update lock clucknut

vendor/phpunit/phpunit/ChangeLog-10.5.md

@@ -2,6 +2,24 @@ # Changes in PHPUnit 10.5
 
 All notable changes of the PHPUnit 10.5 release series are documented in this file using the [Keep a CHANGELOG](https://keepachangelog.com/) principles.
 
+## [10.5.63] - 2026-01-27
+
+### Fixed
+
+* Regression introduced in PHPUnit 9.6.33
+
+## [10.5.62] - 2026-01-27
+
+### Changed
+
+* To prevent Poisoned Pipeline Execution (PPE) attacks using prepared `.coverage` files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs
+
+## [10.5.61] - 2026-01-24
+
+### Changed
+
+* `PHPUnit\Framework\MockObject` exceptions are now subtypes of `PHPUnit\Exception`
+
 ## [10.5.60] - 2025-12-06
 
 * No changes; `phpunit.phar` rebuilt with PHP 8.4 to work around PHP-Scoper issue [#1139](https://github.com/humbug/php-scoper/issues/1139)
@@ -509,6 +527,9 @@ ### Fixed
 
 * [#5563](https://github.com/sebastianbergmann/phpunit/issues/5563): `createMockForIntersectionOfInterfaces()` does not automatically register mock object for expectation verification
 
+[10.5.63]: https://github.com/sebastianbergmann/phpunit/compare/10.5.62...10.5.63
+[10.5.62]: https://github.com/sebastianbergmann/phpunit/compare/10.5.61...10.5.62
+[10.5.61]: https://github.com/sebastianbergmann/phpunit/compare/10.5.60...10.5.61
 [10.5.60]: https://github.com/sebastianbergmann/phpunit/compare/10.5.59...10.5.60
 [10.5.59]: https://github.com/sebastianbergmann/phpunit/compare/10.5.58...10.5.59
 [10.5.58]: https://github.com/sebastianbergmann/phpunit/compare/10.5.57...10.5.58

vendor/phpunit/phpunit/LICENSE

@@ -1,6 +1,6 @@
 BSD 3-Clause License
 
-Copyright (c) 2001-2025, Sebastian Bergmann
+Copyright (c) 2001-2026, Sebastian Bergmann
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

vendor/phpunit/phpunit/composer.json

@@ -39,7 +39,7 @@
         "phpunit/php-timer": "^6.0.0",
         "sebastian/cli-parser": "^2.0.1",
         "sebastian/code-unit": "^2.0.0",
-        "sebastian/comparator": "^5.0.4",
+        "sebastian/comparator": "^5.0.5",
         "sebastian/diff": "^5.1.1",
         "sebastian/environment": "^6.1.0",
         "sebastian/exporter": "^5.1.4",

vendor/phpunit/phpunit/composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "57d0db32e86a80c8096681bddf4bdd30",
+    "content-hash": "8dfe5ace1a29844a4ff8db731eb68f21",
     "packages": [
         {
             "name": "myclabs/deep-copy",
@@ -68,16 +68,16 @@
         },
         {
             "name": "nikic/php-parser",
-            "version": "v5.6.2",
+            "version": "v5.7.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/nikic/PHP-Parser.git",
-                "reference": "3a454ca033b9e06b63282ce19562e892747449bb"
+                "reference": "dca41cd15c2ac9d055ad70dbfd011130757d1f82"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/3a454ca033b9e06b63282ce19562e892747449bb",
-                "reference": "3a454ca033b9e06b63282ce19562e892747449bb",
+                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/dca41cd15c2ac9d055ad70dbfd011130757d1f82",
+                "reference": "dca41cd15c2ac9d055ad70dbfd011130757d1f82",
                 "shasum": ""
             },
             "require": {
@@ -120,9 +120,9 @@
             ],
             "support": {
                 "issues": "https://github.com/nikic/PHP-Parser/issues",
-                "source": "https://github.com/nikic/PHP-Parser/tree/v5.6.2"
+                "source": "https://github.com/nikic/PHP-Parser/tree/v5.7.0"
             },
-            "time": "2025-10-21T19:32:17+00:00"
+            "time": "2025-12-06T11:56:16+00:00"
         },
         {
             "name": "phar-io/manifest",
@@ -733,16 +733,16 @@
         },
         {
             "name": "sebastian/comparator",
-            "version": "5.0.4",
+            "version": "5.0.5",
             "source": {
                 "type": "git",
                 "url": "https://github.com/sebastianbergmann/comparator.git",
-                "reference": "e8e53097718d2b53cfb2aa859b06a41abf58c62e"
+                "reference": "55dfef806eb7dfeb6e7a6935601fef866f8ca48d"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/e8e53097718d2b53cfb2aa859b06a41abf58c62e",
-                "reference": "e8e53097718d2b53cfb2aa859b06a41abf58c62e",
+                "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/55dfef806eb7dfeb6e7a6935601fef866f8ca48d",
+                "reference": "55dfef806eb7dfeb6e7a6935601fef866f8ca48d",
                 "shasum": ""
             },
             "require": {
@@ -798,7 +798,7 @@
             "support": {
                 "issues": "https://github.com/sebastianbergmann/comparator/issues",
                 "security": "https://github.com/sebastianbergmann/comparator/security/policy",
-                "source": "https://github.com/sebastianbergmann/comparator/tree/5.0.4"
+                "source": "https://github.com/sebastianbergmann/comparator/tree/5.0.5"
             },
             "funding": [
                 {
@@ -818,7 +818,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2025-09-07T05:25:07+00:00"
+            "time": "2026-01-24T09:25:16+00:00"
         },
         {
             "name": "sebastian/complexity",

vendor/phpunit/phpunit/src/Event/Emitter/Emitter.php

@@ -19,7 +19,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface Emitter
 {

vendor/phpunit/phpunit/src/Framework/Exception/Incomplete/IncompleteTest.php

@@ -14,7 +14,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface IncompleteTest extends Throwable
 {

vendor/phpunit/phpunit/src/Framework/Exception/Skipped/SkippedTest.php

@@ -14,7 +14,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface SkippedTest extends Throwable
 {

vendor/phpunit/phpunit/src/Framework/MockObject/Exception/Exception.php

@@ -9,13 +9,11 @@
  */
 namespace PHPUnit\Framework\MockObject;
 
-use Throwable;
-
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
-interface Exception extends Throwable
+interface Exception extends \PHPUnit\Exception
 {
 }

vendor/phpunit/phpunit/src/Framework/MockObject/Generator/MockType.php

@@ -12,7 +12,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface MockType
 {

vendor/phpunit/phpunit/src/Framework/MockObject/Runtime/Builder/Identity.php

@@ -12,7 +12,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface Identity
 {

vendor/phpunit/phpunit/src/Framework/MockObject/Runtime/Builder/MethodNameMatch.php

@@ -14,7 +14,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface MethodNameMatch extends ParametersMatch
 {

vendor/phpunit/phpunit/src/Framework/MockObject/Runtime/Builder/ParametersMatch.php

@@ -12,7 +12,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface ParametersMatch extends Stub
 {

vendor/phpunit/phpunit/src/Framework/MockObject/Runtime/Builder/Stub.php

@@ -14,7 +14,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface Stub extends Identity
 {

vendor/phpunit/phpunit/src/Framework/MockObject/Runtime/Stub/Stub.php

@@ -14,7 +14,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface Stub
 {

vendor/phpunit/phpunit/src/Framework/Reorderable.php

@@ -12,7 +12,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface Reorderable
 {

vendor/phpunit/phpunit/src/Framework/TestCase.php

@@ -1869,21 +1869,23 @@ private function compareGlobalStateSnapshots(Snapshot $before, Snapshot $after):
      */
     private function compareGlobalStateSnapshotPart(array $before, array $after, string $header): void
     {
-        if ($before != $after) {
-            $differ   = new Differ(new UnifiedDiffOutputBuilder($header));
-            $exporter = new Exporter;
-
-            Event\Facade::emitter()->testConsideredRisky(
-                $this->valueObjectForEvents(),
-                'This test modified global state but was not expected to do so' . PHP_EOL .
-                trim(
-                    $differ->diff(
-                        $exporter->export($before),
-                        $exporter->export($after),
-                    ),
-                ),
-            );
+        if ($before == $after) {
+            return;
         }
+
+        $differ   = new Differ(new UnifiedDiffOutputBuilder($header));
+        $exporter = new Exporter;
+
+        Event\Facade::emitter()->testConsideredRisky(
+            $this->valueObjectForEvents(),
+            'This test modified global state but was not expected to do so' . PHP_EOL .
+            trim(
+                $differ->diff(
+                    $exporter->export($before),
+                    $exporter->export($after),
+                ),
+            ),
+        );
     }
 
     private function shouldInvocationMockerBeReset(MockObject $mock): bool

vendor/phpunit/phpunit/src/Metadata/Parser/Parser.php

@@ -14,7 +14,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface Parser
 {

vendor/phpunit/phpunit/src/Metadata/RequiresOperatingSystem.php

@@ -25,7 +25,7 @@ final class RequiresOperatingSystem extends Metadata
      * @psalm-param 0|1 $level
      * @psalm-param non-empty-string $operatingSystem
      */
-    public function __construct(int $level, string $operatingSystem)
+    protected function __construct(int $level, string $operatingSystem)
     {
         parent::__construct($level);
 

vendor/phpunit/phpunit/src/Metadata/UsesFunction.php

@@ -25,7 +25,7 @@ final class UsesFunction extends Metadata
      * @psalm-param 0|1 $level
      * @psalm-param non-empty-string $functionName
      */
-    public function __construct(int $level, string $functionName)
+    protected function __construct(int $level, string $functionName)
     {
         parent::__construct($level);
 

vendor/phpunit/phpunit/src/Runner/Exception/CodeCoverageFileExistsException.php

@@ -0,0 +1,21 @@
+<?php declare(strict_types=1);
+/*
+ * This file is part of PHPUnit.
+ *
+ * (c) Sebastian Bergmann <sebastian@phpunit.de>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+namespace PHPUnit\Runner;
+
+use RuntimeException;
+
+/**
+ * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
+ *
+ * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ */
+final class CodeCoverageFileExistsException extends RuntimeException implements Exception
+{
+}

vendor/phpunit/phpunit/src/Runner/Exception/ErrorException.php

@@ -14,7 +14,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 final class ErrorException extends Error implements Exception
 {

vendor/phpunit/phpunit/src/Runner/Exception/Exception.php

@@ -12,7 +12,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface Exception extends \PHPUnit\Exception
 {

vendor/phpunit/phpunit/src/Runner/PhptTestCase.php

@@ -19,6 +19,7 @@
 use function explode;
 use function extension_loaded;
 use function file;
+use function file_exists;
 use function file_get_contents;
 use function file_put_contents;
 use function is_array;
@@ -31,6 +32,7 @@
 use function preg_split;
 use function realpath;
 use function rtrim;
+use function sprintf;
 use function str_contains;
 use function str_replace;
 use function str_starts_with;
@@ -89,7 +91,10 @@ final class PhptTestCase implements Reorderable, SelfDescribing, Test
     public function __construct(string $filename, ?AbstractPhpProcess $phpUtil = null)
     {
         $this->filename = $filename;
-        $this->phpUtil  = $phpUtil ?: AbstractPhpProcess::factory();
+
+        $this->ensureCoverageFileDoesNotExist();
+
+        $this->phpUtil = $phpUtil ?: AbstractPhpProcess::factory();
     }
 
     /**
@@ -654,7 +659,14 @@ private function cleanupForCoverage(): RawCodeCoverageData
         }
 
         if ($buffer !== false) {
-            $coverage = @unserialize($buffer);
+            $coverage = @unserialize(
+                $buffer,
+                [
+                    'allowed_classes' => [
+                        RawCodeCoverageData::class,
+                    ],
+                ],
+            );
 
             if ($coverage === false) {
                 $coverage = RawCodeCoverageData::fromXdebugWithoutPathCoverage([]);
@@ -840,4 +852,22 @@ private function settings(bool $collectCoverage): array
 
         return $settings;
     }
+
+    /**
+     * @throws CodeCoverageFileExistsException
+     */
+    private function ensureCoverageFileDoesNotExist(): void
+    {
+        $files = $this->getCoverageFiles();
+
+        if (file_exists($files['coverage'])) {
+            throw new CodeCoverageFileExistsException(
+                sprintf(
+                    'File %s exists, PHPT test %s will not be executed',
+                    $files['coverage'],
+                    $this->filename,
+                ),
+            );
+        }
+    }
 }

vendor/phpunit/phpunit/src/Runner/ResultCache/ResultCache.php

@@ -14,7 +14,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface ResultCache
 {

vendor/phpunit/phpunit/src/Runner/Version.php

@@ -34,7 +34,7 @@ public static function id(): string
         }
 
         if (self::$version === '') {
-            self::$version = (new VersionId('10.5.60', dirname(__DIR__, 2)))->asString();
+            self::$version = (new VersionId('10.5.63', dirname(__DIR__, 2)))->asString();
         }
 
         return self::$version;

vendor/phpunit/phpunit/src/TextUI/Command/Command.php

@@ -12,7 +12,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface Command
 {

vendor/phpunit/phpunit/src/TextUI/Configuration/Xml/Migration/Migrations/Migration.php

@@ -14,7 +14,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface Migration
 {

vendor/phpunit/phpunit/src/Util/Http/Downloader.php

@@ -12,7 +12,7 @@
 /**
  * @no-named-arguments Parameter names are not covered by the backward compatibility promise for PHPUnit
  *
- * @internal This class is not covered by the backward compatibility promise for PHPUnit
+ * @internal This interface is not covered by the backward compatibility promise for PHPUnit
  */
 interface Downloader
 {

vendor/phpunit/phpunit/src/Util/Xml/Loader.php

@@ -114,7 +114,9 @@ public function load(string $actual, ?string $filename = null): DOMDocument
             }
 
             if ($message === '') {
+                // @codeCoverageIgnoreStart
                 $message = 'Could not load XML for unknown reason';
+                // @codeCoverageIgnoreEnd
             }
 
             throw new XmlException($message);