Bump gumlet/php-image-resize from 2.1.3 to 3.0.1

[dependabot]

Bumps gumlet/php-image-resize from 2.1.3 to 3.0.1.

Release notes

Sourced from gumlet/php-image-resize's releases.

Added check for decompression bombs

No release notes provided.

V3.0 - Fully typed public API

Added

• Full typed public API (parameters and return types on ImageResize).
• PHPStan (level 3) and PSR-12 (PHP-CS-Fixer) in development; CI static-analysis job.
• PHPUnit 10+ configuration migration; tests on PHP 8.2–8.5.
• Additional tests: missing file, allow_enlarge, exact_size save, WebP/AVIF save, gamma save, stronger filter test.

Changed

• Minimum PHP version: 8.1 (ext-gd, ext-fileinfo required).
• ImageResize::__construct() requires string $filename (non-empty path, data: URL, or valid file).
• save() documents array|false $exact_size for fixed canvas output.
• chmod after save only when saving to a file path string.
• Open finfo only when getimagesize() fails (faster loads on success path).

Fixed

• BMP save no longer passes null to imagebmp() (PHP 8.5 deprecation).
• Removed finfo_close() (deprecated in PHP 8.5).
• Constructor no longer uses an invalid return statement.

Removed

• Support for PHP versions below 8.1 (use 2.x releases).

Changelog

Sourced from gumlet/php-image-resize's changelog.

[3.0.1] - 2026-10-06 — Security release (GHSA-3g9v-hjrx-mg5h)

Security

• CWE-400 — Image bomb / uncontrolled resource consumption. __construct() now checks the source image pixel count (width × height) against the new $max_source_pixels property (default 15,000,000) before calling imagecreatefromXXX(). A 4,000 × 4,000 PNG that is only ~56 KB on disk but requires ~61 MB of memory to decode is now rejected immediately with ImageResizeException, so the fatal OOM error can no longer kill a PHP-FPM worker. Set $resize->max_source_pixels = 0 to disable the limit for fully trusted input.

Added

• $max_source_pixels public property (default 15_000_000).
• 2 PHPUnit regression tests covering the image-bomb scenario.

3.0.0 - 2026-07-22

Added

• Full typed public API (parameters and return types on ImageResize).
• PHPStan (level 3) and PSR-12 (PHP-CS-Fixer) in development; CI static-analysis job.
• PHPUnit 10+ configuration migration; tests on PHP 8.2–8.5.
• Additional tests: missing file, allow_enlarge, exact_size save, WebP/AVIF save, gamma save, stronger filter test.

Changed

• Minimum PHP version: 8.1 (ext-gd, ext-fileinfo required).
• ImageResize::__construct() requires string $filename (non-empty path, data: URL, or valid file).
• save() documents array|false $exact_size for fixed canvas output.
• chmod after save only when saving to a file path string.
• Open finfo only when getimagesize() fails (faster loads on success path).

Fixed

• BMP save no longer passes null to imagebmp() (PHP 8.5 deprecation).
• Removed finfo_close() (deprecated in PHP 8.5).
• Constructor no longer uses an invalid return statement.

Removed

• Support for PHP versions below 8.1 (use 2.x releases).

Commits

• cd01c9e Merge commit from fork
• cd59645 updated readme
• 10c1f38 fix(security): prevent DoS via image bomb in ImageResize::__construct (GHSA-3...
• 66de740 making ready for 3.0 release.
• 848d557 tests updated
• 4dc4011 minor type fix
• 8dd14ed phpunit downgrade
• 2140e8b php types added everywhere.
• 9a9b1fc finfo not done every single time
• 1b59ddf actions update and php verison only using supported
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)