composer (3.x)(deps-dev): bump the development-dependencies group with 4 updates

[dependabot]

Updates the requirements on phpunit/phpunit, rector/rector, shipmonk/composer-dependency-analyser and symplify/phpstan-rules to permit the latest version.
Updates phpunit/phpunit to 12.4.5

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 12.4.5

Changed

• Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

Fixed

• #6426: Fix migration of configuration without schema location

---

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

Changelog

Sourced from phpunit/phpunit's changelog.

[12.4.5] - 2025-12-01

Changed

• Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

Fixed

• #6426: Fix migration of configuration without schema location

[12.4.4] - 2025-11-21

Fixed

• #6408: Exception in a data provider method leads to internal PHPUnit error
• #6410: Test runner's shutdown handler is called in system-under-test's child process

[12.4.3] - 2025-11-13

Fixed

• #6402: Avoid reading from STDOUT when rewind() fails

[12.4.2] - 2025-10-30

Changed

• Skipped tests alone no longer lead to a yellow background for the test result summary

Fixed

• #6391: Errors during backup of global variables and static properties are not reported

[12.4.1] - 2025-10-09

Fixed

• #6364: --filter format used by PhpStorm stopped working
• #6378: Wrong method name passed to DataProviderMethodCalled event value object

[12.4.0] - 2025-10-03

Added

• #6277: Allow tests to opt out of the validation that a data provider method does not provide data sets with more values than a test method accepts
• #6341: Support for regular expressions with #[IgnoreDeprecations] attribute
• #6354: Invokable constraints

Deprecated

... (truncated)

Commits

• 5af3178 Prepare release
• 6c99d40 Merge branch '11.5' into 12.4
• faf5fff Prepare release
• 8957454 Merge branch '10.5' into 11.5
• c47fe00 Prepare release
• 6ffc27f Merge branch '9.6' into 10.5
• b69489b Prepare release
• 2d34a01 Work around nikic/PHP-Parser#1133
• 96f8f10 Merge branch '8.5' into 9.6
• 2605ccb Prepare release
• Additional commits viewable in compare view

Updates rector/rector to 2.2.10

Release notes

Sourced from rector/rector's releases.

Released Rector 2.2.10

New Features and Improvements 🥳

• Support Attribute in SortNamedParamRector (#7684), Thanks @​VincentLanglet!

Bugfixes 🐛

• [PhpParser] Add Stmt\Block to NodeGroup::STMTS_AWARE (#7689)
• skip already dim fetch variable on OrdSingleByteRector (#7681)
• [Php85] Handle crash on no arg on OrdSingleByteRector (#7682)
• [Php70] Handle return ternary on IfIssetToCoalescingRector (#7683)
• [CodingStyle] Skip use trait on NewlineBetweenClassLikeStmtsRector (#7685)
• [CodingStyle] Handle use trait after property on NewlineBetweenClassLikeStmtsRector (#7687)
• [CodeQuality] Skip with HTML on ShortenElseIfRector (#7686)
• [Variables] Fetch list super global variable names from PHPStan Scope::SUPERGLOBAL_VARIABLES constant (#7663)
• Fix typo in rule definition message (#7690), Thanks @​simonschaufi!

rectorphp/rector-symfony 🎵

• [code-quality] Skip enum in ControllerMethodInjectionToConstructorRector (#893)
• [symfony 7.3] Add CommandDefaultNameAndDescriptionToAsCommandAttributeRector (#892)
• [symfony 7.x] update sets (#890)
• [CodeQuality] Skip parent method exists on ControllerMethodInjectionToConstructorRector (#889)
• skip params with attributes in ControllerMethodInjectionToConstructorRector (#887)
• [stmts-aware] Use NodeGroup::STMTS_AWARE over StmtsAwareInterface (#886)

rectorphp/rector-phpunit 🟢

• [fix] Improve AssertComparisonToSpecificMethodRector for assert false (#594)

Commits

• 2abbf73 Rector 2.2.10
• 8f056da Updated Rector to commit 6ef19d6b1b9ac99efbc6cb07cb9313ec16e6cc30
• a5d0027 Updated Rector to commit f26495b785120b264e9f4477c647fb3abd8e0d47
• 00b9fe2 Updated Rector to commit 1d141d573432ebc152383bf884f488dc62619f0c
• 8d6ed67 Updated Rector to commit d8e4eeeac636ef79c3a57b5b3f44e3c6f8bf96ba
• fe25f5b Updated Rector to commit c1da4ecdec3bf17ff896b99540388ee564c03eb7
• 7ae74db Updated Rector to commit 89b8e0734e581148261d3b206ea07002017871fb
• ce5a710 Updated Rector to commit 1d519488c8e76f1316bf6aaf02621b2de959c638
• f1f98be Updated Rector to commit 51a334c02c1bfb07c910b345c609bf420b97eb62
• f20290e Updated Rector to commit 51a334c02c1bfb07c910b345c609bf420b97eb62
• Additional commits viewable in compare view

Updates shipmonk/composer-dependency-analyser to 1.8.4

Release notes

Sourced from shipmonk/composer-dependency-analyser's releases.

1.8.4

Fixes:

• Fix edgecase of classlike definitions being detected as function usages (#240)
• Fix detection of unqualified static access in global scope (#243)

Commits

• 975e587 Detect unqualified static access in global scope (#243)
• 735ee14 Fix classlike definitions being detected as function usages (#240)
• 7ad1bec CI: run also PHP 8.5 (#239)
• ff95a1d Adjust E2E tests (#242)
• 65307b9 E2E: no self composer install (#244)
• debd7cb Drop dependabot, update deps (#223)
• a62ecf4 readme: add ignoreErrorsOnExtension example (#234)
• c434180 Adjust E2E tests (#235)
• a4a259c tests: skip testPharSupport instead of hard failure (#225)
• See full diff in compare view

Updates symplify/phpstan-rules to 14.9.1

Commits

• 2e90239 release PHP 7.4 downgraded
• b98bb10 narrow return object type
• d5ef3f8 [rector] add NoOnlyNullReturnInRefactorRule (#247)
• 0abcb28 [config] Add FileNameMatchesExtensionRule (#246)
• d64ecd2 [rector] add PreferDirectIsNameRule (#245)
• ea0d808 [rector] add rule to encourage node passing over assignig in rector rules (#244)
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
composer/phpunit/phpunit	>= 12.4.5, < 13.0.0	🟢 5.2	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Token-Permissions ⚠️ -1 No tokens found Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow ⚠️ -1 no workflows found CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Binary-Artifacts 🟢 10 no binaries found in the repo SAST ⚠️ 0 no SAST tool detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies ⚠️ -1 no dependencies found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches
composer/rector/rector	>= 2.2.10, < 3.0.0	🟢 4.8	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow ⚠️ -1 no workflows found Token-Permissions ⚠️ -1 No tokens found CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected SAST ⚠️ 0 no SAST tool detected Fuzzing ⚠️ 0 project is not fuzzed Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies ⚠️ -1 no dependencies found Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Vulnerabilities 🟢 10 0 existing vulnerabilities detected
composer/shipmonk/composer-dependency-analyser	>= 1.8.4, < 2.0.0	Unknown	Unknown
composer/symplify/phpstan-rules	>= 14.9.1, < 15.0.0	Unknown	Unknown

Scanned Files

• composer.json

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (3f72b2a) to head (77b41a2).
⚠️ Report is 4 commits behind head on 3.x.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff             @@
##                 3.x      #292   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity        23        23           
===========================================
  Files              4         4           
  Lines             81        81           
===========================================
  Hits              81        81           

Flag	Coverage Δ
php-8.3	100.00% <ø> (ø)
phpunit	100.00% <ø> (ø)
ubuntu-latest	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.