[ydah]

String_ only matches complete hexadecimal Unicode escapes, leaving malformed sequences as literal text instead of reporting an error:

String_::parse('"\u{zz}"'); // Before: literal \u{zz}
String_::parse('"\u{}"');   // Before: literal \u{}
// After: both throw PhpParser\Error("Invalid UTF-8 codepoint escape sequence")

Also match the \u{ prefix and reject it when no complete hexadecimal escape was captured. This catches invalid digits, empty escapes, and missing closing braces.

[nikic]

Probably worth testing "\u{" as well, as the minimal invalid sequence?

On the other hand, I'd drop the tests with variables below -- at least it's not obvious to me what extra coverage they are adding.

[ydah]

Thank you. Added a test for \u{ and removed the cases with variables as suggested.