions shadowed by a use function import or a local declaration are resolved per namespace.
• The Leak Lab gains experiment #12, reproducing these leaks in worker mode versus classic mode.

3. Twig\ and ApiPlatform\ as default safe namespaces (#86)

• What: Twig template caches and API Platform metadata caches are idempotent across requests. They no longer produce false positives by default, while your own state providers and extensions are still audited.

---

🐛 Bug Fixes

4. The service map now matches the compiled container (#88, fixing #87)

• What: IgorDiscoveryPass ran before Symfony's RemoveUnusedDefinitionsPass, so igor_service_map.json contained every definition ever registered, including private services that Symfony removes because nothing uses them. Igor audited classes that never exist at runtime.
• How it works:
  • The discovery pass now runs in PassConfig::TYPE_AFTER_REMOVING, last within that stage.
  • Services inlined by Symfony into their parent (private services used only once) are collected recursively and kept in the map as inlined.<Class>.<id>. An inlined service is audited as shared when its parent is shared, so state living inside a singleton is still reported.

... (truncated)

Commits

• 56ceca2 fix(wrapper): send bootstrapper messages to stderr and exit 1 on errors (#90)
• ffc52d5 Fix/issue 87 unused and inlined definitions (#88)
• a68afcc Feat/ide plugin support (#89)
• eb34a4e Feat/add twig to safe namespaces (#86)
• f93c28c Feat/detect dangerous process state functions (#85)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, php. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[HecFranco]

LGTM: dependabot patch/minor bump, MERGEABLE, only lock/manifest (plus expected rebuilt public assets where applicable).