[dependabot]

Bumps the development group with 6 updates:

Package	From	To
brianium/paratest	7.27.4	7.27.5
phpstan/phpstan-doctrine	2.0.28	2.1.0
phpunit/phpunit	13.4.5	13.4.6
symfony/browser-kit	8.1.10	8.1.11
symfony/web-profiler-bundle	8.1.10	8.1.11
zenstruck/messenger-test	1.15.0	1.15.1

Updates brianium/paratest from 7.27.4 to 7.27.5

Release notes

Sourced from brianium/paratest's releases.

v7.27.5

What's Changed

• Use the static analysis cache when building the merged coverage report by @​simbig in paratestphp/paratest#1155

Full Changelog: paratestphp/paratest@v7.27.4...v7.27.5

Commits

• fe4a1fd Use the static analysis cache when building the merged coverage report (#1155)
• 1ae3b6a Update dependency phpstan/phpstan to ^2.3.2
• See full diff in compare view

Updates phpstan/phpstan-doctrine from 2.0.28 to 2.1.0

Release notes

Sourced from phpstan/phpstan-doctrine's releases.

2.1.0

No Changes.

2.0.29

• 1c3be34 - Return non-generic repository type when repository template is not the entity
• 3981e4f - Update GitHub Actions (#804)
• a6d9d77 - Remove Renovate
• 1ed9816 - Check smallint columns against their signed or unsigned range (#800)
• 70bb12c - Fix order-dependent EntityColumnRuleTest (#802)
• 3729ef0 - Fix build with ORM 3.7 and DBAL 4.5 (#803)
• 66a3297 - Add Amp orb setup script
• a8973cc - Update github-actions (#799)
• 1172aef - Update github-actions (#797)
• eda449c - Update github-actions (#795)
• 06e06a1 - Require PHPStan 2.3.0
• 0398693 - Open 2.1.x-dev
• 7c51d06 - Fix 2.3.x-dev build errors (#793)
• a98f6cb - Update github-actions (#787)
• 2e80171 - Ask the node-callback scope directly instead of toMutatingScope()
• 4fac612 - Update github-actions (#784)
• d3f3d57 - Update github-actions (#783)
• 6871fbd - Update github-actions (#782)
• 8e933fa - perf: Reuse the QueryBuilder ObjectType
• 23878d0 - perf: Check QueryBuilder method names before class hierarchies (#777)
• 14ef8a4 - Update github-actions (#774)

Commits

• 1c3be34 Return non-generic repository type when repository template is not the entity
• 3981e4f Update GitHub Actions (#804)
• a6d9d77 Remove Renovate
• 1ed9816 Check smallint columns against their signed or unsigned range (#800)
• 70bb12c Fix order-dependent EntityColumnRuleTest (#802)
• 3729ef0 Fix build with ORM 3.7 and DBAL 4.5 (#803)
• 66a3297 Add Amp orb setup script
• a8973cc Update github-actions (#799)
• 1172aef Update github-actions (#797)
• eda449c Update github-actions (#795)
• Additional commits viewable in compare view

Updates phpunit/phpunit from 13.4.5 to 13.4.6

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.4.6

Changed

• Issues whose message refers to an anonymous class could not be ignored using a baseline on PHP 8.6 (as of PHP 8.6, such messages contain the full name of the anonymous class: a NUL byte followed by the file, line, and a counter)
• Make PHAR build reproducible across filesystems (files are now added to the PHAR sorted by their path instead of in the order in which the filesystem lists them)

Fixed

• When method() is called for a method of a test double that cannot be configured, for instance because it does not exist, every subsequent invocation of a method of that test double fails with Method name is not configured
• When a hook method of a test, for instance setUp(), marks the test as incomplete, the hook method is reported as failed
• When an "after test" method, for instance tearDown(), marks a successful test as incomplete or skips it, the test is reported as failed
• When a before-first-test method, for instance setUpBeforeClass(), calls markTestIncomplete(), each test of the test class is reported as failed instead of the test class being skipped as it is when markTestSkipped() is called
• When an after-last-test method, for instance tearDownAfterClass(), calls markTestIncomplete() or markTestSkipped() after the tests of the test class have been run, this is reported as a failure, also for each test of the test class that is run in process isolation
• A failed PHP assertion, made using assert(), in a hook method is reported as an error of that method instead of as a failure, and it is counted as an error instead of as a failure when that method is a before-first-test method or an after-last-test method
• When an assertion fails in an "after test" method, for instance tearDown(), of a test that already failed, errored, or was marked as incomplete, a failure is reported in addition to the outcome of the test, so the test is counted more than once and onNotSuccessfulTest() is called with the failure from the "after test" method instead of the test's own
• When a test fails because of an exception of a registered failure type, an error or a failure in an "after test" method, for instance tearDown(), is reported in addition to the test's failure, so the test is counted more than once
• A test that fails because of an exception of a registered failure type is considered risky when it does not perform assertions or, when requireCoverageMetadata="true" is configured, when it does not define a code coverage target, unlike a test that fails because an assertion failed
• The TestDox output does not show the failure of a before-first-test method or an after-last-test method, for instance an assertion failure in setUpBeforeClass()
• Control characters and ANSI escape sequences in user-supplied strings are not made visible in the output of --debug and in the logfiles written by --log-events-text and --log-events-verbose-text
• Groups configured for a test directory or test file using the groups attribute of <directory> or <file> in the XML configuration file are not assigned to PHPT tests, so --group and --exclude-group do not select them and --list-groups and --list-tests-xml report them as being in the default group or not at all

Removed

• The library PHAR (phpunit-library-X.Y.Z.phar) is no longer built, it could not be loaded since PHPUnit 9.5.8

---

Learn how to install or update PHPUnit 13.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

Changelog

Sourced from phpunit/phpunit's changelog.

[13.4.6] - 2026-11-02

Changed

• Issues whose message refers to an anonymous class could not be ignored using a baseline on PHP 8.6 (as of PHP 8.6, such messages contain the full name of the anonymous class: a NUL byte followed by the file, line, and a counter)
• Make PHAR build reproducible across filesystems (files are now added to the PHAR sorted by their path instead of in the order in which the filesystem lists them)

Fixed

• When method() is called for a method of a test double that cannot be configured, for instance because it does not exist, every subsequent invocation of a method of that test double fails with Method name is not configured
• When a hook method of a test, for instance setUp(), marks the test as incomplete, the hook method is reported as failed
• When an "after test" method, for instance tearDown(), marks a successful test as incomplete or skips it, the test is reported as failed
• When a before-first-test method, for instance setUpBeforeClass(), calls markTestIncomplete(), each test of the test class is reported as failed instead of the test class being skipped as it is when markTestSkipped() is called
• When an after-last-test method, for instance tearDownAfterClass(), calls markTestIncomplete() or markTestSkipped() after the tests of the test class have been run, this is reported as a failure, also for each test of the test class that is run in process isolation
• A failed PHP assertion, made using assert(), in a hook method is reported as an error of that method instead of as a failure, and it is counted as an error instead of as a failure when that method is a before-first-test method or an after-last-test method
• When an assertion fails in an "after test" method, for instance tearDown(), of a test that already failed, errored, or was marked as incomplete, a failure is reported in addition to the outcome of the test, so the test is counted more than once and onNotSuccessfulTest() is called with the failure from the "after test" method instead of the test's own
• When a test fails because of an exception of a registered failure type, an error or a failure in an "after test" method, for instance tearDown(), is reported in addition to the test's failure, so the test is counted more than once
• A test that fails because of an exception of a registered failure type is considered risky when it does not perform assertions or, when requireCoverageMetadata="true" is configured, when it does not define a code coverage target, unlike a test that fails because an assertion failed
• The TestDox output does not show the failure of a before-first-test method or an after-last-test method, for instance an assertion failure in setUpBeforeClass()
• Control characters and ANSI escape sequences in user-supplied strings are not made visible in the output of --debug and in the logfiles written by --log-events-text and --log-events-verbose-text
• Groups configured for a test directory or test file using the groups attribute of <directory> or <file> in the XML configuration file are not assigned to PHPT tests, so --group and --exclude-group do not select them and --list-groups and --list-tests-xml report them as being in the default group or not at all

Removed

• The library PHAR (phpunit-library-X.Y.Z.phar) is no longer built, it could not be loaded since PHPUnit 9.5.8

Commits

• 4821376 Prepare release
• 33153c8 Merge branch '12.5' into 13.4
• 1d5a4a3 Prepare release
• 0e18ec2 Update cbrgm/mastodon-github-action action to v2.2.6
• 474dca8 Merge branch '12.5' into 13.4
• 092e177 Make control characters in user-supplied strings visible in the output of --d...
• d65ec81 Merge branch '12.5' into 13.4
• d596570 Merge branch '11.5' into 12.5
• 89a07f0 Merge branch '10.5' into 11.5
• 980dbeb Merge branch '9.6' into 10.5
• Additional commits viewable in compare view

Updates symfony/browser-kit from 8.1.10 to 8.1.11

Release notes

Sourced from symfony/browser-kit's releases.

v8.1.11

Changelog (symfony/browser-kit@v8.1.10...v8.1.11)

• bug #67685 Match cookies across equivalent IPv6 addresses (@​X-Coder264)
• bug #67684 Expire cookies dated at the Unix epoch (@​X-Coder264)

[SECURITY] Security release

Commits

• cc23f40 Merge branch '7.4' into 8.1
• a0d19ca Merge branch '6.4' into 7.4
• abc38d9 [BrowserKit] Match cookies across equivalent IPv6 addresses
• bc31f20 [BrowserKit] Expire cookies dated at the Unix epoch
• See full diff in compare view

Updates symfony/web-profiler-bundle from 8.1.10 to 8.1.11

Release notes

Sourced from symfony/web-profiler-bundle's releases.

v8.1.11

Changelog (symfony/web-profiler-bundle@v8.1.10...v8.1.11)

• bug #67618 Reset the CSP handler between requests (@​norkunas)
• bug #67620 Reset the profiler Twig extension between requests (@​nicolas-grekas)
• bug #67606 Return a 404 when opening the profiler file viewer without a file (@​kevinsleegerslameco, @​nicolas-grekas)

[SECURITY] Security release

Commits

• 8d4af20 Merge branch '7.4' into 8.1
• 5f63273 Merge branch '6.4' into 7.4
• fad4e15 bug #67618 [WebProfilerBundle] Reset the CSP handler between requests (norkunas)
• 0ed73f5 [WebProfilerBundle] Reset the profiler Twig extension between requests
• ab7f514 [WebProfilerBundle] Reset the CSP handler between requests
• 0159f31 Merge branch '7.4' into 8.1
• 66f5a21 Merge branch '6.4' into 7.4
• c95e4db [WebProfilerBundle] Return a 404 when opening the profiler file viewer withou...
• See full diff in compare view

Updates zenstruck/messenger-test from 1.15.0 to 1.15.1

Release notes

Sourced from zenstruck/messenger-test's releases.

v1.15.1

cc7f3ef fix: disable retries through the retry strategy (#109) by @​nikophil, @​kbond 06eda6b fix: avoid mutating the event dispatcher on Symfony 8.2+ (#112) by @​kbond

Full Change List

Changelog

Sourced from zenstruck/messenger-test's changelog.

v1.15.1

October 28th, 2026 - v1.15.0...v1.15.1

• cc7f3ef fix: disable retries through the retry strategy (#109) by @​nikophil, @​kbond
• 06eda6b fix: avoid mutating the event dispatcher on Symfony 8.2+ (#112) by @​kbond

Commits

• ebf4c1b changelog: update [skip ci]
• cc7f3ef fix: disable retries through the retry strategy (#109)
• d3cfa3d bot: fix cs [skip ci]
• 06eda6b fix: avoid mutating the event dispatcher on Symfony 8.2+ (#112)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

✅ PHPUnit Summary

Tests: 624, Assertions: 2530, Skipped: 1.
Time: 04:34.434, Memory: 52.50 MB

✅ No PHPUnit Deprecations Found