PL-916 [Vanta] Remediate High vulnerabilities identified in packages are addressed (GitHub Repo)

[anush]

Summary

Clears the single open high Dependabot alert on this repo by raising the phpunit/phpunit dev constraint. As a bonus, it also fixes the currently-broken test suite on master — see below.

Important

This is a direct cross-major bump (6 → 8) of a require-dev dependency, landed as an explicit, deliberately-granted exception to our usual "no direct major bumps" rule. It is safe here because phpunit is a test runner that never reaches consumers of this bundle, and the suite was verified green on 8.5.53 before this PR was opened.

Packages upgraded

Package	From	To	Scope	Alerts cleared
phpunit/phpunit	^6 (resolved 6.5.14)	^8.5.52 (resolves 8.5.53)	require-dev	1 — GHSA-vvj3-c3rp-c85p

Composer also drops five now-unneeded transitive dev packages that phpunit 6 pulled in and phpunit 8 does not: phpunit/phpunit-mock-objects (already marked abandoned; its mock generator moved in-tree in phpunit 7+), phpspec/prophecy, phpdocumentor/reflection-docblock, phpdocumentor/reflection-common, phpdocumentor/type-resolver. No production dependency changes.

Advisory: PHPUnit vulnerable to unsafe deserialization in PHPT code coverage handling. Severity high. Vulnerable range < 8.5.52; first patched 8.5.52.

Why the major bump was unavoidable

• The advisory has no patch on the 6.x line. The highest 6.x release in existence is 6.5.14, which is still inside the vulnerable range — so no in-major fix exists.
• This repo has no composer.lock (it is gitignored), so there is no lockfile-only lever. composer update phpunit/phpunit --with-dependencies refuses outright: "Cannot update only a partial set of packages without a lock file present." The manifest constraint is the only thing that can move.
• 8.5.53 was chosen over the bare 8.5.52 floor and checked against every known phpunit advisory — the two 2026-04 advisories (GHSA-mh6w-vxff-9wqp, GHSA-qrr6-mg7r-m243) only affect the 12.5.21 / 13.1.5 lines, so 8.5.53 is clean.

This PR repairs a pre-existing failure on master

master is currently red, independently of this change. On PHP 7.4, phpunit 6.5's phpunit-mock-objects generator calls ReflectionType::__toString(), which PHP 7.4 deprecated; phpunit.xml.dist sets convertNoticesToExceptions="true", so every one of those deprecations becomes a test error:

Function ReflectionType::__toString() is deprecated
  .../vendor/phpunit/phpunit-mock-objects/src/Generator.php:1089

Baseline on origin/master: 21 tests, 2 assertions, 19 errors.
On this branch: 21 tests, 72 assertions, 0 errors.

So this is not merely a version-number change — it takes the suite from 19 errors to fully green, and restores 70 assertions that were never actually reached before.

Residual

0. This was the only open high-severity Dependabot alert on the repo.

Behavioural caveats

1. phpunit.xml.dist:11 uses a syntaxCheck attribute that phpunit 8 rejects. Running the suite now prints:

Warning - The configuration file did not pass validation!
  Line 11:
  - Element 'phpunit', attribute 'syntaxCheck': The attribute 'syntaxCheck' is not allowed.
  Test results may not be as expected.

This is cosmetic — the attribute was a no-op removed in phpunit 7, all 21 tests still run and pass. I have deliberately not edited it in this PR to keep the diff to the single dependency line. Recommended follow-up: delete the syntaxCheck attribute from phpunit.xml.dist to silence the warning.

2. No : void signature problem here. phpunit 8's main breaking change is requiring : void on setUp() / tearDown() / setUpBeforeClass(). This repo's tests are unaffected, so no source changes were needed and none were made — the diff is one line in composer.json.

Smoke test for the reviewer

composer install
vendor/bin/phpunit

Expect OK (21 tests, 72 assertions) and PHPUnit 8.5.53 in the header (plus the cosmetic syntaxCheck warning above). The meaningful check is Tests/Service/OmnipayTest.php, which exercises real gateway construction across the Omnipay drivers (authorizenet, stripe, paypal, …) via getMockBuilder() — precisely the mock machinery that phpunit 8 rewrote and that was erroring out on master.

Verification

All commands run locally on PHP 7.4.14 / Composer 2.2.26, baseline captured on origin/master first, then compared like-for-like.

Check	Baseline (origin/master, phpunit 6.5.14)	This branch (phpunit 8.5.53)
composer validate	valid, 1 pre-existing warning (symfony/framework-bundle unbound >=2.1)	valid, same pre-existing warning — unchanged by this PR
composer install --no-scripts	PASS	PASS
vendor/bin/phpunit	ERRORS! Tests: 21, Assertions: 2, Errors: 19	OK (21 tests, 72 assertions)
Build / lint	n/a — this repo defines neither	n/a

Semver proof (the actual success measure, not an audit tail): the resolved version was checked against the advisory's vulnerable_version_range on both sides. Baseline resolves 6.5.14, which satisfies < 8.5.52 → vulnerable, confirming the check is not vacuous. This branch resolves 8.5.53, which does not satisfy < 8.5.52 → cleared.

Fixes: https://app.vanta.com/c/xola.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-high

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
  • Updated the PHPUnit testing framework version used during development.

[coderabbitai]

📝 Walkthrough

Walkthrough

The development dependency constraint for phpunit/phpunit in composer.json changes from ^6 to ^8.5.52.

Changes

PHPUnit upgrade

Layer / File(s)	Summary
Update PHPUnit constraint composer.json	The PHPUnit development requirement changes from ^6 to ^8.5.52.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• xola/XolaElasticsearchProxyBundle#10: Updates the PHPUnit development dependency constraint in composer.json to ^8.5.52.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@composer.json`:
- Line 21: Align the PHP platform constraint with the phpunit/phpunit ^8.5.52
requirement by raising the supported PHP minimum to >=7.2, or instead pin
PHPUnit to a compatible 7.x release if PHP 7.0/7.1 support must remain. Update
the relevant PHP constraint in composer.json while preserving the intended
runtime support policy.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f2e428f6-d7ae-4728-b097-b10001e69d32

📥 Commits

Reviewing files that changed from the base of the PR and between 01338eb and f7a0988.

📒 Files selected for processing (1)

• composer.json

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• xola/x2-seller (manual) → reviewed against open PR #6794 vanta/dependabot-high-2026-07-24 instead of the default branch
• xola/x2-checkout (manual)

📜 Review details

🔇 Additional comments (1)

composer.json (1)

21-21: 🗄️ Data Integrity & Integration

composer.lock isn’t tracked here

This repo only includes composer.json, so there’s no lockfile to regenerate.

			> Likely an incorrect or invalid review comment.