[dependabot]

Bumps phpunit/phpunit from 13.4.3 to 13.4.4.

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.4.4

Fixed

• The TeamCity logger writes testSuiteFinished twice for a test class when one of its before-first-test methods errors or fails
• The TestDox output shows a less important outcome of a test that has more than one outcome, for instance the failure in tearDown() of a test that errored
• When the test run is interrupted by a signal while a test is run in process isolation, the result of the test is discarded and the test is counted as passed, and the TestDox output cannot be printed
• When no static analysis cache directory is configured, the cache directory that is automatically created in the operating system's path used for temporary files is also used when it was created by another user or can be written to by other users
• The directory in the operating system's path used for temporary files in which the temporary files for collecting code coverage for a PHPT test are created has a fixed name, and is also used when it was created by another user, who can then replace the code of the PHPT test before it is executed

---

Learn how to install or update PHPUnit 13.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

Changelog

Sourced from phpunit/phpunit's changelog.

[13.4.4] - 2026-10-27

Fixed

• The TeamCity logger writes testSuiteFinished twice for a test class when one of its before-first-test methods errors or fails
• The TestDox output shows a less important outcome of a test that has more than one outcome, for instance the failure in tearDown() of a test that errored
• When the test run is interrupted by a signal while a test is run in process isolation, the result of the test is discarded and the test is counted as passed, and the TestDox output cannot be printed
• When no static analysis cache directory is configured, the cache directory that is automatically created in the operating system's path used for temporary files is also used when it was created by another user or can be written to by other users
• The directory in the operating system's path used for temporary files in which the temporary files for collecting code coverage for a PHPT test are created has a fixed name, and is also used when it was created by another user, who can then replace the code of the PHPT test before it is executed

Commits

• 71b681a Prepare release
• c056074 Merge branch '12.5' into 13.4
• 191b2e0 Prepare release
• ae31c78 Create the temporary files for collecting code coverage for a PHPT test in a ...
• c4c4f06 Merge branch '12.5' into 13.4
• cf57a7b Only use the automatically created static analysis cache directory when it be...
• 7e2aa07 Update dependency phpstan/phpstan to ^2.3.2
• 76ace48 Update dependency phpstan/phpstan to ^2.3.2
• 42dfc03 Remove deprecated INI settings for PHP versions that are no longer supported
• b0b52a9 Remove tests that require PHP < 8.4 and PHP 8.4 requirements that are no long...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 61dc9805-176f-4675-962e-66411291a1b0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	composer/​phpunit/​phpunit@​13.4.3.0 ⏵ 13.4.4.0

View full report