fix(composer-repository): match List for security-advisories field

security-advisories in a p2 provider response is a JSON array, which
decodes to PhpMixed::List rather than PhpMixed::Array. The check only
matched Array, so it always missed and silently fell through to the
api-url fallback instead of using the already-cached provider data.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 5 insertions, 7 deletions

diff --git a/crates/shirabe/src/repository/composer_repository.rs b/crates/shirabe/src/repository/composer_repository.rs
index f3f75ea2..fc576189 100644
--- a/crates/shirabe/src/repository/composer_repository.rs
+++ b/crates/shirabe/src/repository/composer_repository.rs
@@ -1004,18 +1004,16 @@ impl ComposerRepository {
                     Some(a) => a.clone(),
                     None => continue,
                 };
-                let sec_advs_arr = match response_arr
-                    .get("security-advisories")
-                    .and_then(|v| v.as_array())
-                {
-                    Some(a) => a.clone(),
-                    None => continue,
+                let sec_advs_arr = match response_arr.get("security-advisories") {
+                    Some(PhpMixed::List(l)) => l.clone(),
+                    Some(PhpMixed::Array(a)) => a.values().cloned().collect(),
+                    _ => continue,
                 };
 
                 names_found.insert(name.clone(), true);
                 if !sec_advs_arr.is_empty() {
                     let mut entries: Vec<AnySecurityAdvisory> = Vec::new();
-                    for (_k, data_mixed) in sec_advs_arr.iter() {
+                    for data_mixed in sec_advs_arr.iter() {
                         if let Some(data) = data_mixed.as_array() {
                             let data_map: IndexMap<String, PhpMixed> =
                                 data.iter().map(|(k, v)| (k.clone(), v.clone())).collect();