Update phpunit/phpunit from 8.3.4 to 8.5.46

[violinist-bot]

If you have a high test coverage index, and your tests for this pull request are passing, it should be both safe and recommended to merge this update.

Updated packages

Some times an update also needs new or updated dependencies to be installed. Even if this branch is for updating one dependency, it might contain other installs or updates. All of the updates in this branch can be found here:

• phpdocumentor/reflection-common 1.0.1 (package was removed)
• phpdocumentor/reflection-docblock 4.3.1 (package was removed)
• phpdocumentor/type-resolver 0.4.0 (package was removed)
• phpspec/prophecy 1.8.1 (package was removed)
• webmozart/assert 1.4.0 (package was removed)
• doctrine/instantiator: 1.5.0 (updated from 1.2.0)
• myclabs/deep-copy: 1.13.4 (updated from 1.9.3)
• phar-io/manifest: 2.0.4 (updated from 1.0.3)
• phar-io/version: 3.2.1 (updated from 2.0.1)
• phpunit/php-code-coverage: 7.0.17 (updated from 7.0.7)
• phpunit/php-file-iterator: 2.0.6 (updated from 2.0.2)
• phpunit/php-timer: 2.1.4 (updated from 2.1.2)
• phpunit/php-token-stream: 3.1.3 (updated from 3.1.0)
• phpunit/phpunit: 8.5.46 (updated from 8.3.4)
• sebastian/code-unit-reverse-lookup: 1.0.3 (updated from 1.0.1)
• sebastian/comparator: 3.0.6 (updated from 3.0.2)
• sebastian/diff: 3.0.6 (updated from 3.0.2)
• sebastian/environment: 4.2.5 (updated from 4.2.2)
• sebastian/exporter: 3.1.6 (updated from 3.1.1)
• sebastian/global-state: 3.0.6 (updated from 3.0.0)
• sebastian/object-enumerator: 3.0.5 (updated from 3.0.3)
• sebastian/object-reflector: 1.1.3 (updated from 1.1.1)
• sebastian/recursion-context: 3.0.3 (updated from 3.0.0)
• sebastian/resource-operations: 2.0.3 (updated from 2.0.1)
• sebastian/type: 1.1.5 (updated from 1.1.3)
• theseer/tokenizer: 1.2.3 (updated from 1.1.3)

Working with this branch

If you find you need to update the codebase to be able to merge this branch (for example update some tests or rebuild some assets), please note that violinist will force push to this branch to keep it up to date. This means you should not work on this branch directly, since you might lose your work. Read more about branches created by violinist.io here.

---

This is an automated pull request from Violinist: Continuously and automatically monitor and update your composer dependencies. Have ideas on how to improve this message? All violinist messages are open-source, and can be improved here.

Summary by CodeRabbit

• Chores
  • Updated the development testing framework to the latest 8.5.x release to keep the toolchain current.
• Tests
  • Upgraded the test runner version; no changes to test coverage or behavior.
• Impact
  • No changes to user-facing features or runtime behavior.
  • Improves reliability and compatibility of the development/test environment.

[coderabbitai]

Walkthrough

Updated the development dependency phpunit/phpunit from version 8.3.4 to 8.5.46 in composer.json. No other files or declarations were modified.

Changes

Cohort / File(s)	Summary of Changes
Dev dependency update composer.json	Bumped phpunit/phpunit in require-dev from 8.3.4 to 8.5.46.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

I nudge the tests with gentle might,
A patch of digits, version bright—
From 8.3 to 8.5’s gate,
My whiskers twitch, “Validate!”
Hop, hop, green lights through the night.

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title precisely and concisely summarizes the primary change—upgrading phpunit/phpunit from 8.3.4 to 8.5.46—and matches the composer.json modification and the PR description of an automated Violinist dependency update.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment

Tip

👮 Agentic pre-merge checks are now available in preview!

Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.

• Built-in checks – Quickly apply ready-made checks to enforce title conventions, require pull request descriptions that follow templates, validate linked issues for compliance, and more.
• Custom agentic checks – Define your own rules using CodeRabbit’s advanced agentic capabilities to enforce organization-specific policies and workflows. For example, you can instruct CodeRabbit’s agent to verify that API documentation is updated whenever API schema files are modified in a PR. Note: Upto 5 custom checks are currently allowed during the preview period. Pricing for this feature will be announced in a few weeks.

Please see the documentation for more information.

Example:

reviews:
  pre_merge_checks:
    custom_checks:
      - name: "Undocumented Breaking Changes"
        mode: "warning"
        instructions: |
          Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).

Please share your feedback with us on this Discord post.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (2)

composer.json (2)

23-23: Optional: relax pin to allow future 8.5 patch fixes.

If you’re okay with non-breaking patches, prefer a caret within the same major:

-    "phpunit/phpunit": "8.5.46",
+    "phpunit/phpunit": "^8.5.46",

---

1-31: Optional: declare a PHP platform/require to align dev tools with runtime.

You currently don’t declare "php" in "require". Consider adding one to document supported runtimes and avoid accidental resolver drift locally/CI (choose the correct constraint for the library, not for PHPUnit):

Example:

   "require": {
+    "php": "^7.2 || ^8.0",
     "guzzlehttp/guzzle": "6.3.*",
     "symfony/dotenv": "4.3.*",
     "ext-json": "*"
   },

Only do this if it matches your library’s actual support policy.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 0041136 and c68254f.

⛔ Files ignored due to path filters (1)

• composer.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• composer.json (1 hunks)

🔇 Additional comments (3)

composer.json (3)

17-25: CI matrix is compatible with PHPUnit 8.5 (requires PHP ≥ 7.2).
.travis.yml lists:
php:

• '7.2'
• '7.3'
  No other CI configs found; no PHP ≤ 7.1 in the matrix.

---

17-25: Paratest 3.x compatibility with PHPUnit 8.5.46 — OK

Paratest 3.* targets PHPUnit 8 (mapping 8.* → 3.*), so the current "brianium/paratest": "3.0" in composer.json is compatible with phpunit 8.5.46. Use "brianium/paratest:^3.0" if you want composer to accept all 3.x releases.

---

23-23: Upgrade safe — no Prophecy usage found; add phpspec/prophecy-phpunit only if tests use Prophecy.

composer.lock contains "phpspec/prophecy" as a transitive dependency (composer.lock:968). Repository search for "prophesize" and "ProphecyTrait" returned no matches. If your tests use Prophecy, add to require-dev: "phpspec/prophecy-phpunit": "^2.0".