[dependabot]

Bumps phpunit/phpunit from 13.4.5 to 13.4.6.

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.4.6

Changed

• Issues whose message refers to an anonymous class could not be ignored using a baseline on PHP 8.6 (as of PHP 8.6, such messages contain the full name of the anonymous class: a NUL byte followed by the file, line, and a counter)
• Make PHAR build reproducible across filesystems (files are now added to the PHAR sorted by their path instead of in the order in which the filesystem lists them)

Fixed

• When method() is called for a method of a test double that cannot be configured, for instance because it does not exist, every subsequent invocation of a method of that test double fails with Method name is not configured
• When a hook method of a test, for instance setUp(), marks the test as incomplete, the hook method is reported as failed
• When an "after test" method, for instance tearDown(), marks a successful test as incomplete or skips it, the test is reported as failed
• When a before-first-test method, for instance setUpBeforeClass(), calls markTestIncomplete(), each test of the test class is reported as failed instead of the test class being skipped as it is when markTestSkipped() is called
• When an after-last-test method, for instance tearDownAfterClass(), calls markTestIncomplete() or markTestSkipped() after the tests of the test class have been run, this is reported as a failure, also for each test of the test class that is run in process isolation
• A failed PHP assertion, made using assert(), in a hook method is reported as an error of that method instead of as a failure, and it is counted as an error instead of as a failure when that method is a before-first-test method or an after-last-test method
• When an assertion fails in an "after test" method, for instance tearDown(), of a test that already failed, errored, or was marked as incomplete, a failure is reported in addition to the outcome of the test, so the test is counted more than once and onNotSuccessfulTest() is called with the failure from the "after test" method instead of the test's own
• When a test fails because of an exception of a registered failure type, an error or a failure in an "after test" method, for instance tearDown(), is reported in addition to the test's failure, so the test is counted more than once
• A test that fails because of an exception of a registered failure type is considered risky when it does not perform assertions or, when requireCoverageMetadata="true" is configured, when it does not define a code coverage target, unlike a test that fails because an assertion failed
• The TestDox output does not show the failure of a before-first-test method or an after-last-test method, for instance an assertion failure in setUpBeforeClass()
• Control characters and ANSI escape sequences in user-supplied strings are not made visible in the output of --debug and in the logfiles written by --log-events-text and --log-events-verbose-text
• Groups configured for a test directory or test file using the groups attribute of <directory> or <file> in the XML configuration file are not assigned to PHPT tests, so --group and --exclude-group do not select them and --list-groups and --list-tests-xml report them as being in the default group or not at all

Removed

• The library PHAR (phpunit-library-X.Y.Z.phar) is no longer built, it could not be loaded since PHPUnit 9.5.8

---

Learn how to install or update PHPUnit 13.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

Changelog

Sourced from phpunit/phpunit's changelog.

[13.4.6] - 2026-11-02

Changed

• Issues whose message refers to an anonymous class could not be ignored using a baseline on PHP 8.6 (as of PHP 8.6, such messages contain the full name of the anonymous class: a NUL byte followed by the file, line, and a counter)
• Make PHAR build reproducible across filesystems (files are now added to the PHAR sorted by their path instead of in the order in which the filesystem lists them)

Fixed

• When method() is called for a method of a test double that cannot be configured, for instance because it does not exist, every subsequent invocation of a method of that test double fails with Method name is not configured
• When a hook method of a test, for instance setUp(), marks the test as incomplete, the hook method is reported as failed
• When an "after test" method, for instance tearDown(), marks a successful test as incomplete or skips it, the test is reported as failed
• When a before-first-test method, for instance setUpBeforeClass(), calls markTestIncomplete(), each test of the test class is reported as failed instead of the test class being skipped as it is when markTestSkipped() is called
• When an after-last-test method, for instance tearDownAfterClass(), calls markTestIncomplete() or markTestSkipped() after the tests of the test class have been run, this is reported as a failure, also for each test of the test class that is run in process isolation
• A failed PHP assertion, made using assert(), in a hook method is reported as an error of that method instead of as a failure, and it is counted as an error instead of as a failure when that method is a before-first-test method or an after-last-test method
• When an assertion fails in an "after test" method, for instance tearDown(), of a test that already failed, errored, or was marked as incomplete, a failure is reported in addition to the outcome of the test, so the test is counted more than once and onNotSuccessfulTest() is called with the failure from the "after test" method instead of the test's own
• When a test fails because of an exception of a registered failure type, an error or a failure in an "after test" method, for instance tearDown(), is reported in addition to the test's failure, so the test is counted more than once
• A test that fails because of an exception of a registered failure type is considered risky when it does not perform assertions or, when requireCoverageMetadata="true" is configured, when it does not define a code coverage target, unlike a test that fails because an assertion failed
• The TestDox output does not show the failure of a before-first-test method or an after-last-test method, for instance an assertion failure in setUpBeforeClass()
• Control characters and ANSI escape sequences in user-supplied strings are not made visible in the output of --debug and in the logfiles written by --log-events-text and --log-events-verbose-text
• Groups configured for a test directory or test file using the groups attribute of <directory> or <file> in the XML configuration file are not assigned to PHPT tests, so --group and --exclude-group do not select them and --list-groups and --list-tests-xml report them as being in the default group or not at all

Removed

• The library PHAR (phpunit-library-X.Y.Z.phar) is no longer built, it could not be loaded since PHPUnit 9.5.8

Commits

• 4821376 Prepare release
• 33153c8 Merge branch '12.5' into 13.4
• 1d5a4a3 Prepare release
• 0e18ec2 Update cbrgm/mastodon-github-action action to v2.2.6
• 474dca8 Merge branch '12.5' into 13.4
• 092e177 Make control characters in user-supplied strings visible in the output of --d...
• d65ec81 Merge branch '12.5' into 13.4
• d596570 Merge branch '11.5' into 12.5
• 89a07f0 Merge branch '10.5' into 11.5
• 980dbeb Merge branch '9.6' into 10.5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)