[roxblnfk]

Reason for This PR

The Composer metapackage spiral/roadrunner carries the calendar versions 2023.x–2025.x, so Composer and Packagist rank 2025.x above 3.x: Packagist shows 2025.1.x as the latest version, and composer require spiral/roadrunner without a constraint installs 2025.1.x. Advisory GHSA-g9pc-8g42-g6vq (CVE-2025-22871, < 2025.1.0) also matches 3.x, which blocks installing RoadRunner 3 with Composer 2.9+ and roave/security-advisories (#2422).

Description of Changes

• The metapackage is published as roadrunner/roadrunner, starting from the 3.x line; the README badges point to it.
• It does not replace spiral/roadrunner yet — see below.

Why no replace of spiral/roadrunner yet

• Composer checks advisories against every name a package replaces, using the replacing package's own version (SecurityAdvisoryPoolFilter::getMatchingAdvisories() iterates getNames(false), which includes replaced names). With "replace": {"spiral/roadrunner": "self.version"}, roadrunner/roadrunner 3.x would still match GHSA-g9pc-8g42-g6vq and be blocked.
• conflict rules work the same way: roave/security-advisories (spiral/roadrunner <2025.1) and laravel/octane (spiral/roadrunner <2023.1.0) would conflict with the replacing package too.
• The metapackage is empty, so without the replace nothing breaks: old packages that still require spiral/roadrunner install it next to roadrunner/roadrunner. The replace can be added once [GHSA-g9pc-8g42-g6vq] RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency github/advisory-database#10283 fixes the advisory range.

Review notes

• Packagist imports every tag of the repository into the new package, including the ones whose composer.json still says spiral/roadrunner. After roadrunner/roadrunner is submitted, its versions below 3.0.0 have to be deleted on Packagist, otherwise 2025.1.x becomes its latest version again.
• spiral/roadrunner keeps receiving new tags; mark it abandoned only after the roadrunner/* PHP packages require roadrunner/roadrunner ^3.0 instead of spiral/roadrunner ^3.0.

License Acceptance

By submitting this pull request, I confirm that my contribution is made under the terms of the MIT license.

PR Checklist

• All commits in this PR are signed (git commit -s).
• The reason for this PR is clearly provided (issue no. or explanation).
• The description of changes is clear and encompassing.
• Any required documentation changes (code and docs) are included in this PR.
• Any user-facing changes are mentioned in CHANGELOG.md. (Release Please generates it.)
• All added/changed functionality is tested. (No code changes.)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 34.42%. Comparing base (24c18e4) to head (9aa99e3).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2431   +/-   ##
=======================================
  Coverage   34.42%   34.42%           
=======================================
  Files          18       18           
  Lines         761      761           
=======================================
  Hits          262      262           
  Misses        499      499           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.