Issue/532 dependency security followup

[armanist]

Summary by CodeRabbit

• New Features

  • Twig rendering is now optional, while the default HTML renderer continues to work on PHP 8.0+.
  • Logging now accepts stringable messages in addition to plain text.

• Bug Fixes

  • Added a clearer error when Twig is missing, with install guidance.

• Documentation

  • Updated setup and compatibility notes for PHP and Twig support.
  • Refreshes dependency compatibility information.

• Tests

  • Improved test coverage for optional Twig availability and missing-package handling.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR makes Twig an optional renderer dependency with a runtime existence check and a new actionable exception, adds a Twig PHPStan stub, upgrades several composer dependencies, widens Logger report() message typing to accept Stringable, and updates related tests, changelog, and README documentation.

Changes

Optional Twig Renderer Support

Layer / File(s)	Summary
Twig-missing exception and stub src/Renderer/Exceptions/RendererException.php, stubs/Twig.stub, phpstan.neon.dist	Adds RendererException::twigNotInstalled() with install guidance, a Twig.stub defining minimal Twig public API types, and a PHPStan scanFiles entry for the stub.
TwigAdapter runtime guard src/Renderer/Adapters/TwigAdapter.php	Constructor checks class_exists(Twig\Environment::class) and throws the new exception when Twig is not installed.
Test guards for missing Twig tests/Unit/Renderer/Adapters/TwigAdapterTest.php, tests/Unit/Renderer/Factories/RendererFactoryTest.php, tests/Unit/Renderer/RendererTest.php, tests/Unit/View/ViewTest.php	Existing Twig tests are guarded with markTestSkipped() when Twig is absent, and a new test asserts the actionable exception message.
Dependency and documentation updates composer.json, CHANGELOG.md, README.md	Removes required twig/twig, updates the suggest entry and several dependency version constraints, drops config.audit.block-insecure, and documents PHP/Twig version requirements in the changelog and README.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Stringable Message Support in Logger

Layer / File(s)	Summary
Widen report() message type src/Logger/Contracts/ReportableInterface.php, src/Logger/Traits/LoggerTrait.php, src/Logger/Adapters/MessageAdapter.php	Changes report()'s $message parameter from string to string|Stringable across the interface, trait, and adapter, casting non-array messages to string during formatting.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant TwigAdapter
  participant RendererException
  Caller->>TwigAdapter: new TwigAdapter(configs)
  TwigAdapter->>TwigAdapter: class_exists(Twig\Environment)
  alt Twig not installed
    TwigAdapter->>RendererException: twigNotInstalled()
    RendererException-->>Caller: throw RendererException with install guidance
  else Twig installed
    TwigAdapter-->>Caller: instance initialized with FilesystemLoader
  end

Loading

Possibly related PRs

• quantum-php/framework#464: Both PRs modify src/Logger/Adapters/MessageAdapter.php's report() method interaction with debugbar(), while this PR also widens the $message parameter type to string|Stringable.

Suggested labels: enhancement

Suggested reviewers: andrey-smaelov

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main theme of the PR: a security-focused dependency follow-up, including dependency updates and Twig optionality.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@composer.json`:
- Around line 42-52: The dependency entry for zircote/swagger-php is
incompatible with the project’s current PHP baseline in composer.json. Update
the composer requirements by either lowering the swagger-php version to a
release compatible with PHP 8.0 or raising the project PHP constraint to 8.2+;
use the zircote/swagger-php package entry and the root PHP requirement to make
the change consistently.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8545eb0a-871a-42f7-a397-359a4df61798

📥 Commits

Reviewing files that changed from the base of the PR and between 1e7ee02 and 3166253.

📒 Files selected for processing (14)

• CHANGELOG.md
• README.md
• composer.json
• phpstan.neon.dist
• src/Logger/Adapters/MessageAdapter.php
• src/Logger/Contracts/ReportableInterface.php
• src/Logger/Traits/LoggerTrait.php
• src/Renderer/Adapters/TwigAdapter.php
• src/Renderer/Exceptions/RendererException.php
• stubs/Twig.stub
• tests/Unit/Renderer/Adapters/TwigAdapterTest.php
• tests/Unit/Renderer/Factories/RendererFactoryTest.php
• tests/Unit/Renderer/RendererTest.php
• tests/Unit/View/ViewTest.php