:rotating_light: [Conductor] Security update phpunit/phpunit to 13.1.7 by private-packagist[bot] · Pull Request #1708 · composer/packagist

private-packagist · 2026-04-18T01:02:35Z

This PR was automatically generated by Conductor.

The PR contains the changes generated by running the following command:

composer update phpunit/phpunit:13.1.7 --with-all-dependencies --minimal-changes

Changelog

phpunit/phpunit (Source: GitHub Releases))

13.1.7

Changed

Pass LIBXML_NONET when parsing/validating XML configuration files to make explicit that no network I/O is performed
Verify the result file written by an isolated child process with a random nonce before deserializing it

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

13.1.6

Fixed

#6590: Silent failure when configuration file is invalid
#6592: INI metacharacters ; and " are not preserved when forwarding settings to child processes

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

13.1.5

Fixed

#5860: PHP CLI -d settings are not forwarded to child processes for process isolation
#6451: Incomplete version in RequiresPhp (e.g. <=8.5) is compared against full PHP version, causing unexpected skips
#6589: dataSetAsStringWithData() raises "float is not representable as int" warning for large floats in data sets

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

13.1.4

Fixed

#5993: DefaultJobRunner deadlocks on child processes that write large amounts of stderr output
#6465: SAPI-populated $_SERVER entries leak from parent into child process
#6587: failOnEmptyTestSuite="false" in phpunit.xml is ignored when --group/--filter/--testsuite matches no tests
#6588: Order of issue baseline entries is not canonicalized

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

13.1.3

Fixed

Regression in XML configuration migration introduced in PHPUnit 12.5.8

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

13.1.2

Fixed

#4571: No warning when --random-order-seed is used when test execution order is not random
#4975: --filter does not work when filter string starts with #
#5354: JUnit XML logger does not handle TestSuiteSkipped event
#6276: Exit with non-zero exit code when explicit test selection (--filter, --group, --testsuite) yields no tests
#6583: Failing output expectation skips tearDown() and handler restoration, causing subsequent tests to be marked as risky

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

13.1.1

Changed

#3676: Include class/interface name in mock object expectation failure messages
#4793: Exit with non-zero exit code when exit was called from some test

Fixed

#5881: colors="true" in XML configuration file does not unconditionally enable colored output
#6019: --migrate-configuration does not update schema location when XML content already validates against current schema
#6372: Assertion failure inside willReturnCallback() is silently swallowed when code under test catches exceptions
#6464: Process isolation template unconditionally calls set_include_path()
#6571: Static analysis errors for TestDoubleBuilder method chaining

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

13.1.0

Added

#6501: Include unexpected output in Open Test Reporting (OTR) XML logfile
#6517: includeInCodeCoverage attribute for <directory> and <file> children of <source>
#6523: Include #[Group] information in Open Test Reporting (OTR) XML logfile
#6524: Report issues in Open Test Reporting (OTR) XML logfile
#6526: Introduce #[DataProviderClosure] for static closures
#6530: Support for custom issue trigger resolvers that can be configured using <issueTriggerResolvers> in the XML configuration file
#6547: Support for %r...%r in EXPECTF section
Support for configuring HTML code coverage report options (colors, thresholds, custom CSS) in XML configuration file without requiring an outputDirectory attribute, allowing the output directory to be specified later with the --coverage-html CLI option
Support for configuring dark mode colors, progress bar colors, and breadcrumb colors for HTML code coverage reports in the XML configuration file

Changed

#6557: Improve failure description for StringMatchesFormatDescription constraint which is used by assertFileMatchesFormat(), assertFileMatchesFormatFile(), assertStringMatchesFormat(), assertStringMatchesFormatFile(), and EXPECTF sections of PHPT test files
The HTML code coverage report now uses a more colorblind-friendly blue/amber/orange palette by default
Extracted PHPUnit\Runner\Extension\Facade from a concrete class to an interface and introduced an internal ExtensionFacade implementation, so that extensions only depend on the Facade interface while PHPUnit internally uses the ExtensionFacade class that also provides query methods

Deprecated

#6515: Deprecate the --log-events-verbose-text <file> CLI option
#6537: Soft-deprecate id() and after() for mock object expectations

Fixed

#6025: FILE_EXTERNAL breaks __DIR__
#6351: No warning when the same test runner extension is configured more than once
#6433: Logic in TestSuiteLoader is brittle and causes "Class FooTest not found" even for valid tests in valid filenames
#6463: Process Isolation fails on non-serializable globals and quietly ignore closures

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

13.0.6

Changed

#4440: Improve error when configured code coverage file list is empty
#6549: Allow to stub both hooks of non-virtual properties

Fixed

#6529: Git "detached HEAD state" in Open Test Reporting (OTR) XML logger not handled properly
#6545: Stubbing a class with set property hook leaves property uninitialized by default
The RegularExpression and StringMatchesFormatDescription did not handle preg_match() errors such as Compilation failed: regular expression is too large

Learn how to install or update PHPUnit 13.0 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

Task options

Recreate commit - Conductor recreates the update commit and overwrites all additional changes made in this branch.
Details
Skip - Conductor won't attempt to update the dependency to this exact version again.
All tasks
Settings
Docs

If you close the PR, the task will be skipped and Conductor will schedule the next task. Clicking the "Skip" button in the UI has the same effect. Conductor won't attempt to update the dependency to this exact version again but it will schedule updates to newer versions.

Powered by Private Packagist

private-packagist · 2026-04-18T01:02:41Z

composer.lock

Dev Package changes

Package	Operation	From	To	About
sebastian/git-state	add	-	1.0.0	view code - License: BSD 3-Clause "New" or "Revised" License
phpunit/php-code-coverage	upgrade	13.0.1	14.1.3	diff
phpunit/phpunit	upgrade	13.0.5	13.1.7	diff
sebastian/comparator	upgrade	8.0.0	8.1.2	diff
sebastian/diff	upgrade	8.0.0	8.1.0	diff
sebastian/environment	upgrade	9.0.1	9.3.0	diff
sebastian/exporter	upgrade	8.0.0	8.0.2	diff

Settings · Docs · Powered by Private Packagist

Conductor executed the following commands: composer update phpunit/phpunit:13.1.7 --with-all-dependencies --minimal-changes

private-packagist · 2026-04-18T06:17:17Z

The composer.lock diff comment has been updated to reflect new changes in this PR.

private-packagist · 2026-04-18T09:10:46Z

The pull request for this task was closed by Conductor because a newer package version is available.

private-packagist · 2026-04-18T09:10:55Z

The composer.lock diff comment has been updated to reflect new changes in this PR.

github-actions Bot force-pushed the conductor-phpunit-phpunit-70067 branch from 9f7cd65 to c926899 Compare April 18, 2026 06:17

Security update phpunit/phpunit to 13.1.7

b884ea7

Conductor executed the following commands: composer update phpunit/phpunit:13.1.7 --with-all-dependencies --minimal-changes

private-packagist Bot force-pushed the conductor-phpunit-phpunit-70067 branch from c926899 to b884ea7 Compare April 18, 2026 06:17

private-packagist Bot changed the title ~~🚨 [Conductor] Security update phpunit/phpunit to 13.1.6~~ 🚨 [Conductor] Security update phpunit/phpunit to 13.1.7 Apr 18, 2026

private-packagist Bot closed this Apr 18, 2026

private-packagist Bot deleted the conductor-phpunit-phpunit-70067 branch April 18, 2026 09:10

Navigation Menu

Uh oh!

Uh oh!

🚨 [Conductor] Security update phpunit/phpunit to 13.1.7 - #1708

🚨 [Conductor] Security update phpunit/phpunit to 13.1.7#1708
private-packagist[bot] wants to merge 1 commit into
mainfrom
conductor-phpunit-phpunit-70067

private-packagist Bot commented Apr 18, 2026 •

edited

Loading

Uh oh!

private-packagist Bot commented Apr 18, 2026 •

edited

Loading

Uh oh!

private-packagist Bot commented Apr 18, 2026

Uh oh!

private-packagist Bot commented Apr 18, 2026

Uh oh!

private-packagist Bot commented Apr 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

private-packagist Bot commented Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changelog

13.1.7

Changed

Keep up to date with PHPUnit:

13.1.6

Fixed

Keep up to date with PHPUnit:

13.1.5

Fixed

Keep up to date with PHPUnit:

13.1.4

Fixed

Keep up to date with PHPUnit:

13.1.3

Fixed

Keep up to date with PHPUnit:

13.1.2

Fixed

Keep up to date with PHPUnit:

13.1.1

Changed

Fixed

Keep up to date with PHPUnit:

13.1.0

Added

Changed

Deprecated

Fixed

Keep up to date with PHPUnit:

13.0.6

Changed

Fixed

Keep up to date with PHPUnit:

Task options

Uh oh!

private-packagist Bot commented Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

composer.lock

Dev Package changes

Uh oh!

private-packagist Bot commented Apr 18, 2026

Uh oh!

private-packagist Bot commented Apr 18, 2026

Uh oh!

private-packagist Bot commented Apr 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

private-packagist Bot commented Apr 18, 2026 •

edited

Loading

private-packagist Bot commented Apr 18, 2026 •

edited

Loading