Skip to content

Bump the composer group across 2 directories with 4 updates#109

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/php/cakephp5/composer-1e3a4180ad
Open

Bump the composer group across 2 directories with 4 updates#109
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/php/cakephp5/composer-1e3a4180ad

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the composer group with 2 updates in the /php/cakephp5 directory: phpunit/phpunit and composer/composer.
Bumps the composer group with 1 update in the /php/simple directory: nesbot/carbon.

Updates phpunit/phpunit from 10.3.5 to 10.5.62

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 10.5.62

Changed

  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

Learn how to install or update PHPUnit 10.5 in the documentation.

Keep up to date with PHPUnit:

PHPUnit 10.5.61

Changed

  • PHPUnit\Framework\MockObject exceptions are now subtypes of PHPUnit\Exception

Learn how to install or update PHPUnit 10.5 in the documentation.

Keep up to date with PHPUnit:

PHPUnit 10.5.60

  • No changes; phpunit.phar rebuilt with PHP 8.4 to work around PHP-Scoper issue #1139

Learn how to install or update PHPUnit 10.5 in the documentation.

Keep up to date with PHPUnit:

PHPUnit 10.5.59

Changed

  • #6338: Removed code from PHPUnit\Runner\TestSuiteSorter that was only used in the tests for this class
  • Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

Learn how to install or update PHPUnit 10.5 in the documentation.

... (truncated)

Changelog

Sourced from phpunit/phpunit's changelog.

[10.5.62] - 2026-01-27

Changed

  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

[10.5.61] - 2026-01-24

Changed

  • PHPUnit\Framework\MockObject exceptions are now subtypes of PHPUnit\Exception

[10.5.60] - 2025-12-06

  • No changes; phpunit.phar rebuilt with PHP 8.4 to work around PHP-Scoper issue #1139

[10.5.59] - 2025-12-01

Changed

  • #6338: Removed code from PHPUnit\Runner\TestSuiteSorter that was only used in the tests for this class
  • Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

[10.5.58] - 2025-09-28

Fixed

  • #6368: failOnPhpunitWarning="false" has no effect

[10.5.57] - 2025-09-24

  • No changes; phpunit.phar rebuilt with updated dependencies

[10.5.56] - 2025-09-23

  • No changes; phpunit.phar rebuilt with updated dependencies

[10.5.55] - 2025-09-14

Changed

  • #6366: Exclude __sleep() and __wakeup() from test double code generation on PHP >= 8.5

[10.5.54] - 2025-09-11

Changed

  • Do not use __sleep() method (which will be deprecated in PHP 8.5)

[10.5.53] - 2025-08-20

... (truncated)

Commits
  • 3f7dd50 Prepare release
  • 9c95cf0 Merge branch '9.6' into 10.5
  • fea0625 Prepare release
  • 1a677f6 Merge branch '8.5' into 9.6
  • 1015741 Prepare release
  • e5cda18 Fix bad merge
  • a8b932b Merge branch '9.6' into 10.5
  • 1cce5f3 Merge branch '8.5' into 9.6
  • 3141742 Do not run PHPT test when its temporary file for code coverage information ex...
  • 0b3170a We do not need to unserialize() objects here
  • Additional commits viewable in compare view

Updates composer/composer from 2.6.3 to 2.9.7

Release notes

Sourced from composer/composer's releases.

2.9.7

  • Fixes regression calling custom script command aliases that are called a substring of a composer command (#12802)

Full Changelog: composer/composer@2.9.6...2.9.7

2.9.6

  • Security: Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q / CVE-2026-40261)
  • Security: Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p / CVE-2026-40176)
  • Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
  • Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
  • Security: Fixed Perforce unescaped user input in queryP4User shell command (ef3fc088)
  • Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with - do not cause issues (6621d45, d836b90, 5e08c764)
  • Fixed inconsistent treatment of SingleCommandApplication script commands wrt autoloading (#12758)
  • Fixed GitHub API authentication errors not being visible to the user (#12737)
  • Fixed some platform package parsing failing when Composer runs in web SAPIs (#12735)
  • Fixed error reporting for clarity when a constraint cannot be parsed (#12743)

Full Changelog: composer/composer@2.9.5...2.9.6

2.9.5

  • Added support for new pie download-url-methods (#12727)
  • Fixed detection of 7z when installed as 7za on some linux systems (#12731)
  • Fixed warning because of the symfony/process CVE, 2.9.4 had a workaround already

Full Changelog: composer/composer@2.9.4...2.9.5

2.9.4

  • Added active plugins to the diagnose command output (#12706)
  • Fixed HTTP/3 causing issues with proxies (#12699)
  • Fixed show command regression with long descriptions containing unicode characters (#12704)
  • Fixed regression handling invalid unicode sequences in output (#12707)
  • Fixed git rev-list usages to support older pre-2.33 git versions (#12705)
  • Fixed issue handling paths with = in them on Windows (#12726)

Full Changelog: composer/composer@2.9.3...2.9.4

2.9.3

  • Security: Fixed ANSI sequence injection (GHSA-59pp-r3rg-353g / CVE-2025-67746)
  • Fixed COMPOSER_NO_SECURITY_BLOCKING env var not being respected for updates done via the install command, and added --no-security-blocking flag to install as well (#12677)
  • Fixed update --lock / update mirrors not working when locked packages contain vulnerabilities (#12645)
  • Fixed client-certificate authentication implementation (#12667)
  • Fixed php-ext schema not being validated in ValidatingArrayLoader (#12694)
  • Fixed crash when --bump-after-update is used and the lock file is disabled (#12660)
  • Fixed support for SecureTransport + LibreSSL on macOS (#12615)
  • Fixed display of reasons for why advisories are ignored (#12668)
  • Fixed compatibility issues when git has log.showSignature enabled (#12666)
  • Fixed curl downloader not retrying when a timeout (err 28) failure occurs (#12662)
  • Fixed EventDispatcher requiring a full Composer instance to function (#12629)

Full Changelog: composer/composer@2.9.2...2.9.3

... (truncated)

Changelog

Sourced from composer/composer's changelog.

[2.9.7] 2026-04-14

  • Fixes regression calling custom script command aliases that are called a substring of a composer command (#12802)

[2.9.6] 2026-04-14

  • Security: Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q / CVE-2026-40261)
  • Security: Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p / CVE-2026-40176)
  • Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
  • Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
  • Security: Fixed Perforce unescaped user input in queryP4User shell command (ef3fc088)
  • Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with - do not cause issues (6621d45, d836b90, 5e08c764)
  • Fixed inconsistent treatment of SingleCommandApplication script commands wrt autoloading (#12758)
  • Fixed GitHub API authentication errors not being visible to the user (#12737)
  • Fixed some platform package parsing failing when Composer runs in web SAPIs (#12735)
  • Fixed error reporting for clarity when a constraint cannot be parsed (#12743)

[2.9.5] 2026-01-29

  • Added support for new pie download-url-methods (#12727)
  • Fixed detection of 7z when installed as 7za on some linux systems (#12731)
  • Fixed warning because of the symfony/process CVE, 2.9.4 had a workaround already

[2.9.4] 2026-01-22

  • Added active plugins to the diagnose command output (#12706)
  • Fixed HTTP/3 causing issues with proxies (#12699)
  • Fixed show command regression with long descriptions containing unicode characters (#12704)
  • Fixed regression handling invalid unicode sequences in output (#12707)
  • Fixed git rev-list usages to support older pre-2.33 git versions (#12705)
  • Fixed issue handling paths with = in them on Windows (#12726)

[2.9.3] 2025-12-30

  • Security: Fixed ANSI sequence injection (GHSA-59pp-r3rg-353g / CVE-2025-67746)
  • Fixed COMPOSER_NO_SECURITY_BLOCKING env var not being respected for updates done via the install command, and added --no-security-blocking flag to install as well (#12677)
  • Fixed update --lock / update mirrors not working when locked packages contain vulnerabilities (#12645)
  • Fixed client-certificate authentication implementation (#12667)
  • Fixed php-ext schema not being validated in ValidatingArrayLoader (#12694)
  • Fixed crash when --bump-after-update is used and the lock file is disabled (#12660)
  • Fixed support for SecureTransport + LibreSSL on macOS (#12615)
  • Fixed display of reasons for why advisories are ignored (#12668)
  • Fixed compatibility issues when git has log.showSignature enabled (#12666)
  • Fixed curl downloader not retrying when a timeout (err 28) failure occurs (#12662)
  • Fixed EventDispatcher requiring a full Composer instance to function (#12629)

[2.9.2] 2025-11-19

  • Added new --no-security-blocking flag to disable/configure security blocking (#12617)
  • Added a way to set audit > ignore to act only on audits or only on security blocking (#12618, #12612)

... (truncated)

Commits
  • 82a2fbd Release 2.9.7
  • 02265b2 Update changelog
  • ca0612e Fixes custom script command aliases regression when a script is called a subs...
  • bd695ee Reverting release version changes
  • 9afc32c Release 2.9.6
  • e00073c Fix some perforce type issues
  • 4fcc13d Convert perforce util to use array process args to avoid injections
  • fd82721 Update changelog
  • 15f2541 Fix --no-plugins handling regression in #12758, fixes #12789
  • 4f02616 Merge commit from fork
  • Additional commits viewable in compare view

Updates symfony/process from 6.3.4 to 6.4.33

Release notes

Sourced from symfony/process's releases.

v6.4.33

Changelog (symfony/process@v6.4.32...v6.4.33)

v6.4.32

Changelog (symfony/process@v6.4.31...v6.4.32)

v6.4.31

Changelog (symfony/process@v6.4.30...v6.4.31)

v6.4.26

Changelog (symfony/process@v6.4.25...v6.4.26)

v6.4.25

Changelog (symfony/process@v6.4.24...v6.4.25)

v6.4.24

Changelog (symfony/process@v6.4.23...v6.4.24)

  • no significant changes

v6.4.20

Changelog (symfony/process@v6.4.19...v6.4.20)

v6.4.19

Changelog (symfony/process@v6.4.18...v6.4.19)

  • no significant changes

v6.4.15

Changelog (symfony/process@v6.4.14...v6.4.15)

  • no significant changes

v6.4.14

Changelog (symfony/process@v6.4.13...v6.4.14)

... (truncated)

Changelog

Sourced from symfony/process's changelog.

CHANGELOG

7.3

  • Add RunProcessMessage::fromShellCommandline() to instantiate a Process via the fromShellCommandline method

7.1

  • Add Process::setIgnoredSignals() to disable signal propagation to the child process

6.4

  • Add PhpSubprocess to handle PHP subprocesses that take over the configuration from their parent
  • Add RunProcessMessage and RunProcessMessageHandler

5.2.0

  • added Process::setOptions() to set Process specific options
  • added option create_new_console to allow a subprocess to continue to run after the main script exited, both on Linux and on Windows

5.1.0

  • added Process::getStartTime() to retrieve the start time of the process as float

5.0.0

  • removed Process::inheritEnvironmentVariables()
  • removed PhpProcess::setPhpBinary()
  • Process must be instantiated with a command array, use Process::fromShellCommandline() when the command should be parsed by the shell
  • removed Process::setCommandLine()

4.4.0

  • deprecated Process::inheritEnvironmentVariables(): env variables are always inherited.
  • added Process::getLastOutputTime() method

4.2.0

... (truncated)

Commits
  • c46e854 [Process] Fix escaping for MSYS on Windows
  • c593135 [Process] Adjust Process mustRun method phpdoc
  • e579464 [Process] Ignore invalid env var names
  • 8541b73 [Process] Fix dealing with broken stdin pipes
  • 48bad91 Replace __sleep/wakeup() by __(un)serialize() for throwing and internal usages
  • 6be2f0c [Process] Enhance hasSystemCallBeenInterrupted function for non-english locale
  • 6e0026e Fix wrong boolean values
  • 8eb6dc5 CS fixes
  • e2a61c1 fix(process): use a pipe for stderr in pty mode to avoid mixed output between...
  • 7a1c12e [Process] Fix process status tracking
  • Additional commits viewable in compare view

Updates nesbot/carbon from 3.4.0 to 3.8.4

Release notes

Sourced from nesbot/carbon's releases.

3.8.4

Complete commits list: briannesbitt/Carbon@3.8.3...3.8.4

Summary:

  • Validate locale earlier

3.8.3

Complete commits list: briannesbitt/Carbon@3.8.2...3.8.3

Summary:

New Contributors

3.8.2

Complete commits list: briannesbitt/Carbon@3.8.1...3.8.2

Summary:

3.8.1

Complete commits list: briannesbitt/Carbon@3.8.0...3.8.1

Summary:

3.8.0

Complete commits list: briannesbitt/Carbon@3.7.0...3.8.0

Summary:

... (truncated)

Commits
  • 129700e Validate locale earlier
  • f01cfa9 Merge pull request #3125 from briannesbitt/issue/3037-add-psalm-config
  • b81878c Add Psalm config
  • 28fe8d6 Merge pull request #3122 from koprivan/fix-month-names
  • ef30374 add months_standalone and regexp to sk.php
  • 593d8f9 add missing regexp to cs.php
  • 121d9ac Merge pull request #3120 from briannesbitt/job/update-sponsors
  • 66b1be9 Update sponsors
  • b40b832 Merge pull request #3118 from briannesbitt/job/update-sponsors
  • 7f26853 Update sponsors
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the composer group across 2 directories with 4 updates
a9ce187 
Bumps the composer group with 2 updates in the /php/cakephp5 directory: [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit) and [composer/composer](https://github.com/composer/composer).
Bumps the composer group with 1 update in the /php/simple directory: [nesbot/carbon](https://github.com/briannesbitt/Carbon).


Updates `phpunit/phpunit` from 10.3.5 to 10.5.62
- [Release notes](https://github.com/sebastianbergmann/phpunit/releases)
- [Changelog](https://github.com/sebastianbergmann/phpunit/blob/10.5.62/ChangeLog-10.5.md)
- [Commits](sebastianbergmann/phpunit@10.3.5...10.5.62)

Updates `composer/composer` from 2.6.3 to 2.9.7
- [Release notes](https://github.com/composer/composer/releases)
- [Changelog](https://github.com/composer/composer/blob/main/CHANGELOG.md)
- [Commits](composer/composer@2.6.3...2.9.7)

Updates `symfony/process` from 6.3.4 to 6.4.33
- [Release notes](https://github.com/symfony/process/releases)
- [Changelog](https://github.com/symfony/process/blob/8.1/CHANGELOG.md)
- [Commits](symfony/process@v6.3.4...v6.4.33)

Updates `nesbot/carbon` from 3.4.0 to 3.8.4
- [Release notes](https://github.com/briannesbitt/Carbon/releases)
- [Commits](briannesbitt/Carbon@3.4.0...3.8.4)

---
updated-dependencies:
- dependency-name: phpunit/phpunit
  dependency-version: 10.5.62
  dependency-type: direct:development
  dependency-group: composer
- dependency-name: composer/composer
  dependency-version: 2.9.7
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/process
  dependency-version: 6.4.33
  dependency-type: indirect
  dependency-group: composer
- dependency-name: nesbot/carbon
  dependency-version: 3.8.4
  dependency-type: direct:production
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update Php code labels Apr 14, 2026
@dependabot dependabot Bot mentioned this pull request Apr 14, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update Php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants