build(deps-dev): bump phpunit/phpunit from 9.5.28 to 13.1.9

[dependabot]

Bumps phpunit/phpunit from 9.5.28 to 13.1.9.

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.1.9

Changed

• A Test or Tests prefix is no longer stripped from class names when they are processed for TestDox output

Fixed

• #6605: Data set names and provider values containing Unicode bidirectional control characters distort terminal output
• #6610: Per-testsuite bootstrap script not loaded in process isolation
• TestDox output collapsed separate test classes into a single group when their prettified class names matched

---

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.1.8

Fixed

• #6595: Crash when before-class or after-class method fails with assertion failure
• #6599: TeamCity logger does not wrap failures in before-test methods with testStarted and testFinished
• #6601: Anonymous classes are not rejected with a clear error when creating a test double
• #6603: assertArrays*IgnoringOrder() fails on mixed scalar types and on reordered nested associative arrays
• MockBuilder::setMockClassName() and TestStubBuilder::setStubClassName() now reject values that are not valid unqualified PHP class identifiers, throwing the new InvalidClassNameException
• The regular expression used by Generator::ensureValidMethods() to validate method names passed to MockBuilder::onlyMethods() and addMethods() was not anchored, so any string containing a valid identifier substring (including strings with parentheses, braces, comments, or newlines) was accepted

---

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.1.7

Changed

• Pass LIBXML_NONET when parsing/validating XML configuration files to make explicit that no network I/O is performed
• Verify the result file written by an isolated child process with a random nonce before deserializing it

---

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

... (truncated)

Changelog

Sourced from phpunit/phpunit's changelog.

[13.1.9] - 2026-05-13

Changed

• A Test or Tests prefix is no longer stripped from class names when they are processed for TestDox output

Fixed

• #6605: Data set names and provider values containing Unicode bidirectional control characters distort terminal output
• #6610: Per-testsuite bootstrap script not loaded in process isolation
• TestDox output collapsed separate test classes into a single group when their prettified class names matched

[13.1.8] - 2026-05-01

Fixed

• #6595: Crash when before-class or after-class method fails with assertion failure
• #6599: TeamCity logger does not wrap failures in before-test methods with testStarted and testFinished
• #6601: Anonymous classes are not rejected with a clear error when creating a test double
• #6603: assertArrays*IgnoringOrder() fails on mixed scalar types and on reordered nested associative arrays
• MockBuilder::setMockClassName() and TestStubBuilder::setStubClassName() now reject values that are not valid unqualified PHP class identifiers, throwing the new InvalidClassNameException
• The regular expression used by Generator::ensureValidMethods() to validate method names passed to MockBuilder::onlyMethods() and addMethods() was not anchored, so any string containing a valid identifier substring (including strings with parentheses, braces, comments, or newlines) was accepted

[13.1.7] - 2026-04-18

Changed

• Pass LIBXML_NONET when parsing/validating XML configuration files to make explicit that no network I/O is performed
• Verify the result file written by an isolated child process with a random nonce before deserializing it

[13.1.6] - 2026-04-17

Fixed

• #6590: Silent failure when configuration file is invalid
• #6592: INI metacharacters ; and " are not preserved when forwarding settings to child processes

[13.1.5] - 2026-04-16

Fixed

• #5860: PHP CLI -d settings are not forwarded to child processes for process isolation
• #6451: Incomplete version in RequiresPhp (e.g. <=8.5) is compared against full PHP version, causing unexpected skips
• #6589: dataSetAsStringWithData() raises "float is not representable as int" warning for large floats in data sets

[13.1.4] - 2026-04-15

Fixed

• #5993: DefaultJobRunner deadlocks on child processes that write large amounts of stderr output

... (truncated)

Commits

• 506033f Prepare release
• c8041c1 Merge branch '12.5' into 13.1
• 792c298 Prepare release
• 3c6867a Merge branch '12.5' into 13.1
• e5120fd Merge branch '11.5' into 12.5
• 1e58f6d Merge branch '10.5' into 11.5
• 8be7939 Merge branch '9.6' into 10.5
• 505691b Merge branch '8.5' into 9.6
• b5c83ce Harden against script injection
• cbbd4d9 Do not persist Git credentials
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR performs a significant upgrade across four major versions of PHPUnit (9 to 13). This change introduces critical breaking requirements that are currently unaddressed in the PR, most notably a hard requirement for PHP 8.4.1+ and the need for a configuration migration.

The test suite is likely to fail in its current state because the mandatory migration of phpunit.xml and the update of lifecycle methods (requiring void return types) have not been performed. Furthermore, the upgrade of nikic/php-parser to v5 may introduce upstream incompatibilities with metrics tools used in this project.

About this PR

• The upgrade to PHPUnit 10+ requires a specific migration for the phpunit.xml configuration file and a transition to PHP 8 Attributes for test metadata. These changes are missing from the current PR.

Test suggestions

• Execute the test suite with PHPUnit 13 to verify compatibility with removed assertions and internal API changes
• Verify that phpunit.xml has been migrated to the new schema introduced in PHPUnit 10
• Verify that the CI environment is updated to support PHP 8.4.1+, as required by the new dependency versions

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Execute the test suite with PHPUnit 13 to verify compatibility with removed assertions and internal API changes
2. Verify that `phpunit.xml` has been migrated to the new schema introduced in PHPUnit 10
3. Verify that the CI environment is updated to support PHP 8.4.1+, as required by the new dependency versions

Low confidence findings

• The jump of nikic/php-parser from v4 to v5 may cause issues with codacy/codacy-metrics-pdepend if its underlying dependencies are not yet compatible with the v5 parser API.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

This upgrade to PHPUnit 13 introduces a hard requirement for PHP 8.4.1 or higher, which is a breaking change for development and CI environments. Additionally, jumping from version 9 to 13 involves numerous breaking changes—including the transition to attributes for test metadata, mandatory void return types for lifecycle methods, and a new configuration schema—that are incompatible with the existing test suite and phpunit.xml.

To address this:

1. Update the phpunit.xml configuration file to the latest schema by running vendor/bin/phpunit --migrate-configuration.
2. Convert PHPUnit DocBlock annotations (such as @test, @dataProvider, and @depends) into their equivalent PHP 8 Attributes.
3. Ensure CI environments are updated to PHP 8.4.1+.