Skip to content

Update dependency phpunit/phpunit to v13 [SECURITY]#36

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/packagist-phpunit-phpunit-vulnerability
Open

Update dependency phpunit/phpunit to v13 [SECURITY]#36
renovate[bot] wants to merge 1 commit intomainfrom
renovate/packagist-phpunit-phpunit-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Apr 18, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
phpunit/phpunit (source) ^10.0 → ^13.0 age adoption passing confidence

GitHub Vulnerability Alerts

GHSA-qrr6-mg7r-m243

Impact

PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives.

An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process.

Sources of INI values that participate in the attack:

  • <ini name="…" value="…"/> entries in phpunit.xml / phpunit.xml.dist
  • INI settings inherited from the host PHP runtime via ini_get_all()

Threat Model

Exploitation requires the attacker to control the content of an INI value read by PHPUnit. In practice this means write access to the project's phpunit.xml, the host php.ini, or the PHP binary's environment. The most realistic exposure is Poisoned Pipeline Execution (PPE): a pull request from an untrusted contributor that modifies phpunit.xml to include a newline-containing INI value, executed by a CI system that runs PHPUnit against the PR without isolation. A malicious newline is not visibly distinguishable from a legitimate value in a typical diff review.

Affected component

PHPUnit\Util\PHP\JobRunner::settingsToParameters().

Patches

The fix has two parts:

1. Reject line-break characters

Because a newline or carriage return in an INI value has no legitimate use and is the primitive that enables directive injection, any PHP setting value containing \n or \r is now rejected with an explicit PhpProcessException. This follows the same "visibility over silence" principle applied in CVE-2026-24765: the anomalous state fails loudly in CI output rather than being silently sanitized, giving operators an opportunity to investigate whether it reflects tampering, environment contamination, or an unexpected upstream change.

2. Quote remaining metacharacters

Values containing " or ;, both of which have legitimate uses (e.g., regex-valued INI settings such as ddtrace's datadog.appsec.obfuscation_parameter_value_regexp), are wrapped in double quotes with inner " escaped as \", so PHP's INI parser reads them as literal string contents rather than comment/delimiter tokens. Plain values are forwarded unchanged so that boolean keywords (On/Off) and bitwise expressions (E_ALL & ~E_NOTICE) retain their INI semantics.

Workarounds

If upgrading is not immediately possible:

  • Audit INI values: Ensure no <ini value="…"> entry in phpunit.xml / phpunit.xml.dist contains newline, ", or ; characters, and that nothing writes such values into configuration at build time.
  • Isolate CI execution of untrusted code: Run PHPUnit against pull requests only in ephemeral, containerized runners that discard filesystem state between jobs; require human review before executing PRs from forks; enforce branch protection on workflows that handle secrets (pull_request_target and similar). These mitigations apply to the broader PPE risk class and are effective against this vulnerability as well.
  • Restrict who can modify phpunit.xml: Treat phpunit.xml as security-sensitive in code review, particularly <ini> entries.
  • Sanitize host INI: Ensure the host PHP's php.ini does not contain values with embedded newlines or unescaped metacharacters.

References

Severity
  • CVSS Score: 7.8 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Release Notes

sebastianbergmann/phpunit (phpunit/phpunit)

v13.1.7: PHPUnit 13.1.7

Compare Source

Changed
  • Pass LIBXML_NONET when parsing/validating XML configuration files to make explicit that no network I/O is performed
  • Verify the result file written by an isolated child process with a random nonce before deserializing it

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

v13.1.6: PHPUnit 13.1.6

Compare Source

Fixed
  • #​6590: Silent failure when configuration file is invalid
  • #​6592: INI metacharacters ; and " are not preserved when forwarding settings to child processes

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

v13.1.5: PHPUnit 13.1.5

Compare Source

Fixed
  • #​5860: PHP CLI -d settings are not forwarded to child processes for process isolation
  • #​6451: Incomplete version in RequiresPhp (e.g. <=8.5) is compared against full PHP version, causing unexpected skips
  • #​6589: dataSetAsStringWithData() raises "float is not representable as int" warning for large floats in data sets

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

v13.1.4: PHPUnit 13.1.4

Compare Source

Fixed
  • #​5993: DefaultJobRunner deadlocks on child processes that write large amounts of stderr output
  • #​6465: SAPI-populated $_SERVER entries leak from parent into child process
  • #​6587: failOnEmptyTestSuite="false" in phpunit.xml is ignored when --group/--filter/--testsuite matches no tests
  • #​6588: Order of issue baseline entries is not canonicalized

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

v13.1.3: PHPUnit 13.1.3

Compare Source

Fixed
  • Regression in XML configuration migration introduced in PHPUnit 12.5.8

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

v13.1.2: PHPUnit 13.1.2

Compare Source

Fixed
  • #​4571: No warning when --random-order-seed is used when test execution order is not random
  • #​4975: --filter does not work when filter string starts with #
  • #​5354: JUnit XML logger does not handle TestSuiteSkipped event
  • #​6276: Exit with non-zero exit code when explicit test selection (--filter, --group, --testsuite) yields no tests
  • #​6583: Failing output expectation skips tearDown() and handler restoration, causing subsequent tests to be marked as risky

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

v13.1.1: PHPUnit 13.1.1

Compare Source

Changed
  • #​3676: Include class/interface name in mock object expectation failure messages
  • #​4793: Exit with non-zero exit code when exit was called from some test
Fixed
  • #​5881: colors="true" in XML configuration file does not unconditionally enable colored output
  • #​6019: --migrate-configuration does not update schema location when XML content already validates against current schema
  • #​6372: Assertion failure inside willReturnCallback() is silently swallowed when code under test catches exceptions
  • #​6464: Process isolation template unconditionally calls set_include_path()
  • #​6571: Static analysis errors for TestDoubleBuilder method chaining

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

v13.1.0: PHPUnit 13.1.0

Compare Source

Added
  • #​6501: Include unexpected output in Open Test Reporting (OTR) XML logfile
  • #​6517: includeInCodeCoverage attribute for <directory> and <file> children of <source>
  • #​6523: Include #[Group] information in Open Test Reporting (OTR) XML logfile
  • #​6524: Report issues in Open Test Reporting (OTR) XML logfile
  • #​6526: Introduce #[DataProviderClosure] for static closures
  • #​6530: Support for custom issue trigger resolvers that can be configured using <issueTriggerResolvers> in the XML configuration file
  • #​6547: Support for %r...%r in EXPECTF section
  • Support for configuring HTML code coverage report options (colors, thresholds, custom CSS) in XML configuration file without requiring an outputDirectory attribute, allowing the output directory to be specified later with the --coverage-html CLI option
  • Support for configuring dark mode colors, progress bar colors, and breadcrumb colors for HTML code coverage reports in the XML configuration file
Changed
  • #​6557: Improve failure description for StringMatchesFormatDescription constraint which is used by assertFileMatchesFormat(), assertFileMatchesFormatFile(), assertStringMatchesFormat(), assertStringMatchesFormatFile(), and EXPECTF sections of PHPT test files
  • The HTML code coverage report now uses a more colorblind-friendly blue/amber/orange palette by default
  • Extracted PHPUnit\Runner\Extension\Facade from a concrete class to an interface and introduced an internal ExtensionFacade implementation, so that extensions only depend on the Facade interface while PHPUnit internally uses the ExtensionFacade class that also provides query methods
Deprecated
  • #​6515: Deprecate the --log-events-verbose-text <file> CLI option
  • #​6537: Soft-deprecate id() and after() for mock object expectations
Fixed
  • #​6025: FILE_EXTERNAL breaks __DIR__
  • #​6351: No warning when the same test runner extension is configured more than once
  • #​6433: Logic in TestSuiteLoader is brittle and causes "Class FooTest not found" even for valid tests in valid filenames
  • #​6463: Process Isolation fails on non-serializable globals and quietly ignore closures

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

v13.0.6: PHPUnit 13.0.6

Compare Source

Changed
  • #​4440: Improve error when configured code coverage file list is empty
  • #​6549: Allow to stub both hooks of non-virtual properties
Fixed
  • #​6529: Git "detached HEAD state" in Open Test Reporting (OTR) XML logger not handled properly
  • #​6545: Stubbing a class with set property hook leaves property uninitialized by default
  • The RegularExpression and StringMatchesFormatDescription did not handle preg_match() errors such as Compilation failed: regular expression is too large

Learn how to install or update PHPUnit 13.0 in the documentation.

Keep up to date with PHPUnit:

v13.0.5: PHPUnit 13.0.5

Compare Source

Fixed
  • #​6521: Performance regression in PHPUnit 11.5.54, PHPUnit 12.5.13, and PHPUnit 13.0.4

Learn how to install or update PHPUnit 13.0 in the documentation.

Keep up to date with PHPUnit:

v13.0.4: PHPUnit 13.0.4

Compare Source

Fixed
  • #​6489: Classification of self/direct/indirect deprecation triggers is not aligned with Symfony's bridge for PHPUnit

Learn how to install or update PHPUnit 13.0 in the documentation.

Keep up to date with PHPUnit:

v13.0.3: PHPUnit 13.0.3

Compare Source

Fixed
  • #​6511: TestDox variables out of order with named arguments
  • #​6514: <ini /> can silently fail

Learn how to install or update PHPUnit 13.0 in the documentation.

Keep up to date with PHPUnit:

v13.0.2: PHPUnit 13.0.2

Compare Source

Deprecated
  • #​6505: Calling atLeast() with an argument that is not positive
  • #​6507: Support for using with*() without expects()
Fixed
  • #​6503: Temporary file used by SourceMapper may be deleted prematurely when multiple PHPUnit processes run in parallel
  • #​6509: "No expectations were configured for the mock object ..." notice is emitted when with() is used without expects()

Learn how to install or update PHPUnit 13.0 in the documentation.

Keep up to date with PHPUnit:

v13.0.1: PHPUnit 13.0.1

Compare Source

Fixed
  • #​6495: Source map for issue trigger identification is regenerated in process isolation child processes
  • #​6497: method() returns InvocationMocker instead of InvocationStubber for test stubs

Learn how to install or update PHPUnit 13.0 in the documentation.

Keep up to date with PHPUnit:

v13.0.0: PHPUnit 13.0.0

Compare Source

Added
  • #​6450: TestCase::invokeTestMethod() method for customizing test method invocation
  • #​6455: withParameterSetsInOrder() and withParameterSetsInAnyOrder() for expecting calls to the same method of a mock object but with different arguments
  • #​6466: Sealed test doubles
  • #​6468: Configuration option to require sealed mock objects
  • #​6477: assertArraysAreIdentical(), assertArraysAreIdenticalIgnoringOrder(), assertArraysHaveIdenticalValues(), assertArraysHaveIdenticalValuesIgnoringOrder(), assertArraysAreEqual(), assertArraysAreEqualIgnoringOrder(), assertArraysHaveEqualValues(), and assertArraysHaveEqualValuesIgnoringOrder() assertions
  • --test-files-file <file> CLI option to configure a file that contains the paths to the test files to be loaded (one file per line); use this when using CLI arguments is not an option due to argument length limitations
Deprecated
  • #​6461: any() matcher (hard deprecation)
Removed
  • #​6054: Assert::isType()
  • #​6057: assertContainsOnly() and assertNotContainsOnly()
  • #​6061: containsOnly()
  • #​6076: Support for PHP 8.3
  • #​6141: testClassName() method on event value objects for hook methods called for test methods
  • #​6230: Configuration::includeTestSuite() and Configuration::excludeTestSuite()
  • #​6241: --dont-report-useless-tests CLI option
  • #​6247: Support for using #[CoversNothing] on a test method
  • #​6285: #[RunClassInSeparateProcess] attribute
  • #​6356: Support for version constraint string argument without explicit version comparison operator

Learn how to install or update PHPUnit 13.0 in the documentation.

Keep up to date with PHPUnit:

v12.5.23: PHPUnit 12.5.23

Compare Source

Changed
  • Pass LIBXML_NONET when parsing/validating XML configuration files to make explicit that no network I/O is performed
  • Verify the result file written by an isolated child process with a random nonce before deserializing it

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.22

Compare Source

v12.5.21

Compare Source

v12.5.20

Compare Source

v12.5.19: PHPUnit 12.5.19

Compare Source

Fixed
  • Regression in XML configuration migration introduced in PHPUnit 12.5.8

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.18: PHPUnit 12.5.18

Compare Source

Fixed
  • #​4571: No warning when --random-order-seed is used when test execution order is not random
  • #​4975: --filter does not work when filter string starts with #
  • #​5354: JUnit XML logger does not handle TestSuiteSkipped event
  • #​6276: Exit with non-zero exit code when explicit test selection (--filter, --group, --testsuite) yields no tests
  • #​6583: Failing output expectation skips tearDown() and handler restoration, causing subsequent tests to be marked as risky

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.17: PHPUnit 12.5.17

Compare Source

Changed
  • #​4793: Exit with non-zero exit code when exit was called from some test
Fixed
  • #​5881: colors="true" in XML configuration file does not unconditionally enable colored output
  • #​6019: --migrate-configuration does not update schema location when XML content already validates against current schema
  • #​6372: Assertion failure inside willReturnCallback() is silently swallowed when code under test catches exceptions
  • #​6464: Process isolation template unconditionally calls set_include_path()
  • #​6571: Static analysis errors for TestDoubleBuilder method chaining

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.16: PHPUnit 12.5.16

Compare Source

Added
  • #​6547: Support for %r...%r in EXPECTF section
Fixed
  • #​6025: FILE_EXTERNAL breaks __DIR__
  • #​6351: No warning when the same test runner extension is configured more than once
  • #​6433: Logic in TestSuiteLoader is brittle and causes "Class FooTest not found" even for valid tests in valid filenames
  • #​6463: Process Isolation fails on non-serializable globals and quietly ignore closures

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.15: PHPUnit 12.5.15

Compare Source

Changed
  • #​4440: Improve error when configured code coverage file list is empty
  • #​6549: Allow to stub both hooks of non-virtual properties
Fixed
  • #​6529: Git "detached HEAD state" in Open Test Reporting (OTR) XML logger not handled properly
  • #​6545: Stubbing a class with set property hook leaves property uninitialized by default
  • The RegularExpression and StringMatchesFormatDescription did not handle preg_match() errors such as Compilation failed: regular expression is too large

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.14: PHPUnit 12.5.14

Compare Source

Fixed
  • #​6521: Performance regression in PHPUnit 11.5.54, PHPUnit 12.5.13, and PHPUnit 13.0.4

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.13: PHPUnit 12.5.13

Compare Source

Fixed
  • #​6489: Classification of self/direct/indirect deprecation triggers is not aligned with Symfony's bridge for PHPUnit

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.12: PHPUnit 12.5.12

Compare Source

Fixed
  • #​6511: TestDox variables out of order with named arguments
  • #​6514: <ini /> can silently fail

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.11: PHPUnit 12.5.11

Compare Source

Deprecated
  • #​6510: Deprecate using with*() on test stubs
Fixed
  • #​6503: Temporary file used by SourceMapper may be deleted prematurely when multiple PHPUnit processes run in parallel
  • #​6509: "No expectations were configured for the mock object ..." notice is emitted when with() is used without expects()

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.10: PHPUnit 12.5.10

Compare Source

Fixed
  • #​6495: Source map for issue trigger identification is regenerated in process isolation child processes

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.9: PHPUnit 12.5.9

Compare Source

Added
  • #​6488: Allow disabling issue trigger identification for improved performance
Fixed
  • #​6486: Incorrect file name reported for errors for test methods declared in traits
  • #​6490: Incorrect test count when tests are skipped in before-class method

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.8: PHPUnit 12.5.8

Compare Source

Changed
  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.7: PHPUnit 12.5.7

Compare Source

Fixed
  • #​6362: Manually instantiated test doubles are broken since PHPUnit 11.2
  • #​6470: Infinite recursion in Count::getCountOf() for unusal implementations of Iterator or IteratorAggregate

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.6: PHPUnit 12.5.6

Compare Source

Changed

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.5: PHPUnit 12.5.5

Compare Source

Deprecated
  • #​6461: any() matcher (soft deprecation)
Fixed
  • #​6470: Mocking a class with a property hook setter accepting more types than the property results in a fatal error

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.4: PHPUnit 12.5.4

Compare Source

Changed
  • The #[AllowMockObjectsWithoutExpectations] attribute can now be used on the method level
Fixed
  • #​6446: Test runner crashes with Timer::start() has to be called before Timer::stop()

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.3: PHPUnit 12.5.3

Compare Source

Changed
  • The message emitted when a test method creates a mock object but does not configure any expectations for it has been improved

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.2: PHPUnit 12.5.2

Compare Source

Added
  • Attribute #[AllowMockObjectsWithoutExpectations] for excluding tests from the check that emits the notice for test methods that create a mock object but do not configure an expectation for it

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.1: PHPUnit 12.5.1

Compare Source

Added
  • TestCase::getStubBuilder() (analogous to TestCase::getMockBuilder()) for creating (partial) test stubs using a fluent API

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.0: PHPUnit 12.5.0

Compare Source

Added
  • #​6376: --all CLI option to ignore test selection configured in XML configuration file
  • #​6422: Make <source> element in XML code coverage report optional
Changed
  • #​6380: Allow Throwable in expectExceptionObject()
  • A PHPUnit notice is now emitted for test methods that create a mock object but do not configure an expectation for it

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.4.5: PHPUnit 12.4.5

Compare Source

Changed
  • Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6
Fixed
  • #​6426: Fix migration of configuration without schema location

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.4: PHPUnit 12.4.4

Compare Source

Fixed
  • #​6408: Exception in a data provider method leads to internal PHPUnit error
  • #​6410: Test runner's shutdown handler is called in system-under-test's child process

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.3: PHPUnit 12.4.3

Compare Source

Fixed
  • #​6402: Avoid reading from STDOUT when rewind() fails

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.2: PHPUnit 12.4.2

Compare Source

Changed
  • Skipped tests alone no longer lead to a yellow background for the test result summary
Fixed
  • #​6391: Errors during backup of global variables and static properties are not reported

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.1: PHPUnit 12.4.1

Compare Source

Fixed
  • #​6364: --filter format used by PhpStorm stopped working
  • #​6378: Wrong method name passed to DataProviderMethodCalled event value object

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.4.0: PHPUnit 12.4.0

Compare Source

Added
  • #​6277: Allow tests to opt out of the validation that a data provider method does not provide data sets with more values than a test method accepts
  • #​6341: Support for regular expressions with #[IgnoreDeprecations] attribute
  • #​6354: Invokable constraints
Deprecated
  • #​6284: #[RunClassInSeparateProcess] attribute
  • #​6355: Support for version constraint string argument without explicit version comparison operator

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

v12.3.15: PHPUnit 12.3.15

Compare Source

Fixed
  • #​6368: failOnPhpunitWarning="false" has no effect

Learn how to install or update PHPUnit 12.3 in the documentation.

Keep up to date with PHPUnit:

[`v12

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

Read more information about the use of Renovate Bot within Laminas.

@renovate
Update dependency phpunit/phpunit to v13 [SECURITY]
d3386d4 
| datasource | package         | from    | to     |
| ---------- | --------------- | ------- | ------ |
| packagist  | phpunit/phpunit | 10.5.63 | 13.1.7 |


Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate bot force-pushed the renovate/packagist-phpunit-phpunit-vulnerability branch from 9a585ef to d3386d4 Compare April 19, 2026 12:39
@renovate renovate bot changed the title Update dependency phpunit/phpunit to v12 [SECURITY] Update dependency phpunit/phpunit to v13 [SECURITY] Apr 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Awaiting Maintainer Response security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants