chore(deps): update dependency phpunit/phpunit to v13.1.7 [security] (#450)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [phpunit/phpunit](https://phpunit.de/)
([source](https://redirect.github.com/sebastianbergmann/phpunit)) |
`13.1.5` → `13.1.6` |
![age](https://developer.mend.io/api/mc/badges/age/packagist/phpunit%2fphpunit/13.1.6?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/packagist/phpunit%2fphpunit/13.1.5/13.1.6?slim=true)
|

### GitHub Vulnerability Alerts

####
[GHSA-qrr6-mg7r-m243](https://redirect.github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r-m243)

## Impact

PHPUnit forwards PHP INI settings to child processes (used for
isolated/PHPT test execution) as `-d name=value` command-line arguments
without neutralizing INI metacharacters. Because PHP's INI parser
interprets `"` as a string delimiter, `;` as the start of a comment, and
most importantly a newline as a directive separator, a value containing
a newline is parsed by the child process as multiple INI directives.

An attacker able to influence a single INI value can therefore inject
arbitrary additional directives into the child's configuration,
including `auto_prepend_file`, `extension`, `disable_functions`,
`open_basedir`, and others. Setting `auto_prepend_file` to an
attacker-controlled path yields remote code execution in the child
process.

Sources of INI values that participate in the attack:

- `<ini name="…" value="…"/>` entries in `phpunit.xml` /
`phpunit.xml.dist`
- INI settings inherited from the host PHP runtime via `ini_get_all()`

### Threat Model

Exploitation requires the attacker to control the content of an INI
value read by PHPUnit. In practice this means write access to the
project's `phpunit.xml`, the host `php.ini`, or the PHP binary's
environment. The most realistic exposure is [Poisoned Pipeline
Execution](https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution)
(PPE): a pull request from an untrusted contributor that modifies
`phpunit.xml` to include a newline-containing INI value, executed by a
CI system that runs PHPUnit against the PR without isolation. A
malicious newline is not visibly distinguishable from a legitimate value
in a typical diff review.

### Affected component

`PHPUnit\Util\PHP\JobRunner::settingsToParameters()`.

## Patches

The fix has two parts:

**1. Reject line-break characters**

Because a newline or carriage return in an INI value has no legitimate
use and is the primitive that enables directive injection, any PHP
setting value containing `\n` or `\r` is now rejected with an explicit
`PhpProcessException`. This follows the same "visibility over silence"
principle applied in
[CVE-2026-24765](https://redirect.github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p):
the anomalous state fails loudly in CI output rather than being silently
sanitized, giving operators an opportunity to investigate whether it
reflects tampering, environment contamination, or an unexpected upstream
change.

**2. Quote remaining metacharacters**

Values containing `"` or `;`, both of which have legitimate uses (e.g.,
regex-valued INI settings such as `ddtrace`'s
`datadog.appsec.obfuscation_parameter_value_regexp`), are wrapped in
double quotes with inner `"` escaped as `\"`, so PHP's INI parser reads
them as literal string contents rather than comment/delimiter tokens.
Plain values are forwarded unchanged so that boolean keywords
(`On`/`Off`) and bitwise expressions (`E_ALL & ~E_NOTICE`) retain their
INI semantics.

## Workarounds

If upgrading is not immediately possible:

- Audit INI values: Ensure no `<ini value="…">` entry in `phpunit.xml` /
`phpunit.xml.dist` contains newline, `"`, or `;` characters, and that
nothing writes such values into configuration at build time.
- Isolate CI execution of untrusted code: Run PHPUnit against pull
requests only in ephemeral, containerized runners that discard
filesystem state between jobs; require human review before executing PRs
from forks; enforce branch protection on workflows that handle secrets
(`pull_request_target` and similar). These mitigations apply to the
broader PPE risk class and are effective against this vulnerability as
well.
- Restrict who can modify `phpunit.xml`: Treat `phpunit.xml` as
security-sensitive in code review, particularly `<ini>` entries.
- Sanitize host INI: Ensure the host PHP's `php.ini` does not contain
values with embedded newlines or unescaped metacharacters.

## References

- Fix:
[https://github.com/sebastianbergmann/phpunit/pull/6592](https://redirect.github.com/sebastianbergmann/phpunit/pull/6592)
- Related advisory (same threat class, Poisoned Pipeline Execution):
[GHSA-vvj3-c3rp-c85p /
CVE-2026-24765](https://redirect.github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p)
- OWASP CI/CD Top 10: [CICD-SEC-04 Poisoned Pipeline
Execution](https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution)
- CWE-88: https://cwe.mitre.org/data/definitions/88.html
- CWE-93: https://cwe.mitre.org/data/definitions/93.html

##### Severity
- CVSS Score: 7.8 / 10 (High)
- Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

---

### Release Notes

<details>
<summary>sebastianbergmann/phpunit (phpunit/phpunit)</summary>

###
[`v13.1.6`](https://redirect.github.com/sebastianbergmann/phpunit/compare/13.1.5...13.1.6)

[Compare
Source](https://redirect.github.com/sebastianbergmann/phpunit/compare/13.1.5...13.1.6)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - ""
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Lendable/composer-license-checker).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45Mi4xIiwidXBkYXRlZEluVmVyIjoiNDMuMTIzLjgiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbInJlbm92YXRlIl19-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Marcin Michalski <marcin.michalski@lendable.co.uk>

Author: renovate[bot]

composer.json

@@ -19,12 +19,12 @@
         "ergebnis/composer-normalize": "^2.50.0",
         "lendable/phpunit-extensions": "^0.5",
         "php-cs-fixer/shim": "^3.94.2",
-        "phpstan/phpstan": "^2.1.46",
+        "phpstan/phpstan": "^2.1.50",
         "phpstan/phpstan-deprecation-rules": "^2.0.4",
         "phpstan/phpstan-phpunit": "^2.0.16",
         "phpstan/phpstan-strict-rules": "^2.0.10",
-        "phpunit/phpunit": "^13.1.5",
-        "rector/rector": "^2.4.1",
+        "phpunit/phpunit": "^13.1.7",
+        "rector/rector": "^2.4.2",
         "symfony/filesystem": "^6.2"
     },
     "autoload": {

composer.lock

@@ -5,20 +5,14 @@
 use Rector\Caching\ValueObject\Storage\FileCacheStorage;
 use Rector\CodeQuality\Rector\Identical\FlipTypeControlToUseExclusiveTypeRector;
 use Rector\Config\RectorConfig;
-use Rector\PHPUnit\Set\PHPUnitSetList;
 
 return RectorConfig::configure()
     ->withPaths([__DIR__.'/src', __DIR__.'/tests', __DIR__.'/bin', __DIR__.'/rector.php'])
     ->withPHPStanConfigs([__DIR__.'/phpstan-rector.neon'])
     ->withCache(__DIR__.'/tmp/rector', FileCacheStorage::class)
     ->withPreparedSets(codeQuality: true)
-    ->withComposerBased(symfony: true)
+    ->withComposerBased(phpunit: true, symfony: true)
     ->withPhpSets(php84: true)
-    ->withSets(
-        [
-            PHPUnitSetList::PHPUNIT_120,
-        ],
-    )
     ->withSkip(
         [
             FlipTypeControlToUseExclusiveTypeRector::class,