diff --git a/.github/workflows/php-package.yml b/.github/workflows/php-package.yml
index c7874c03..501dff15 100644
--- a/.github/workflows/php-package.yml
+++ b/.github/workflows/php-package.yml
@@ -8,18 +8,40 @@ on:
     branches: [ 3.* ]
   pull_request:
     branches: [ 3.* ]
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
 
 jobs:
   test:
     runs-on: ${{ matrix.operating-system }}
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
-        operating-system: ['ubuntu-latest']
+        operating-system: ['ubuntu-22.04'] # ubuntu-22.04 has good support for the PHP 7.2–7.4 toolchain.
         php-versions: [7.2, 7.3, 7.4]
     steps:
-      - name: Setup PHP, with composer and extensions
-        uses: shivammathur/setup-php@v2 #https://github.com/shivammathur/setup-php
+      # Checkout FIRST so the workspace is ready for all later steps.
+      # Pin to a full commit SHA for supply-chain safety.
+      # To find the latest SHA for a tag, run:
+      #   git ls-remote --tags https://github.com/actions/checkout.git | grep v4
+      #   or check https://github.com/actions/checkout/releases
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      # Set git line-ending config
+      - name: Set git to use LF
+        run: |
+          git config --global core.autocrlf false
+          git config --global core.eol lf
+
+      # Setup PHP
+      # Pin to SHA. Right now using >= 2.37.1 which fixes CVE-2026-46420
+      # Check https://github.com/shivammathur/setup-php/releases for latest.
+      - name: Setup PHP ${{ matrix.php-versions }}, with composer and extensions
+        uses: shivammathur/setup-php@716331904ea2625d93a4f4f8f8c050d235845675 # v2
         with:
           php-version: ${{ matrix.php-versions }}
           extensions: mbstring, intl, mcrypt, xml
@@ -27,19 +49,13 @@ jobs:
           ini-values: post_max_size=256M, max_execution_time=180
           coverage: xdebug2
 
-      - name: Set git to use LF
-        run: |
-          git config --global core.autocrlf false
-          git config --global core.eol lf
-      - uses: actions/checkout@v4
-
       - name: Validate composer.json and composer.lock
         run: composer validate
 
       - name: Install Composer dependencies
         run: |
-          composer self-update
           composer install --prefer-source --no-interaction
+
       - name: Syntax check PHP
         run: |
           php vendor/bin/phpcpd --exclude tests --exclude vendor .
diff --git a/composer.json b/composer.json
index d4815d66..53a5313c 100644
--- a/composer.json
+++ b/composer.json
@@ -19,12 +19,12 @@
         "robrichards/xmlseclibs": "^3.1.5"
     },
     "require-dev": {
-	      "phpunit/phpunit": ">8.5.51",
-        "php-coveralls/php-coveralls": "^1.0.2 || ^2.0",
-        "sebastian/phpcpd": "^2.0 || ^3.0 || ^4.0",
-        "phploc/phploc": "^2.1 || ^3.0 || ^4.0",
-        "pdepend/pdepend": "^2.5.0",
-        "squizlabs/php_codesniffer": "^3.1.1"
+	    "phpunit/phpunit": "^8.5.51 || ^9.6.33",
+        "php-coveralls/php-coveralls": "^2.8 || ^2.9",
+        "sebastian/phpcpd": "^4.0 || ^5.0",
+        "phploc/phploc": "^5.0 || ^6.0 || ^7.0",
+        "pdepend/pdepend": "^2.16",
+        "phpcsstandards/php_codesniffer": "^4.0"
     },
     "suggest": {
         "ext-openssl": "Install openssl lib in order to handle with x509 certs (require to support sign and encryption)",