chore(deps-dev): bump phpunit/phpunit from 12.5.39 to 13.4.2 in /tools/phpunit

[dependabot]

Bumps phpunit/phpunit from 12.5.39 to 13.4.2.

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.4.2

Fixed

• #7033: Compact printer is created although an extension replaces the progress output
• #7035: Sorting tests by duration recomputes the duration of a test suite for every comparison
• Sorting tests by size recomputes the size of a test suite for every comparison
• expectUserDeprecationMessage() and expectUserDeprecationMessageMatches() did not see the deprecations triggered by an attempt of a retried test and saw those of the previously run test instead
• The status of a test whose mock object raises an exception in its destructor is success although the test is reported as errored, so #[Retry] does not retry the test, --repeat does not skip the remaining repetitions, tearDown() sees the wrong status, and code coverage records the test as successful
• Named arguments passed to with() were matched by position instead of by name, so an expectation such as ->with(b: 7) compared the expected value with the first parameter of the method and the parameter named $b was not checked
• String keys of the parameter sets passed to withParameterSetsInOrder(), withParameterSetsInAnyOrder(), and withParameterSetsInPartialOrder() were ignored, so a parameter set such as ['b' => 7] compared the expected value with the first parameter of the method and the parameter named $b was not checked

---

Learn how to install or update PHPUnit 13.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.4.1

Changed

• The Software Bill of Materials (SBOM) embedded in the PHAR now uses CycloneDX 1.7 and provides the NTIA minimum elements as well as the data fields that BSI TR-03183-2 (version 2.1.0) requires for logical and identified components, including component creators, original, distribution and effective licences, source code URIs, and the PHP runtime and its extensions as external components

Fixed

• #7029: TestSuite::runTests() doubles garbage collector time when zend.exception_ignore_args is off
• setUpBeforeClass() and tearDownAfterClass() were run twice for a test class that is the only test class in a test suite of the XML configuration file that has the name of that test class
• Tests could not be run in process isolation when the path of the bootstrap script, the test file, or the directory for temporary files contained a single quote
• Arguments in the --ARGS-- section of a PHPT test that start with - were interpreted by PHP instead of being passed to the test when the test also has a --STDIN-- section
• Recording the tests that passed in a child process copied all tests that had passed so far, which made running many tests in process isolation increasingly slow

---

Learn how to install or update PHPUnit 13.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.4.0

Added

• #6585: executionOrder attribute values and --order-by token lists that spell the order before defects, for example duration-ascending,defects
• #6585: pipeline() on the TestSuite\Sorted event for inspecting which reordering stages were applied
• #6686: Constraint::negatedToString() and Constraint::negatedFailureDescription() for authoring the description of a constraint that is wrapped in LogicalNot
• #6863: Cache which tests a test file contains

... (truncated)

Changelog

Sourced from phpunit/phpunit's changelog.

[13.4.2] - 2026-10-12

Fixed

• #7033: Compact printer is created although an extension replaces the progress output
• #7035: Sorting tests by duration recomputes the duration of a test suite for every comparison
• Sorting tests by size recomputes the size of a test suite for every comparison
• expectUserDeprecationMessage() and expectUserDeprecationMessageMatches() did not see the deprecations triggered by an attempt of a retried test and saw those of the previously run test instead
• The status of a test whose mock object raises an exception in its destructor is success although the test is reported as errored, so #[Retry] does not retry the test, --repeat does not skip the remaining repetitions, tearDown() sees the wrong status, and code coverage records the test as successful
• Named arguments passed to with() were matched by position instead of by name, so an expectation such as ->with(b: 7) compared the expected value with the first parameter of the method and the parameter named $b was not checked
• String keys of the parameter sets passed to withParameterSetsInOrder(), withParameterSetsInAnyOrder(), and withParameterSetsInPartialOrder() were ignored, so a parameter set such as ['b' => 7] compared the expected value with the first parameter of the method and the parameter named $b was not checked

[13.4.1] - 2026-10-05

Changed

• The Software Bill of Materials (SBOM) embedded in the PHAR now uses CycloneDX 1.7 and provides the NTIA minimum elements as well as the data fields that BSI TR-03183-2 (version 2.1.0) requires for logical and identified components, including component creators, original, distribution and effective licences, source code URIs, and the PHP runtime and its extensions as external components

Fixed

• #7029: TestSuite::runTests() doubles garbage collector time when zend.exception_ignore_args is off
• setUpBeforeClass() and tearDownAfterClass() were run twice for a test class that is the only test class in a test suite of the XML configuration file that has the name of that test class
• Tests could not be run in process isolation when the path of the bootstrap script, the test file, or the directory for temporary files contained a single quote
• Arguments in the --ARGS-- section of a PHPT test that start with - were interpreted by PHP instead of being passed to the test when the test also has a --STDIN-- section
• Recording the tests that passed in a child process copied all tests that had passed so far, which made running many tests in process isolation increasingly slow

[13.4.0] - 2026-10-02

Added

• #6585: executionOrder attribute values and --order-by token lists that spell the order before defects, for example duration-ascending,defects
• #6585: pipeline() on the TestSuite\Sorted event for inspecting which reordering stages were applied
• #6686: Constraint::negatedToString() and Constraint::negatedFailureDescription() for authoring the description of a constraint that is wrapped in LogicalNot
• #6863: Cache which tests a test file contains
• #6957: Allow ordering tests by the time their source files were last modified
• #6958: Select the tests that are in all of several groups
• #6960: Record the order in which methods of mock objects are invoked
• #6964: #[RequiresClass] attribute to skip a test if a class does not exist
• #6995: ChildProcessExtension interface for extensions that need to be bootstrapped in the child process of a test that runs in process isolation
• --coverage-jsonl CLI option and <jsonl> element for the XML configuration file to write a code coverage report in JSONL format, one JSON object per line, that reports uncovered code rather than every executable line
• --timeout CLI option to limit the wall-clock time of the entire test run
• requireCoverageMetadataOnSmallTests, requireCoverageMetadataOnMediumTests, and requireCoverageMetadataOnLargeTests attributes for the XML configuration file to require code coverage metadata depending on the size of a test; these have precedence over requireCoverageMetadata

Changed

• Output printed by a test is now shown in the compact output as a --- OUTPUT: record that is attributed to the test instead of being passed through unformatted; the record is omitted when beStrictAboutOutputDuringTests or --disallow-test-output already reports the output as risky

Deprecated

... (truncated)

Commits

• 7b9ba83 Prepare release
• 63d92f3 Merge branch '12.5' into 13.4
• 2096b7e Merge branch '12.5' into 13.4
• 8e46560 Merge branch '12.5' into 13.4
• 2dc7a9d Resolve the path of the system's temporary directory in which the files for c...
• abfadd0 Fix CS/WS issues
• 352273e Merge branch '12.5' into 13.4
• 2b4aa84 Match string keys of parameter sets by parameter name in all withParameterSet...
• 3096e07 Merge branch '12.5' into 13.4
• 253bdd7 Use --do-not-record-test-run-history instead of the deprecated --do-not-cache...
• Additional commits viewable in compare view

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.