Prepare for Matomo 6

[sgiehl]

Description

Prepares the plugin for Matomo 6, in six commits.

Metadata — plugin.json version 5.2.0 → 6.0.0 and require.matomo >=5.7.0-alpha,<6.0.0-b1 →
>=6.0.0-b1,<7.0.0-b1 (the -b1 lower bound is required so the plugin is not disabled against a beta
core), plus a 6.0.0 CHANGELOG entry. No composer.json, so no PHP constraint to raise there.

Updates/ — checked, not changed. core/Updater only runs update files where
installedVersion < fileVersion <= marker, so every file must sort at or below the new 6.0.0 marker.
5.0.4.php and 5.2.0.php both do, and released update files are immutable regardless.

Plugin tests workflow — PHP aliases matomo5_* → matomo6_* in the matrix, the UI job, the
upload-artifacts condition and the generate:test-action header comment. Added a database matrix for
MySQL 8.0 and MariaDB 10.6 (Matomo 6's new minimums), passed through as mysql-engine / mysql-version,
with matrix.database.engine == 'Mysql' added to upload-artifacts. The UI job was on
node-version: '16' while Matomo 6 requires Node 24 — bumped to '24' with explicit mysql-engine /
mysql-version, without which it fails with Unknown database 'piwik_tests' before comparing any
screenshot.

PHPCS / PHPStan workflows — ran on PHP 7.4 and 7.2, both below Matomo 6's 8.1 floor. Bumped to 8.1.

PHPStan configuration — excludePaths listed github-action-tests, which does not exist in the
repository. PHPStan 2 (bundled with Matomo 6) fails hard on an entry matching nothing, so the analysis
aborted with Invalid entry in excludePaths rather than running. Marked optional as
github-action-tests/ (?), which keeps it skipped in CI — where checkout_matomo.sh copies the action
workspace into the plugin directory — while letting it pass locally. tests/* is a wildcard and was left
alone. phpVersion 70200 → 80100.

Two real findings, now fixed (only visible once the analysis actually ran):

• Settings/EncryptedSystemSetting.php:63 guarded a saveValue() call with
  $backend instanceof PluginSettingsTable && method_exists($backend, 'saveValue'). The method_exists
  arm is dead — Piwik\Settings\Storage\Backend\PluginSettingsTable::saveValue() is declared in core 6.
  Removed.
• ClientSecretExpiryNotifier.php:255 widened its by-ref array<string, string> $recipients to
  array<mixed> by assigning $user['email'], which the array<string, mixed> $user PHPDoc types as
  mixed. Cast to string once and used for both key and value.

Vue — rebuilt with the Vite toolchain; no TypeScript errors. This repo tracked three artefacts the
single-pass Vite build no longer produces — MicrosoftTeams.umd.js, MicrosoftTeams.umd.js.map and
MicrosoftTeams.umd.min.js.map, all still dated from the old Vue CLI build. Removed, and the
/vue/dist/*.umd.js and /vue/dist/*.map ignore rules added (this .gitignore had only .codex, unlike
the other prepared plugins which already carry that block). MicrosoftTeams.umd.min.js and
umd.metadata.json are regenerated.

Reviewed and kept: EnrichTriggeredAlerts.php:17 extends Controller, which the #[JsonResponse]
sweep matches — but that is the CustomAlerts plugin's controller, not a core JSON action, and the
class only overrides enrichTriggeredAlerts(). The API.getBulkRequest string in
tests/Integration/MicrosoftTeamsTest.php:209 is a crafted URL inside a webhook SSRF-rejection test, not
a call.

All six commits are marked [ignore_release]: this only establishes Matomo 6 compatibility and nothing
can be released for Matomo 6 until core ships.

Issue No

Related to the Matomo 6 plugin preparation effort.

Steps to Replicate the Issue

1. Mount the plugin into a Matomo 6 checkout (PHP 8.1, MySQL 8.0, Node 24) and activate it —
   ./console plugin:activate MicrosoftTeams succeeds.
2. ./console core:update reports no pending migrations.
3. phpstan analyse -c plugins/MicrosoftTeams/phpstan.neon reports no errors (before this PR it
   aborted with Invalid entry in excludePaths).
4. ./console vue:build MicrosoftTeams completes with no TypeScript errors.
5. ./vendor/bin/phpcs --standard=phpcs.xml passes on PHP 8.1.
6. ./console tests:run plugins/MicrosoftTeams/tests/Integration — 74 of 81 pass locally. The 7
   ScheduledReportsTest::testGetAlertMessage cases assert a hard-coded http://localhost/... URL and
   fail on any dev machine whose [tests] http_host is not localhost; CI uses localhost, so they
   pass there.

Checklist

• [✔] Tested locally or on demo2/demo3?
• [NA] New test case added/updated?
• [NA] Are all newly added texts included via translation?
• [NA] Are text sanitized properly? (Eg use of v-text v/s v-html for vue)
• [✔] Version bumped?
• [✔] I have understood, reviewed, and tested all AI outputs before use
• [✔] All AI instructions respect security, IP, and privacy rules
• [NA] Documentation updated?