chore(deps): Bump rowbot/url from 1.1.1 to 4.1.0

[dependabot]

Bumps rowbot/url from 1.1.1 to 4.1.0.

Release notes

Sourced from rowbot/url's releases.

4.1.0

See CHANGELOG

4.0.0

See CHANGELOG

3.1.7

See CHANGELOG.md

3.1.6

See CHANGELOG.md

3.1.5

See CHANGELOG.md

3.1.4

See CHANGELOG.md

3.1.3

See CHANGELOG.md

3.1.2

See CHANGELOG.md

3.1.1

See CHANGELOG.md

3.1.0

See CHANGELOG.md

3.0.1

See https://github.com/TRowbotham/URL-Parser/blob/HEAD/CHANGELOG.md

3.0.0

See https://github.com/TRowbotham/URL-Parser/blob/HEAD/CHANGELOG.md

2.0.3

Fixed

• "%2e%2E" and "%2E%2e" were not properly detected as percent encoded double dot path segments.

2.0.2

• Fixes some compatibility issues with PHP 7.4.
• Removes some unnecessary type casting when serializing IP addresses.

2.0.1

Fixes an issue loading cached test data when using newer versions of the symfony/cache component.

2.0.0

• The minimum required PHP version is now 7.1
• Native typehints are now used. This which means that an \TypeError is now thrown instead of an \InvalidArgumentException when a value with an incorrect type is passed.

... (truncated)

Changelog

Sourced from rowbot/url's changelog.

[4.1.0] - 2025-09-18

Changed

• Update IDNA processing options per whatwg/url#820, whatwg/url#842, whatwg/url#821, and whatwg/url#820
• Update domain to ASCII error handling per whatwg/url#845
• ^ are now percent encoded in non-opaque paths per whatwg/url#607 and whatwg/url#846
• Bump version of brick/math
• Bump version of phpstan/phpstan
• Ensure opaque paths always round trip per whatwg/url#784 and whatwg/url#844
• Make port state override return failure more for URLPattern per whatwg/url#866 and whatwg/urlpattern#266
• Report all hostname state failures for URLPattern per whatwg/url#863 and whatwg/urlpattern#252
• Bump version of symfony/cache
• Bump version of phpunit/phpunit
• Bump version of rowbot/idna

Internals

• Removed \Rowbot\URL\Component\PathInterface::potentiallyStripTrailingSpaces() as it no longer exists in the spec
  • Removed \Rowbot\URL\Component\PathSegment::stripTrailingSpaces() as it was only used by the above method.
  • Removed \Rowbot\URL\Component\AbstractPath::potentiallyStripTrailingSpaces()
• The $matches parameter of \Rowbot\URL\String\USVString::matches() is no longer nullable to make PHPStan happy

[4.0.0] - 2024-06-20

Added

• Performance improvements
• Validation error logging
• \Rowbot\URL\URL and \Rowbot\URL\URLSearchParams now implement \Stringable
• \Rowbot\URL\URLSearchParams constructor now has a native typehint of array|object|string
• \Rowbot\URL\URLSearchParams now has a size getter per whatwg/url#734
  • \Rowbot\URL\URLSearchParams now also implements \Countable
• Added \Rowbot\URL\URL::canParse(), which returns a boolean if parsing was successful, per whatwg/url#713 and whatwg/url#763
• Add value parameter to \Rowbot\URL\URLSearchParams::has() and \Rowbot\URL\URLSearchParams::delete() per whatwg/url#335 and whatwg/url#735
• Added \Rowbot\URL\URL::parse(), which will return the parsed URL or null on failure, avoiding needing a try statement per whatwg/url#372 and whatwg/url#825

Changed

• Bump minimum PHP version to 8.1
• Lone surrogate code points are no longer treated differently from other invalid code points
• \Rowbot\URL\String\Exception\UConverterException has been renamed to \Rowbot\URL\String\Exception\EncodingException
• Moved 32-bit tests to GitHub Actions from Appveyor
• \Rowbot\URL\URL's $url and $base parameters now also accept \Stringable
• \Rowbot\URL\URLSearchParams::current() now returns null when the iterator is invalid instead of ['', ''], which better matches the expected behavior
• Ensure opaque paths can round trip from the API whatwg/url#651 whatwg/url#728
• Blob URL's with an inner non-http(s) URL now returns an opaque origin per whatwg/url#770 and whatwg/url#771

Removed

... (truncated)

Commits

• 3087a67 Prepare 4.1.0 release
• 1931bb6 Fix tests
• 7b1697f Sync tests with changes in the WPT
• e5aaf70 Bump rowbot/idna version
• 07b9606 Bump codecov action
• 12b2a29 Document URL::parse()
• b18f073 Fix condition for installing dependencies
• 5e0d0f7 Test on PHP 8.4
• d7f106c Revert "Downgrade ubuntu to avoid broken runner"
• 81cfac1 Downgrade ubuntu to avoid broken runner
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dj4oC]

Dependabot PR (rowbot/url 1.1.1 → 4.1.0), auto-rebase disabled after >30 days open.

• Security: no findings — routine dev-dependency bump, no CVE indicated in the bump itself.
• Stability: no findings.
• Performance: no findings.
• Test coverage: n/a (dependency bump only).
• TODOs found: none.
• Dependency touched: yes — confirmed covered by dependabot.yml (this PR is Dependabot's own output).
• CI status: failing — Commits / Validate semantic commits. All PHP Unit/Code Style jobs pass. This is very likely the same systemic cause seen across multiple ownCloud repos right now: Dependabot's default commit message (Bump X from Y to Z) doesn't satisfy this repo's conventional-commit lint rule, so every Dependabot PR here fails that one check regardless of the bump's safety. Fix belongs at the repo config level — either set a commit-message.prefix in dependabot.yml (e.g. chore(deps)) so generated commits pass the lint, or add a lint-config exception for dependabot[bot]-authored commits. Not something to patch on this individual PR branch.
• Stale review: no (no named human reviewer requested).

Verdict

Commenting — not approving while CI is red; the fix needed is a one-time repo config change (see above), not a per-PR change.

🤖 Automated review by Claude Code (security · stability · performance · coverage)

---

Generated by Claude Code

[dj4oC]

• Security: no findings
• Stability: no findings — routine composer patch bump, no breaking change
• Performance: no findings
• Test coverage: N/A (dependency bump only)
• TODOs found: none
• Dependency touched: yes — confirmed covered by dependabot.yml (composer ecosystem)
• CI status: all green
• Stale review: no

Dependabot fast-lane: CI green, no open questions, no CVE regression. Auto-merging per policy.

---

Generated by Claude Code

[DeepDiver1975]

@dependabot rebase

[DeepDiver1975]

Holding: CI is failing (not a rebase conflict). Failing check(s): Commits / Validate semantic commits, lint. A rebase won't fix this — needs a human/upstream fix.

[DeepDiver1975]

Holding: CI is failing (not a rebase conflict). Root cause: this is a PR-title/commit-message lint failure, not a code failure — lint reports No release type found in pull request title "Bump rowbot/url from 1.1.1 to 4.1.0" and Commits / Validate semantic commits rejects the commit message against the conventional-commits spec. A rebase won't fix this — the PR needs retitling with a conventional-commit prefix (e.g. build(deps): bump rowbot/url from 1.1.1 to 4.1.0).