Merge branch '12.5' into 13.1

* 12.5:
  Closes #6465

Author: sebastianbergmann

ChangeLog-13.1.md

@@ -7,6 +7,7 @@ All notable changes of the PHPUnit 13.1 release series are documented in this fi
 ### Fixed
 
 * [#5993](https://github.com/sebastianbergmann/phpunit/issues/5993): `DefaultJobRunner` deadlocks on child processes that write large amounts of stderr output
+* [#6465](https://github.com/sebastianbergmann/phpunit/issues/6465): SAPI-populated `$_SERVER` entries leak from parent into child process
 * [#6587](https://github.com/sebastianbergmann/phpunit/issues/6587): `failOnEmptyTestSuite="false"` in `phpunit.xml` is ignored when `--group`/`--filter`/`--testsuite` matches no tests
 
 ## [13.1.3] - 2026-04-13

src/Util/GlobalState.php

@@ -52,6 +52,24 @@
         '_REQUEST',
     ];
 
+    /**
+     * Keys in $_SERVER that are populated by the SAPI in the child process
+     * and must therefore not be preserved from the parent process.
+     *
+     * @var non-empty-list<non-empty-string>
+     */
+    private const array SAPI_SERVER_KEYS = [
+        'PHP_SELF',
+        'SCRIPT_NAME',
+        'SCRIPT_FILENAME',
+        'PATH_TRANSLATED',
+        'DOCUMENT_ROOT',
+        'REQUEST_TIME',
+        'REQUEST_TIME_FLOAT',
+        'argv',
+        'argc',
+    ];
+
     /**
      * @var non-empty-array<non-empty-string, non-empty-array<non-empty-string, true>>
      */
@@ -271,6 +289,10 @@ public static function exportGlobals(): GlobalStateResult
         foreach (self::SUPER_GLOBAL_ARRAYS as $superGlobalArray) {
             if (isset($GLOBALS[$superGlobalArray]) && is_array($GLOBALS[$superGlobalArray])) {
                 foreach ($GLOBALS[$superGlobalArray] as $key => $value) {
+                    if ($superGlobalArray === '_SERVER' && in_array($key, self::SAPI_SERVER_KEYS, true)) {
+                        continue;
+                    }
+
                     $name = sprintf('$GLOBALS[\'%s\'][\'%s\']', $superGlobalArray, $key);
 
                     if ($value instanceof Closure) {

tests/end-to-end/regression/6465.phpt

@@ -0,0 +1,24 @@
+--TEST--
+https://github.com/sebastianbergmann/phpunit/issues/6465
+--FILE--
+<?php declare(strict_types=1);
+$_SERVER['REQUEST_TIME_FLOAT'] = 1.0;
+$_SERVER['REQUEST_TIME']       = 1;
+$_SERVER['SCRIPT_FILENAME']    = '/fake/parent/script.php';
+
+$_SERVER['argv'][] = '--do-not-cache-result';
+$_SERVER['argv'][] = '--no-configuration';
+$_SERVER['argv'][] = __DIR__ . '/6465/Issue6465Test.php';
+
+require_once __DIR__ . '/../../bootstrap.php';
+(new PHPUnit\TextUI\Application)->run($_SERVER['argv']);
+--EXPECTF--
+PHPUnit %s by Sebastian Bergmann and contributors.
+
+Runtime: %s
+
+..                                                                  2 / 2 (100%)
+
+Time: %s, Memory: %s
+
+OK (2 tests, 3 assertions)

tests/end-to-end/regression/6465/Issue6465Test.php

@@ -0,0 +1,29 @@
+<?php declare(strict_types=1);
+/*
+ * This file is part of PHPUnit.
+ *
+ * (c) Sebastian Bergmann <sebastian@phpunit.de>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+namespace PHPUnit\TestFixture\Issue6465;
+
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use PHPUnit\Framework\TestCase;
+
+final class Issue6465Test extends TestCase
+{
+    #[RunInSeparateProcess]
+    public function testRequestTimeFloatIsNotInheritedFromParent(): void
+    {
+        $this->assertNotSame(1.0, $_SERVER['REQUEST_TIME_FLOAT']);
+        $this->assertNotSame(1, $_SERVER['REQUEST_TIME']);
+    }
+
+    #[RunInSeparateProcess]
+    public function testScriptFilenameIsNotInheritedFromParent(): void
+    {
+        $this->assertNotSame('/fake/parent/script.php', $_SERVER['SCRIPT_FILENAME']);
+    }
+}