build(deps-dev): bump composer/semver from 3.4.4 to 3.5.0

[dependabot]

Bumps composer/semver from 3.4.4 to 3.5.0.

Release notes

Sourced from composer/semver's releases.

3.5.0

• Added VersionParser::isValid() to check whether a version string can be normalized (#168)
• Fixed Intervals::compactConstraint() turning constraints that match no dev versions, like > 1.0.0 != 2.0.0 || < 1.9.0, into != 2.0.0 which matches all dev-* versions (#189)
• Fixed >= and < constraints on RC versions, like >=1.0-RC1, getting an extra -dev suffix which beta and alpha constraints did not get (#187)
• Improved CompilingMatcher performance by avoiding building concatenated cache keys on every call (#186)

Full Changelog: composer/semver@3.4.4...3.5.0

Changelog

Sourced from composer/semver's changelog.

[3.5.0] 2026-09-24

• Added VersionParser::isValid() to check whether a version string can be normalized (#168)
• Fixed Intervals::compactConstraint() turning constraints that match no dev versions, like > 1.0.0 != 2.0.0 || < 1.9.0, into != 2.0.0 which matches all dev-* versions (#189)
• Fixed >= and < constraints on RC versions, like >=1.0-RC1, getting an extra -dev suffix which beta and alpha constraints did not get (#187)
• Improved CompilingMatcher performance by avoiding building concatenated cache keys on every call (#186)

Commits

• f7a296f Update changelog
• b60bbab Do not compact a dev-free constraint into bare != constraints that match dev ...
• 346ebc8 Avoid concatenated cache keys in CompilingMatcher (#186)
• 9255780 Add CI job running the VERS spec test suite (#188)
• 9ee1a95 Fix RC stability suffix getting an extra -dev in < and >= constraints (#187)
• dee3264 Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#185)
• 1cbc9b5 Bump actions/checkout from 7.0.0 to 7.0.1 (#183)
• 52bf964 Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 (#182)
• a5e1d2d Bump shivammathur/setup-php from 2.37.1 to 2.37.2 (#181)
• 0de3018 Bump actions/checkout from 6.0.2 to 7.0.0 (#179)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)