[dependabot]

Bumps the composer-development group with 2 updates in the / directory: phpstan/phpstan and phpunit/phpunit.

Updates phpstan/phpstan from 2.2.16 to 2.3.1

Commits

• See full diff in compare view

Updates phpunit/phpunit from 13.3.5 to 13.4.2

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.4.2

Fixed

• #7033: Compact printer is created although an extension replaces the progress output
• #7035: Sorting tests by duration recomputes the duration of a test suite for every comparison
• Sorting tests by size recomputes the size of a test suite for every comparison
• expectUserDeprecationMessage() and expectUserDeprecationMessageMatches() did not see the deprecations triggered by an attempt of a retried test and saw those of the previously run test instead
• The status of a test whose mock object raises an exception in its destructor is success although the test is reported as errored, so #[Retry] does not retry the test, --repeat does not skip the remaining repetitions, tearDown() sees the wrong status, and code coverage records the test as successful
• Named arguments passed to with() were matched by position instead of by name, so an expectation such as ->with(b: 7) compared the expected value with the first parameter of the method and the parameter named $b was not checked
• String keys of the parameter sets passed to withParameterSetsInOrder(), withParameterSetsInAnyOrder(), and withParameterSetsInPartialOrder() were ignored, so a parameter set such as ['b' => 7] compared the expected value with the first parameter of the method and the parameter named $b was not checked

---

Learn how to install or update PHPUnit 13.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.4.1

Changed

• The Software Bill of Materials (SBOM) embedded in the PHAR now uses CycloneDX 1.7 and provides the NTIA minimum elements as well as the data fields that BSI TR-03183-2 (version 2.1.0) requires for logical and identified components, including component creators, original, distribution and effective licences, source code URIs, and the PHP runtime and its extensions as external components

Fixed

• #7029: TestSuite::runTests() doubles garbage collector time when zend.exception_ignore_args is off
• setUpBeforeClass() and tearDownAfterClass() were run twice for a test class that is the only test class in a test suite of the XML configuration file that has the name of that test class
• Tests could not be run in process isolation when the path of the bootstrap script, the test file, or the directory for temporary files contained a single quote
• Arguments in the --ARGS-- section of a PHPT test that start with - were interpreted by PHP instead of being passed to the test when the test also has a --STDIN-- section
• Recording the tests that passed in a child process copied all tests that had passed so far, which made running many tests in process isolation increasingly slow

---

Learn how to install or update PHPUnit 13.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.4.0

Added

• #6585: executionOrder attribute values and --order-by token lists that spell the order before defects, for example duration-ascending,defects
• #6585: pipeline() on the TestSuite\Sorted event for inspecting which reordering stages were applied
• #6686: Constraint::negatedToString() and Constraint::negatedFailureDescription() for authoring the description of a constraint that is wrapped in LogicalNot
• #6863: Cache which tests a test file contains

... (truncated)

Changelog

Sourced from phpunit/phpunit's changelog.

[13.4.2] - 2026-10-12

Fixed

• #7033: Compact printer is created although an extension replaces the progress output
• #7035: Sorting tests by duration recomputes the duration of a test suite for every comparison
• Sorting tests by size recomputes the size of a test suite for every comparison
• expectUserDeprecationMessage() and expectUserDeprecationMessageMatches() did not see the deprecations triggered by an attempt of a retried test and saw those of the previously run test instead
• The status of a test whose mock object raises an exception in its destructor is success although the test is reported as errored, so #[Retry] does not retry the test, --repeat does not skip the remaining repetitions, tearDown() sees the wrong status, and code coverage records the test as successful
• Named arguments passed to with() were matched by position instead of by name, so an expectation such as ->with(b: 7) compared the expected value with the first parameter of the method and the parameter named $b was not checked
• String keys of the parameter sets passed to withParameterSetsInOrder(), withParameterSetsInAnyOrder(), and withParameterSetsInPartialOrder() were ignored, so a parameter set such as ['b' => 7] compared the expected value with the first parameter of the method and the parameter named $b was not checked

[13.4.1] - 2026-10-05

Changed

• The Software Bill of Materials (SBOM) embedded in the PHAR now uses CycloneDX 1.7 and provides the NTIA minimum elements as well as the data fields that BSI TR-03183-2 (version 2.1.0) requires for logical and identified components, including component creators, original, distribution and effective licences, source code URIs, and the PHP runtime and its extensions as external components

Fixed

• #7029: TestSuite::runTests() doubles garbage collector time when zend.exception_ignore_args is off
• setUpBeforeClass() and tearDownAfterClass() were run twice for a test class that is the only test class in a test suite of the XML configuration file that has the name of that test class
• Tests could not be run in process isolation when the path of the bootstrap script, the test file, or the directory for temporary files contained a single quote
• Arguments in the --ARGS-- section of a PHPT test that start with - were interpreted by PHP instead of being passed to the test when the test also has a --STDIN-- section
• Recording the tests that passed in a child process copied all tests that had passed so far, which made running many tests in process isolation increasingly slow

[13.4.0] - 2026-10-02

Added

• #6585: executionOrder attribute values and --order-by token lists that spell the order before defects, for example duration-ascending,defects
• #6585: pipeline() on the TestSuite\Sorted event for inspecting which reordering stages were applied
• #6686: Constraint::negatedToString() and Constraint::negatedFailureDescription() for authoring the description of a constraint that is wrapped in LogicalNot
• #6863: Cache which tests a test file contains
• #6957: Allow ordering tests by the time their source files were last modified
• #6958: Select the tests that are in all of several groups
• #6960: Record the order in which methods of mock objects are invoked
• #6964: #[RequiresClass] attribute to skip a test if a class does not exist
• #6995: ChildProcessExtension interface for extensions that need to be bootstrapped in the child process of a test that runs in process isolation
• --coverage-jsonl CLI option and <jsonl> element for the XML configuration file to write a code coverage report in JSONL format, one JSON object per line, that reports uncovered code rather than every executable line
• --timeout CLI option to limit the wall-clock time of the entire test run
• requireCoverageMetadataOnSmallTests, requireCoverageMetadataOnMediumTests, and requireCoverageMetadataOnLargeTests attributes for the XML configuration file to require code coverage metadata depending on the size of a test; these have precedence over requireCoverageMetadata

Changed

• Output printed by a test is now shown in the compact output as a --- OUTPUT: record that is attributed to the test instead of being passed through unformatted; the record is omitted when beStrictAboutOutputDuringTests or --disallow-test-output already reports the output as risky

Deprecated

... (truncated)

Commits

• 7b9ba83 Prepare release
• 63d92f3 Merge branch '12.5' into 13.4
• 4e8cbea Prepare release
• 2096b7e Merge branch '12.5' into 13.4
• 244de3b Merge branch '11.5' into 12.5
• 36cbc46 Merge branch '10.5' into 11.5
• 9510903 Merge branch '9.6' into 10.5
• 5487b34 Merge branch '8.5' into 9.6
• ad43979 Update tools
• 901a149 Fix CS/WS issue
• Additional commits viewable in compare view

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud