Update dependency phpunit/phpunit to v12 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
phpunit/phpunit (source)	^9.5.10 → ^12.0.0

GitHub Vulnerability Alerts

GHSA-qrr6-mg7r-m243

Impact

PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives.

An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process.

Sources of INI values that participate in the attack:

• <ini name="…" value="…"/> entries in phpunit.xml / phpunit.xml.dist
• INI settings inherited from the host PHP runtime via ini_get_all()

Threat Model

Exploitation requires the attacker to control the content of an INI value read by PHPUnit. In practice this means write access to the project's phpunit.xml, the host php.ini, or the PHP binary's environment. The most realistic exposure is Poisoned Pipeline Execution (PPE): a pull request from an untrusted contributor that modifies phpunit.xml to include a newline-containing INI value, executed by a CI system that runs PHPUnit against the PR without isolation. A malicious newline is not visibly distinguishable from a legitimate value in a typical diff review.

Affected component

PHPUnit\Util\PHP\JobRunner::settingsToParameters().

Patches

The fix has two parts:

1. Reject line-break characters

Because a newline or carriage return in an INI value has no legitimate use and is the primitive that enables directive injection, any PHP setting value containing \n or \r is now rejected with an explicit PhpProcessException. This follows the same "visibility over silence" principle applied in CVE-2026-24765: the anomalous state fails loudly in CI output rather than being silently sanitized, giving operators an opportunity to investigate whether it reflects tampering, environment contamination, or an unexpected upstream change.

2. Quote remaining metacharacters

Values containing " or ;, both of which have legitimate uses (e.g., regex-valued INI settings such as ddtrace's datadog.appsec.obfuscation_parameter_value_regexp), are wrapped in double quotes with inner " escaped as \", so PHP's INI parser reads them as literal string contents rather than comment/delimiter tokens. Plain values are forwarded unchanged so that boolean keywords (On/Off) and bitwise expressions (E_ALL & ~E_NOTICE) retain their INI semantics.

Workarounds

If upgrading is not immediately possible:

• Audit INI values: Ensure no <ini value="…"> entry in phpunit.xml / phpunit.xml.dist contains newline, ", or ; characters, and that nothing writes such values into configuration at build time.
• Isolate CI execution of untrusted code: Run PHPUnit against pull requests only in ephemeral, containerized runners that discard filesystem state between jobs; require human review before executing PRs from forks; enforce branch protection on workflows that handle secrets (pull_request_target and similar). These mitigations apply to the broader PPE risk class and are effective against this vulnerability as well.
• Restrict who can modify phpunit.xml: Treat phpunit.xml as security-sensitive in code review, particularly <ini> entries.
• Sanitize host INI: Ensure the host PHP's php.ini does not contain values with embedded newlines or unescaped metacharacters.

References

• Fix: https://github.com/sebastianbergmann/phpunit/pull/6592
• Related advisory (same threat class, Poisoned Pipeline Execution): GHSA-vvj3-c3rp-c85p / CVE-2026-24765
• OWASP CI/CD Top 10: CICD-SEC-04 Poisoned Pipeline Execution
• CWE-88: https://cwe.mitre.org/data/definitions/88.html
• CWE-93: https://cwe.mitre.org/data/definitions/93.html

Severity

• CVSS Score: 7.8 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

---

Release Notes

sebastianbergmann/phpunit (phpunit/phpunit)

v12.5.22

Compare Source

v12.5.21

Compare Source

v12.5.20

Compare Source

v12.5.19: PHPUnit 12.5.19

Compare Source

Fixed

• Regression in XML configuration migration introduced in PHPUnit 12.5.8

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.18: PHPUnit 12.5.18

Compare Source

Fixed

• #​4571: No warning when --random-order-seed is used when test execution order is not random
• #​4975: --filter does not work when filter string starts with #
• #​5354: JUnit XML logger does not handle TestSuiteSkipped event
• #​6276: Exit with non-zero exit code when explicit test selection (--filter, --group, --testsuite) yields no tests
• #​6583: Failing output expectation skips tearDown() and handler restoration, causing subsequent tests to be marked as risky

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.17: PHPUnit 12.5.17

Compare Source

Changed

• #​4793: Exit with non-zero exit code when exit was called from some test

Fixed

• #​5881: colors="true" in XML configuration file does not unconditionally enable colored output
• #​6019: --migrate-configuration does not update schema location when XML content already validates against current schema
• #​6372: Assertion failure inside willReturnCallback() is silently swallowed when code under test catches exceptions
• #​6464: Process isolation template unconditionally calls set_include_path()
• #​6571: Static analysis errors for TestDoubleBuilder method chaining

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.16: PHPUnit 12.5.16

Compare Source

Added

• #​6547: Support for %r...%r in EXPECTF section

Fixed

• #​6025: FILE_EXTERNAL breaks __DIR__
• #​6351: No warning when the same test runner extension is configured more than once
• #​6433: Logic in TestSuiteLoader is brittle and causes "Class FooTest not found" even for valid tests in valid filenames
• #​6463: Process Isolation fails on non-serializable globals and quietly ignore closures

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.15: PHPUnit 12.5.15

Compare Source

Changed

• #​4440: Improve error when configured code coverage file list is empty
• #​6549: Allow to stub both hooks of non-virtual properties

Fixed

• #​6529: Git "detached HEAD state" in Open Test Reporting (OTR) XML logger not handled properly
• #​6545: Stubbing a class with set property hook leaves property uninitialized by default
• The RegularExpression and StringMatchesFormatDescription did not handle preg_match() errors such as Compilation failed: regular expression is too large

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.14: PHPUnit 12.5.14

Compare Source

Fixed

• #​6521: Performance regression in PHPUnit 11.5.54, PHPUnit 12.5.13, and PHPUnit 13.0.4

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.13: PHPUnit 12.5.13

Compare Source

Fixed

• #​6489: Classification of self/direct/indirect deprecation triggers is not aligned with Symfony's bridge for PHPUnit

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.12: PHPUnit 12.5.12

Compare Source

Fixed

• #​6511: TestDox variables out of order with named arguments
• #​6514: <ini /> can silently fail

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.11: PHPUnit 12.5.11

Compare Source

Deprecated

• #​6510: Deprecate using with*() on test stubs

Fixed

• #​6503: Temporary file used by SourceMapper may be deleted prematurely when multiple PHPUnit processes run in parallel
• #​6509: "No expectations were configured for the mock object ..." notice is emitted when with() is used without expects()

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.10: PHPUnit 12.5.10

Compare Source

Fixed

• #​6495: Source map for issue trigger identification is regenerated in process isolation child processes

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.9: PHPUnit 12.5.9

Compare Source

Added

• #​6488: Allow disabling issue trigger identification for improved performance

Fixed

• #​6486: Incorrect file name reported for errors for test methods declared in traits
• #​6490: Incorrect test count when tests are skipped in before-class method

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.8: PHPUnit 12.5.8

Compare Source

Changed

• To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.7: PHPUnit 12.5.7

Compare Source

Fixed

• #​6362: Manually instantiated test doubles are broken since PHPUnit 11.2
• #​6470: Infinite recursion in Count::getCountOf() for unusal implementations of Iterator or IteratorAggregate

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.6: PHPUnit 12.5.6

Compare Source

Changed

• Reverted a change that caused a build failure for the PHP project's nightly community job

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.5: PHPUnit 12.5.5

Compare Source

Deprecated

• #​6461: any() matcher (soft deprecation)

Fixed

• #​6470: Mocking a class with a property hook setter accepting more types than the property results in a fatal error

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.4: PHPUnit 12.5.4

Compare Source

Changed

• The #[AllowMockObjectsWithoutExpectations] attribute can now be used on the method level

Fixed

• #​6446: Test runner crashes with Timer::start() has to be called before Timer::stop()

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.3: PHPUnit 12.5.3

Compare Source

Changed

• The message emitted when a test method creates a mock object but does not configure any expectations for it has been improved

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.2: PHPUnit 12.5.2

Compare Source

Added

• Attribute #[AllowMockObjectsWithoutExpectations] for excluding tests from the check that emits the notice for test methods that create a mock object but do not configure an expectation for it

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.1: PHPUnit 12.5.1

Compare Source

Added

• TestCase::getStubBuilder() (analogous to TestCase::getMockBuilder()) for creating (partial) test stubs using a fluent API

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.5.0: PHPUnit 12.5.0

Compare Source

Added

• #​6376: --all CLI option to ignore test selection configured in XML configuration file
• #​6422: Make <source> element in XML code coverage report optional

Changed

• #​6380: Allow Throwable in expectExceptionObject()
• A PHPUnit notice is now emitted for test methods that create a mock object but do not configure an expectation for it

---

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.4.5: PHPUnit 12.4.5

Compare Source

Changed

• Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

Fixed

• #​6426: Fix migration of configuration without schema location

---

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.4.4: PHPUnit 12.4.4

Compare Source

Fixed

• #​6408: Exception in a data provider method leads to internal PHPUnit error
• #​6410: Test runner's shutdown handler is called in system-under-test's child process

---

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.4.3: PHPUnit 12.4.3

Compare Source

Fixed

• #​6402: Avoid reading from STDOUT when rewind() fails

---

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.4.2: PHPUnit 12.4.2

Compare Source

Changed

• Skipped tests alone no longer lead to a yellow background for the test result summary

Fixed

• #​6391: Errors during backup of global variables and static properties are not reported

---

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.4.1: PHPUnit 12.4.1

Compare Source

Fixed

• #​6364: --filter format used by PhpStorm stopped working
• #​6378: Wrong method name passed to DataProviderMethodCalled event value object

---

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.4.0: PHPUnit 12.4.0

Compare Source

Added

• #​6277: Allow tests to opt out of the validation that a data provider method does not provide data sets with more values than a test method accepts
• #​6341: Support for regular expressions with #[IgnoreDeprecations] attribute
• #​6354: Invokable constraints

Deprecated

• #​6284: #[RunClassInSeparateProcess] attribute
• #​6355: Support for version constraint string argument without explicit version comparison operator

---

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.15: PHPUnit 12.3.15

Compare Source

Fixed

• #​6368: failOnPhpunitWarning="false" has no effect

---

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.14: PHPUnit 12.3.14

Compare Source

• No changes; phpunit.phar rebuilt with updated dependencies

---

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.13: PHPUnit 12.3.13

Compare Source

• No changes; phpunit.phar rebuilt with updated dependencies

---

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.12: PHPUnit 12.3.12

Compare Source

• No changes; phpunit.phar rebuilt with updated dependencies

---

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.11: PHPUnit 12.3.11

Compare Source

Changed

• #​6366: Exclude __sleep() and __wakeup() from test double code generation on PHP >= 8.5

---

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.10: PHPUnit 12.3.10

Compare Source

Changed

• #​6353: Disable performance optimization for tests requiring Xdebug
• #​6357: Also collect E_DEPRECATED issues when building the test suite

---

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.9: PHPUnit 12.3.9

Compare Source

Changed

• Do not use __sleep() method (which will be deprecated in PHP 8.5)

---

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.8: PHPUnit 12.3.8

Compare Source

Fixed

• #​6340: Implicitly enabled display of deprecation details is not disabled when it should be

---

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.7: PHPUnit 12.3.7

Compare Source

Changed

• #[IgnorePhpunitDeprecations] is now considered for test runner deprecations (where applicable)

---

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.6

Compare Source

v12.3.5: PHPUnit 12.3.5

Compare Source

Changed

• #​6319: Detect premature end of PHPUnit's main PHP process
• #​6321: Allow error_reporting=E_ALL for --check-php-configuration

Fixed

• #​5863: TestDox printer does not show previous exception
• #​6102: expectUserDeprecationMessage*() fails when test is run in separate process

---

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.4: PHPUnit 12.3.4

Compare Source

Changed

• #​6308: Improve output of --check-php-configuration
• The version number for the test result cache file has been incremented to reflect that its structure for PHPUnit 12.3 is not compatible with its structure for PHPUnit 8.5 and PHPUnit 9.6

Fixed

• #​6197: ini_set('error_log') sets filepath outside open_basedir
• #​6279: Deprecation triggered in data provider method affects all test methods using that data provider method
• #​6281: Exceptions raised in after-test method are not reported for skipped tests

---

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.3: PHPUnit 12.3.3

Compare Source

Fixed

• #​6304: PHPUnit 11.5.29 hangs when a test runner deprecation is triggered and process isolation is used (this reverts "#[IgnorePhpunitDeprecations] is now considered for test runner deprecations" from PHPUnit 12.3.1)

---

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.2: PHPUnit 12.3.2

Compare Source

Changed

• #​6300: Emit warning when the name of a data provider method begins with test
• Do not use SplObjectStorage methods that will be deprecated in PHP 8.5

---

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.1: PHPUnit 12.3.1

Compare Source

Added

• #​6297: --check-php-configuration CLI option for checking whether PHP is configured for testing

Changed

• #[IgnorePhpunitDeprecations] is now considered for test runner deprecations (where applicable)

Fixed

• #​6160: Baseline file in a subdirectory contains absolute paths
• #​6294: Silent failure of PHP fatal errors
• Errors due to invalid data provided using #[TestWith] or #[TestWithJson] attributes are now properly reported
• The DataProviderMethodFinished event is now also emitted when the provided data set has an invalid key

---

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v12.3.0: PHPUnit 12.3.0

Compare Source

Added

• #​3795: Bootstrap scripts specific to test suites
• #​6268: #[IgnorePHPUnitWarnings] attribute for ignoring PHPUnit warnings
• #[TestDoxFormatter] and #[TestDoxFormatterExternal] attributes for configuring a custom TestDox formatter for tests that use data from data providers
• TestRunner\ChildProcessErrored event
• Configuration::includeTestSuites() and Configuration::excludeTestSuites()

Changed

• #​6237: Do not run tests when code coverage analysis is requested but code coverage data cannot be collected
• #​6272: Use @<data-set-name> format (compatible with --filter CLI option) in defect messages
• #​6273: Warn when #[DataProvider*] attributes are mixed with #[TestWith*] attributes

Deprecated

• #​6229: Configuration::includeTestSuite(), use Configuration::includeTestSuites() instead
• #​6229: Configuration::excludeTestSuite(), use Configuration::excludeTestSuites() instead
• #​6246: Using #[CoversNothing] on a test method

---

How to install or update PHPUnit

v12.2.9: PHPUnit 12.2.9

Compare Source

Fixed

• #​6097: The file attribute of <testClass> node of XML test list can be wrong

---

How to install or update PHPUnit

v12.2.8: PHPUnit 12.2.8

Compare Source

Fixed

• #​6274: Infinite recursion when code coverage report in OpenClover XML format is configured in XML configuration file

---

How to install or update PHPUnit

v12.2.7: PHPUnit 12.2.7

Compare Source

Fixed

• #​6254: defects,randomconfiguration is supported by implementation, but it is not allowed by the XML configuration file schema
• #​6259: Order of tests which use data from data providers is not affected by test sorting
• #​6266: Superfluous whitespace in TestDox output when test method name has a number after the test prefix

---

How to install or update PHPUnit

v12.2.6: PHPUnit 12.2.6

Compare Source

Fixed

• #​6104: Test with dependencies and data provider fails
• #​6163: @no-named-arguments leads to static analysis errors for variadic arguments

---

How to install or update PHPUnit

v12.2.5: PHPUnit 12.2.5

Compare Source

Fixed

• #​6249: No meaningful error when <testsuite> element is missing required name attribute

---

How to install or update PHPUnit

v12.2.4: PHPUnit 12.2.4

Compare Source

Changed

• Including information about the Git repository (such as the commit hash and branch name) in the Open Test Reporting XML format is now an opt-in feature that can be enabled via the --include-git-information CLI option or the includeGitInformation attribute in the XML configuration file

---

How to install or update PHPUnit

v12.2.3: PHPUnit 12.2.3

Compare Source

Added

• #​6236: failOnPhpunitWarning attribute on the <phpunit> element of the XML configuration file and --fail-on-phpunit-warning CLI option for controlling whether PHPUnit should fail on PHPUnit warnings (default: true)
• #​6239: --do-not-fail-on-deprecation, --do-not-fail-on-phpunit-warning, --do-not-fail-on-phpunit-deprecation, --do-not-fail-on-empty-test-suite, --do-not-fail-on-incomplete, --do-not-fail-on-notice, --do-not-fail-on-risky, --do-not-fail-on-skipped, and --do-not-fail-on-warning CLI options
• --do-not-report-useless-tests CLI option as a replacement for --dont-report-useless-tests

Deprecated

• --dont-report-useless-tests CLI option (use --do-not-report-useless-tests instead)

Fixed

• #​6243: Constraints cannot be implemented without using internal class ExpectationFailedException

---

How to install or update PHPUnit

v12.2.2: PHPUnit 12.2.2

Compare Source

Fixed

• #​6222: Data Provider seems to mess up Test Dependencies
• shortenArraysForExportThreshold XML configuration setting has no effect on all arrays exported for event-related value objects

---

How to install or update PHPUnit

v12.2.1: PHPUnit 12.2.1

Compare Source

Fixed

• #​6228: Variadic test methods should not warn about too many arguments from data provider

---

How to install or update PHPUnit

v12.2.0: PHPUnit 12.2.0

Compare Source

Added

Experimental Support for Open Test Reporting XML

PHPUnit has supported reporting test results in the JUnit XML format for a long time. Unfortunately, there has never been a standard schema for the JUnit XML format. Common consumers of Clover XML log files interpret these files differently, which has led to frequent problems.

To address this, the JUnit team started the Open Test Reporting project, creating and maintaining language-agnostic XML and HTML test reporting formats. Unlike JUnit XML, Open Test Reporting's XML formats are extensible.

Logging in the Open Test Reporting XML format is controlled by the new --log-otr CLI option and the new <otr> XML configuration element.

This feature is experimental and the generated XML may change in order to enhance compliance with the Open Test Reporting project's XML schema definitions. The same applies to the XML schema definitions for information that is specific for PHP and PHPUnit. Please note that such changes may occur in bugfix or minor releases and could potentially break backwards compatibility.

Experimental Support for OpenClover XML

PHPUnit has supported reporting code coverage information in the Clover XML format for a long time. Unfortunately, there has never been a standard schema for the Clover XML format. Common consumers of Clover XML log files interpret these files differently, which leads to frequent problems.

The original commercial Clover project has been superseded by the Open Source OpenClover project, which provides an XML schema for its OpenClover XML format. Rather than modifying the existing Clover XML reporter to comply with the OpenClover XML schema, thereby breaking backward compatibility, a new OpenClover XML reporter has been introduced.

This new reporter is controlled by the new CLI option, `-

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.