Bump phpunit/phpunit from 7.5.x-dev to 13.1.7

[dependabot]

Bumps phpunit/phpunit from 7.5.x-dev to 13.1.7.

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.1.7

Changed

• Pass LIBXML_NONET when parsing/validating XML configuration files to make explicit that no network I/O is performed
• Verify the result file written by an isolated child process with a random nonce before deserializing it

---

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.1.6

Fixed

• #6590: Silent failure when configuration file is invalid
• #6592: INI metacharacters ; and " are not preserved when forwarding settings to child processes

---

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.1.5

Fixed

• #5860: PHP CLI -d settings are not forwarded to child processes for process isolation
• #6451: Incomplete version in RequiresPhp (e.g. <=8.5) is compared against full PHP version, causing unexpected skips
• #6589: dataSetAsStringWithData() raises "float is not representable as int" warning for large floats in data sets

---

Learn how to install or update PHPUnit 13.1 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.1.4

Fixed

• #5993: DefaultJobRunner deadlocks on child processes that write large amounts of stderr output

... (truncated)

Changelog

Sourced from phpunit/phpunit's changelog.

[13.1.7] - 2026-04-18

Changed

• Pass LIBXML_NONET when parsing/validating XML configuration files to make explicit that no network I/O is performed
• Verify the result file written by an isolated child process with a random nonce before deserializing it

[13.1.6] - 2026-04-17

Fixed

• #6590: Silent failure when configuration file is invalid
• #6592: INI metacharacters ; and " are not preserved when forwarding settings to child processes

[13.1.5] - 2026-04-16

Fixed

• #5860: PHP CLI -d settings are not forwarded to child processes for process isolation
• #6451: Incomplete version in RequiresPhp (e.g. <=8.5) is compared against full PHP version, causing unexpected skips
• #6589: dataSetAsStringWithData() raises "float is not representable as int" warning for large floats in data sets

[13.1.4] - 2026-04-15

Fixed

• #5993: DefaultJobRunner deadlocks on child processes that write large amounts of stderr output
• #6465: SAPI-populated $_SERVER entries leak from parent into child process
• #6587: failOnEmptyTestSuite="false" in phpunit.xml is ignored when --group/--filter/--testsuite matches no tests
• #6588: Order of issue baseline entries is not canonicalized

[13.1.3] - 2026-04-13

Fixed

• Regression in XML configuration migration introduced in PHPUnit 12.5.8

[13.1.2] - 2026-04-13

Fixed

• #4571: No warning when --random-order-seed is used when test execution order is not random
• #4975: --filter does not work when filter string starts with #
• #5354: JUnit XML logger does not handle TestSuiteSkipped event
• #6276: Exit with non-zero exit code when explicit test selection (--filter, --group, --testsuite) yields no tests
• #6583: Failing output expectation skips tearDown() and handler restoration, causing subsequent tests to be marked as risky

[13.1.1] - 2026-04-08

Changed

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.