Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
composer/composer (source)	^2.9.8 → ^2.10.1					require-dev	patch
laminas/laminas-continuous-integration-action	1.43.0 → v1.44					action	minor
phpunit/phpunit (source)	^13.1.11 → ^13.2.1					require-dev	minor
psalm/plugin-phpunit	^0.19.7 → ^0.20.2					require-dev	minor

---

Release Notes

composer/composer (composer/composer)

v2.10.1

Compare Source

• Security: Fixed shell escaping when opening an editor (#​12903)
  • Security: Verify backup phar signature before restoring it when using self-update --rollback (#​12918)
  • Fixed source-fallback also disabling fallbacks to dist install when source is the preferred install method (#​12888)
  • Fixed source -> dist package updates wiping the .git dir without checking for local changes first (#​12912)
  • Fixed GitHub token prompt happening multiple times on parallel auth failures (#​12913)
  • Fixed warnings from Composer repositories being printed twice in some cases (#​12907)

laminas/laminas-continuous-integration-action (laminas/laminas-continuous-integration-action)

v1.44

Compare Source

v1.44.0

Compare Source

Release Notes for 1.44.0

This release updates composer to a version not affected by the CVE-2026-45793.

If you use our published container directly and pin to a specific version or digest you will need to update, otherwise latest container is in use and no action is required.

1.44.0

• Total issues resolved: 0
• Total pull requests resolved: 3
• Total contributors: 1

renovate

• 363: Update composer Docker tag to v2.9.8 thanks to @​renovate[bot]
• 330: Update actions/checkout action to v6 thanks to @​renovate[bot]

dependencies

• 332: Update dependency markdownlint-cli2 to v0.20.0 thanks to @​renovate[bot]

sebastianbergmann/phpunit (phpunit/phpunit)

v13.2.1

Compare Source

v13.2.0: PHPUnit 13.2.0

Compare Source

Added

• #​3387: Specify a list of tests to run
• #​4201: Handle interrupts and display current test results
• #​4501: Option to mark test as risky when it does not contribute to code coverage
• #​5757: Add assertions for ignoring whitespace differences in strings
• #​5810: Do not dump arrays and objects in failure messages of IsTrue, IsFalse, IsNull, IsFinite, IsInfinite, and IsNan constraints
• #​5838: Inherit #[RunTestsInSeparateProcesses] from parent test classes
• #​5922: assertContainsEquals() should use sebastian/comparator for element comparison
• #​6000: Report PHPT test as risky when --SKIPIF-- does not have standard-output side effect
• #​6075: Support test execution order sorted by descending duration
• #​6346: Emit warning when conflicting CLI options are used
• #​6534: Make $_dataName available to #[TestDoxFormatter] callbacks
• #​6559: Improved API for exception message expectations
• #​6565: Optional $skipWhenEmpty parameter for #[DataProvider] and #[DataProviderExternal]
• #​6566: Allow --stop-on-defect, --stop-on-error, etc. to accept an optional threshold
• #​6567: Make diff context lines configurable
• #​6574: Improve willReturnMap() with constraint support and strict matching
• #​6575: --list-test-ids CLI option and enhance --filter CLI option to support test ID syntax
• #​6577: --run-test-id <test-id> CLI option that accepts a single test ID for exact matching
• #​6579: Properly handle issues triggered outside of tests
• #​6597: Compact output (activated through --compact CLI option and PHPUNIT_COMPACT_OUTPUT=1 environment variable)
• #​6598: --disable-coverage-targeting CLI option
• #​6602: Separate configuration for branch coverage from path coverage
• #​6606: Support for partially ordered parameter sets in mock object expectations
• #​6611: Add CPU time to telemetry
• #​6681: Comment-aware variants of XML comparison assertions
• The executionOrder attribute in the XML configuration file now accepts defects combined with any main order, as well as three-way combinations of depends/no-depends, defects, and a main order (for example, depends,defects,duration-ascending)
• --validate-configuration CLI option to validate an XML configuration file for PHPUnit
• Report TestDox information in Open Test Reporting XML
• Report per-test and per-test-suite resource usage (time, memory usage, peak memory usage) in Open Test Reporting XML
• Report number of assertions performed for each test in Open Test Reporting XML
• Report structured comparison failure details (expected, actual, diff) in Open Test Reporting XML
• Report random order seed in Open Test Reporting XML when test execution order is randomised

Changed

• #​5873: Chain previously registered error handler instead of silently disabling PHPUnit's error handling
• #​6535: Use sebastian/file-filter in SourceFilter::includes() for issue trigger identification
• #​6581: Allow #[IgnoreDeprecations] to be repeated
• #​6609: Skip data providers whose method cannot match --filter
• #​6685: Generate failure messages for inverse assertions by authoring negations, not by rewriting strings
• Only errors and failures are now considered for "defect first" test reordering (tests that triggered deprecations, notices, or warnings as well as incomplete, risky, and skipped tests were previous also considered)
• A warning is now emitted when closures are compared for equality using the IsEqual, IsEqualCanonicalizing, IsEqualIgnoringCase, IsEqualWithDelta, and TraversableContainsEqual constraints or the assertEquals(), assertEqualsCanonicalizing(), assertEqualsIgnoringCase(), assertEqualsWithDelta(), and assertContainsEquals() assertions

Deprecated

• #​6075: --order-by duration CLI option, use --order-by duration-ascending instead
• #​6075: --order-by size CLI option, use --order-by size-ascending instead
• #​6075: executionOrder="duration" XML configuration attribute value, use executionOrder="duration-ascending" instead
• #​6075: executionOrder="size" XML configuration attribute value, use executionOrder="size-ascending" instead
• #​6560: Soft-deprecate expectExceptionMessage(), use expectExceptionMessageIsOrContains() instead

Fixed

• #​5845: Error handlers registered before PHPUnit (e.g. via auto_prepend_file) cause false "risky test" warnings
• #​5851: Output buffer manipulation in tests causes incorrect capture, hangs, and silent failures
• #​6582: TestSuiteSorter::cmpSize() does not handle TestSuite objects for TestCase classes

---

Learn how to install or update PHPUnit 13.2 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v13.1.14: PHPUnit 13.1.14

Compare Source

Fixed

• #​6683: assertNotEquals() failure message says "is equal to" instead of "is not equal to" when comparing arrays or objects
• #​6700: expectOutputString() and expectOutputRegex() silently replace themselves and each other

---

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

psalm/psalm-plugin-phpunit (psalm/plugin-phpunit)

v0.20.2

Compare Source

What's Changed

• Fix #[Test] attribute detection for inherited and fully-qualified attributes by @​alies-dev in #​160

New Contributors

• @​alies-dev made their first contribution in #​160

Full Changelog: psalm/psalm-plugin-phpunit@0.20.1...0.20.2

v0.20.1

Compare Source

v0.20.0

Compare Source

What's Changed

• Switch to psalm/psalm-plugin-api 0.1.0 (targeting Psalm v7 beta)
• Bump actions/cache from 3 to 4 by @​dependabot[bot] in #​153
• Bump actions/checkout from 3 to 4 by @​dependabot[bot] in #​152
• Bump actions/cache from 4 to 5 by @​dependabot[bot] in #​157
• Bump actions/checkout from 4 to 6 by @​dependabot[bot] in #​156

Full Changelog: psalm/psalm-plugin-phpunit@0.19.5...0.20.0

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

Read more about the use of Renovate Bot within ocramius/* projects.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer update composer/composer:2.10.1 phpunit/phpunit:13.2.1 psalm/plugin-phpunit:0.20.2 --with-dependencies --ignore-platform-req=ext-* --ignore-platform-req=lib-* --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires phpunit/phpunit ^13.2.1 -> satisfiable by phpunit/phpunit[13.2.1].
    - phpunit/phpunit 13.2.1 requires sebastian/diff ^9.0 -> found sebastian/diff[9.0.0] but these were not loaded, likely because it conflicts with another require.
  Problem 2
    - Root composer.json requires psalm/plugin-phpunit ^0.20.2 -> satisfiable by psalm/plugin-phpunit[0.20.2].
    - vimeo/psalm is locked to version 6.16.1 and an update of this package was not requested.
    - psalm/plugin-phpunit 0.20.2 requires psalm/psalm-plugin-api ^0.1 -> satisfiable by psalm/psalm-plugin-api[0.1.0].
    - psalm/psalm-plugin-api 0.1.0 conflicts with vimeo/psalm <7.0.0.

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.