Skip to content

Bump the composer-dev-dependencies group with 9 updates - #296

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/composer/composer-dev-dependencies-9dfce12cfb
Open

Bump the composer-dev-dependencies group with 9 updates#296
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/composer/composer-dev-dependencies-9dfce12cfb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on vlucas/phpdotenv, codeception/codeception, codeception/lib-innerbrowser, codeception/module-phpbrowser, codeception/module-rest, friendsofphp/php-cs-fixer, phpunit/phpunit, rector/rector and vimeo/psalm to permit the latest version.
Updates vlucas/phpdotenv to 5.8.0

Release notes

Sourced from vlucas/phpdotenv's releases.

v5.8.0

What's Changed

New Contributors

Full Changelog: phpdotenv/phpdotenv@v5.7.0...v5.8.0

Commits
  • 9614910 Bump branch alias
  • 7f5e066 Recognise a multiline closing quote at the start of a line (#622)
  • 3f7ae97 Report unterminated double-quoted values instead of dropping them (#621)
  • d704058 Rename nul.env test fixture to prevent Windows checkout failure (#620)
  • 301c079 Resolve the remaining static analysis baseline entries (#614)
  • 5d0bb3b Document the real parsing, nesting, comment, escape and validation rules (#609)
  • 4426075 Stop comments from starting multiline values (#615)
  • eec19ee Add regression tests for existing behaviour (#608)
  • 226b4ed Improve diagnostics and messages (#607)
  • 4f84f7e Strip a leading UTF-8 byte order mark from string content (#606)
  • Additional commits viewable in compare view

Updates codeception/codeception to 5.3.7

Release notes

Sourced from codeception/codeception's releases.

5.3.7

What's Changed

Full Changelog: Codeception/Codeception@5.3.6...5.3.7

Changelog

Sourced from codeception/codeception's changelog.

5.3.7

5.3.6

5.3.5

5.3.4

  • Use attributes syntax in gherkin:snippets in #6917
  • PHP 8.5: Fix usage of deprecated $http_response_header in #6919
  • Do not expect the register_argc_argv ini setting in cli for php >= 8.5 in #6921

5.3.3

... (truncated)

Commits
  • 5740d83 5.3.7
  • 232be8b Fix compatibility with phpunit 13.4 (#6953)
  • 2aea436 fix(ci): relax expected shell output in LocalCept (#6950)
  • ee47eab 5.3.6
  • 3a8dc67 Bump action/cache and actions/checkout (#6948)
  • 1df5d0e Minor: More details about codecept run -g failed (#6926)
  • 16e4430 Fix ArgumentCountError in ReportPrinter when test names contain % charact...
  • eb7a6a2 Migrate internal tests to the canonical v5 Support layout (#6943)
  • a0c973e Fix compatibility with sebastian/diff v8.3.0 + v9.0.0 (#6941)
  • cf9292b Support for Variadic parameters (#6932)
  • Additional commits viewable in compare view

Updates codeception/lib-innerbrowser to 4.1.1

Release notes

Sourced from codeception/lib-innerbrowser's releases.

4.1.1

What's Changed

Full Changelog: Codeception/lib-innerbrowser@4.1.0...4.1.1

Commits

Updates codeception/module-phpbrowser to 4.1.0

Release notes

Sourced from codeception/module-phpbrowser's releases.

4.1.0

4.1.0 (2026-07-27)

Features

  • add support for Guzzle 8 (23dba2f)
Commits
  • 56903df Merge pull request #51 from W0rma/fix-phpstan
  • c7697d2 chore(ci): remove superfluous phpstan-ignore-next-line
  • 7b2a8d6 chore(deps): bump phpstan version to 2.2.6
  • e291e50 chore(deps): sort packages alphabetically
  • 3606a64 Merge pull request #50 from GrahamCampbell/guzzle-8
  • 23dba2f feat: add support for Guzzle 8
  • See full diff in compare view

Updates codeception/module-rest to 3.4.4

Commits

Updates friendsofphp/php-cs-fixer to 3.95.27

Release notes

Sourced from friendsofphp/php-cs-fixer's releases.

v3.95.27 Adalbertus

What's Changed

New Contributors

Full Changelog: PHP-CS-Fixer/PHP-CS-Fixer@v3.95.26...v3.95.27

Changelog

Sourced from friendsofphp/php-cs-fixer's changelog.

Changelog for v3.95.27

  • fix: refuse a symlinked cache path in FileHandler to avoid arbitrary file overwrite (#9856)
  • fix: validate value types in Cache::fromJson so a corrupt cache rebuilds instead of crashing (#9855)
  • fix: SimplifiedIfReturnFixer - fix whitespace before ; as well (#9857)
  • refactor: more moderate permissions for newly created cache file/directory (#9852)
  • chore: add TODO to split class with too many responsibilities (#9853)
  • docs: FullyQualifiedStrictTypesFixer - document attribute handling in example (#9859)

Changelog for v3.95.26

  • perf: Use dedicated sequence matcher in simplified_if_return (#9763)
  • DX: add XDEBUG for PHP 8.5 docker build (#9841)
  • chore: ConfigInterface - document TODO for v4 (#9845)
  • chore: drop benchmark.sh in favour of phpbench (#9849)
  • chore: stalebot - exclude RTM labels (#9843)
  • deps: bump dev-deps (#9840)
  • deps: explicitly expect PHPUnit 13.3+ over 13.0.x (#9842)
  • deps: update dev deps (#9848)
  • docs: do not promote deprecated path argument usage with --path-mode=override (#9850)
  • docs: simpler docs for parallel execution, as it's default one nowadays (#9851)

Changelog for v3.95.25

  • fix: handle missing terminator after ?? in AssignNullCoalescingToCoalesceEqualFixer (#9831)
  • fix: IsNullFixer - do not fix is_null() calls using argument unpacking (#9830)
  • fix: IsNullFixer - handle is_null() calls using named arguments (#9828)
  • UX: init - use outlined messages (#9826)
  • deps: bump crate-ci/typos from 1.49.0 to 1.50.1 in /.github/workflows in the all group across 1 directory (#9824)
  • deps: bump phpstan/phpstan from 2.2.9 to 2.2.12 in /dev-tools in the phpstan group (#9822)
  • deps: bump shipmonk/dead-code-detector from 1.3.3 to 1.4.0 in /dev-tools in the shipmonk group across 1 directory (#9823)

Changelog for v3.95.24

  • fix: ControlStructureBracesFixer - do not read a body starting with a parenthesis as a condition (#9815)
  • UX: init - add handling of .gitignore (#9813)
  • UX: init - add sections (#9819)
  • UX: init - command improvements (#9807)
  • UX: init - fix typos and improve wording (#9820)
  • UX: init command - suggest php_unit_test_case_static_method_calls rule (#9810)
  • chore: Fixer name must not be empty (#9756)
  • chore: DescribeCommand - replace dynamic method calls with explicit ones (#9817)
  • chore: PhpdocOrderFixer - fix type of duplicated tags passed to naturalLanguageJoin (#9818)
  • CI: fix warning - Unexpected input(s) 'extensions' (#9809)
  • CI: introduce PHPBench (#9755)
  • refactor: init - move content preparation to helper method (#9812)

... (truncated)

Commits
  • 1d0c68e prepared the 3.95.27 release
  • 730c761 docs: FullyQualifiedStrictTypesFixer - document attribute handling in examp...
  • 57b9dc0 fix: validate value types in Cache::fromJson so a corrupt cache rebuilds inst...
  • cad2991 fix: SimplifiedIfReturnFixer - fix whitespace before ; as well (#9857)
  • 65086cb fix: refuse a symlinked cache path in FileHandler to avoid arbitrary file ove...
  • 00a4527 chore: add TODO to split class with too many responsibilities (#9853)
  • e3bcd56 refactor: more moderate permissions for newly created cache file/directory (#...
  • ab9226e bumped version
  • 11839df prepared the 3.95.26 release
  • c84d44a docs: simpler docs for parallel execution, as it's default one nowadays (#9851)
  • Additional commits viewable in compare view

Updates phpunit/phpunit to 13.4.6

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.4.6

Changed

  • Issues whose message refers to an anonymous class could not be ignored using a baseline on PHP 8.6 (as of PHP 8.6, such messages contain the full name of the anonymous class: a NUL byte followed by the file, line, and a counter)
  • Make PHAR build reproducible across filesystems (files are now added to the PHAR sorted by their path instead of in the order in which the filesystem lists them)

Fixed

  • When method() is called for a method of a test double that cannot be configured, for instance because it does not exist, every subsequent invocation of a method of that test double fails with Method name is not configured
  • When a hook method of a test, for instance setUp(), marks the test as incomplete, the hook method is reported as failed
  • When an "after test" method, for instance tearDown(), marks a successful test as incomplete or skips it, the test is reported as failed
  • When a before-first-test method, for instance setUpBeforeClass(), calls markTestIncomplete(), each test of the test class is reported as failed instead of the test class being skipped as it is when markTestSkipped() is called
  • When an after-last-test method, for instance tearDownAfterClass(), calls markTestIncomplete() or markTestSkipped() after the tests of the test class have been run, this is reported as a failure, also for each test of the test class that is run in process isolation
  • A failed PHP assertion, made using assert(), in a hook method is reported as an error of that method instead of as a failure, and it is counted as an error instead of as a failure when that method is a before-first-test method or an after-last-test method
  • When an assertion fails in an "after test" method, for instance tearDown(), of a test that already failed, errored, or was marked as incomplete, a failure is reported in addition to the outcome of the test, so the test is counted more than once and onNotSuccessfulTest() is called with the failure from the "after test" method instead of the test's own
  • When a test fails because of an exception of a registered failure type, an error or a failure in an "after test" method, for instance tearDown(), is reported in addition to the test's failure, so the test is counted more than once
  • A test that fails because of an exception of a registered failure type is considered risky when it does not perform assertions or, when requireCoverageMetadata="true" is configured, when it does not define a code coverage target, unlike a test that fails because an assertion failed
  • The TestDox output does not show the failure of a before-first-test method or an after-last-test method, for instance an assertion failure in setUpBeforeClass()
  • Control characters and ANSI escape sequences in user-supplied strings are not made visible in the output of --debug and in the logfiles written by --log-events-text and --log-events-verbose-text
  • Groups configured for a test directory or test file using the groups attribute of <directory> or <file> in the XML configuration file are not assigned to PHPT tests, so --group and --exclude-group do not select them and --list-groups and --list-tests-xml report them as being in the default group or not at all

Removed

  • The library PHAR (phpunit-library-X.Y.Z.phar) is no longer built, it could not be loaded since PHPUnit 9.5.8

Learn how to install or update PHPUnit 13.4 in the documentation.

Keep up to date with PHPUnit:

Changelog

Sourced from phpunit/phpunit's changelog.

[13.4.6] - 2026-11-02

Changed

  • Issues whose message refers to an anonymous class could not be ignored using a baseline on PHP 8.6 (as of PHP 8.6, such messages contain the full name of the anonymous class: a NUL byte followed by the file, line, and a counter)
  • Make PHAR build reproducible across filesystems (files are now added to the PHAR sorted by their path instead of in the order in which the filesystem lists them)

Fixed

  • When method() is called for a method of a test double that cannot be configured, for instance because it does not exist, every subsequent invocation of a method of that test double fails with Method name is not configured
  • When a hook method of a test, for instance setUp(), marks the test as incomplete, the hook method is reported as failed
  • When an "after test" method, for instance tearDown(), marks a successful test as incomplete or skips it, the test is reported as failed
  • When a before-first-test method, for instance setUpBeforeClass(), calls markTestIncomplete(), each test of the test class is reported as failed instead of the test class being skipped as it is when markTestSkipped() is called
  • When an after-last-test method, for instance tearDownAfterClass(), calls markTestIncomplete() or markTestSkipped() after the tests of the test class have been run, this is reported as a failure, also for each test of the test class that is run in process isolation
  • A failed PHP assertion, made using assert(), in a hook method is reported as an error of that method instead of as a failure, and it is counted as an error instead of as a failure when that method is a before-first-test method or an after-last-test method
  • When an assertion fails in an "after test" method, for instance tearDown(), of a test that already failed, errored, or was marked as incomplete, a failure is reported in addition to the outcome of the test, so the test is counted more than once and onNotSuccessfulTest() is called with the failure from the "after test" method instead of the test's own
  • When a test fails because of an exception of a registered failure type, an error or a failure in an "after test" method, for instance tearDown(), is reported in addition to the test's failure, so the test is counted more than once
  • A test that fails because of an exception of a registered failure type is considered risky when it does not perform assertions or, when requireCoverageMetadata="true" is configured, when it does not define a code coverage target, unlike a test that fails because an assertion failed
  • The TestDox output does not show the failure of a before-first-test method or an after-last-test method, for instance an assertion failure in setUpBeforeClass()
  • Control characters and ANSI escape sequences in user-supplied strings are not made visible in the output of --debug and in the logfiles written by --log-events-text and --log-events-verbose-text
  • Groups configured for a test directory or test file using the groups attribute of <directory> or <file> in the XML configuration file are not assigned to PHPT tests, so --group and --exclude-group do not select them and --list-groups and --list-tests-xml report them as being in the default group or not at all

Removed

  • The library PHAR (phpunit-library-X.Y.Z.phar) is no longer built, it could not be loaded since PHPUnit 9.5.8

[13.4.5] - 2026-10-27

Fixed

  • The static analysis cache directory that is automatically created in the operating system's path used for temporary files when no cache directory is configured is not used when the POSIX extension is not loaded

[13.4.4] - 2026-10-27

Fixed

  • The TeamCity logger writes testSuiteFinished twice for a test class when one of its before-first-test methods errors or fails
  • The TestDox output shows a less important outcome of a test that has more than one outcome, for instance the failure in tearDown() of a test that errored
  • When the test run is interrupted by a signal while a test is run in process isolation, the result of the test is discarded and the test is counted as passed, and the TestDox output cannot be printed
  • When no static analysis cache directory is configured, the cache directory that is automatically created in the operating system's path used for temporary files is also used when it was created by another user or can be written to by other users
  • The directory in the operating system's path used for temporary files in which the temporary files for collecting code coverage for a PHPT test are created has a fixed name, and is also used when it was created by another user, who can then replace the code of the PHPT test before it is executed

[13.4.3] - 2026-10-16

Fixed

  • The dependencies of a test that are listed after a dependency on a test that does not return a value, or after a dependency on a larger test, were not checked, so the test was run instead of being skipped when one of these dependencies had not passed
  • Tests could not be run in process isolation when the namespace of the test class begins with a name that the code of the child process imports, for instance CodeCoverage or Facade
  • A test that is run in process isolation aborts the test run when its data set or a value returned by a test it depends on cannot be serialized, for instance because it is a closure
  • When a before-first-test method or an after-last-test method errors or fails, the remaining methods of the same kind are still called, and each of them that does not error or fail itself is reported with the exception of the earlier method

... (truncated)

Commits
  • 4821376 Prepare release
  • 33153c8 Merge branch '12.5' into 13.4
  • 1d5a4a3 Prepare release
  • 0e18ec2 Update cbrgm/mastodon-github-action action to v2.2.6
  • 474dca8 Merge branch '12.5' into 13.4
  • 092e177 Make control characters in user-supplied strings visible in the output of --d...
  • d65ec81 Merge branch '12.5' into 13.4
  • d596570 Merge branch '11.5' into 12.5
  • 89a07f0 Merge branch '10.5' into 11.5
  • 980dbeb Merge branch '9.6' into 10.5
  • Additional commits viewable in compare view

Updates rector/rector to 2.8.3

Release notes

Sourced from rector/rector's releases.

Released Rector 2.8.3

Faster node traversal and updated PHPStan stack 🚀

This release brings performance improvements to node visitors, reducing unnecessary traversals and reflection resolution during analysis.

It also updates PHPStan to 2.3.4 and phpstan/phpdoc-parser to 2.4, with compatibility fixes for the updated PHPDoc type nodes.

Performance Improvements 🚀

  • Avoid nested traversals in ByRefNodeVisitor by tracking by-reference variable names per FunctionLike (#8879) Thanks @​samsonasik
  • Only resolve call reflection for 2-item array arguments in CallLikeReflectionNodeVisitor (#8880) Thanks @​samsonasik

Bugfixes 🐛

  • [TypeDeclaration] AddArrayFunctionClosureParamTypeRector: resolve array item types from unions of arrays (#8877) Thanks @​SanderMuller
  • Lock the fixture directory itself to prevent conflicts between parallel test workers using different TMPDIR values (#8878) Thanks @​SanderMuller

Internals ⚙️

  • Bump PHPStan to 2.3.4 and phpstan/phpdoc-parser to 2.4, adapting PHPDoc node handling for the new NameNode, FullyQualifiedNameNode, and RelativeNameNode types (#8883) Thanks @​ondrejmirtes
Commits
  • 12ddb68 Rector 2.8.3
  • 768a3dc Updated Rector to commit 8323e93e55a40fb408fae7af4e5ba8b770fa8441
  • 7c07b79 Updated Rector to commit 62e0fccbe42cebe7d5b3281b687aa404e6120ede
  • b8a1dca Updated Rector to commit 62e0fccbe42cebe7d5b3281b687aa404e6120ede
  • 0207c40 Updated Rector to commit 62e0fccbe42cebe7d5b3281b687aa404e6120ede
  • 85ff869 Updated Rector to commit 6f8df55c5210ab07b644da15a57111bd65d3690e
  • 066425d Updated Rector to commit e291f0d9bc43002279494134a993abc59a27d465
  • 69d19ec Updated Rector to commit 8271f5dd75261f4532e3ba6d9ae34649d3d9cffb
  • ebc7e41 Updated Rector to commit 7aef6aac3302fe53bf0a3cd8369d496f3a0c84c1
  • 03a365d Rector 2.8.2
  • Additional commits viewable in compare view

Updates vimeo/psalm to 7.0.0

Release notes

Sourced from vimeo/psalm's releases.

Psalm 7

Announcing the release of Psalm 7!

Featuring a simply enormous number of new features and bug fixes, such as:

  • security analysis on by default: fully refactored for 10x+ performance and much greater coverage, in the same run as type checking and dead code detection;
  • much deeper security analysis taint tracking: NoSQL, LLM prompt and URL injection, new sources like php://input and uploaded file names, flows through closures, generators, traits and by-reference parameters, and ready-made stubs for Guzzle, PSR-7, Monolog, MongoDB and more.
  • a new purity model based on Hack's capabilities: declare exactly which side effects a function may have (io, time, write-props...), with purity templates for classes, closures and automatically inferred annotations;
  • graph-based dead code detection: If nothing reachable uses a class, function, method, constant, variable, etc, Psalm finds it, now properly handling unused cycles as well.
  • Template defaults (@template TError of Throwable = RuntimeException) for classes, functions and methods: Result<int> just works, and libraries can add templates without breaking their users.
  • PHP 8.5 and 8.6 support: Full support for Partial Function Application, the pipe operator, and much more!
  • Daily releases. Features and fixes reach you the day they land, no more waiting on dev-master.
  • Framework plugins in the box. The PHPUnit, Symfony, Laravel, Mockery and sabre/event plugins ship with Psalm and switch on by themselves. Zero setup.
  • a bigger Psalm maintainer team: @​alies-dev has joined the Psalm maintainer team, contributing many new useful features and bugfixes!
  • An official Discord community!
  • And so, so many other new features and bugfixes!

Psalm 7 runs on 64-bit PHP 8.2 to 8.6. Upgrading is simple for most projects: see Upgrading below.

Security analysis: faster, always on, in a single run

Taints are now stored as a bitmask, and the taint graph is resolved over compact summaries of each function. This makes security analysis up to 10x faster.

Combined analysis (#11384) runs type checking, security analysis and dead code detection together in one run, so taint analysis is now on by default (#11399).

Taint issues are reported with a SECURITY severity, and with a rank in SARIF reports (#12068, #11383). The results no longer change between runs or with the thread count (#11946, #11952, #11953).

Deeper taint tracking

<?php
$run = function (string $c): void {
    shell_exec($c);
};
$run((string) $_GET['cmd']); // TaintedShell, through the closure
$mongo = new MongoDB\Driver\Manager('mongodb://localhost');
$mongo->executeQuery('db.users', new MongoDB\Driver\Query(['name' => $_GET['name']])); // TaintedNosql
/** @​return mixed */
function body() {
return json_decode((string) file_get_contents('php://input'), true);
}
eval((string) body()); // TaintedEval: php://input is a source

Try it on psalm.dev »

... (truncated)

Commits
  • 618ca49 Merge pull request #13061 from alies-dev/alies-dev/close-issues
  • 209f0e1 Add regression tests for issues fixed on master
  • 7cf7d72 Merge pull request #13059 from alies-dev/alies-dev/detect-duplicate-use-state...
  • ef22d25 Merge pull request #13060 from danog/upgrading-to-psalm-7-docs
  • 4c82e11 style(tests): import DIRECTORY_SEPARATOR in NamespaceTest #5364
  • 0f32464 Add the Upgrading to Psalm 7 docs page
  • 60c5f49 fix(parser): report duplicate use imports as ParseError #5364
  • f8dd6d3 Merge pull request #13058 from danog/announce-discord
  • 529fcb8 Don't announce a release twice on Discord when the job is rerun
  • 20de184 Don't start a docblock line with @​everyone
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the composer-dev-dependencies group with 9 updates
46cdf1f 
Updates the requirements on [vlucas/phpdotenv](https://github.com/phpdotenv/phpdotenv), [codeception/codeception](https://github.com/Codeception/Codeception), [codeception/lib-innerbrowser](https://github.com/Codeception/lib-innerbrowser), [codeception/module-phpbrowser](https://github.com/Codeception/module-phpbrowser), [codeception/module-rest](https://github.com/Codeception/module-rest), [friendsofphp/php-cs-fixer](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer), [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit), [rector/rector](https://github.com/rectorphp/rector) and [vimeo/psalm](https://github.com/vimeo/psalm) to permit the latest version.

Updates `vlucas/phpdotenv` to 5.8.0
- [Release notes](https://github.com/phpdotenv/phpdotenv/releases)
- [Commits](phpdotenv/phpdotenv@v5.6.3...v5.8.0)

Updates `codeception/codeception` to 5.3.7
- [Release notes](https://github.com/Codeception/Codeception/releases)
- [Changelog](https://github.com/Codeception/Codeception/blob/main/CHANGELOG-5.x.md)
- [Commits](Codeception/Codeception@5.3.5...5.3.7)

Updates `codeception/lib-innerbrowser` to 4.1.1
- [Release notes](https://github.com/Codeception/lib-innerbrowser/releases)
- [Commits](Codeception/lib-innerbrowser@4.1.0...4.1.1)

Updates `codeception/module-phpbrowser` to 4.1.0
- [Release notes](https://github.com/Codeception/module-phpbrowser/releases)
- [Commits](Codeception/module-phpbrowser@4.0.0...4.1.0)

Updates `codeception/module-rest` to 3.4.4
- [Release notes](https://github.com/Codeception/module-rest/releases)
- [Commits](Codeception/module-rest@3.4.3...3.4.4)

Updates `friendsofphp/php-cs-fixer` to 3.95.27
- [Release notes](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases)
- [Changelog](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/blob/master/CHANGELOG.md)
- [Commits](PHP-CS-Fixer/PHP-CS-Fixer@v3.95.1...v3.95.27)

Updates `phpunit/phpunit` to 13.4.6
- [Release notes](https://github.com/sebastianbergmann/phpunit/releases)
- [Changelog](https://github.com/sebastianbergmann/phpunit/blob/13.4.6/ChangeLog-13.4.md)
- [Commits](sebastianbergmann/phpunit@11.5.55...13.4.6)

Updates `rector/rector` to 2.8.3
- [Release notes](https://github.com/rectorphp/rector/releases)
- [Commits](rectorphp/rector@2.4.2...2.8.3)

Updates `vimeo/psalm` to 7.0.0
- [Release notes](https://github.com/vimeo/psalm/releases)
- [Commits](vimeo/psalm@6.16.1...7.0.0)

---
updated-dependencies:
- dependency-name: vlucas/phpdotenv
  dependency-version: 5.8.0
  dependency-type: direct:development
  dependency-group: composer-dev-dependencies
- dependency-name: codeception/codeception
  dependency-version: 5.3.7
  dependency-type: direct:development
  dependency-group: composer-dev-dependencies
- dependency-name: codeception/lib-innerbrowser
  dependency-version: 4.1.1
  dependency-type: direct:development
  dependency-group: composer-dev-dependencies
- dependency-name: codeception/module-phpbrowser
  dependency-version: 4.1.0
  dependency-type: direct:development
  dependency-group: composer-dev-dependencies
- dependency-name: codeception/module-rest
  dependency-version: 3.4.4
  dependency-type: direct:development
  dependency-group: composer-dev-dependencies
- dependency-name: friendsofphp/php-cs-fixer
  dependency-version: 3.95.27
  dependency-type: direct:development
  dependency-group: composer-dev-dependencies
- dependency-name: phpunit/phpunit
  dependency-version: 13.4.6
  dependency-type: direct:development
  dependency-group: composer-dev-dependencies
- dependency-name: rector/rector
  dependency-version: 2.8.3
  dependency-type: direct:development
  dependency-group: composer-dev-dependencies
- dependency-name: vimeo/psalm
  dependency-version: 7.0.0
  dependency-type: direct:development
  dependency-group: composer-dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update Php code labels Nov 9, 2026
@coderabbitai

coderabbitai Bot commented Nov 9, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 4a222ea5-14a2-46cb-9c20-c9b2eb02ed71

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update Php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants