Skip to content

security Update dependency phpunit/phpunit to v13 [SECURITY] - autoclosed - #41

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/packagist-phpunit-phpunit-vulnerability
Closed

security Update dependency phpunit/phpunit to v13 [SECURITY] - autoclosed#41
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/packagist-phpunit-phpunit-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Feb 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
phpunit/phpunit (source) ^10.2 || ^11.0 || ^12.0 → ^13.0 age adoption passing confidence

PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

CVE-2026-24765 / GHSA-vvj3-c3rp-c85p

More information

Details

Overview

A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage() method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious .coverage files are present prior to the execution of the PHPT test.

Technical Details

Affected Component: PHPT test runner, method cleanupForCoverage()
Affected Versions: <= 8.5.51, <= 9.6.32, <= 10.5.61, <= 11.5.49, <= 12.5.7

Vulnerable Code Pattern
if ($buffer !== false) {
    // Unsafe call without restrictions
    $coverage = @&#8203;unserialize($buffer);
}

The vulnerability occurs when a .coverage file, which should not exist before test execution, is deserialized without the allowed_classes parameter restriction. An attacker with local file write access can place a malicious serialized object with a __wakeup() method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.

Attack Prerequisites and Constraints

This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through:

  • CI/CD Pipeline Attacks: A malicious pull request that places a .coverage file alongside test files, executed when the CI system runs tests using PHPUnit and collects code coverage information
  • Local Development Environment: An attacker with shell access or ability to write files to the project directory
  • Compromised Dependencies: A supply chain attack inserting malicious files into a package or monorepo

Critical Context: Running test suites from unreviewed pull requests without isolated execution is inherently a code execution risk, independent of this specific vulnerability. This represents a broader class of Poisoned Pipeline Execution (PPE) attacks affecting CI/CD systems.

Proposed Remediation Approach

Rather than just silently sanitizing the input via ['allowed_classes' => false], the maintainer has chosen to make the anomalous state explicit by treating pre-existing .coverage files for PHPT tests as an error condition.

Rationale for Error-Based Approach:
  1. Visibility Over Silence: When an invariant is violated (a .coverage file existing before test execution), the error must be visible in CI/CD output, alerting operators to investigate the root cause rather than proceeding with sanitized input
  2. Operational Security: A .coverage file should never exist before tests run, coverage data is generated by executing tests, not sourced from artifacts. Its presence indicates:
    • A malicious actor placed it intentionally
    • Build artifacts from a previous run contaminated the environment
    • An unexpected filesystem state requiring investigation
  3. Defense-in-Depth Principle: Protecting a single deserialization call does not address the fundamental attack surface. Proper mitigations for PPE attacks lie outside PHPUnit's scope:
    • Isolate CI/CD runners (ephemeral, containerized environments)
    • Restrict code execution on protected branches
    • Scan pull requests and artifacts for tampering
    • Use branch protection rules to prevent unreviewed code execution
Severity Classification
  • Attack Vector (AV): Local (L) — requires write access to the file system where tests execute
  • Attack Complexity (AC): Low (L) — exploitation is straightforward once the malicious file is placed
  • Privileges Required (PR): Low (L) — PR submitter status or contributor role provides sufficient access
  • User Interaction (UI): None (N) — automatic execution during standard test execution
  • Scope (S): Unchanged (U) — impact remains within the affected test execution context
  • Confidentiality Impact (C): High (H) — full remote code execution enables complete system compromise
  • Integrity Impact (I): High (H) — arbitrary code execution allows malicious modifications
  • Availability Impact (A): High (H) — full code execution permits denial-of-service actions
Mitigating Factors (Environmental Context)

Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration:

  • Ephemeral Runners: Use containerized, single-use CI/CD runners that discard filesystem state between runs
  • Code Review Enforcement: Require human review and approval before executing code from pull requests
  • Branch Protection: Enforce branch protection rules that block unreviewed code execution
  • Artifact Isolation: Separate build artifacts from source; never reuse artifacts across independent builds
  • Access Control: Limit file write permissions in CI environments to authenticated, trusted actors
Fixed Behaviour

When a .coverage file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. This ensures:

  • Visibility: The error appears prominently in CI/CD output and test logs
  • Investigation: Operations teams can investigate the root cause (potential tampering, environment contamination)
  • Fail-Fast Semantics: Test execution stops rather than proceeding with an unexpected state
Recommendation

Update to the patched version immediately if a project runs PHPT tests using PHPUnit with coverage instrumentation in any CI/CD environment that executes code from external contributors. Additionally, audit the project's CI/CD configuration to ensure:

  • Pull requests from forks or untrusted sources execute in isolated environments
  • Branch protection rules require human review before code execution
  • CI/CD runners are ephemeral and discarded after each build
  • Build artifacts are not reused across independent runs without validation

Severity

  • CVSS Score: 7.8 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

CVE-2026-24765 / GHSA-vvj3-c3rp-c85p

More information

Details

Overview

A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage() method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious .coverage files are present prior to the execution of the PHPT test.

Technical Details

Affected Component: PHPT test runner, method cleanupForCoverage()
Affected Versions: <= 8.5.51, <= 9.6.32, <= 10.5.61, <= 11.5.49, <= 12.5.7

Vulnerable Code Pattern
if ($buffer !== false) {
    // Unsafe call without restrictions
    $coverage = @&#8203;unserialize($buffer);
}

The vulnerability occurs when a .coverage file, which should not exist before test execution, is deserialized without the allowed_classes parameter restriction. An attacker with local file write access can place a malicious serialized object with a __wakeup() method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.

Attack Prerequisites and Constraints

This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through:

  • CI/CD Pipeline Attacks: A malicious pull request that places a .coverage file alongside test files, executed when the CI system runs tests using PHPUnit and collects code coverage information
  • Local Development Environment: An attacker with shell access or ability to write files to the project directory
  • Compromised Dependencies: A supply chain attack inserting malicious files into a package or monorepo

Critical Context: Running test suites from unreviewed pull requests without isolated execution is inherently a code execution risk, independent of this specific vulnerability. This represents a broader class of Poisoned Pipeline Execution (PPE) attacks affecting CI/CD systems.

Proposed Remediation Approach

Rather than just silently sanitizing the input via ['allowed_classes' => false], the maintainer has chosen to make the anomalous state explicit by treating pre-existing .coverage files for PHPT tests as an error condition.

Rationale for Error-Based Approach:
  1. Visibility Over Silence: When an invariant is violated (a .coverage file existing before test execution), the error must be visible in CI/CD output, alerting operators to investigate the root cause rather than proceeding with sanitized input
  2. Operational Security: A .coverage file should never exist before tests run, coverage data is generated by executing tests, not sourced from artifacts. Its presence indicates:
    • A malicious actor placed it intentionally
    • Build artifacts from a previous run contaminated the environment
    • An unexpected filesystem state requiring investigation
  3. Defense-in-Depth Principle: Protecting a single deserialization call does not address the fundamental attack surface. Proper mitigations for PPE attacks lie outside PHPUnit's scope:
    • Isolate CI/CD runners (ephemeral, containerized environments)
    • Restrict code execution on protected branches
    • Scan pull requests and artifacts for tampering
    • Use branch protection rules to prevent unreviewed code execution
Severity Classification
  • Attack Vector (AV): Local (L) — requires write access to the file system where tests execute
  • Attack Complexity (AC): Low (L) — exploitation is straightforward once the malicious file is placed
  • Privileges Required (PR): Low (L) — PR submitter status or contributor role provides sufficient access
  • User Interaction (UI): None (N) — automatic execution during standard test execution
  • Scope (S): Unchanged (U) — impact remains within the affected test execution context
  • Confidentiality Impact (C): High (H) — full remote code execution enables complete system compromise
  • Integrity Impact (I): High (H) — arbitrary code execution allows malicious modifications
  • Availability Impact (A): High (H) — full code execution permits denial-of-service actions
Mitigating Factors (Environmental Context)

Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration:

  • Ephemeral Runners: Use containerized, single-use CI/CD runners that discard filesystem state between runs
  • Code Review Enforcement: Require human review and approval before executing code from pull requests
  • Branch Protection: Enforce branch protection rules that block unreviewed code execution
  • Artifact Isolation: Separate build artifacts from source; never reuse artifacts across independent builds
  • Access Control: Limit file write permissions in CI environments to authenticated, trusted actors
Fixed Behaviour

When a .coverage file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. This ensures:

  • Visibility: The error appears prominently in CI/CD output and test logs
  • Investigation: Operations teams can investigate the root cause (potential tampering, environment contamination)
  • Fail-Fast Semantics: Test execution stops rather than proceeding with an unexpected state
Recommendation

Update to the patched version immediately if a project runs PHPT tests using PHPUnit with coverage instrumentation in any CI/CD environment that executes code from external contributors. Additionally, audit the project's CI/CD configuration to ensure:

  • Pull requests from forks or untrusted sources execute in isolated environments
  • Branch protection rules require human review before code execution
  • CI/CD runners are ephemeral and discarded after each build
  • Build artifacts are not reused across independent runs without validation

Severity

  • CVSS Score: 7.8 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

sebastianbergmann/phpunit (phpunit/phpunit)

v13.0.0: PHPUnit 13.0.0

Compare Source

Added
  • #​6450: TestCase::invokeTestMethod() method for customizing test method invocation
  • #​6455: withParameterSetsInOrder() and withParameterSetsInAnyOrder() for expecting calls to the same method of a mock object but with different arguments
  • #​6466: Sealed test doubles
  • #​6468: Configuration option to require sealed mock objects
  • #​6477: assertArraysAreIdentical(), assertArraysAreIdenticalIgnoringOrder(), assertArraysHaveIdenticalValues(), assertArraysHaveIdenticalValuesIgnoringOrder(), assertArraysAreEqual(), assertArraysAreEqualIgnoringOrder(), assertArraysHaveEqualValues(), and assertArraysHaveEqualValuesIgnoringOrder() assertions
  • --test-files-file <file> CLI option to configure a file that contains the paths to the test files to be loaded (one file per line); use this when using CLI arguments is not an option due to argument length limitations
Deprecated
  • #​6461: any() matcher (hard deprecation)
Removed
  • #​6054: Assert::isType()
  • #​6057: assertContainsOnly() and assertNotContainsOnly()
  • #​6061: containsOnly()
  • #​6076: Support for PHP 8.3
  • #​6141: testClassName() method on event value objects for hook methods called for test methods
  • #​6230: Configuration::includeTestSuite() and Configuration::excludeTestSuite()
  • #​6241: --dont-report-useless-tests CLI option
  • #​6247: Support for using #[CoversNothing] on a test method
  • #​6285: #[RunClassInSeparateProcess] attribute
  • #​6356: Support for version constraint string argument without explicit version comparison operator

Learn how to install or update PHPUnit 13.0 in the documentation.

Keep up to date with PHPUnit:

v12.5.29

Compare Source

v12.5.28: PHPUnit 12.5.28

Compare Source

Fixed
  • #​6681: XML assertions such as assertXmlStringEqualsXmlString() regressed into treating comments as significant

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.27: PHPUnit 12.5.27

Compare Source

Fixed
  • #​6673: Empty PHP settings from the parent process override per-test -d settings forwarded to child processes (breaks PCOV coverage)

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.26: PHPUnit 12.5.26

Compare Source

Fixed
  • PHP setting values containing = need to be quoted before forwarding via -d

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.25: PHPUnit 12.5.25

Compare Source

Changed
  • A Test or Tests prefix is no longer stripped from class names when they are processed for TestDox output
Fixed
  • #​6605: Data set names and provider values containing Unicode bidirectional control characters distort terminal output
  • #​6610: Per-testsuite bootstrap script not loaded in process isolation
  • TestDox output collapsed separate test classes into a single group when their prettified class names matched

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.24: PHPUnit 12.5.24

Compare Source

Added
  • #​6596: Backport TestCase::invokeTestMethod() method for customizing test method invocation from PHPUnit 13
Fixed
  • #​6595: Crash when before-class or after-class method fails with assertion failure
  • #​6599: TeamCity logger does not wrap failures in before-test methods with testStarted and testFinished
  • #​6601: Anonymous classes are not rejected with a clear error when creating a test double
  • MockBuilder::setMockClassName() and TestStubBuilder::setStubClassName() now reject values that are not valid unqualified PHP class identifiers, throwing the new InvalidClassNameException
  • The regular expression used by Generator::ensureValidMethods() to validate method names passed to MockBuilder::onlyMethods() and addMethods() was not anchored, so any string containing a valid identifier substring (including strings with parentheses, braces, comments, or newlines) was accepted

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.23: PHPUnit 12.5.23

Compare Source

Changed
  • Pass LIBXML_NONET when parsing/validating XML configuration files to make explicit that no network I/O is performed
  • Verify the result file written by an isolated child process with a random nonce before deserializing it

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.22

Compare Source

v12.5.21

Compare Source

v12.5.20

Compare Source

v12.5.19: PHPUnit 12.5.19

Compare Source

Fixed
  • Regression in XML configuration migration introduced in PHPUnit 12.5.8

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.18: PHPUnit 12.5.18

Compare Source

Fixed
  • #​4571: No warning when --random-order-seed is used when test execution order is not random
  • #​4975: --filter does not work when filter string starts with #
  • #​5354: JUnit XML logger does not handle TestSuiteSkipped event
  • #​6276: Exit with non-zero exit code when explicit test selection (--filter, --group, --testsuite) yields no tests
  • #​6583: Failing output expectation skips tearDown() and handler restoration, causing subsequent tests to be marked as risky

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.17: PHPUnit 12.5.17

Compare Source

Changed
  • #​4793: Exit with non-zero exit code when exit was called from some test
Fixed
  • #​5881: colors="true" in XML configuration file does not unconditionally enable colored output
  • #​6019: --migrate-configuration does not update schema location when XML content already validates against current schema
  • #​6372: Assertion failure inside willReturnCallback() is silently swallowed when code under test catches exceptions
  • #​6464: Process isolation template unconditionally calls set_include_path()
  • #​6571: Static analysis errors for TestDoubleBuilder method chaining

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.16: PHPUnit 12.5.16

Compare Source

Added
  • #​6547: Support for %r...%r in EXPECTF section
Fixed
  • #​6025: FILE_EXTERNAL breaks __DIR__
  • #​6351: No warning when the same test runner extension is configured more than once
  • #​6433: Logic in TestSuiteLoader is brittle and causes "Class FooTest not found" even for valid tests in valid filenames
  • #​6463: Process Isolation fails on non-serializable globals and quietly ignore closures

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.15: PHPUnit 12.5.15

Compare Source

Changed
  • #​4440: Improve error when configured code coverage file list is empty
  • #​6549: Allow to stub both hooks of non-virtual properties
Fixed
  • #​6529: Git "detached HEAD state" in Open Test Reporting (OTR) XML logger not handled properly
  • #​6545: Stubbing a class with set property hook leaves property uninitialized by default
  • The RegularExpression and StringMatchesFormatDescription did not handle preg_match() errors such as Compilation failed: regular expression is too large

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.14: PHPUnit 12.5.14

Compare Source

Fixed
  • #​6521: Performance regression in PHPUnit 11.5.54, PHPUnit 12.5.13, and PHPUnit 13.0.4

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.13: PHPUnit 12.5.13

Compare Source

Fixed
  • #​6489: Classification of self/direct/indirect deprecation triggers is not aligned with Symfony's bridge for PHPUnit

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.12: PHPUnit 12.5.12

Compare Source

Fixed
  • #​6511: TestDox variables out of order with named arguments
  • #​6514: <ini /> can silently fail

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.11: PHPUnit 12.5.11

Compare Source

Deprecated
  • #​6510: Deprecate using with*() on test stubs
Fixed
  • #​6503: Temporary file used by SourceMapper may be deleted prematurely when multiple PHPUnit processes run in parallel
  • #​6509: "No expectations were configured for the mock object ..." notice is emitted when with() is used without expects()

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.10: PHPUnit 12.5.10

Compare Source

Fixed
  • #​6495: Source map for issue trigger identification is regenerated in process isolation child processes

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.9: PHPUnit 12.5.9

Compare Source

Added
  • #​6488: Allow disabling issue trigger identification for improved performance
Fixed
  • #​6486: Incorrect file name reported for errors for test methods declared in traits
  • #​6490: Incorrect test count when tests are skipped in before-class method

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.8: PHPUnit 12.5.8

Compare Source

Changed
  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.7: PHPUnit 12.5.7

Compare Source

Fixed
  • #​6362: Manually instantiated test doubles are broken since PHPUnit 11.2
  • #​6470: Infinite recursion in Count::getCountOf() for unusal implementations of Iterator or IteratorAggregate

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.6: PHPUnit 12.5.6

Compare Source

Changed

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.5: PHPUnit 12.5.5

Compare Source

Deprecated
  • #​6461: any() matcher (soft deprecation)
Fixed
  • #​6470: Mocking a class with a property hook setter accepting more types than the property results in a fatal error

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.4: PHPUnit 12.5.4

Compare Source

Changed
  • The #[AllowMockObjectsWithoutExpectations] attribute can now be used on the method level
Fixed
  • #​6446: Test runner crashes with Timer::start() has to be called before Timer::stop()

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.3: PHPUnit 12.5.3

Compare Source

Changed
  • The message emitted when a test method creates a mock object but does not configure any expectations for it has been improved

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.2: PHPUnit 12.5.2

Compare Source

Added
  • Attribute #[AllowMockObjectsWithoutExpectations] for excluding tests from the check that emits the notice for test methods that create a mock object but do not configure an expectation for it

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.1: PHPUnit 12.5.1

Compare Source

Added
  • TestCase::getStubBuilder() (analogous to TestCase::getMockBuilder()) for creating (partial) test stubs using a fluent API

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.0: PHPUnit 12.5.0

Compare Source

Added
  • #​6376: --all CLI option to ignore test selection configured in XML configuration file
  • #​6422: Make <source> element in XML code coverage report optional
Changed
  • #​6380: Allow Throwable in expectExceptionObject()
  • A PHPUnit notice is now emitted for test methods that create a mock object but do not configure an expectation for it

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.4.5: PHPUnit 12.4.5

Compare Source

Changed
  • Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6
Fixed
  • #​6426: Fix migration of configuration without schema location

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.4: PHPUnit 12.4.4

Compare Source

Fixed
  • #​6408: Exception in a data provider method leads to internal PHPUnit error
  • #​6410: Test runner's shutdown handler is called in system-under-test's child process

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.3: PHPUnit 12.4.3

Compare Source

Fixed
  • #​6402: Avoid reading from STDOUT when rewind() fails

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.2: PHPUnit 12.4.2

Compare Source

Changed
  • Skipped tests alone no longer lead to a yellow background for the test result summary
Fixed
  • #​6391: Errors during backup of global variables and static properties are not reported

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.1: PHPUnit 12.4.1

Compare Source

Fixed
  • #​6364: --filter format used by PhpStorm stopped working
  • #​6378: Wrong method name passed to DataProviderMethodCalled event value object

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.0: PHPUnit 12.4.0

Compare Source

Added
  • #​6277: Allow tests to opt out of the validation that a data provider method does not provide data sets with more values than a test method accepts
  • #​6341: Support for regular expressions with #[IgnoreDeprecations] attribute
  • #​6354: Invokable constraints
Deprecated
  • #​6284: #[RunClassInSeparateProcess] attribute
  • #​6355: Support for version constraint string argument without explicit version comparison operator

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.3.15: PHPUnit 12.3.15

Compare Source

Fixed
  • #​6368: failOnPhpunitWarning="false" has no effect

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.14: PHPUnit 12.3.14

[Compar

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the security label Feb 7, 2026
@renovate
renovate Bot requested a review from konradmichalik as a code owner February 7, 2026 07:04
@renovate

renovate Bot commented Feb 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock
Command failed: composer update phpunit/phpunit:13.0.0 --with-dependencies --ignore-platform-req ext-* --ignore-platform-req lib-* --ignore-platform-req php --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires phpunit/phpunit ^13.0 -> satisfiable by phpunit/phpunit[13.0.0].
    - phpunit/phpunit 13.0.0 requires sebastian/diff ^8.0.0 -> found sebastian/diff[8.0.0, ..., 8.3.0] but these were not loaded, likely because it conflicts with another require.

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

@renovate renovate Bot added the security label Feb 7, 2026
@renovate renovate Bot changed the title chore(deps): update dependency phpunit/phpunit to v13 [security] chore(deps): update dependency phpunit/phpunit to v13 [security] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate
renovate Bot deleted the renovate/packagist-phpunit-phpunit-vulnerability branch March 27, 2026 01:00
@renovate renovate Bot changed the title chore(deps): update dependency phpunit/phpunit to v13 [security] - autoclosed chore(deps): update dependency phpunit/phpunit to v13 [security] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate
renovate Bot force-pushed the renovate/packagist-phpunit-phpunit-vulnerability branch 2 times, most recently from aa770d1 to ce8c60b Compare March 30, 2026 21:00
@renovate renovate Bot changed the title chore(deps): update dependency phpunit/phpunit to v13 [security] chore(deps): update dependency phpunit/phpunit to v13 [security] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate
chore(deps): update dependency phpunit/phpunit to v13 [security]
132b661 
| datasource | package         | from    | to     |
| ---------- | --------------- | ------- | ------ |
| packagist  | phpunit/phpunit | 11.5.46 | 13.0.0 |
@renovate renovate Bot changed the title chore(deps): update dependency phpunit/phpunit to v13 [security] - autoclosed chore(deps): update dependency phpunit/phpunit to v13 [security] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate
renovate Bot force-pushed the renovate/packagist-phpunit-phpunit-vulnerability branch 2 times, most recently from ce8c60b to 132b661 Compare April 27, 2026 21:31
@renovate renovate Bot changed the title chore(deps): update dependency phpunit/phpunit to v13 [security] security Update dependency phpunit/phpunit to v13 [SECURITY] Jun 4, 2026
@renovate renovate Bot changed the title security Update dependency phpunit/phpunit to v13 [SECURITY] security Update dependency phpunit/phpunit to v13 [SECURITY] - autoclosed Jun 25, 2026
@renovate renovate Bot closed this Jun 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@konradmichalik konradmichalik Awaiting requested review from konradmichalik konradmichalik is a code owner

Assignees

No one assigned

Labels

security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants