Skip to content

composer (master)(deps-dev): bump the development-dependencies group with 8 updates - #925

Merged
mimmi20 merged 1 commit into
masterfrom
dependabot/composer/development-dependencies-60d3785123
Aug 24, 2026
Merged

composer (master)(deps-dev): bump the development-dependencies group with 8 updates#925
mimmi20 merged 1 commit into
masterfrom
dependabot/composer/development-dependencies-60d3785123

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on infection/infection, mimmi20/coding-standard, phpstan/phpstan, phpstan/phpstan-deprecation-rules, phpunit/phpunit, rector/rector, rector/type-perfect and tomasvotruba/type-coverage to permit the latest version.
Updates infection/infection to 0.34.2

Release notes

Sourced from infection/infection's releases.

0.34.2

Fixed:

Internal:

New Contributors

Full Changelog: infection/infection@0.34.1...0.34.2

Commits
  • 18d9bef fix(phpunit): Use recordTestRunHistory instead of cacheResult on PHPUnit 13.3...
  • 9505953 [Conductor] Update shipmonk/dead-code-detector to 1.3.3 (#3446)
  • aa66f5f chore: Fix Rector warning (#3443)
  • 2dd27a7 refactor(reporter): Refactor GitHub annotation command formatting (#3442)
  • b669894 fix(reporter): Escape GitHub annotation workflow commands (#3441)
  • 57605a4 build(deps): bump zizmorcore/zizmor from 1.27.0 to 1.28.0 in the dependencies...
  • 6758404 [Conductor] Update carthage-software/mago to 1.46.0 (#3439)
  • 9233b25 [Conductor] Update rector/rector to 2.6.1 (#3438)
  • 65f79f3 [Conductor] Update all of phpstan (#3437)
  • d779f90 feat(test-framework): Add debug test framework and static analysis adapters (...
  • Additional commits viewable in compare view

Updates mimmi20/coding-standard to 8.0.20

Release notes

Sourced from mimmi20/coding-standard's releases.

8.0.20

What’s Changed

🕸 Dependencies:

  • composer (master)(deps): update squizlabs/php_codesniffer requirement from ^4.0.2 to ^4.0.4 by @​dependabot (#1078)

👨🏼‍💻 Contributors

@​dependabot, @​dependabot[bot] and @​mimmi20

Commits
  • bffe846 Merge pull request #1078 from mimmi20/dependabot/composer/squizlabs/php_codes...
  • 731ea03 composer (master)(deps): update squizlabs/php_codesniffer requirement
  • be71ba5 Merge pull request #1077 from mimmi20/dependabot/composer/squizlabs/php_codes...
  • 254da16 composer (master)(deps): update squizlabs/php_codesniffer requirement
  • 6ec61ce Merge pull request #1076 from mimmi20/dependabot/composer/development-depende...
  • 4df50cc composer (master)(deps-dev): update phpstan/phpstan requirement
  • 488826e Merge pull request #1075 from mimmi20/dependabot/composer/development-depende...
  • 77e72c5 composer (master)(deps-dev): update rector/rector requirement
  • d788f47 Merge pull request #1074 from mimmi20/dependabot/composer/slevomat/coding-sta...
  • a3edd1a composer (master)(deps): update slevomat/coding-standard requirement
  • Additional commits viewable in compare view

Updates phpstan/phpstan to 2.2.8

Commits

Updates phpstan/phpstan-deprecation-rules to 2.0.5

Release notes

Sourced from phpstan/phpstan-deprecation-rules's releases.

2.0.5

  • 67bedd6 - Update github-actions (#197)
  • 6be8bd3 - Update actions/cache action to v6 (#198)
  • 0b310ec - Update github-actions to v3.0.1 (#195)
  • 782d848 - Update github-actions to v7 (#196)
  • 85fff9d - Update github-actions to f3e473d (#194)
  • 54db580 - Update github-actions (#193)
  • 99aff1a - Replace deprecated actions/create-release with softprops/action-gh-release
  • 971f8e1 - Bump GitHub Actions across major versions
  • 89fef35 - Bump GitHub Actions within their current majors
  • 0652358 - Update github-actions
  • 02119cc - Update github-actions
  • 389c78c - latest infection does not support PHP 8.2 (#189)
  • 899202d - Update release-toot.yml (#188)
  • 016d677 - name-collision-detector (#187)
  • 945df12 - Delete .github/workflows/claude-react-on-comment.yml
  • a70b8b1 - Remove default branch determination from workflow
  • 1faeb2e - Lint workflows
  • 534891e - [StepSecurity] ci: Harden GitHub Actions
  • 3acc664 - Remove PHPSTAN_BOT_TOKEN from checkout step
  • 49efeb2 - React on issues opened and fall back to issue body
  • 319c3f6 - Add PHP 8.5 to CI matrix for lint, tests, and static analysis
  • 73feeba - Add missing export-ignore entries to .gitattributes
  • c6d73e5 - Add CLAUDE.md with project documentation
  • f9f68eb - Add Claude React on Comment workflow
Commits

Updates phpunit/phpunit to 13.3.1

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.3.1

Changed

  • Invoking a static hook method such as setUpBeforeClass() no longer triggers a deprecation warning on PHP 8.6

Learn how to install or update PHPUnit 13.3 in the documentation.

Keep up to date with PHPUnit:

Changelog

Sourced from phpunit/phpunit's changelog.

[13.3.1] - 2026-08-13

Changed

  • Invoking a static hook method such as setUpBeforeClass() no longer triggers a deprecation warning on PHP 8.6

[13.3.0] - 2026-08-07

Added

  • #3794: Filesystem-based code coverage targeting
  • #5758: Make export of objects customizable
  • #6546: Both property hooks can now be configured on test doubles of virtual hooked properties, even when the doubled property only declares one of them
  • #6586: Custom code coverage driver support
  • #6591: Repeated test execution using --repeat CLI option and #[Repeat] attribute
  • #6701: Allow expectOutputString() and expectOutputRegex() to be combined and repeated
  • #6710: Deprecation Filters
  • #6722: Allow #[CoversNothing] on methods
  • #6742: Retry failing tests up to N times using --retry CLI option #[Retry] attribute
  • #6827: Customize which deprecation trigger types fail the test run
  • #6830: Warn when failOnAllIssues="true" is combined with an explicitly disabled fine-grained failOn* setting
  • #6832: Allow doubling properties that do not declare property hooks
  • #6853: Optionally warn when PHP is not configured for development
  • [phpunit/php-code-coverage #1140](sebastianbergmann/php-code-coverage#1140): Class-oriented HTML report
  • [phpunit/php-code-coverage #1141](sebastianbergmann/php-code-coverage#1141): Improve visualization of branch coverage and path coverage in the HTML report
  • [phpunit/php-code-coverage #1153](sebastianbergmann/php-code-coverage#1153): Filter HTML code coverage report by test size
  • --record-test-run-history and --do-not-record-test-run-history CLI options as well as the recordTestRunHistory attribute for the XML configuration file to control whether the status and duration of each test are recorded for use by --order-by defects and --order-by duration-*
  • --without-class-view CLI option and classView attribute for the XML configuration file to disable the class-oriented view in the HTML code coverage report
  • --without-file-view CLI option and fileView attribute for the XML configuration file to disable the file-oriented view in the HTML code coverage report
  • {PWD} is now substituted with the directory of the PHPT test file in --ENV-- and --INI-- sections of PHPT test files
  • {TMP} (system directory for temporary files) and {ENV:name} (value of environment variable name) are now substituted in --INI-- sections of PHPT test files
  • A PHPT test whose --INI-- section references an environment variable that is not set is now skipped
  • A --SKIPIF-- section of a PHPT test file that prints xfail <reason> now marks the test as expected to fail, as if the PHPT test file had an --XFAIL-- section with that reason

Changed

  • [phpunit/php-code-coverage #1231](sebastianbergmann/php-code-coverage#1231): Identify dead code using static analysis
  • [phpunit/php-code-coverage #1259](sebastianbergmann/php-code-coverage#1259): Degrade gracefully when a source file cannot be parsed
  • The test runner no longer crashes when an attribute cannot be instantiated
  • Improved TestDox HTML report
  • The feature formerly named "test result cache" is now named "test run history"; when a cache directory is configured, the file it is stored in is now named test-run-history instead of test-results
  • The test runner warns now when ordering by defects or duration is configured but recording of the test run history is disabled
  • TestCase no longer captures error_log() output for tests that do not use expectErrorLog(), avoiding the cost of setting up error log redirection for every test
  • error_log() output from tests without an expectation is no longer echoed (date-stripped) to PHPUnit's output; it goes to the configured error log again, as it did before capture was introduced
  • A test running in process isolation that calls error_log() without expectErrorLog() now produces stderr output in the child process, which the test runner reports as a test error
  • A PHPT test that is expected to fail (--XFAIL-- section or xfail output from the --SKIPIF-- section) but passes is now considered risky; this usually means the expected-failure marker is stale and should be removed
  • A PHPT test whose --SKIPIF-- section produces output that is not recognized is now considered risky; this usually means the skip check itself is broken. The keywords understood by PHP's own test runner that have no PHPUnit counterpart (info, warn, xleak, flaky, and nocache) are tolerated and do not make the test risky
  • PHPT tests now run with additional INI defaults for deterministic output (date.timezone=UTC, display_startup_errors=1, fatal_error_backtraces=Off, ignore_repeated_errors=0, precision=14, serialize_precision=-1), consistent with PHP's own test runner; all of them can be overridden per test using the --INI-- section

... (truncated)

Commits
  • fc02493 Prepare release
  • e29a704 Update dependencies
  • 04157ce Do not pass object to ReflectionMethod::invoke() for static hook methods (whi...
  • 7efd432 Revert "Do not report deprecations triggered by myclabs/deep-copy"
  • a2048e9 Merge branch '12.5' into 13.3
  • 83be0fc Merge branch '11.5' into 12.5
  • 9375d10 Merge branch '10.5' into 11.5
  • bbd3c83 Update dependencies
  • dbc02ef Make closure comparison test independent of PHP 8.6 closure reuse
  • 5d20f13 Do not report deprecations triggered by myclabs/deep-copy
  • Additional commits viewable in compare view

Updates rector/rector to 2.6.2

Release notes

Sourced from rector/rector's releases.

Released Rector 2.6.2

The 2.6.0 release introduced composer-based sets. This release finishes the job: every extension package now ships a single composer-based set, and the per-version set providers behind the old guessing game are gone.

use Rector\Config\RectorConfig;
return RectorConfig::configure()
->withComposerBased(
doctrine: true,
phpunit: true,
twig: true,
);

Each rule inside checks composer.json/installed.json on its own and runs only if the installed package version matches its constraint. No SymfonySetList::SYMFONY_63, no picking a PHPUnit version by hand. We're working hard to bring Drupal and Laravel community packages to the same system.

Run only the PHP rules (#8322)

A new --php option on the process command runs only rules bound to a minimal PHP version — those implementing MinPhpVersionInterface. Useful to split a PHP upgrade from the rest, without a second config:

vendor/bin/rector process src --php --dry-run

New features 🥳

  • [Process] Add --php option to run only PHP version rules (#8322)
  • [Configuration] Resolve the composer-based set of extension packages in withComposerBased() (#8332), load Doctrine and Twig composer-based sets (#8313)
  • [Configuration] Report explicit error when the --only rule exists but is not registered in rector.php (#8300)
  • [DX] Warn on skipped classes that are not Rector rules (#8323), include the skipped class name in the message (#8325)
  • [DX] Show previous exceptions during bootstrap (#8287)
 [WARNING] This skipped class is not a Rector rule, so it can never be skipped.
           Only classes that implement "Rector\Contract\Rector\RectorInterface"
           can be used in "->withSkip()"

New rules 🎉

rector-src

  • [DeadCode] RemoveRedundantTypeCheckRector (#8307)

... (truncated)

Commits
  • 03cd615 Rector 2.6.2
  • 112412c Updated Rector to commit d39693f97e95e5dfb160f6d3529b740ac1c24b38
  • db9eb19 Updated Rector to commit 29928dd034534323ebf603bd1602b4f20ecd3ac6
  • 722336e Updated Rector to commit 09ee9549d7e20c168004ec0111ba165f91350541
  • 3654819 Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
  • f42c503 Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
  • f7bbc4f Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
  • 08865fb Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
  • b00041d Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
  • 032c857 Updated Rector to commit 768539a46a08410a7e25a643fe3777ab9c17b116
  • Additional commits viewable in compare view

Updates rector/type-perfect to 2.2.0

Release notes

Sourced from rector/type-perfect's releases.

Type Perfect 2.2.0 - Deprecated & merged into tomasvotruba/type-coverage

This package is deprecated

Keeping 2 very close packages up-to-date is daunting work and keep both behind. T Both focus with custom PHPStan rule on better type coverage and more precise and narrow types if available.

To improve support, the Type Perfect rules have been merged into tomasvotruba/type-coverage as of its 2.3.0 release. This is the final release of rector/type-perfect — it is marked abandoned in composer.json and Composer will now point you at the replacement on every install.

How to switch

1. Swap the package

 "require-dev": {
-    "rector/type-perfect": "^2.1"
+    "tomasvotruba/type-coverage": "^2.3"
 }
composer remove rector/type-perfect --dev
composer require tomasvotruba/type-coverage --dev

If you already use tomasvotruba/type-coverage, only remove rector/type-perfect — keeping both loads every rule twice.

Type Coverage requires PHP ^8.4; Type Perfect required ^8.2.

2. Keep your ignoreErrors as they are

The rules keep the Rector\TypePerfect\ namespace inside Type Coverage, so existing ignore patterns and PHPStan baselines still match. The extension is registered by phpstan/extension-installer, so no includes change is needed either.

3. Enable the rules that used to be on by default

NoParamTypeRemovalRule, NoIssetOnObjectRule and NoEmptyOnObjectRule reported right after install here. In Type Coverage they are opt-in like the rest of the set, one parameter each:

 parameters:
     type_perfect:
         narrow_param: true
         narrow_return: true
         no_mixed_property: true
         no_mixed_caller: true
         null_over_false: true
</tr></table> 

... (truncated)

Commits
  • 33d189f Deprecate package in favor of tomasvotruba/type-coverage (#78)
  • 255b323 NoArrayAccessOnObjectRule: Skip Symfony DomCrawler AbstractUriElement and chi...
  • bf9bd55 Prepare push repository logic to anywherephp/type-perfect (#75)
  • See full diff in compare view

Updates tomasvotruba/type-coverage to 2.3.0

Release notes

Sourced from tomasvotruba/type-coverage's releases.

Type Coverage 2.3.0 released

Type Perfect rules are now part of this package

rector/type-perfect has been merged into tomasvotruba/type-coverage (#68). Its rules live in packages/type-perfect and keep the Rector\TypePerfect\ namespace, so existing ignoreErrors patterns still match.

The extension is registered automatically via phpstan/extension-installer — no extra includes needed.

If you use both packages, drop rector/type-perfect from composer.json to avoid duplicate rules:

 "require-dev": {
     "tomasvotruba/type-coverage": "^2.3",
-    "rector/type-perfect": "^2.1"
 }

All Type Perfect rules are opt-in

Four rules used to report right after install, with no way off short of ignoreErrors. They now match the rest of the set — off by default, one parameter each (#69):

 parameters:
     type_perfect:
         narrow_param: false
         narrow_return: false
         no_mixed: false
         null_over_false: false
+        no_param_type_removal: false
+        no_array_access_on_object: false
+        no_isset_on_object: false
+        no_empty_on_object: false

Enable what you want:

parameters:
    type_perfect:
        narrow_param: true
        narrow_return: true
        no_mixed_property: true
        no_mixed_caller: true
        null_over_false: true
        no_param_type_removal: true
        no_array_access_on_object: true
        no_isset_on_object: true
        no_empty_on_object: true

What each of those 4 catches:

... (truncated)

Commits
  • 7ba48c1 bump symfony/dom-crawler to ^8.1 (#70)
  • 8cedbb8 [DX] Make type-perfect rules configurable, disabled by default (#69)
  • fbba498 Merge rector/type-perfect into this repo (#68)
  • See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…with 8 updates

Updates the requirements on [infection/infection](https://github.com/infection/infection), [mimmi20/coding-standard](https://github.com/mimmi20/coding-standard), [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source), [phpstan/phpstan-deprecation-rules](https://github.com/phpstan/phpstan-deprecation-rules), [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit), [rector/rector](https://github.com/rectorphp/rector), [rector/type-perfect](https://github.com/rectorphp/type-perfect) and [tomasvotruba/type-coverage](https://github.com/TomasVotruba/type-coverage) to permit the latest version.

Updates `infection/infection` to 0.34.2
- [Release notes](https://github.com/infection/infection/releases)
- [Changelog](https://github.com/infection/infection/blob/master/CHANGELOG.md)
- [Commits](infection/infection@0.34.0...0.34.2)

Updates `mimmi20/coding-standard` to 8.0.20
- [Release notes](https://github.com/mimmi20/coding-standard/releases)
- [Commits](mimmi20/coding-standard@8.0.12...8.0.20)

Updates `phpstan/phpstan` to 2.2.8
- [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits)

Updates `phpstan/phpstan-deprecation-rules` to 2.0.5
- [Release notes](https://github.com/phpstan/phpstan-deprecation-rules/releases)
- [Commits](phpstan/phpstan-deprecation-rules@2.0.4...2.0.5)

Updates `phpunit/phpunit` to 13.3.1
- [Release notes](https://github.com/sebastianbergmann/phpunit/releases)
- [Changelog](https://github.com/sebastianbergmann/phpunit/blob/13.3.1/ChangeLog-13.3.md)
- [Commits](sebastianbergmann/phpunit@13.2.4...13.3.1)

Updates `rector/rector` to 2.6.2
- [Release notes](https://github.com/rectorphp/rector/releases)
- [Commits](rectorphp/rector@2.5.7...2.6.2)

Updates `rector/type-perfect` to 2.2.0
- [Release notes](https://github.com/rectorphp/type-perfect/releases)
- [Commits](rectorphp/type-perfect@2.1.4...2.2.0)

Updates `tomasvotruba/type-coverage` to 2.3.0
- [Release notes](https://github.com/TomasVotruba/type-coverage/releases)
- [Commits](TomasVotruba/type-coverage@2.2.2...2.3.0)

---
updated-dependencies:
- dependency-name: infection/infection
  dependency-version: 0.34.2
  dependency-type: direct:development
  dependency-group: development-dependencies
- dependency-name: mimmi20/coding-standard
  dependency-version: 8.0.20
  dependency-type: direct:development
  dependency-group: development-dependencies
- dependency-name: phpstan/phpstan
  dependency-version: 2.2.8
  dependency-type: direct:development
  dependency-group: development-dependencies
- dependency-name: phpstan/phpstan-deprecation-rules
  dependency-version: 2.0.5
  dependency-type: direct:development
  dependency-group: development-dependencies
- dependency-name: phpunit/phpunit
  dependency-version: 13.3.1
  dependency-type: direct:development
  dependency-group: development-dependencies
- dependency-name: rector/rector
  dependency-version: 2.6.2
  dependency-type: direct:development
  dependency-group: development-dependencies
- dependency-name: rector/type-perfect
  dependency-version: 2.2.0
  dependency-type: direct:development
  dependency-group: development-dependencies
- dependency-name: tomasvotruba/type-coverage
  dependency-version: 2.3.0
  dependency-type: direct:development
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 24, 2026
@dependabot
dependabot Bot requested a review from mimmi20 as a code owner August 24, 2026 02:03
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 24, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
composer/infection/infection >= 0.34.2, < 0.35.0 UnknownUnknown
composer/mimmi20/coding-standard >= 8.0.20, < 9.0.0 UnknownUnknown
composer/phpstan/phpstan >= 2.2.8, < 3.0.0 UnknownUnknown
composer/phpstan/phpstan-deprecation-rules >= 2.0.5, < 3.0.0 UnknownUnknown
composer/phpunit/phpunit >= 13.3.1, < 14.0.0 UnknownUnknown
composer/rector/rector >= 2.6.2, < 3.0.0 UnknownUnknown
composer/rector/type-perfect >= 2.2.0, < 3.0.0 UnknownUnknown
composer/tomasvotruba/type-coverage >= 2.3.0, < 3.0.0 UnknownUnknown

Scanned Files

  • composer.json

@mimmi20
mimmi20 merged commit 1aff628 into master Aug 24, 2026
37 checks passed
@mimmi20
mimmi20 deleted the dependabot/composer/development-dependencies-60d3785123 branch August 24, 2026 04:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant