Update twig-cs-fixer to 4.0

[turegjorup]

Link to ticket

TODO: no ticket linked yet — please add before review.

Description

The dependency sweep after #93. composer update within the current constraints reports "Nothing to modify in lock file": every package is already at its latest minor and patch. The only thing left to move is one major, so that is all this PR contains.

vincentlanglet/twig-cs-fixer goes from ^3.14 to ^4.0. It needs no reformatting sweep, but that was worth checking, because 4.0 does change what the fixer enforces: | and . moved from punctuation to operators, and OperatorSpacingRule split into operator, ternary and unary rules. A probe template confirms the new rules bite:

{{ 'x' | upper }}   ERROR Expecting 0 whitespace before/after "|"; found 1.
{{ foo . bar }}     ERROR Expecting 0 whitespace before/after "."; found 1.

Our 27 templates already satisfy them: lint --no-cache reports 0 notices, 0 warnings, 0 errors, and lint --fix --no-cache rewrites nothing. The --no-cache matters — .twig-cs-fixer.cache was written by 3.14, and a cached run would have looked clean whether or not it was.

.twig-cs-fixer.dist.php needs no changes either. It only builds a Finder and an empty Config; the 4.0 upgrade notes are about constructor signatures and token types, which affect custom rules, and we have none.

Outstanding majors

Everything else that composer outdated flags is held back by a dependent, not by us:

Package	Current → Latest	Held back by
itk-dev/openid-connect-bundle	5.1.1 → 6.0.0	#92, in flight
doctrine/collections	2.6.0 → 3.1.0	doctrine/orm 3.6.8 requires ^2.2
guzzlehttp/guzzle	7.15.5 → 8.1.0	league/oauth2-client 2.9.0 requires ^6.5.8 || ^7.4.5
guzzlehttp/psr7	2.13.1 → 3.1.0	guzzlehttp/guzzle 7.15.5 requires ^2.13.1
guzzlehttp/promises	2.5.3 → 3.0.2	guzzlehttp/guzzle 7.15.5 requires ^2.5.3
robrichards/xmlseclibs	3.1.5 → 4.0.0	itk-dev/openid-connect 5.0.0 requires ^3.1.5

The Guzzle 8 line and xmlseclibs 4 both wait on the OIDC packages: league/oauth2-client pins Guzzle 7, and itk-dev/openid-connect pins xmlseclibs 3. Nothing to do here until those release, and neither carries an advisory — composer audit --locked is clean.

Screenshot of the result

No user interface changes.

Checklist

• My code is covered by test cases.
• My code passes our test (all our tests).
• My code passes our static analysis suite.
• My code passes our continuous integration process.

Dev-tooling change only, so the existing suite is what verifies it: 45 tests, PHPStan, PHP-CS-Fixer, composer validate --strict, composer normalize --dry-run, markdownlint, and twig-cs-fixer itself on 4.0 all pass locally.

Additional comments or questions

.twig-cs-fixer.dist.php carries a note that it is copied from config/symfony/twig/.twig-cs-fixer.dist.php in devops_itkdev-docker. Our copy works unchanged on 4.0, so there is nothing to send upstream — worth knowing if the shared template gets a 4.0-specific revision later.

[github-actions]

API Specification - Non-breaking changes

No changelog changes

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 37.99%. Comparing base (bae8493) to head (db3082f).
⚠️ Report is 20 commits behind head on develop.

Additional details and impacted files

@@              Coverage Diff              @@
##             develop      #95      +/-   ##
=============================================
+ Coverage      37.14%   37.99%   +0.84%     
+ Complexity       948      946       -2     
=============================================
  Files            133      133              
  Lines           2972     2982      +10     
=============================================
+ Hits            1104     1133      +29     
+ Misses          1868     1849      -19     

Flag	Coverage Δ
unittests	37.99% <ø> (+0.84%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.