Skip to content

Update dependency phpunit/phpunit to v13 [SECURITY]#15

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/packagist-phpunit-phpunit-vulnerability
Open

Update dependency phpunit/phpunit to v13 [SECURITY]#15
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/packagist-phpunit-phpunit-vulnerability

Conversation

@renovate
Copy link

@renovate renovate bot commented Jan 29, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
phpunit/phpunit (source) ~4.8 → ~13.0 age confidence

GitHub Vulnerability Alerts

CVE-2026-24765

Overview

A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage() method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious .coverage files are present prior to the execution of the PHPT test.

Technical Details

Affected Component: PHPT test runner, method cleanupForCoverage()
Affected Versions: <= 8.5.51, <= 9.6.32, <= 10.5.61, <= 11.5.49, <= 12.5.7

Vulnerable Code Pattern

if ($buffer !== false) {
    // Unsafe call without restrictions
    $coverage = @&#8203;unserialize($buffer);
}

The vulnerability occurs when a .coverage file, which should not exist before test execution, is deserialized without the allowed_classes parameter restriction. An attacker with local file write access can place a malicious serialized object with a __wakeup() method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.

Attack Prerequisites and Constraints

This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through:

  • CI/CD Pipeline Attacks: A malicious pull request that places a .coverage file alongside test files, executed when the CI system runs tests using PHPUnit and collects code coverage information
  • Local Development Environment: An attacker with shell access or ability to write files to the project directory
  • Compromised Dependencies: A supply chain attack inserting malicious files into a package or monorepo

Critical Context: Running test suites from unreviewed pull requests without isolated execution is inherently a code execution risk, independent of this specific vulnerability. This represents a broader class of Poisoned Pipeline Execution (PPE) attacks affecting CI/CD systems.

Proposed Remediation Approach

Rather than just silently sanitizing the input via ['allowed_classes' => false], the maintainer has chosen to make the anomalous state explicit by treating pre-existing .coverage files for PHPT tests as an error condition.

Rationale for Error-Based Approach:

  1. Visibility Over Silence: When an invariant is violated (a .coverage file existing before test execution), the error must be visible in CI/CD output, alerting operators to investigate the root cause rather than proceeding with sanitized input
  2. Operational Security: A .coverage file should never exist before tests run, coverage data is generated by executing tests, not sourced from artifacts. Its presence indicates:
    • A malicious actor placed it intentionally
    • Build artifacts from a previous run contaminated the environment
    • An unexpected filesystem state requiring investigation
  3. Defense-in-Depth Principle: Protecting a single deserialization call does not address the fundamental attack surface. Proper mitigations for PPE attacks lie outside PHPUnit's scope:
    • Isolate CI/CD runners (ephemeral, containerized environments)
    • Restrict code execution on protected branches
    • Scan pull requests and artifacts for tampering
    • Use branch protection rules to prevent unreviewed code execution

Severity Classification

  • Attack Vector (AV): Local (L) — requires write access to the file system where tests execute
  • Attack Complexity (AC): Low (L) — exploitation is straightforward once the malicious file is placed
  • Privileges Required (PR): Low (L) — PR submitter status or contributor role provides sufficient access
  • User Interaction (UI): None (N) — automatic execution during standard test execution
  • Scope (S): Unchanged (U) — impact remains within the affected test execution context
  • Confidentiality Impact (C): High (H) — full remote code execution enables complete system compromise
  • Integrity Impact (I): High (H) — arbitrary code execution allows malicious modifications
  • Availability Impact (A): High (H) — full code execution permits denial-of-service actions

Mitigating Factors (Environmental Context)

Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration:

  • Ephemeral Runners: Use containerized, single-use CI/CD runners that discard filesystem state between runs
  • Code Review Enforcement: Require human review and approval before executing code from pull requests
  • Branch Protection: Enforce branch protection rules that block unreviewed code execution
  • Artifact Isolation: Separate build artifacts from source; never reuse artifacts across independent builds
  • Access Control: Limit file write permissions in CI environments to authenticated, trusted actors

Fixed Behaviour

When a .coverage file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. This ensures:

  • Visibility: The error appears prominently in CI/CD output and test logs
  • Investigation: Operations teams can investigate the root cause (potential tampering, environment contamination)
  • Fail-Fast Semantics: Test execution stops rather than proceeding with an unexpected state

Recommendation

Update to the patched version immediately if a project runs PHPT tests using PHPUnit with coverage instrumentation in any CI/CD environment that executes code from external contributors. Additionally, audit the project's CI/CD configuration to ensure:

  • Pull requests from forks or untrusted sources execute in isolated environments
  • Branch protection rules require human review before code execution
  • CI/CD runners are ephemeral and discarded after each build
  • Build artifacts are not reused across independent runs without validation

Release Notes

sebastianbergmann/phpunit (phpunit/phpunit)

v13.0.3

Compare Source

v13.0.2: PHPUnit 13.0.2

Compare Source

Deprecated
  • #​6505: Calling atLeast() with an argument that is not positive
  • #​6507: Support for using with*() without expects()
Fixed
  • #​6503: Temporary file used by SourceMapper may be deleted prematurely when multiple PHPUnit processes run in parallel
  • #​6509: "No expectations were configured for the mock object ..." notice is emitted when with() is used without expects()

Learn how to install or update PHPUnit 13.0 in the documentation.

Keep up to date with PHPUnit:

v13.0.1: PHPUnit 13.0.1

Compare Source

Fixed
  • #​6495: Source map for issue trigger identification is regenerated in process isolation child processes
  • #​6497: method() returns InvocationMocker instead of InvocationStubber for test stubs

Learn how to install or update PHPUnit 13.0 in the documentation.

Keep up to date with PHPUnit:

v13.0.0: PHPUnit 13.0.0

Compare Source

Added
  • #​6450: TestCase::invokeTestMethod() method for customizing test method invocation
  • #​6455: withParameterSetsInOrder() and withParameterSetsInAnyOrder() for expecting calls to the same method of a mock object but with different arguments
  • #​6466: Sealed test doubles
  • #​6468: Configuration option to require sealed mock objects
  • #​6477: assertArraysAreIdentical(), assertArraysAreIdenticalIgnoringOrder(), assertArraysHaveIdenticalValues(), assertArraysHaveIdenticalValuesIgnoringOrder(), assertArraysAreEqual(), assertArraysAreEqualIgnoringOrder(), assertArraysHaveEqualValues(), and assertArraysHaveEqualValuesIgnoringOrder() assertions
  • --test-files-file <file> CLI option to configure a file that contains the paths to the test files to be loaded (one file per line); use this when using CLI arguments is not an option due to argument length limitations
Deprecated
  • #​6461: any() matcher (hard deprecation)
Removed
  • #​6054: Assert::isType()
  • #​6057: assertContainsOnly() and assertNotContainsOnly()
  • #​6061: containsOnly()
  • #​6076: Support for PHP 8.3
  • #​6141: testClassName() method on event value objects for hook methods called for test methods
  • #​6230: Configuration::includeTestSuite() and Configuration::excludeTestSuite()
  • #​6241: --dont-report-useless-tests CLI option
  • #​6247: Support for using #[CoversNothing] on a test method
  • #​6285: #[RunClassInSeparateProcess] attribute
  • #​6356: Support for version constraint string argument without explicit version comparison operator

Learn how to install or update PHPUnit 13.0 in the documentation.

Keep up to date with PHPUnit:

v12.5.12

Compare Source

v12.5.11: PHPUnit 12.5.11

Compare Source

Deprecated
  • #​6510: Deprecate using with*() on test stubs
Fixed
  • #​6503: Temporary file used by SourceMapper may be deleted prematurely when multiple PHPUnit processes run in parallel
  • #​6509: "No expectations were configured for the mock object ..." notice is emitted when with() is used without expects()

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.10: PHPUnit 12.5.10

Compare Source

Fixed
  • #​6495: Source map for issue trigger identification is regenerated in process isolation child processes

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.9: PHPUnit 12.5.9

Compare Source

Added
  • #​6488: Allow disabling issue trigger identification for improved performance
Fixed
  • #​6486: Incorrect file name reported for errors for test methods declared in traits
  • #​6490: Incorrect test count when tests are skipped in before-class method

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.8: PHPUnit 12.5.8

Compare Source

Changed
  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.7: PHPUnit 12.5.7

Compare Source

Fixed
  • #​6362: Manually instantiated test doubles are broken since PHPUnit 11.2
  • #​6470: Infinite recursion in Count::getCountOf() for unusal implementations of Iterator or IteratorAggregate

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.6: PHPUnit 12.5.6

Compare Source

Changed

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.5: PHPUnit 12.5.5

Compare Source

Deprecated
  • #​6461: any() matcher (soft deprecation)
Fixed
  • #​6470: Mocking a class with a property hook setter accepting more types than the property results in a fatal error

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.4: PHPUnit 12.5.4

Compare Source

Changed
  • The #[AllowMockObjectsWithoutExpectations] attribute can now be used on the method level
Fixed
  • #​6446: Test runner crashes with Timer::start() has to be called before Timer::stop()

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.3: PHPUnit 12.5.3

Compare Source

Changed
  • The message emitted when a test method creates a mock object but does not configure any expectations for it has been improved

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.2: PHPUnit 12.5.2

Compare Source

Added
  • Attribute #[AllowMockObjectsWithoutExpectations] for excluding tests from the check that emits the notice for test methods that create a mock object but do not configure an expectation for it

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.1: PHPUnit 12.5.1

Compare Source

Added
  • TestCase::getStubBuilder() (analogous to TestCase::getMockBuilder()) for creating (partial) test stubs using a fluent API

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.0: PHPUnit 12.5.0

Compare Source

Added
  • #​6376: --all CLI option to ignore test selection configured in XML configuration file
  • #​6422: Make <source> element in XML code coverage report optional
Changed
  • #​6380: Allow Throwable in expectExceptionObject()
  • A PHPUnit notice is now emitted for test methods that create a mock object but do not configure an expectation for it

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.4.5: PHPUnit 12.4.5

Compare Source

Changed
  • Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6
Fixed
  • #​6426: Fix migration of configuration without schema location

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.4: PHPUnit 12.4.4

Compare Source

Fixed
  • #​6408: Exception in a data provider method leads to internal PHPUnit error
  • #​6410: Test runner's shutdown handler is called in system-under-test's child process

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.3: PHPUnit 12.4.3

Compare Source

Fixed
  • #​6402: Avoid reading from STDOUT when rewind() fails

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.2: PHPUnit 12.4.2

Compare Source

Changed
  • Skipped tests alone no longer lead to a yellow background for the test result summary
Fixed
  • #​6391: Errors during backup of global variables and static properties are not reported

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.1: PHPUnit 12.4.1

Compare Source

Fixed
  • #​6364: --filter format used by PhpStorm stopped working
  • #​6378: Wrong method name passed to DataProviderMethodCalled event value object

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.0: PHPUnit 12.4.0

Compare Source

Added
  • #​6277: Allow tests to opt out of the validation that a data provider method does not provide data sets with more values than a test method accepts
  • #​6341: Support for regular expressions with #[IgnoreDeprecations] attribute
  • #​6354: Invokable constraints
Deprecated
  • #​6284: #[RunClassInSeparateProcess] attribute
  • #​6355: Support for version constraint string argument without explicit version comparison operator

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.3.15: PHPUnit 12.3.15

Compare Source

Fixed
  • #​6368: failOnPhpunitWarning="false" has no effect

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.14: PHPUnit 12.3.14

Compare Source

  • No changes; phpunit.phar rebuilt with updated dependencies

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.13: PHPUnit 12.3.13

Compare Source

  • No changes; phpunit.phar rebuilt with updated dependencies

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.12: PHPUnit 12.3.12

Compare Source

  • No changes; phpunit.phar rebuilt with updated dependencies

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.11: PHPUnit 12.3.11

Compare Source

Changed
  • #​6366: Exclude __sleep() and __wakeup() from test double code generation on PHP >= 8.5

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.10: PHPUnit 12.3.10

Compare Source

Changed
  • #​6353: Disable performance optimization for tests requiring Xdebug
  • #​6357: Also collect E_DEPRECATED issues when building the test suite

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.9: PHPUnit 12.3.9

Compare Source

Changed
  • Do not use __sleep() method (which will be deprecated in PHP 8.5)

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.8: PHPUnit 12.3.8

Compare Source

Fixed
  • #​6340: Implicitly enabled display of deprecation details is not disabled when it should be

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.7: PHPUnit 12.3.7

Compare Source

Changed
  • #[IgnorePhpunitDeprecations] is now considered for test runner deprecations (where applicable)

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.6

Compare Source

v12.3.5: PHPUnit 12.3.5

Compare Source

Changed
  • #​6319: Detect premature end of PHPUnit's main PHP process
  • #​6321: Allow error_reporting=E_ALL for --check-php-configuration
Fixed
  • #​5863: TestDox printer does not show previous exception
  • #​6102: expectUserDeprecationMessage*() fails when test is run in separate process

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.4: PHPUnit 12.3.4

Compare Source

Changed
  • #​6308: Improve output of --check-php-configuration
  • The version number for the test result cache file has been incremented to reflect that its structure for PHPUnit 12.3 is not compatible with its structure for PHPUnit 8.5 and PHPUnit 9.6
Fixed
  • #​6197: ini_set('error_log') sets filepath outside open_basedir
  • #​6279: Deprecation triggered in data provider method affects all test methods using that data provider method
  • #​6281: Exceptions raised in after-test method are not reported for skipped tests

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.3: PHPUnit 12.3.3

Compare Source

Fixed
  • #​6304: PHPUnit 11.5.29 hangs when a test runner deprecation is triggered and process isolation is used (this reverts "#[IgnorePhpunitDeprecations] is now considered for test runner deprecations" from PHPUnit 12.3.1)

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.2: PHPUnit 12.3.2

Compare Source

Changed
  • #​6300: Emit warning when the name of a data provider method begins with test
  • Do not use SplObjectStorage methods that will be deprecated in PHP 8.5

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.1: PHPUnit 12.3.1

Compare Source

Added
  • #​6297: --check-php-configuration CLI option for checking whether PHP is configured for testing
Changed
  • #[IgnorePhpunitDeprecations] is now considered for test runner deprecations (where applicable)
Fixed
  • #​6160: Baseline file in a subdirectory contains absolute paths
  • #​6294: Silent failure of PHP fatal errors
  • Errors due to invalid data provided using #[TestWith] or #[TestWithJson] attributes are now properly reported
  • The DataProviderMethodFinished event is now also emitted when the provided data set has an invalid key

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

v12.3.0: PHPUnit 12.3.0

Compare Source

Added
  • #​3795: Bootstrap scripts specific to test suites
  • #​6268: #[IgnorePHPUnitWarnings] attribute for ignoring PHPUnit warnings
  • #[TestDoxFormatter] and #[TestDoxFormatterExternal] attributes for configuring a custom TestDox formatter for tests that use data from data providers
  • TestRunner\ChildProcessErrored event
  • Configuration::includeTestSuites() and Configuration::excludeTestSuites()
Changed
  • #​6237: Do not run tests when code coverage analysis is requested but code coverage data cannot be collected
  • #​6272: Use @<data-set-name> format (compatible with --filter CLI option) in defect messages
  • #​6273: Warn when #[DataProvider*] attributes are mixed with #[TestWith*] attributes
Deprecated
  • #​6229: Configuration::includeTestSuite(), use Configuration::includeTestSuites() instead
  • #​6229: Configuration::excludeTestSuite(), use Configuration::excludeTestSuites() instead
  • #​6246: Using #[CoversNothing] on a test method

How to install or update PHPUnit

v12.2.9: PHPUnit 12.2.9

Compare Source

Fixed
  • #​6097: The file attribute of <testClass> node of XML test list can be wrong

How to install or update PHPUnit

v12.2.8: PHPUnit 12.2.8

Compare Source

Fixed
  • #​6274: Infinite recursion when code coverage report in OpenClover XML format is configured in XML configuration file

How to install or update PHPUnit

v12.2.7: PHPUnit 12.2.7

Compare Source

Fixed
  • #​6254: defects,randomconfiguration is supported by implementation, but it is not allowed by the XML configuration file schema
  • #​6259: Order of tests which use data from data providers is not affected by test sorting
  • #​6266: Superfluous whitespace in TestDox output when test method name has a number after the test prefix

How to install or update PHPUnit

v12.2.6: PHPUnit 12.2.6

Compare Source

Fixed
  • #​6104: Test with dependencies and data provider fails
  • #​6163: @no-named-arguments leads to static analysis errors for variadic arguments

How to install or update PHPUnit

v12.2.5: PHPUnit 12.2.5

Compare Source

Fixed
  • #​6249: No meaningful error when <testsuite> element is missing required name attribute

How to install or update PHPUnit

v12.2.4: PHPUnit 12.2.4

Compare Source

Changed
  • Including information about the Git repository (such as the commit hash and branch name) in the Open Test Reporting XML format is now an opt-in feature that can be enabled via the --include-git-information CLI option or the includeGitInformation attribute in the XML configuration file

How to install or update PHPUnit

v12.2.3: PHPUnit 12.2.3

Compare Source

Added
  • #​6236: failOnPhpunitWarning attribute on the <phpunit> element of the XML configuration file and --fail-on-phpunit-warning CLI option for controlling whether PHPUnit should fail on PHPUnit warnings (default: true)
  • #​6239: --do-not-fail-on-deprecation, --do-not-fail-on-phpunit-warning, --do-not-fail-on-phpunit-deprecation, --do-not-fail-on-empty-test-suite, --do-not-fail-on-incomplete, --do-not-fail-on-notice, --do-not-fail-on-risky, --do-not-fail-on-skipped, and --do-not-fail-on-warning CLI options
  • --do-not-report-useless-tests CLI option as a replacement for --dont-report-useless-tests
Deprecated
  • --dont-report-useless-tests CLI option (use --do-not-report-useless-tests instead)
Fixed
  • #​6243: Constraints cannot be implemented without using internal class ExpectationFailedException

How to install or update PHPUnit

v12.2.2: PHPUnit 12.2.2

Compare Source

Fixed
  • #​6222: Data Provider seems to mess up Test Dependencies
  • shortenArraysForExportThreshold XML configuration setting has no effect on all arrays exported for event-related value objects

How to install or update PHPUnit

v12.2.1: PHPUnit 12.2.1

Compare Source

Fixed
  • #​6228: Variadic test methods should not warn about too many arguments from data provider

How to install or update PHPUnit

v12.2.0: PHPUnit 12.2.0

Compare Source

Added
Experimental Support for Open Test Reporting XML

PHPUnit has supported reporting test results in the JUnit XML format for a long time. Unfortunately, there has never been a standard schema for the JUnit XML format. Common consumers of Clover XML log files interpret these files differently, which has led to frequent problems.

To address this, the JUnit team started the Open Test Reporting project, creating and maintaining language-agnostic XML and HTML test reporting formats. Unlike JUnit XML, Open Test Reporting's XML formats are extensible.

Logging in the Open Test Reporting XML format is controlled by the new --log-otr CLI option and the new <otr> XML configuration element.

This feature is experimental and the generated XML may change in order to enhance compliance with the Open Test Reporting project's XML schema definitions. The same applies to the XML schema definitions for information that is specific for PHP and PHPUnit. Please note that such changes may occur in bugfix or minor releases and could potentially break backwards compatibility.

Experimental Support for OpenClover XML

PHPUnit has supported reporting code coverage information in the Clover XML format for a long time. Unfortunately, there has never been a standard schema for the Clover XML format. Common consumers of Clover XML log files interpret these files differently, which leads to frequent problems.

The original commercial Clover project has been superseded by the Open Source OpenClover project, which provides an XML schema for its OpenClover XML format. Rather than modifying the existing Clover XML reporter to comply with the OpenClover XML schema, thereby breaking backward compatibility, a new OpenClover XML reporter has been introduced.

This new reporter is controlled by the new CLI option, --coverage-openclover, and the new XML configuration element, <openclover>. This code coverage reporter generates XML documents that validate against the OpenClover project's XML schema definition, with one exception: the <testproject> element is not generated.

The existing Clover XML reporter, controlled by the --coverage-clover CLI option and the <clover> XML configuration element, remains unchanged.

This feature is experimental and the generated XML may change to enhance compliance with the OpenClover XML schema definition. Please note that such changes may occur in bugfix or minor releases and could potentially break backwards compatibility.

Miscellaneous
  • --with-telemetry CLI option that can be used together with --debug to print debugging information that includes telemetry information
  • The TestCase::provideAdditionalInformation() method can now be used to emit a Test\AdditionalInformationProvided event
  • The new Test\AfterLastTestMethodFailed, Test\AfterTestMethodFailed, Test\BeforeFirstTestMethodFailed, Test\BeforeTestMethodFailed, Test\PostConditionFailed, Test\PreConditionFailed events are now emitted instead of Test\AfterLastTestMethodErrored, Test\AfterTestMethodErrored, Test\BeforeFirstTestMethodErrored, Test\BeforeTestMethodErrored, Test\PostConditionErrored, Test\PreConditionErrored when the Throwable extends AssertionFailedError to distinguish between errors and failures triggered in hook methods
  • The new Test\PreparationErrored event is now emitted instead of Test\PreparationFailed when the Throwable does not extend AssertionFailedError to distinguish between errors and failures triggered during test preparation
  • Test\PreparationFailed::throwable()
Changed
  • #​6165: Collect deprecations triggered by autoloading while loading/building the test suite
  • Do not treat warnings differently than other issues in summary section of default output
  • A warning is now emitted when both #[CoversNothing] and #[Covers*] (or #[Uses*]) are used on a test class
  • A warning is now emitted when the same #[Covers*] (or #[Uses*]) attribute is used multiple times on a test class
  • A warning is now emitted when the same code is targeted by both #[Covers*] and #[Uses*] attributes
  • A warning is now emitted when a hook method such as setUp(), for example has a #[Test] attribute
  • A warning is now emitted when more than one of #[Small], #[Medium], or #[Large] is used on a test class
  • A warning is now emitted when a data provider provides data sets that have more values than the test method consumes using arguments

How to install or update PHPUnit

[v12.1.6](https://redi

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/packagist-phpunit-phpunit-vulnerability branch from c95e26f to bcc4fda Compare February 3, 2026 07:56
@renovate renovate bot changed the title Update dependency phpunit/phpunit to v8 [SECURITY] Update dependency phpunit/phpunit to v12 [SECURITY] Feb 3, 2026
@renovate renovate bot force-pushed the renovate/packagist-phpunit-phpunit-vulnerability branch from bcc4fda to 02de08b Compare February 4, 2026 11:58
@renovate renovate bot changed the title Update dependency phpunit/phpunit to v12 [SECURITY] Update dependency phpunit/phpunit to v8 [SECURITY] Feb 4, 2026
@renovate renovate bot force-pushed the renovate/packagist-phpunit-phpunit-vulnerability branch from 02de08b to 59b4bc3 Compare February 13, 2026 12:08
@renovate renovate bot changed the title Update dependency phpunit/phpunit to v8 [SECURITY] Update dependency phpunit/phpunit to v13 [SECURITY] Feb 13, 2026
@renovate renovate bot force-pushed the renovate/packagist-phpunit-phpunit-vulnerability branch from 59b4bc3 to d9ce269 Compare February 14, 2026 08:01
@renovate renovate bot changed the title Update dependency phpunit/phpunit to v13 [SECURITY] Update dependency phpunit/phpunit to v8 [SECURITY] Feb 14, 2026
@renovate renovate bot force-pushed the renovate/packagist-phpunit-phpunit-vulnerability branch from d9ce269 to 44bb93c Compare February 17, 2026 04:12
@renovate renovate bot changed the title Update dependency phpunit/phpunit to v8 [SECURITY] Update dependency phpunit/phpunit to v13 [SECURITY] Feb 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

Comments