From f7a09881974ea3749ecb96420e3361794b183494 Mon Sep 17 00:00:00 2001 From: Anush Ramani Date: Mon, 27 Jul 2026 08:36:16 +0530 Subject: [PATCH 1/2] chore(deps): resolve high-severity Dependabot alerts Raises the phpunit/phpunit dev constraint from "^6" to "^8.5.52" to clear GHSA-vvj3-c3rp-c85p (unsafe deserialization in PHPT code coverage handling, high, vulnerable range "< 8.5.52"). This is a direct cross-major bump (6 -> 8) of a require-dev dependency, approved as an explicit exception: phpunit is a test runner that never reaches consumers of this bundle, and the suite was verified green on 8.5.53 beforehand. There is no patch on the 6.x line -- the highest available 6.x is 6.5.14, so no in-major fix exists. This repo has no composer.lock (it is gitignored), so the manifest constraint is the only available lever. This bump also REPAIRS an existing failure on master: phpunit 6.5's phpunit-mock-objects generator calls ReflectionType::__toString(), which is deprecated in PHP 7.4, and convertNoticesToExceptions turns each into an error. Tests go from 21 tests / 19 errors before to 21/21 passing after. No source changes were required. Note: phpunit 8 rejects the "syntaxCheck" attribute at phpunit.xml.dist line 11 and prints a config-validation warning. Tests still run and pass. Left untouched here; recommended as a follow-up cleanup. Fixes: https://app.vanta.com/c/xola.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-high Co-Authored-By: Claude Opus 5 (1M context) --- composer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/composer.json b/composer.json index b9ef661..1ae4d9b 100644 --- a/composer.json +++ b/composer.json @@ -18,7 +18,7 @@ "php-http/logger-plugin": "^1.1" }, "require-dev": { - "phpunit/phpunit": "^6", + "phpunit/phpunit": "^8.5.52", "omnipay/authorizenet": "^3.3", "omnipay/eway": "^3.0", "omnipay/mollie": "^5.2", From 744d9cdde1faec4a4bbf706156ca0ff5d808a9c4 Mon Sep 17 00:00:00 2001 From: Anush Ramani Date: Thu, 30 Jul 2026 12:12:40 +0530 Subject: [PATCH 2/2] PL-916 Address review feedback: raise composer.json PHP floor to >=7.2 require-dev pins phpunit/phpunit ^8.5.52, which requires PHP >=7.2, and .travis.yml only tests PHP 7.2/7.3/7.4. The previous php:">=7" constraint falsely advertised support for PHP 7.0/7.1, which are neither tested nor compatible with the dev dependency. composer.lock is gitignored in this repo so no lockfile change is needed. Co-Authored-By: Claude Opus 5 (1M context) --- composer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/composer.json b/composer.json index 1ae4d9b..9856dee 100644 --- a/composer.json +++ b/composer.json @@ -12,7 +12,7 @@ "homepage": "https://github.com/xola/OmnipayBundle", "license": "MIT", "require": { - "php": ">=7", + "php": ">=7.2", "symfony/framework-bundle": ">=2.1", "league/omnipay": "^3.0", "php-http/logger-plugin": "^1.1"