[dependabot]

Bumps the composer-development-tools group with 4 updates: infection/infection, phpstan/phpstan, phpunit/phpunit and rector/rector.

Updates infection/infection from 0.35.5 to 0.35.6

Release notes

Sourced from infection/infection's releases.

0.35.6

Added:

• feat: Add a hint about the config:list-sources command when no sources are found by @​theofidry in infection/infection#3593
• feat(reporter): Explain when no mutations are generated by @​theofidry in infection/infection#3596
• perf(ast): Clone the AST only once per mutant by @​janwaleed09 in infection/infection#3609

Fixed:

• fix(source): Report the read no source found exception by @​theofidry in infection/infection#3595
• fix(phpunit): Select data sets whose names only look like numbers by @​janwaleed09 in infection/infection#3608
• fix(phpunit): Select named data sets on PHPUnit 12.3–12.4.0 by @​theofidry in infection/infection#3612

Internal:

• fix(e2e): restrict PHPUnit 13.3 fixture to patch releases by @​maks-rafalko in infection/infection#3611
• Reuse production mutant code factory in mutator tests by @​maks-rafalko in infection/infection#3610

New Contributors

• @​janwaleed09 made their first contribution in infection/infection#3608

Full Changelog: infection/infection@0.35.5...0.35.6

Commits

• 1b89ae3 fix(phpunit): Select named data sets on PHPUnit 12.3–12.4.0 (#3612)
• ee13c87 perf(ast): Clone the AST only once per mutant (#3609)
• f7a1412 Reuse production mutant code factory in mutator tests (#3610)
• d843653 fix(e2e): restrict PHPUnit 13.3 fixture to patch releases (#3611)
• 7a52ce3 fix(phpunit): Select data sets whose names only look like numbers (#3608)
• fb87644 [Conductor] Update doctrine/lexer to 3.0.3 (#3605)
• 8fc651d [Conductor] Update all of phpstan (#3604)
• c04c33a [Conductor] Update carthage-software/mago to 1.50.0 (#3582)
• 24d3e6e refactor(test-framework): Create PHPUnit through the shared test framework fa...
• b30b09f feat(test-framework): Make test framework factory dependencies explicit (#3562)
• Additional commits viewable in compare view

Updates phpstan/phpstan from 2.2.16 to 2.3.0

Commits

• See full diff in compare view

Updates phpunit/phpunit from 13.3.5 to 13.4.1

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.4.1

Changed

• The Software Bill of Materials (SBOM) embedded in the PHAR now uses CycloneDX 1.7 and provides the NTIA minimum elements as well as the data fields that BSI TR-03183-2 (version 2.1.0) requires for logical and identified components, including component creators, original, distribution and effective licences, source code URIs, and the PHP runtime and its extensions as external components

Fixed

• #7029: TestSuite::runTests() doubles garbage collector time when zend.exception_ignore_args is off
• setUpBeforeClass() and tearDownAfterClass() were run twice for a test class that is the only test class in a test suite of the XML configuration file that has the name of that test class
• Tests could not be run in process isolation when the path of the bootstrap script, the test file, or the directory for temporary files contained a single quote
• Arguments in the --ARGS-- section of a PHPT test that start with - were interpreted by PHP instead of being passed to the test when the test also has a --STDIN-- section
• Recording the tests that passed in a child process copied all tests that had passed so far, which made running many tests in process isolation increasingly slow

---

Learn how to install or update PHPUnit 13.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.4.0

Added

• #6585: executionOrder attribute values and --order-by token lists that spell the order before defects, for example duration-ascending,defects
• #6585: pipeline() on the TestSuite\Sorted event for inspecting which reordering stages were applied
• #6686: Constraint::negatedToString() and Constraint::negatedFailureDescription() for authoring the description of a constraint that is wrapped in LogicalNot
• #6863: Cache which tests a test file contains
• #6957: Allow ordering tests by the time their source files were last modified
• #6958: Select the tests that are in all of several groups
• #6960: Record the order in which methods of mock objects are invoked
• #6964: #[RequiresClass] attribute to skip a test if a class does not exist
• #6995: ChildProcessExtension interface for extensions that need to be bootstrapped in the child process of a test that runs in process isolation
• --coverage-jsonl CLI option and <jsonl> element for the XML configuration file to write a code coverage report in JSONL format, one JSON object per line, that reports uncovered code rather than every executable line
• --timeout CLI option to limit the wall-clock time of the entire test run
• requireCoverageMetadataOnSmallTests, requireCoverageMetadataOnMediumTests, and requireCoverageMetadataOnLargeTests attributes for the XML configuration file to require code coverage metadata depending on the size of a test; these have precedence over requireCoverageMetadata

Changed

• Output printed by a test is now shown in the compact output as a --- OUTPUT: record that is attributed to the test instead of being passed through unformatted; the record is omitted when beStrictAboutOutputDuringTests or --disallow-test-output already reports the output as risky

Deprecated

• #6585: Writing defects before the order for --order-by and executionOrder, which will change meaning in PHPUnit 14
• #6585: depends and no-depends for --order-by and executionOrder
• #6585: Configuring more than one order for --order-by and executionOrder
• #6585: Unknown values for the executionOrder XML configuration attribute, which are currently ignored
• #6686: Constraint::failureDescriptionInContext() and LogicalNot::negate()
• #6999: Class-level #[Group], #[Ticket], #[Small], #[Medium], and #[Large] on parent classes of test classes

... (truncated)

Changelog

Sourced from phpunit/phpunit's changelog.

[13.4.1] - 2026-10-05

Changed

• The Software Bill of Materials (SBOM) embedded in the PHAR now uses CycloneDX 1.7 and provides the NTIA minimum elements as well as the data fields that BSI TR-03183-2 (version 2.1.0) requires for logical and identified components, including component creators, original, distribution and effective licences, source code URIs, and the PHP runtime and its extensions as external components

Fixed

• #7029: TestSuite::runTests() doubles garbage collector time when zend.exception_ignore_args is off
• setUpBeforeClass() and tearDownAfterClass() were run twice for a test class that is the only test class in a test suite of the XML configuration file that has the name of that test class
• Tests could not be run in process isolation when the path of the bootstrap script, the test file, or the directory for temporary files contained a single quote
• Arguments in the --ARGS-- section of a PHPT test that start with - were interpreted by PHP instead of being passed to the test when the test also has a --STDIN-- section
• Recording the tests that passed in a child process copied all tests that had passed so far, which made running many tests in process isolation increasingly slow

[13.4.0] - 2026-10-02

Added

• #6585: executionOrder attribute values and --order-by token lists that spell the order before defects, for example duration-ascending,defects
• #6585: pipeline() on the TestSuite\Sorted event for inspecting which reordering stages were applied
• #6686: Constraint::negatedToString() and Constraint::negatedFailureDescription() for authoring the description of a constraint that is wrapped in LogicalNot
• #6863: Cache which tests a test file contains
• #6957: Allow ordering tests by the time their source files were last modified
• #6958: Select the tests that are in all of several groups
• #6960: Record the order in which methods of mock objects are invoked
• #6964: #[RequiresClass] attribute to skip a test if a class does not exist
• #6995: ChildProcessExtension interface for extensions that need to be bootstrapped in the child process of a test that runs in process isolation
• --coverage-jsonl CLI option and <jsonl> element for the XML configuration file to write a code coverage report in JSONL format, one JSON object per line, that reports uncovered code rather than every executable line
• --timeout CLI option to limit the wall-clock time of the entire test run
• requireCoverageMetadataOnSmallTests, requireCoverageMetadataOnMediumTests, and requireCoverageMetadataOnLargeTests attributes for the XML configuration file to require code coverage metadata depending on the size of a test; these have precedence over requireCoverageMetadata

Changed

• Output printed by a test is now shown in the compact output as a --- OUTPUT: record that is attributed to the test instead of being passed through unformatted; the record is omitted when beStrictAboutOutputDuringTests or --disallow-test-output already reports the output as risky

Deprecated

• #6585: Writing defects before the order for --order-by and executionOrder, which will change meaning in PHPUnit 14
• #6585: depends and no-depends for --order-by and executionOrder
• #6585: Configuring more than one order for --order-by and executionOrder
• #6585: Unknown values for the executionOrder XML configuration attribute, which are currently ignored
• #6686: Constraint::failureDescriptionInContext() and LogicalNot::negate()
• #6999: Class-level #[Group], #[Ticket], #[Small], #[Medium], and #[Large] on parent classes of test classes

Fixed

• Issues that are listed in the baseline are not ignored for tests that are run in a separate process
• A test that is run in process isolation aborts the test run when its result cannot be unserialized, for instance because it returns an object that holds a test double
• A test that uses #[DataProviderClosure] errors when it is run in process isolation

... (truncated)

Commits

• ccde403 Prepare release
• 7f315af Merge branch '12.5' into 13.4
• 1e87ad8 Prepare release
• 80758d0 Merge branch '11.5' into 12.5
• 36b75bf Prepare release
• 43b38ce Merge branch '10.5' into 11.5
• 747c988 Prepare release
• a7d6e8b Merge branch '9.6' into 10.5
• 8b5f757 Prepare release
• d2e3381 Merge branch '8.5' into 9.6
• Additional commits viewable in compare view

Updates rector/rector from 2.6.7 to 2.7.0

Release notes

Sourced from rector/rector's releases.

Released Rector 2.7

New Rules ✨

• Add TernaryToNullsafeCoalesceRector (#8499)
• Add BoolReturnTypeFromBooleanConstAndStrictReturnsRector for mixed const + strict bool returns (#8498)
• Add ConstructorReadonlyAssignToDefaultRector for readonly property defaults (#8502)
• Add RemoveOverriddenAssignBeforeIfElseRector (#8505)

Performance Improvements 🚀

• Cache class-like name resolution per file version in ShortNameResolver, so name import no longer rescans the whole file for every name - up to ~24 % fewer CPU instructions on large projects (#8524)
• Cache dry-run files whose FileDiff has no content change (#8523)
• Key the file cache on project-relative paths, so a cache survives a change of checkout (#8490)
• Use FileSystem::writeAtomic() in FileCacheStorage to avoid partial cache reads on parallel runs (#8520)
• Terminate timed-out and unconnected workers (#8522)
• Fix silently skipped files when the only worker is respawned (#8521)
• Give the worker the same NDJSON frame limit as the main process (#8489)
• Bump to PHPStan 2.3

Bugfixes 🐛

• RenamePropertyRector: rename the property both in the trait and in the class property itself (#8518)
• RenameClassRector: throw on same old and new class in the configuration (#8515)
• ScalarParamTypeByMethodCallTypeRector: skip string param inference to avoid unsafe scalar coercion (#8514)
• RepeatedAndNotEqualToNotInArrayRector / RepeatedOrEqualToInArrayRector: skip short-circuit dependent values (#8516)
• SeparateMultiUseImportsRector: keep trait use adaptations (#8510)
• Privatize*Rector: drop the final flag when changing protected to private, since private final is forbidden on PHP 8.4 (#8509)
• AddNameToBooleanArgumentRector / AddNameToNullArgumentRector: skip callees marked @no-named-arguments (#8508)
• TypedPropertyFromStrictConstructorRector: skip a protected property redeclared in a child class (#8503)
• RemoveAlwaysTrueIfConditionRector: skip a maybe-undefined variable (#8501)
• SingularSwitchToIfRector: skip nested break/continue in the case body (#8500)
• TypeDeclaration: skip redundant intersection types in union return types (#8527)
• Naming: keep mass nouns ending in data/info untouched when singularizing (#8492)

rector-doctrine 🟠

• Add DoctrineQueryBuilderSortDirectionRector (#524)
• Add DoctrineOrderByAttributeSortDirectionRector (#525)
• Register the SortDirection rules in the composer-based set and cover Expr\OrderBy::add() (#530)
• CorrectDefaultTypesOnEntityPropertyRector: support properties initialized as int (#526)

rector-symfony 🎵

... (truncated)

Commits

• 4d6a39b Rector 2.7.0
• a2c8963 Updated Rector to commit 33926fa99a7ee6c86f4d7dcb16101bf5304c8edf
• 47fb3a7 Updated Rector to commit b4d80f41ff90e2ab3cb511d466097ceae767053a
• ec544a4 Updated Rector to commit b4d80f41ff90e2ab3cb511d466097ceae767053a
• e2a1ac1 Updated Rector to commit 09b71bd39460a5daaf9b754b4ebcaecfc0fce3d4
• 0f75a58 Updated Rector to commit c5254e7c8c9b14e750c3e726f2c89322d9ad3870
• 89c175c Updated Rector to commit c5254e7c8c9b14e750c3e726f2c89322d9ad3870
• a9294b1 Updated Rector to commit b540db79a8c1f21609c4c51f9fc544cf4f7d6ce7
• 0bc2f0a Updated Rector to commit 9024bc53bf85850634116675a82266b604e06850
• 479e93d Updated Rector to commit 5b56397612aa1bb35636468fa3133d306e6277c5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1edddc2f-f325-48fc-bcaf-f67cb37f5a28

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 60.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.23%. Comparing base (d5b56d8) to head (2abffb7).

Files with missing lines	Patch %	Lines
src/Console/BuildCommand.php	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##             master     #180   +/-   ##
=========================================
  Coverage     72.23%   72.23%           
+ Complexity     3434     3431    -3     
=========================================
  Files           165      165           
  Lines          9486     9486           
=========================================
  Hits           6852     6852           
  Misses         2634     2634           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.