chore(deps): bump mtdowling/jmespath.php from 2.8.0 to 2.9.2 in /php/example_code/rds

[dependabot]

Bumps mtdowling/jmespath.php from 2.8.0 to 2.9.2.

Release notes

Sourced from mtdowling/jmespath.php's releases.

2.9.2

• Pass explicit trim characters ahead of the PHP 8.6 trim default change.

2.9.1

• Fixed the compiled runtime to emit function names as string literals, preventing arbitrary code execution.
• Fixed the parser to reject non-identifier function callees, such as literal and raw string callees.

2.9.0

• Added PHP 8.5 support.
• Fixed to_number() to parse number strings using the JSON number grammar.
• Fixed reverse() and string slicing to operate on UTF-8 characters rather than bytes.
• Fixed slicing of array-like (ArrayAccess + Countable) values.
• Fixed equality and contains() to use JSON semantics, e.g. 1 == 1.0 is now true.
• Fixed multi-select hashes to end projections, so following tokens apply to the projected list.
• Fixed sort() and sort_by() to compare numbers numerically.
• Changed sort(), sort_by(), max(), min(), max_by() and min_by() to order strings by code point.
• Fixed max_by() and min_by() to error on mixed-type keys instead of returning arbitrary elements.
• Fixed max() returning null or erroring when the first array element is falsy, e.g. max([0, 1]).
• Fixed sum() and join() to return 0 and an empty string respectively for empty arrays.
• Fixed 0.0 to be truthy in filters and logical operators, like every other number.
• Fixed the compiled runtime to apply JMESPath truthiness to || and &&.
• Fixed @(foo), foo[-] and oversized index literals to throw syntax errors.
• Fixed PHP warnings emitted while parsing certain invalid expressions.
• Fixed the caret position in syntax error messages for errors at the end of an expression.
• Fixed map() to error on non-array second arguments instead of returning [].
• Fixed Env::cleanCompileDir() when JP_PHP_COMPILE=on.

Changelog

Sourced from mtdowling/jmespath.php's changelog.

2.9.2 - 2026-07-06

• Pass explicit trim characters ahead of the PHP 8.6 trim default change.

2.9.1 - 2026-06-11

• Fixed the compiled runtime to emit function names as string literals, preventing arbitrary code execution.
• Fixed the parser to reject non-identifier function callees, such as literal and raw string callees.

2.9.0 - 2026-06-10

• Added PHP 8.5 support.
• Fixed to_number() to parse number strings using the JSON number grammar.
• Fixed reverse() and string slicing to operate on UTF-8 characters rather than bytes.
• Fixed slicing of array-like (ArrayAccess + Countable) values.
• Fixed equality and contains() to use JSON semantics, e.g. 1 == 1.0 is now true.
• Fixed multi-select hashes to end projections, so following tokens apply to the projected list.
• Fixed sort() and sort_by() to compare numbers numerically.
• Changed sort(), sort_by(), max(), min(), max_by() and min_by() to order strings by code point.
• Fixed max_by() and min_by() to error on mixed-type keys instead of returning arbitrary elements.
• Fixed max() returning null or erroring when the first array element is falsy, e.g. max([0, 1]).
• Fixed sum() and join() to return 0 and an empty string respectively for empty arrays.
• Fixed 0.0 to be truthy in filters and logical operators, like every other number.
• Fixed the compiled runtime to apply JMESPath truthiness to || and &&.
• Fixed @(foo), foo[-] and oversized index literals to throw syntax errors.
• Fixed PHP warnings emitted while parsing certain invalid expressions.
• Fixed the caret position in syntax error messages for errors at the end of an expression.
• Fixed map() to error on non-array second arguments instead of returning [].
• Fixed Env::cleanCompileDir() when JP_PHP_COMPILE=on.

Commits

• 2157c5e Release 2.9.2
• aa13a7b Freeze trim characters ahead of PHP 8.6 (#121)
• 9c208ba Release 2.9.1
• 83a51c1 Add security policy and convert readme to markdown (#117)
• 69aea5a Fix arbitrary code execution in the compiled runtime (#119)
• 77105da Replace old links in the code (#118)
• 9501100 Release 2.9.0
• ca10035 Fixed sum() and join() to return 0 and an empty string respectively for empty...
• eb36591 Fixed 0.0 to be truthy in filters and logical operators, like every other num...
• eed8676 Fixed multi-select hashes to end projections, so following tokens apply to th...
• Additional commits viewable in compare view

[github-actions]

🤖 AI Code Example Review

This PR is a straightforward automated dependency bump by Dependabot, updating mtdowling/jmespath.php from 2.8.0 to 2.9.2 in the PHP RDS example's composer.lock file. It is a maintenance/security update with no code example changes, and it passes review.

Detailed Review

1. Nature of change: This is a purely automated dependency update generated by Dependabot. Only php/example_code/rds/composer.lock is modified — no example source code, tests, or documentation are changed.

2. Security relevance: The 2.9.1 release notably includes a fix for arbitrary code execution in the compiled runtime ('Fixed the compiled runtime to emit function names as string literals, preventing arbitrary code execution'). This makes the bump a meaningful security improvement, not just a routine version bump.

3. Correctness of the lock file change: The diff shows correct and consistent updates — version string, git reference hash, dist URL, branch alias, phpunit dev dependency constraint, and support source URL are all updated in sync. No orphaned or inconsistent references remain.

4. Transitive dependency update: symfony/polyfill-mbstring is also bumped from v1.33.0 to v1.38.2 as part of this update. This is consistent with a legitimate transitive dependency resolution and appears benign.

5. No composer.json change: The composer.json file is not included in the diff, which is expected — composer.lock is updated to reflect the resolved version while composer.json likely already had a permissive constraint (e.g., ^2.6) that allows this upgrade. This is normal Dependabot behavior.

6. No test impact: Since this is a transitive/indirect dependency used internally by the AWS SDK for PHP, no example tests need to change. The update is backward-compatible within the 2.x series.

7. Timestamps: The new timestamps reference 2026 dates, which is consistent with the upstream repository's release metadata as shown in the changelog. This is not a concern.

8. No breaking changes for examples: The 2.9.x changelog entries describe bug fixes and behavioral corrections to JMESPath semantics. These changes are internal to SDK query processing and are unlikely to affect the RDS PHP examples in any observable way.

9. Approval recommendation: This PR should be approved and merged. It is a low-risk security/maintenance update with no changes to example logic, tests, or documentation.

10. Minor note: There are no issues to flag. The change is clean, minimal, and appropriate.

---

_{This review was generated automatically using Amazon Bedrock. It compares your changes against existing examples and coding guidelines. Please use your judgment — this is advisory, not authoritative.}

[github-actions]

🤖 AI Code Example Review

This PR is a routine dependency bump updating mtdowling/jmespath.php from 2.8.0 to 2.9.2 (and a transitive bump of symfony/polyfill-mbstring) in the PHP RDS example's composer.lock. It is a straightforward, low-risk maintenance change and should pass.

Detailed Review

1. Nature of change: This is a pure dependency-lock-file update with no changes to example source code, tests, or composer.json. Only composer.lock is modified.
2. Security relevance: Version 2.9.1 includes a fix for arbitrary code execution in the compiled JMESPath runtime (CVE-level issue). Merging this bump is important for keeping the example dependencies secure.
3. PHP 8.6 compatibility: Version 2.9.2 proactively addresses a breaking change in PHP 8.6 (trim() default character change). Adopting this now is good forward-compatibility hygiene.
4. Transitive bump of symfony/polyfill-mbstring (v1.33.0 → v1.38.2): This is a harmless transitive update that likely came along as a result of the jmespath upgrade. No concerns here.
5. composer.json not shown: The PR only updates composer.lock. If composer.json still pins mtdowling/jmespath.php to ^2.8, that constraint already satisfies 2.9.2 (semver minor bump), so no change to composer.json is required — this is acceptable.
6. No source/test changes: Since no PHP source files or test files were changed, there is nothing to review from a code quality, error handling, or guidelines-conformance perspective. The existing tests for the RDS examples should still apply.
7. Minimal diff scope: The diff is tightly scoped to just the lock file entries for the two affected packages. No unintended changes are present.
8. No hardcoded values or resource management concerns: Not applicable to a lock file change.
9. Automated dependency bump: The PR description format and content suggest this was generated by Dependabot, which is the standard and recommended approach for keeping example dependencies current.
10. Overall assessment: This is a clean, well-scoped maintenance PR with clear security and compatibility benefits. No blocking issues identified.

---

_{This review was generated automatically using Amazon Bedrock. It compares your changes against existing examples and coding guidelines. Please use your judgment — this is advisory, not authoritative.}

[github-actions]

🤖 AI Code Example Review

Pass. This is a routine automated dependency bump updating mtdowling/jmespath.php from 2.8.0 to 2.9.2 (and a transitive symfony/polyfill-mbstring bump) in the PHP RDS example's composer.lock. The change is low-risk, addresses security fixes, and requires no code review beyond confirming the lock file is consistent.

Detailed Review

1. Nature of the change: This is a pure dependency version bump generated by Dependabot/an automated tool. Only composer.lock is modified — no source code, tests, or composer.json files are touched.

2. Security relevance: The 2.9.1 release note explicitly states it fixes arbitrary code execution in the compiled runtime (Fix arbitrary code execution in the compiled runtime). Accepting this bump is important for security hygiene, even if the compiled runtime is unlikely to be exercised in these examples.

3. composer.json not updated: The diff only shows composer.lock. If composer.json still pins mtdowling/jmespath.php to ^2.8.0 (or similar), the lock file bump is valid as long as 2.9.2 satisfies the constraint. However, it would be worth confirming that composer.json allows ^2.9 or ^2.8 (which would cover 2.9.x under semver). No action needed if the existing constraint already satisfies 2.9.2.

4. Transitive bump of symfony/polyfill-mbstring: The diff also updates symfony/polyfill-mbstring from v1.33.0 to v1.38.2. This is a transitive dependency of jmespath.php or the AWS SDK. The bump appears consistent and expected when updating jmespath.

5. No test changes required: Since no library APIs changed in a breaking way for consumers (all changes are bug-fixes and additions), no updates to the example test files are needed.

6. Lock file integrity: The commit SHAs, zip URLs, and metadata (branch-alias 2.9-dev, updated time field, updated source URL) are all internally consistent within the lock file, indicating this was generated by a proper composer update run rather than a manual edit.

7. No hardcoded values or example logic changed: This PR introduces zero risk to the documentation examples themselves — it is purely a dependency maintenance update.

8. PHP 8.6 forward compatibility: The 2.9.2 fix ('Pass explicit trim characters ahead of the PHP 8.6 trim default change') is a proactive compatibility fix, which is a positive signal for longevity of these examples.

9. Minor: consider updating composer.json constraint: If composer.json still says ^2.8.0, it may be worth bumping it to ^2.9.0 to document the minimum-tested version, though this is a nice-to-have and not blocking.

10. Overall assessment: The PR is correct, safe, and addresses a security issue. It should be approved as-is.

---

_{This review was generated automatically using Amazon Bedrock. It compares your changes against existing examples and coding guidelines. Please use your judgment — this is advisory, not authoritative.}