[dependabot]

Bumps phpunit/phpunit from 10.5.64 to 13.4.6.

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.4.6

Changed

• Issues whose message refers to an anonymous class could not be ignored using a baseline on PHP 8.6 (as of PHP 8.6, such messages contain the full name of the anonymous class: a NUL byte followed by the file, line, and a counter)
• Make PHAR build reproducible across filesystems (files are now added to the PHAR sorted by their path instead of in the order in which the filesystem lists them)

Fixed

• When method() is called for a method of a test double that cannot be configured, for instance because it does not exist, every subsequent invocation of a method of that test double fails with Method name is not configured
• When a hook method of a test, for instance setUp(), marks the test as incomplete, the hook method is reported as failed
• When an "after test" method, for instance tearDown(), marks a successful test as incomplete or skips it, the test is reported as failed
• When a before-first-test method, for instance setUpBeforeClass(), calls markTestIncomplete(), each test of the test class is reported as failed instead of the test class being skipped as it is when markTestSkipped() is called
• When an after-last-test method, for instance tearDownAfterClass(), calls markTestIncomplete() or markTestSkipped() after the tests of the test class have been run, this is reported as a failure, also for each test of the test class that is run in process isolation
• A failed PHP assertion, made using assert(), in a hook method is reported as an error of that method instead of as a failure, and it is counted as an error instead of as a failure when that method is a before-first-test method or an after-last-test method
• When an assertion fails in an "after test" method, for instance tearDown(), of a test that already failed, errored, or was marked as incomplete, a failure is reported in addition to the outcome of the test, so the test is counted more than once and onNotSuccessfulTest() is called with the failure from the "after test" method instead of the test's own
• When a test fails because of an exception of a registered failure type, an error or a failure in an "after test" method, for instance tearDown(), is reported in addition to the test's failure, so the test is counted more than once
• A test that fails because of an exception of a registered failure type is considered risky when it does not perform assertions or, when requireCoverageMetadata="true" is configured, when it does not define a code coverage target, unlike a test that fails because an assertion failed
• The TestDox output does not show the failure of a before-first-test method or an after-last-test method, for instance an assertion failure in setUpBeforeClass()
• Control characters and ANSI escape sequences in user-supplied strings are not made visible in the output of --debug and in the logfiles written by --log-events-text and --log-events-verbose-text
• Groups configured for a test directory or test file using the groups attribute of <directory> or <file> in the XML configuration file are not assigned to PHPT tests, so --group and --exclude-group do not select them and --list-groups and --list-tests-xml report them as being in the default group or not at all

Removed

• The library PHAR (phpunit-library-X.Y.Z.phar) is no longer built, it could not be loaded since PHPUnit 9.5.8

---

Learn how to install or update PHPUnit 13.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.4.5

Fixed

• The static analysis cache directory that is automatically created in the operating system's path used for temporary files when no cache directory is configured is not used when the POSIX extension is not loaded

---

Learn how to install or update PHPUnit 13.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.4.4

Fixed

... (truncated)

Changelog

Sourced from phpunit/phpunit's changelog.

[13.4.6] - 2026-11-02

Changed

• Issues whose message refers to an anonymous class could not be ignored using a baseline on PHP 8.6 (as of PHP 8.6, such messages contain the full name of the anonymous class: a NUL byte followed by the file, line, and a counter)
• Make PHAR build reproducible across filesystems (files are now added to the PHAR sorted by their path instead of in the order in which the filesystem lists them)

Fixed

• When method() is called for a method of a test double that cannot be configured, for instance because it does not exist, every subsequent invocation of a method of that test double fails with Method name is not configured
• When a hook method of a test, for instance setUp(), marks the test as incomplete, the hook method is reported as failed
• When an "after test" method, for instance tearDown(), marks a successful test as incomplete or skips it, the test is reported as failed
• When a before-first-test method, for instance setUpBeforeClass(), calls markTestIncomplete(), each test of the test class is reported as failed instead of the test class being skipped as it is when markTestSkipped() is called
• When an after-last-test method, for instance tearDownAfterClass(), calls markTestIncomplete() or markTestSkipped() after the tests of the test class have been run, this is reported as a failure, also for each test of the test class that is run in process isolation
• A failed PHP assertion, made using assert(), in a hook method is reported as an error of that method instead of as a failure, and it is counted as an error instead of as a failure when that method is a before-first-test method or an after-last-test method
• When an assertion fails in an "after test" method, for instance tearDown(), of a test that already failed, errored, or was marked as incomplete, a failure is reported in addition to the outcome of the test, so the test is counted more than once and onNotSuccessfulTest() is called with the failure from the "after test" method instead of the test's own
• When a test fails because of an exception of a registered failure type, an error or a failure in an "after test" method, for instance tearDown(), is reported in addition to the test's failure, so the test is counted more than once
• A test that fails because of an exception of a registered failure type is considered risky when it does not perform assertions or, when requireCoverageMetadata="true" is configured, when it does not define a code coverage target, unlike a test that fails because an assertion failed
• The TestDox output does not show the failure of a before-first-test method or an after-last-test method, for instance an assertion failure in setUpBeforeClass()
• Control characters and ANSI escape sequences in user-supplied strings are not made visible in the output of --debug and in the logfiles written by --log-events-text and --log-events-verbose-text
• Groups configured for a test directory or test file using the groups attribute of <directory> or <file> in the XML configuration file are not assigned to PHPT tests, so --group and --exclude-group do not select them and --list-groups and --list-tests-xml report them as being in the default group or not at all

Removed

• The library PHAR (phpunit-library-X.Y.Z.phar) is no longer built, it could not be loaded since PHPUnit 9.5.8

[13.4.5] - 2026-10-27

Fixed

• The static analysis cache directory that is automatically created in the operating system's path used for temporary files when no cache directory is configured is not used when the POSIX extension is not loaded

[13.4.4] - 2026-10-27

Fixed

• The TeamCity logger writes testSuiteFinished twice for a test class when one of its before-first-test methods errors or fails
• The TestDox output shows a less important outcome of a test that has more than one outcome, for instance the failure in tearDown() of a test that errored
• When the test run is interrupted by a signal while a test is run in process isolation, the result of the test is discarded and the test is counted as passed, and the TestDox output cannot be printed
• When no static analysis cache directory is configured, the cache directory that is automatically created in the operating system's path used for temporary files is also used when it was created by another user or can be written to by other users
• The directory in the operating system's path used for temporary files in which the temporary files for collecting code coverage for a PHPT test are created has a fixed name, and is also used when it was created by another user, who can then replace the code of the PHPT test before it is executed

[13.4.3] - 2026-10-16

Fixed

• The dependencies of a test that are listed after a dependency on a test that does not return a value, or after a dependency on a larger test, were not checked, so the test was run instead of being skipped when one of these dependencies had not passed
• Tests could not be run in process isolation when the namespace of the test class begins with a name that the code of the child process imports, for instance CodeCoverage or Facade
• A test that is run in process isolation aborts the test run when its data set or a value returned by a test it depends on cannot be serialized, for instance because it is a closure
• When a before-first-test method or an after-last-test method errors or fails, the remaining methods of the same kind are still called, and each of them that does not error or fail itself is reported with the exception of the earlier method

... (truncated)

Commits

• 4821376 Prepare release
• 33153c8 Merge branch '12.5' into 13.4
• 1d5a4a3 Prepare release
• 0e18ec2 Update cbrgm/mastodon-github-action action to v2.2.6
• 474dca8 Merge branch '12.5' into 13.4
• 092e177 Make control characters in user-supplied strings visible in the output of --d...
• d65ec81 Merge branch '12.5' into 13.4
• d596570 Merge branch '11.5' into 12.5
• 89a07f0 Merge branch '10.5' into 11.5
• 980dbeb Merge branch '9.6' into 10.5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)