Skip to content

Bump the composer group across 2 directories with 4 updates#105

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/composer/php/cakephp5/composer-4f47a57b31
Open

Bump the composer group across 2 directories with 4 updates#105
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/composer/php/cakephp5/composer-4f47a57b31

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 30, 2026

Bumps the composer group with 2 updates in the /php/cakephp5 directory: phpunit/phpunit and composer/composer.
Bumps the composer group with 1 update in the /php/simple directory: nesbot/carbon.

Updates phpunit/phpunit from 10.3.5 to 10.5.62

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 10.5.62

Changed

  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

Learn how to install or update PHPUnit 10.5 in the documentation.

Keep up to date with PHPUnit:

PHPUnit 10.5.61

Changed

  • PHPUnit\Framework\MockObject exceptions are now subtypes of PHPUnit\Exception

Learn how to install or update PHPUnit 10.5 in the documentation.

Keep up to date with PHPUnit:

PHPUnit 10.5.60

  • No changes; phpunit.phar rebuilt with PHP 8.4 to work around PHP-Scoper issue #1139

Learn how to install or update PHPUnit 10.5 in the documentation.

Keep up to date with PHPUnit:

PHPUnit 10.5.59

Changed

  • #6338: Removed code from PHPUnit\Runner\TestSuiteSorter that was only used in the tests for this class
  • Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

Learn how to install or update PHPUnit 10.5 in the documentation.

... (truncated)

Changelog

Sourced from phpunit/phpunit's changelog.

[10.5.62] - 2026-01-27

Changed

  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

[10.5.61] - 2026-01-24

Changed

  • PHPUnit\Framework\MockObject exceptions are now subtypes of PHPUnit\Exception

[10.5.60] - 2025-12-06

  • No changes; phpunit.phar rebuilt with PHP 8.4 to work around PHP-Scoper issue #1139

[10.5.59] - 2025-12-01

Changed

  • #6338: Removed code from PHPUnit\Runner\TestSuiteSorter that was only used in the tests for this class
  • Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

[10.5.58] - 2025-09-28

Fixed

  • #6368: failOnPhpunitWarning="false" has no effect

[10.5.57] - 2025-09-24

  • No changes; phpunit.phar rebuilt with updated dependencies

[10.5.56] - 2025-09-23

  • No changes; phpunit.phar rebuilt with updated dependencies

[10.5.55] - 2025-09-14

Changed

  • #6366: Exclude __sleep() and __wakeup() from test double code generation on PHP >= 8.5

[10.5.54] - 2025-09-11

Changed

  • Do not use __sleep() method (which will be deprecated in PHP 8.5)

[10.5.53] - 2025-08-20

... (truncated)

Commits
  • 3f7dd50 Prepare release
  • 9c95cf0 Merge branch '9.6' into 10.5
  • fea0625 Prepare release
  • 1a677f6 Merge branch '8.5' into 9.6
  • 1015741 Prepare release
  • e5cda18 Fix bad merge
  • a8b932b Merge branch '9.6' into 10.5
  • 1cce5f3 Merge branch '8.5' into 9.6
  • 3141742 Do not run PHPT test when its temporary file for code coverage information ex...
  • 0b3170a We do not need to unserialize() objects here
  • Additional commits viewable in compare view

Updates composer/composer from 2.6.3 to 2.9.5

Release notes

Sourced from composer/composer's releases.

2.9.5

  • Added support for new pie download-url-methods (#12727)
  • Fixed detection of 7z when installed as 7za on some linux systems (#12731)
  • Fixed warning because of the symfony/process CVE, 2.9.4 had a workaround already

Full Changelog: composer/composer@2.9.4...2.9.5

2.9.4

  • Added active plugins to the diagnose command output (#12706)
  • Fixed HTTP/3 causing issues with proxies (#12699)
  • Fixed show command regression with long descriptions containing unicode characters (#12704)
  • Fixed regression handling invalid unicode sequences in output (#12707)
  • Fixed git rev-list usages to support older pre-2.33 git versions (#12705)
  • Fixed issue handling paths with = in them on Windows (#12726)

Full Changelog: composer/composer@2.9.3...2.9.4

2.9.3

  • Security: Fixed ANSI sequence injection (GHSA-59pp-r3rg-353g / CVE-2025-67746)
  • Fixed COMPOSER_NO_SECURITY_BLOCKING env var not being respected for updates done via the install command, and added --no-security-blocking flag to install as well (#12677)
  • Fixed update --lock / update mirrors not working when locked packages contain vulnerabilities (#12645)
  • Fixed client-certificate authentication implementation (#12667)
  • Fixed php-ext schema not being validated in ValidatingArrayLoader (#12694)
  • Fixed crash when --bump-after-update is used and the lock file is disabled (#12660)
  • Fixed support for SecureTransport + LibreSSL on macOS (#12615)
  • Fixed display of reasons for why advisories are ignored (#12668)
  • Fixed compatibility issues when git has log.showSignature enabled (#12666)
  • Fixed curl downloader not retrying when a timeout (err 28) failure occurs (#12662)
  • Fixed EventDispatcher requiring a full Composer instance to function (#12629)

Full Changelog: composer/composer@2.9.2...2.9.3

2.9.2

  • Added new --no-security-blocking flag to disable/configure security blocking (#12617)
  • Added a way to set audit > ignore to act only on audits or only on security blocking (#12618, #12612)
  • Fixed config command not being able to set the new audit settings (#12609)
  • Fixed handling audit.ignore to support CVE ids while doing security blocking, but advisory IDs are still preferred for performance reasons (#12624)
  • Fixed partial updates failing when another package in the lock file has a known security advisory (#12626)

Full Changelog: composer/composer@2.9.1...2.9.2

2.9.1

  • Fixed regression in phpunit binary proxies (#12601)
  • Fixed script handler autoloading issues (#12606)
  • Fixed null call of Command::setDescription in some cases (#12605)
  • Fixed --prefer-lowest builds sometimes failing due to the filtering of versions with known vulnerabilities (#12603)

Full Changelog: composer/composer@2.9.0...2.9.1

2.9.0

... (truncated)

Changelog

Sourced from composer/composer's changelog.

[2.9.5] 2026-01-29

  • Added support for new pie download-url-methods (#12727)
  • Fixed detection of 7z when installed as 7za on some linux systems (#12731)
  • Fixed warning because of the symfony/process CVE, 2.9.4 had a workaround already

[2.9.4] 2026-01-22

  • Added active plugins to the diagnose command output (#12706)
  • Fixed HTTP/3 causing issues with proxies (#12699)
  • Fixed show command regression with long descriptions containing unicode characters (#12704)
  • Fixed regression handling invalid unicode sequences in output (#12707)
  • Fixed git rev-list usages to support older pre-2.33 git versions (#12705)
  • Fixed issue handling paths with = in them on Windows (#12726)

[2.9.3] 2025-12-30

  • Security: Fixed ANSI sequence injection (GHSA-59pp-r3rg-353g / CVE-2025-67746)
  • Fixed COMPOSER_NO_SECURITY_BLOCKING env var not being respected for updates done via the install command, and added --no-security-blocking flag to install as well (#12677)
  • Fixed update --lock / update mirrors not working when locked packages contain vulnerabilities (#12645)
  • Fixed client-certificate authentication implementation (#12667)
  • Fixed php-ext schema not being validated in ValidatingArrayLoader (#12694)
  • Fixed crash when --bump-after-update is used and the lock file is disabled (#12660)
  • Fixed support for SecureTransport + LibreSSL on macOS (#12615)
  • Fixed display of reasons for why advisories are ignored (#12668)
  • Fixed compatibility issues when git has log.showSignature enabled (#12666)
  • Fixed curl downloader not retrying when a timeout (err 28) failure occurs (#12662)
  • Fixed EventDispatcher requiring a full Composer instance to function (#12629)

[2.9.2] 2025-11-19

  • Added new --no-security-blocking flag to disable/configure security blocking (#12617)
  • Added a way to set audit > ignore to act only on audits or only on security blocking (#12618, #12612)
  • Fixed config command not being able to set the new audit settings (#12609)
  • Fixed handling audit.ignore to support CVE ids while doing security blocking, but advisory IDs are still preferred for performance reasons (#12624)
  • Fixed partial updates failing when another package in the lock file has a known security advisory (#12626)

[2.9.1] 2025-11-13

  • Fixed regression in phpunit binary proxies (#12601)
  • Fixed script handler autoloading issues (#12606)
  • Fixed null call of Command::setDescription in some cases (#12605)
  • Fixed --prefer-lowest builds sometimes failing due to the filtering of versions with known vulnerabilities (#12603)

[2.9.0] 2025-11-13

  • Fixed a couple minor issues with --bump-after-update (#12598)
  • Various docs fixes

[2.9.0-RC1] 2025-11-07

... (truncated)

Commits

Updates symfony/process from 6.3.4 to 6.4.33

Release notes

Sourced from symfony/process's releases.

v6.4.33

Changelog (symfony/process@v6.4.32...v6.4.33)

v6.4.32

Changelog (symfony/process@v6.4.31...v6.4.32)

v6.4.31

Changelog (symfony/process@v6.4.30...v6.4.31)

v6.4.26

Changelog (symfony/process@v6.4.25...v6.4.26)

v6.4.25

Changelog (symfony/process@v6.4.24...v6.4.25)

v6.4.24

Changelog (symfony/process@v6.4.23...v6.4.24)

  • no significant changes

v6.4.20

Changelog (symfony/process@v6.4.19...v6.4.20)

v6.4.19

Changelog (symfony/process@v6.4.18...v6.4.19)

  • no significant changes

v6.4.15

Changelog (symfony/process@v6.4.14...v6.4.15)

  • no significant changes

v6.4.14

Changelog (symfony/process@v6.4.13...v6.4.14)

... (truncated)

Changelog

Sourced from symfony/process's changelog.

CHANGELOG

7.3

  • Add RunProcessMessage::fromShellCommandline() to instantiate a Process via the fromShellCommandline method

7.1

  • Add Process::setIgnoredSignals() to disable signal propagation to the child process

6.4

  • Add PhpSubprocess to handle PHP subprocesses that take over the configuration from their parent
  • Add RunProcessMessage and RunProcessMessageHandler

5.2.0

  • added Process::setOptions() to set Process specific options
  • added option create_new_console to allow a subprocess to continue to run after the main script exited, both on Linux and on Windows

5.1.0

  • added Process::getStartTime() to retrieve the start time of the process as float

5.0.0

  • removed Process::inheritEnvironmentVariables()
  • removed PhpProcess::setPhpBinary()
  • Process must be instantiated with a command array, use Process::fromShellCommandline() when the command should be parsed by the shell
  • removed Process::setCommandLine()

4.4.0

  • deprecated Process::inheritEnvironmentVariables(): env variables are always inherited.
  • added Process::getLastOutputTime() method

4.2.0

... (truncated)

Commits
  • c46e854 [Process] Fix escaping for MSYS on Windows
  • c593135 [Process] Adjust Process mustRun method phpdoc
  • e579464 [Process] Ignore invalid env var names
  • 8541b73 [Process] Fix dealing with broken stdin pipes
  • 48bad91 Replace __sleep/wakeup() by __(un)serialize() for throwing and internal usages
  • 6be2f0c [Process] Enhance hasSystemCallBeenInterrupted function for non-english locale
  • 6e0026e Fix wrong boolean values
  • 8eb6dc5 CS fixes
  • e2a61c1 fix(process): use a pipe for stderr in pty mode to avoid mixed output between...
  • 7a1c12e [Process] Fix process status tracking
  • Additional commits viewable in compare view

Updates nesbot/carbon from 3.4.0 to 3.8.4

Release notes

Sourced from nesbot/carbon's releases.

3.8.4

Complete commits list: briannesbitt/Carbon@3.8.3...3.8.4

Summary:

  • Validate locale earlier

3.8.3

Complete commits list: briannesbitt/Carbon@3.8.2...3.8.3

Summary:

New Contributors

3.8.2

Complete commits list: briannesbitt/Carbon@3.8.1...3.8.2

Summary:

3.8.1

Complete commits list: briannesbitt/Carbon@3.8.0...3.8.1

Summary:

3.8.0

Complete commits list: briannesbitt/Carbon@3.7.0...3.8.0

Summary:

... (truncated)

Commits
  • 129700e Validate locale earlier
  • f01cfa9 Merge pull request #3125 from briannesbitt/issue/3037-add-psalm-config
  • b81878c Add Psalm config
  • 28fe8d6 Merge pull request #3122 from koprivan/fix-month-names
  • ef30374 add months_standalone and regexp to sk.php
  • 593d8f9 add missing regexp to cs.php
  • 121d9ac Merge pull request #3120 from briannesbitt/job/update-sponsors
  • 66b1be9 Update sponsors
  • b40b832 Merge pull request #3118 from briannesbitt/job/update-sponsors
  • 7f26853 Update sponsors
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the composer group across 2 directories with 4 updates
26b10b4 
Bumps the composer group with 2 updates in the /php/cakephp5 directory: [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit) and [composer/composer](https://github.com/composer/composer).
Bumps the composer group with 1 update in the /php/simple directory: [nesbot/carbon](https://github.com/briannesbitt/Carbon).


Updates `phpunit/phpunit` from 10.3.5 to 10.5.62
- [Release notes](https://github.com/sebastianbergmann/phpunit/releases)
- [Changelog](https://github.com/sebastianbergmann/phpunit/blob/10.5.62/ChangeLog-10.5.md)
- [Commits](sebastianbergmann/phpunit@10.3.5...10.5.62)

Updates `composer/composer` from 2.6.3 to 2.9.5
- [Release notes](https://github.com/composer/composer/releases)
- [Changelog](https://github.com/composer/composer/blob/main/CHANGELOG.md)
- [Commits](composer/composer@2.6.3...2.9.5)

Updates `symfony/process` from 6.3.4 to 6.4.33
- [Release notes](https://github.com/symfony/process/releases)
- [Changelog](https://github.com/symfony/process/blob/8.1/CHANGELOG.md)
- [Commits](symfony/process@v6.3.4...v6.4.33)

Updates `nesbot/carbon` from 3.4.0 to 3.8.4
- [Release notes](https://github.com/briannesbitt/Carbon/releases)
- [Commits](briannesbitt/Carbon@3.4.0...3.8.4)

---
updated-dependencies:
- dependency-name: phpunit/phpunit
  dependency-version: 10.5.62
  dependency-type: direct:development
  dependency-group: composer
- dependency-name: composer/composer
  dependency-version: 2.9.5
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/process
  dependency-version: 6.4.33
  dependency-type: indirect
  dependency-group: composer
- dependency-name: nesbot/carbon
  dependency-version: 3.8.4
  dependency-type: direct:production
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file php Pull requests that update Php code labels Jan 30, 2026
@dependabot dependabot bot mentioned this pull request Jan 30, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update Php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants