composer (master)(deps-dev): bump the development-dependencies group with 8 updates by dependabot[bot] · Pull Request #924 · mimmi20/template

dependabot · 2026-07-24T02:03:57Z

Updates the requirements on infection/infection, mimmi20/coding-standard, nikic/php-parser, phpstan/phpstan, phpstan/phpstan-phpunit, phpunit/phpunit, rector/rector and tomasvotruba/unused-public to permit the latest version.
Updates infection/infection to 0.34.0

Release notes

Sourced from infection/infection's releases.

0.34.0

Added:

Support positional arguments to mimic --filter and --test-framewor-extra-args options by @maks-rafalko in infection/infection#3284

Allow skipping run command with positional args by @maks-rafalko in infection/infection#3285

Changed:

Deprecate --filter options in favor of new positional arguments for filtering source by @maks-rafalko in infection/infection#3308

Support sebastian/diff: 9 by @sidz in infection/infection#3298

feat: Add our own local unified diff output builder by @theofidry in infection/infection#3300

Add support for positional arguments for config:list-sources command by @maks-rafalko in infection/infection#3307

Full Changelog: infection/infection@0.33.3...0.34.0

Commits

373c2ab Allow skipping run command with positional args (#3285)
d8b56fc Add support for positional arguments for config:list-sources command (#3307)
2960c35 Deprecate --filter options in favor of new positional arguments for filteri...
0efff96 Support positional arguments to mimic --filter and `--test-framewor-extra-a...
cd433d3 refactor(autoreview): Refine autoreview I/O detection for source classes (#3286)
371d88d refactor(autoreview): Move the PHPUnit related code from IoCodeDetector to th...
a6fd990 refactor(autoreview): Minor variable and method renames (#3305)
f75942d feat: Add our own local unified diff output builder (#3300)
9031987 docs: Improve the description of the Differ service (#3304)
af20b6b Support sebastian/diff: 9 (#3298)
Additional commits viewable in compare view

Updates mimmi20/coding-standard to 8.0.12

Commits

a23a0e7 Merge pull request #1049 from mimmi20/dependabot/composer/friendsofphp/php-cs...
5daf107 composer (master)(deps): update friendsofphp/php-cs-fixer requirement
00ed247 Merge pull request #1048 from mimmi20/dependabot/composer/development-depende...
e68896f composer (master)(deps-dev): update rector/rector requirement
6d1ced4 Merge pull request #1047 from mimmi20/dependabot/composer/development-depende...
7091540 composer (master)(deps-dev): bump the development-dependencies group with 3 u...
6de7894 Merge pull request #1046 from mimmi20/dependabot/composer/development-depende...
9ee6e21 composer (master)(deps-dev): update phpstan/phpstan requirement
fc29f17 Merge pull request #1045 from mimmi20/dependabot/composer/slevomat/coding-sta...
3848456 composer (master)(deps): update slevomat/coding-standard requirement
Additional commits viewable in compare view

Updates nikic/php-parser to 5.8.0

Release notes

Sourced from nikic/php-parser's releases.

PHP-Parser 5.8.0

Fixed

Treat _ as label character in formatting-preserving pretty printer.

Handle comment after object operator in keyword emulator.

Changed

Drop support for pipe operator in constant expression evaluator. It is not supported in constant expressions and may pose security risks, as it allows calls to arbitrary functions.

void parameter types now generate a (recoverable) error during parsing.

Restored reverse emulation support for fn keywords when targeting PHP before 7.4.

Changelog

Sourced from nikic/php-parser's changelog.

Version 5.8.0 (2026-06-04)

Fixed

Treat _ as label character in formatting-preserving pretty printer.

Handle comment after object operator in keyword emulator.

Changed

Drop support for pipe operator in constant expression evaluator. It is not supported in constant expressions and may pose security risks, as it allows calls to arbitrary functions.

void parameter types now generate a (recoverable) error during parsing.

Restored reverse emulation support for fn keywords when targeting PHP before 7.4.

Version 5.7.0 (2025-12-06)

Fixed

Fixed changing modifier on anonymous class with formatting preserving pretty printer.

Emit an error for unparenthesized arrow functions in pipe operator, and print necessary parentheses in the pretty printer.

Fix PHP 8.5 deprecation warning in php-parse binary.

Changed

When targeting PHP 8.4 or newer, omit parentheses around immediately dereferenced new expressions.

Added

Added shouldPrintRawValue attribute to Scalar\Int_, which makes the pretty printer use the rawValue of the node. This can be used to print integers with separators.

Version 5.6.2 (2025-10-21)

Fixed

Fixed formatting-preserving pretty-printing when changing the visibility modifier on a node that has attributes.

Fixed chr() deprecation warning on PHP 8.5.

Added

Added Param::isFinal() method.

Version 5.6.1 (2025-08-13)

... (truncated)

Commits

044a6a3 Release PHP-Parser 5.8.0
ca145ac Try to fix tests on older versions
c81a0af Test PHP 8.6 in CI
b82d4c2 Handle comment after object operator
49429ef Integration test against PHP 8.5
9c3fe25 Drop support for pipe operator in constant expression evaluator
2e66ec3 Fix PHPStan build on latest release (#1148)
b560dba Add missing label characters in PrettyPrinterAbstract::$labelCharMap (#1150)
50f0d9c Restore FnTokenEmulator (#1141)
0512478 Prevent void param type (#1142)
Additional commits viewable in compare view

Updates phpstan/phpstan to 2.2.5

Commits

See full diff in compare view

Updates phpstan/phpstan-phpunit to 2.0.18

Release notes

Sourced from phpstan/phpstan-phpunit's releases.

2.0.18

f5dc20f - Fix #[RequiresPhpunit] version requirement being evaluated against PHP version (#313)

1e573d3 - AttributeVersionRequirementHelper: add defaults to bool parameters (#312)

Commits

f5dc20f Fix #[RequiresPhpunit] version requirement being evaluated against PHP vers...
1e573d3 AttributeVersionRequirementHelper: add defaults to bool parameters (#312)
c2f9775 Update actions/cache action to v6 (#311)
933f682 Update actions/cache action to v5.1.0 (#310)
8ec191f Check #[RequiresPhpunit] in the same way we check #[RequiresPhp] (#308)
d138088 Implement ClassAttributeRequiresPhpVersionRule (#305)
caada62 Update github-actions to v7 (#307)
611a216 Update github-actions to v3.0.1 (#306)
2312495 Extract AttributeVersionRequirementHelper (#304)
952d0ee Warn about incomplete versions in #[RequiresPhp] (#303)
Additional commits viewable in compare view

Updates phpunit/phpunit to 13.2.4

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.2.4

Fixed

#6817: Issue is reported even when previously registered error handler turns the error into an exception

#6818: Issue is reported when custom error handler checks error_reporting() output dynamically

Learn how to install or update PHPUnit 13.2 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.

You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

Changelog

Sourced from phpunit/phpunit's changelog.

[13.2.4] - 2026-07-08

Fixed

#6817: Issue is reported even when previously registered error handler turns the error into an exception

#6818: Issue is reported when custom error handler checks error_reporting() output dynamically

[13.2.3] - 2026-07-06

Changed

#6797: Adapt code generated for test double of interface with constructor for PHP 8.6

[13.2.2] - 2026-06-29

Fixed

#6768: Negative priorities for hook methods are rejected by static analysis

#6778: Deprecation triggered outside of tests cannot be ignored

[13.2.1] - 2026-06-15

Fixed

#6741: Test is not run when --filter matches the name of a data set but not the name of the test method

#6743: Improve error message for invalid version constraint in attribute

#6744: Environment variable attributes reject empty-string values since PHPUnit 13.2.0

[13.2.0] - 2026-06-05

Added

#3387: Specify a list of tests to run

#4201: Handle interrupts and display current test results

#4501: Option to mark test as risky when it does not contribute to code coverage

#5757: Add assertions for ignoring whitespace differences in strings

#5810: Do not dump arrays and objects in failure messages of IsTrue, IsFalse, IsNull, IsFinite, IsInfinite, and IsNan constraints

#5838: Inherit #[RunTestsInSeparateProcesses] from parent test classes

#5922: assertContainsEquals() should use sebastian/comparator for element comparison

#6000: Report PHPT test as risky when --SKIPIF-- does not have standard-output side effect

#6075: Support test execution order sorted by descending duration

#6346: Emit warning when conflicting CLI options are used

#6534: Make $_dataName available to #[TestDoxFormatter] callbacks

#6559: Improved API for exception message expectations

#6565: Optional $skipWhenEmpty parameter for #[DataProvider] and #[DataProviderExternal]

#6566: Allow --stop-on-defect, --stop-on-error, etc. to accept an optional threshold

#6567: Make diff context lines configurable

#6574: Improve willReturnMap() with constraint support and strict matching

#6575: --list-test-ids CLI option and enhance --filter CLI option to support test ID syntax

#6577: --run-test-id <test-id> CLI option that accepts a single test ID for exact matching

... (truncated)

Commits

8f5180f Prepare release
6b667a5 Closes #6818
1d90b39 Closes #6817
4f2ca2c Update dependencies
d76d0e2 Prepare release
eca8792 Merge branch '12.5' into 13.2
0608d15 Prepare release
ca03a71 Merge branch '11.5' into 12.5
5f83edf Prepare release
2f3b5e4 Merge branch '10.5' into 11.5
Additional commits viewable in compare view

Updates rector/rector to 2.5.7

Release notes

Sourced from rector/rector's releases.

Released Rector 2.5.7

This release sharpens the PHPUnit code-quality sets, adds a focused narrow asserts set, deprecates two blurry Symfony web-test rules, and fixes a handful of docblock false-positives in dead-code removal.

New Features 🎉

PHPUnit: PHPUNIT_NARROW_ASSERTS set

A new set focused on narrowing broad asserts to their specific, more descriptive method — e.g. assertTrue(isset($a['b'])) → assertArrayHasKey('b', $a). ([rector-phpunit #716])
use Rector\PHPUnit\Set\PHPUnitSetList;
return RectorConfig::configure()
->withSets([PHPUnitSetList::PHPUNIT_NARROW_ASSERTS]);
withPreparedSets() gains phpunitNarrowAsserts + phpunitMockToStub

The 2 PHPUnit sets are now toggleable like any other prepared set. (#8178)
return RectorConfig::configure()
    ->withPreparedSets(
        phpunitNarrowAsserts: true,
        phpunitMockToStub: true,
    );
PHPUnit: flip with($this->callback(...)) on void methods to willReturnCallback()

VoidMethodWithCallbackToWillReturnCallbackRector (renamed + refocused) drops the pointless return value and types the closure as void, matching the mocked void method. ([rector-phpunit #724])
 $this->createMock(SomeClass::class)
     ->method('run')
-    ->with($this->callback(function ($arg) {
-        echo $arg;
-
-        return true;
-    }));
+    ->willReturnCallback(function ($arg): void {
+        echo $arg;
+    });

... (truncated)

Commits

ba22f8c Rector 2.5.7
1109537 Updated Rector to commit 653ec233fa55057fb11a6c133ed5c8d57dec9ff2
e363554 Updated Rector to commit 3c481b689cd746323dfad98782cd7939f28035e4
fb62051 Updated Rector to commit 3c481b689cd746323dfad98782cd7939f28035e4
561c81c Updated Rector to commit 51d61737c5fbaed10c5f711bbc8074720452417e
9f3ea3a Updated Rector to commit e713102f40682bc65311d3a50e5490e6acc452f3
78b5c28 Updated Rector to commit 306b852af3e4d0045034a6865bffe311ccdf38c9
4bb232c Updated Rector to commit 0e269a0d17470ec8331efb518efcfd5fa6e7162d
eab289b Updated Rector to commit cc1a748e25adb989f2cf42f0329792810d79d216
4ebe4bc Updated Rector to commit ed944a11e6e3a83bac0f9e1f4a413bcc7153fca7
Additional commits viewable in compare view

Updates tomasvotruba/unused-public to 2.2.1

Commits

00ddca4 release PHP 7.4 downgraded
22128e6 Update dependencies (phpunit 13, rector/jack 1) and fix CI (#157)
1be9659 no ansic
f2154d8 fix CI: PHPStan errors after dep/PHP 8.3 bump
See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…with 8 updates Updates the requirements on [infection/infection](https://github.com/infection/infection), [mimmi20/coding-standard](https://github.com/mimmi20/coding-standard), [nikic/php-parser](https://github.com/nikic/PHP-Parser), [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source), [phpstan/phpstan-phpunit](https://github.com/phpstan/phpstan-phpunit), [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit), [rector/rector](https://github.com/rectorphp/rector) and [tomasvotruba/unused-public](https://github.com/TomasVotruba/unused-public) to permit the latest version. Updates `infection/infection` to 0.34.0 - [Release notes](https://github.com/infection/infection/releases) - [Changelog](https://github.com/infection/infection/blob/master/CHANGELOG.md) - [Commits](infection/infection@0.33.2...0.34.0) Updates `mimmi20/coding-standard` to 8.0.12 - [Release notes](https://github.com/mimmi20/coding-standard/releases) - [Commits](mimmi20/coding-standard@8.0.5...8.0.12) Updates `nikic/php-parser` to 5.8.0 - [Release notes](https://github.com/nikic/PHP-Parser/releases) - [Changelog](https://github.com/nikic/PHP-Parser/blob/master/CHANGELOG.md) - [Commits](nikic/PHP-Parser@v5.7.0...v5.8.0) Updates `phpstan/phpstan` to 2.2.5 - [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits) Updates `phpstan/phpstan-phpunit` to 2.0.18 - [Release notes](https://github.com/phpstan/phpstan-phpunit/releases) - [Commits](phpstan/phpstan-phpunit@2.0.16...2.0.18) Updates `phpunit/phpunit` to 13.2.4 - [Release notes](https://github.com/sebastianbergmann/phpunit/releases) - [Changelog](https://github.com/sebastianbergmann/phpunit/blob/13.2.4/ChangeLog-13.2.md) - [Commits](sebastianbergmann/phpunit@13.1.10...13.2.4) Updates `rector/rector` to 2.5.7 - [Release notes](https://github.com/rectorphp/rector/releases) - [Commits](rectorphp/rector@2.4.5...2.5.7) Updates `tomasvotruba/unused-public` to 2.2.1 - [Commits](TomasVotruba/unused-public@2.2.0...2.2.1) --- updated-dependencies: - dependency-name: infection/infection dependency-version: 0.34.0 dependency-type: direct:development dependency-group: development-dependencies - dependency-name: mimmi20/coding-standard dependency-version: 8.0.12 dependency-type: direct:development dependency-group: development-dependencies - dependency-name: nikic/php-parser dependency-version: 5.8.0 dependency-type: direct:development dependency-group: development-dependencies - dependency-name: phpstan/phpstan dependency-version: 2.2.5 dependency-type: direct:development dependency-group: development-dependencies - dependency-name: phpstan/phpstan-phpunit dependency-version: 2.0.18 dependency-type: direct:development dependency-group: development-dependencies - dependency-name: phpunit/phpunit dependency-version: 13.2.4 dependency-type: direct:development dependency-group: development-dependencies - dependency-name: rector/rector dependency-version: 2.5.7 dependency-type: direct:development dependency-group: development-dependencies - dependency-name: tomasvotruba/unused-public dependency-version: 2.2.1 dependency-type: direct:development dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-07-24T02:04:08Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
composer/infection/infection	>= 0.34.0, < 0.35.0	Unknown	Unknown
composer/mimmi20/coding-standard	>= 8.0.12, < 9.0.0	Unknown	Unknown
composer/nikic/php-parser	>= 5.8.0, < 6.0.0	Unknown	Unknown
composer/phpstan/phpstan	>= 2.2.5, < 3.0.0	Unknown	Unknown
composer/phpstan/phpstan-phpunit	>= 2.0.18, < 3.0.0	Unknown	Unknown
composer/phpunit/phpunit	>= 13.2.4, < 14.0.0	Unknown	Unknown
composer/rector/rector	>= 2.5.7, < 3.0.0	Unknown	Unknown
composer/tomasvotruba/unused-public	>= 2.2.1, < 3.0.0	Unknown	Unknown

Scanned Files

composer.json

dependabot Bot assigned mimmi20 Jul 24, 2026

dependabot Bot requested a review from mimmi20 as a code owner July 24, 2026 02:03

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 24, 2026

mimmi20 approved these changes Jul 24, 2026

View reviewed changes

mimmi20 merged commit ceb2fa0 into master Jul 24, 2026
37 checks passed

mimmi20 deleted the dependabot/composer/development-dependencies-ed4c7358c3 branch July 24, 2026 19:28

Navigation Menu

composer (master)(deps-dev): bump the development-dependencies group with 8 updates - #924

composer (master)(deps-dev): bump the development-dependencies group with 8 updates#924
mimmi20 merged 1 commit into
masterfrom
dependabot/composer/development-dependencies-ed4c7358c3

dependabot Bot commented on behalf of github Jul 24, 2026

Uh oh!

github-actions Bot commented Jul 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 24, 2026

0.34.0

PHP-Parser 5.8.0

Fixed

Changed

Version 5.8.0 (2026-06-04)

Fixed

Changed

Version 5.7.0 (2025-12-06)

Fixed

Changed

Added

Version 5.6.2 (2025-10-21)

Fixed

Added

Version 5.6.1 (2025-08-13)

2.0.18

PHPUnit 13.2.4

Fixed

Keep up to date with PHPUnit:

[13.2.4] - 2026-07-08

Fixed

[13.2.3] - 2026-07-06

Changed

[13.2.2] - 2026-06-29

Fixed

[13.2.1] - 2026-06-15

Fixed

[13.2.0] - 2026-06-05

Added

Released Rector 2.5.7

New Features 🎉

PHPUnit: PHPUNIT_NARROW_ASSERTS set

withPreparedSets() gains phpunitNarrowAsserts + phpunitMockToStub

PHPUnit: flip with($this->callback(...)) on void methods to willReturnCallback()

Uh oh!

github-actions Bot commented Jul 24, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

PHPUnit: `PHPUNIT_NARROW_ASSERTS` set

`withPreparedSets()` gains `phpunitNarrowAsserts` + `phpunitMockToStub`

PHPUnit: flip `with($this->callback(...))` on void methods to `willReturnCallback()`