build(deps-dev): bump phpunit/phpunit from 9.5.28 to 13.1.8

[dependabot]

Bumps phpunit/phpunit from 9.5.28 to 13.1.8.

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.1.8

Fixed

• #6595: Crash when before-class or after-class method fails with assertion failure
• #6599: TeamCity logger does not wrap failures in before-test methods with testStarted and testFinished
• #6601: Anonymous classes are not rejected with a clear error when creating a test double
• #6603: assertArrays*IgnoringOrder() fails on mixed scalar types and on reordered nested associative arrays
• MockBuilder::setMockClassName() and TestStubBuilder::setStubClassName() now reject values that are not valid unqualified PHP class identifiers, throwing the new InvalidClassNameException
• The regular expression used by Generator::ensureValidMethods() to validate method names passed to MockBuilder::onlyMethods() and addMethods() was not anchored, so any string containing a valid identifier substring (including strings with parentheses, braces, comments, or newlines) was accepted

---

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.1.7

Changed

• Pass LIBXML_NONET when parsing/validating XML configuration files to make explicit that no network I/O is performed
• Verify the result file written by an isolated child process with a random nonce before deserializing it

---

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.1.6

Fixed

• #6590: Silent failure when configuration file is invalid
• #6592: INI metacharacters ; and " are not preserved when forwarding settings to child processes

---

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.1.5

... (truncated)

Changelog

Sourced from phpunit/phpunit's changelog.

[13.1.8] - 2026-05-01

Fixed

• #6595: Crash when before-class or after-class method fails with assertion failure
• #6599: TeamCity logger does not wrap failures in before-test methods with testStarted and testFinished
• #6601: Anonymous classes are not rejected with a clear error when creating a test double
• #6603: assertArrays*IgnoringOrder() fails on mixed scalar types and on reordered nested associative arrays
• MockBuilder::setMockClassName() and TestStubBuilder::setStubClassName() now reject values that are not valid unqualified PHP class identifiers, throwing the new InvalidClassNameException
• The regular expression used by Generator::ensureValidMethods() to validate method names passed to MockBuilder::onlyMethods() and addMethods() was not anchored, so any string containing a valid identifier substring (including strings with parentheses, braces, comments, or newlines) was accepted

[13.1.7] - 2026-04-18

Changed

• Pass LIBXML_NONET when parsing/validating XML configuration files to make explicit that no network I/O is performed
• Verify the result file written by an isolated child process with a random nonce before deserializing it

[13.1.6] - 2026-04-17

Fixed

• #6590: Silent failure when configuration file is invalid
• #6592: INI metacharacters ; and " are not preserved when forwarding settings to child processes

[13.1.5] - 2026-04-16

Fixed

• #5860: PHP CLI -d settings are not forwarded to child processes for process isolation
• #6451: Incomplete version in RequiresPhp (e.g. <=8.5) is compared against full PHP version, causing unexpected skips
• #6589: dataSetAsStringWithData() raises "float is not representable as int" warning for large floats in data sets

[13.1.4] - 2026-04-15

Fixed

• #5993: DefaultJobRunner deadlocks on child processes that write large amounts of stderr output
• #6465: SAPI-populated $_SERVER entries leak from parent into child process
• #6587: failOnEmptyTestSuite="false" in phpunit.xml is ignored when --group/--filter/--testsuite matches no tests
• #6588: Order of issue baseline entries is not canonicalized

[13.1.3] - 2026-04-13

Fixed

• Regression in XML configuration migration introduced in PHPUnit 12.5.8

[13.1.2] - 2026-04-13

... (truncated)

Commits

• f49a2b5 Prepare release
• 423461f Merge branch '12.5' into 13.1
• d75dd30 Prepare release
• 451a35b Merge branch '12.5' into 13.1
• 419e088 Closes #6599
• 172f1cd Closes #6603
• 8a8e7bb Merge branch '12.5' into 13.1
• f86f987 Merge branch '11.5' into 12.5
• 078b608 Update tools
• febf07f Increase timeout
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR upgrades PHPUnit across four major versions (9 to 13) without any corresponding updates to the test codebase or project configuration. This update is highly likely to break the build for two reasons: the strict requirement for PHP 8.4.1+, which is not currently defined in composer.json, and the extensive breaking changes in PHPUnit's internal API (including the move from annotations to attributes and the new Event system).

Although Codacy marks the PR as 'up to standards', this is likely due to the analysis being restricted to the dependency files themselves. This PR should not be merged until the environment compatibility is confirmed and the test suite has been migrated to handle the removed assertions and updated configuration schema.

About this PR

• The minimum requirement of PHP 8.4.1 for PHPUnit 13.1 may unexpectedly break development environments or CI pipelines that are not yet on the latest PHP release, as the project does not explicitly define its own PHP requirement in composer.json.
• The PR jumps across four major versions of PHPUnit without any adjustments to test files or configuration. Given the breaking changes introduced in PHPUnit 10 and later, it is highly probable that the current tests will fail to execute without a significant refactoring effort.

Test suggestions

• Execute the existing test suite using PHPUnit 13 to detect breakages caused by API removals or behavior changes (e.g. transition from annotations to attributes).
• Verify that the CI/CD pipeline and local environments support PHP 8.4.1, as necessitated by this version of PHPUnit.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Execute the existing test suite using PHPUnit 13 to detect breakages caused by API removals or behavior changes (e.g. transition from annotations to attributes).
2. Verify that the CI/CD pipeline and local environments support PHP 8.4.1, as necessitated by this version of PHPUnit.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

This major version jump (9 to 13) introduces a requirement for PHP >= 8.4.1 and many breaking changes.

1. Explicitly declare the minimum PHP version requirement in the require section of composer.json (>= 8.4.1).
2. Update phpunit.xml by running vendor/bin/phpunit --migrate-configuration.
3. Migrate test files to use Attributes instead of Docblock annotations and replace removed assertions like assertRegExp or assertInternalType.

Try running the following prompt in your coding agent:

Update composer.json to require php 8.4.1 or higher and migrate the tests in the tests/ directory to be compatible with PHPUnit 13 attributes and configuration.

[dependabot]

Superseded by #358.