build(deps-dev): bump phpunit/phpunit from 12.5.33 to 13.3.0 in /tools/phpunit

[dependabot]

Bumps phpunit/phpunit from 12.5.33 to 13.3.0.

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.3.0

Added

• #3794: Filesystem-based code coverage targeting
• #5758: Make export of objects customizable
• #6546: Both property hooks can now be configured on test doubles of virtual hooked properties, even when the doubled property only declares one of them
• #6586: Custom code coverage driver support
• #6591: Repeated test execution using --repeat CLI option and #[Repeat] attribute
• #6701: Allow expectOutputString() and expectOutputRegex() to be combined and repeated
• #6710: Deprecation Filters
• #6722: Allow #[CoversNothing] on methods
• #6742: Retry failing tests up to N times using --retry CLI option #[Retry] attribute
• #6827: Customize which deprecation trigger types fail the test run
• #6830: Warn when failOnAllIssues="true" is combined with an explicitly disabled fine-grained failOn* setting
• #6832: Allow doubling properties that do not declare property hooks
• #6853: Optionally warn when PHP is not configured for development
• [phpunit/php-code-coverage #1140](sebastianbergmann/php-code-coverage#1140): Class-oriented HTML report
• [phpunit/php-code-coverage #1141](sebastianbergmann/php-code-coverage#1141): Improve visualization of branch coverage and path coverage in the HTML report
• [phpunit/php-code-coverage #1153](sebastianbergmann/php-code-coverage#1153): Filter HTML code coverage report by test size
• --record-test-run-history and --do-not-record-test-run-history CLI options as well as the recordTestRunHistory attribute for the XML configuration file to control whether the status and duration of each test are recorded for use by --order-by defects and --order-by duration-*
• --without-class-view CLI option and classView attribute for the XML configuration file to disable the class-oriented view in the HTML code coverage report
• --without-file-view CLI option and fileView attribute for the XML configuration file to disable the file-oriented view in the HTML code coverage report
• {PWD} is now substituted with the directory of the PHPT test file in --ENV-- and --INI-- sections of PHPT test files
• {TMP} (system directory for temporary files) and {ENV:name} (value of environment variable name) are now substituted in --INI-- sections of PHPT test files
• A PHPT test whose --INI-- section references an environment variable that is not set is now skipped
• A --SKIPIF-- section of a PHPT test file that prints xfail <reason> now marks the test as expected to fail, as if the PHPT test file had an --XFAIL-- section with that reason

Changed

• [phpunit/php-code-coverage #1231](sebastianbergmann/php-code-coverage#1231): Identify dead code using static analysis
• [phpunit/php-code-coverage #1259](sebastianbergmann/php-code-coverage#1259): Degrade gracefully when a source file cannot be parsed
• The test runner no longer crashes when an attribute cannot be instantiated
• Improved TestDox HTML report
• The feature formerly named "test result cache" is now named "test run history"; when a cache directory is configured, the file it is stored in is now named test-run-history instead of test-results
• The test runner warns now when ordering by defects or duration is configured but recording of the test run history is disabled
• TestCase no longer captures error_log() output for tests that do not use expectErrorLog(), avoiding the cost of setting up error log redirection for every test
• error_log() output from tests without an expectation is no longer echoed (date-stripped) to PHPUnit's output; it goes to the configured error log again, as it did before capture was introduced
• A test running in process isolation that calls error_log() without expectErrorLog() now produces stderr output in the child process, which the test runner reports as a test error
• A PHPT test that is expected to fail (--XFAIL-- section or xfail output from the --SKIPIF-- section) but passes is now considered risky; this usually means the expected-failure marker is stale and should be removed
• A PHPT test whose --SKIPIF-- section produces output that is not recognized is now considered risky; this usually means the skip check itself is broken. The keywords understood by PHP's own test runner that have no PHPUnit counterpart (info, warn, xleak, flaky, and nocache) are tolerated and do not make the test risky
• PHPT tests now run with additional INI defaults for deterministic output (date.timezone=UTC, display_startup_errors=1, fatal_error_backtraces=Off, ignore_repeated_errors=0, precision=14, serialize_precision=-1), consistent with PHP's own test runner; all of them can be overridden per test using the --INI-- section

Deprecated

• --cache-result CLI option, use --record-test-run-history instead
• --do-not-cache-result CLI option, use --do-not-record-test-run-history instead
• cacheResult XML configuration attribute, use recordTestRunHistory instead
• PHPUnit\TextUI\Configuration\Configuration::cacheResult(), use PHPUnit\TextUI\Configuration\Configuration::recordTestRunHistory() instead
• PHPUnit\TextUI\Configuration\Configuration::testResultCacheFile(), use PHPUnit\TextUI\Configuration\Configuration::testRunHistoryFile() instead

... (truncated)

Changelog

Sourced from phpunit/phpunit's changelog.

[13.3.0] - 2026-08-07

Added

• #3794: Filesystem-based code coverage targeting
• #5758: Make export of objects customizable
• #6546: Both property hooks can now be configured on test doubles of virtual hooked properties, even when the doubled property only declares one of them
• #6586: Custom code coverage driver support
• #6591: Repeated test execution using --repeat CLI option and #[Repeat] attribute
• #6701: Allow expectOutputString() and expectOutputRegex() to be combined and repeated
• #6710: Deprecation Filters
• #6722: Allow #[CoversNothing] on methods
• #6742: Retry failing tests up to N times using --retry CLI option #[Retry] attribute
• #6827: Customize which deprecation trigger types fail the test run
• #6830: Warn when failOnAllIssues="true" is combined with an explicitly disabled fine-grained failOn* setting
• #6832: Allow doubling properties that do not declare property hooks
• #6853: Optionally warn when PHP is not configured for development
• [phpunit/php-code-coverage #1140](sebastianbergmann/php-code-coverage#1140): Class-oriented HTML report
• [phpunit/php-code-coverage #1141](sebastianbergmann/php-code-coverage#1141): Improve visualization of branch coverage and path coverage in the HTML report
• [phpunit/php-code-coverage #1153](sebastianbergmann/php-code-coverage#1153): Filter HTML code coverage report by test size
• --record-test-run-history and --do-not-record-test-run-history CLI options as well as the recordTestRunHistory attribute for the XML configuration file to control whether the status and duration of each test are recorded for use by --order-by defects and --order-by duration-*
• --without-class-view CLI option and classView attribute for the XML configuration file to disable the class-oriented view in the HTML code coverage report
• --without-file-view CLI option and fileView attribute for the XML configuration file to disable the file-oriented view in the HTML code coverage report
• {PWD} is now substituted with the directory of the PHPT test file in --ENV-- and --INI-- sections of PHPT test files
• {TMP} (system directory for temporary files) and {ENV:name} (value of environment variable name) are now substituted in --INI-- sections of PHPT test files
• A PHPT test whose --INI-- section references an environment variable that is not set is now skipped
• A --SKIPIF-- section of a PHPT test file that prints xfail <reason> now marks the test as expected to fail, as if the PHPT test file had an --XFAIL-- section with that reason

Changed

• [phpunit/php-code-coverage #1231](sebastianbergmann/php-code-coverage#1231): Identify dead code using static analysis
• [phpunit/php-code-coverage #1259](sebastianbergmann/php-code-coverage#1259): Degrade gracefully when a source file cannot be parsed
• The test runner no longer crashes when an attribute cannot be instantiated
• Improved TestDox HTML report
• The feature formerly named "test result cache" is now named "test run history"; when a cache directory is configured, the file it is stored in is now named test-run-history instead of test-results
• The test runner warns now when ordering by defects or duration is configured but recording of the test run history is disabled
• TestCase no longer captures error_log() output for tests that do not use expectErrorLog(), avoiding the cost of setting up error log redirection for every test
• error_log() output from tests without an expectation is no longer echoed (date-stripped) to PHPUnit's output; it goes to the configured error log again, as it did before capture was introduced
• A test running in process isolation that calls error_log() without expectErrorLog() now produces stderr output in the child process, which the test runner reports as a test error
• A PHPT test that is expected to fail (--XFAIL-- section or xfail output from the --SKIPIF-- section) but passes is now considered risky; this usually means the expected-failure marker is stale and should be removed
• A PHPT test whose --SKIPIF-- section produces output that is not recognized is now considered risky; this usually means the skip check itself is broken. The keywords understood by PHP's own test runner that have no PHPUnit counterpart (info, warn, xleak, flaky, and nocache) are tolerated and do not make the test risky
• PHPT tests now run with additional INI defaults for deterministic output (date.timezone=UTC, display_startup_errors=1, fatal_error_backtraces=Off, ignore_repeated_errors=0, precision=14, serialize_precision=-1), consistent with PHP's own test runner; all of them can be overridden per test using the --INI-- section

Deprecated

• --cache-result CLI option, use --record-test-run-history instead
• --do-not-cache-result CLI option, use --do-not-record-test-run-history instead
• cacheResult XML configuration attribute, use recordTestRunHistory instead
• PHPUnit\TextUI\Configuration\Configuration::cacheResult(), use PHPUnit\TextUI\Configuration\Configuration::recordTestRunHistory() instead

... (truncated)

Commits

• 346fcba Prepare release
• 77af2e2 Update dependencies
• 828d62c Restore PCRE backtrack limit so that it does not affect PHPUnit's own regular...
• f121d56 Update dependencies
• 17ac9f6 Only run test that requires PHP 8.5 syntax on PHP 8.5
• 51ece9d Disable PCRE JIT compiler so that the backtrack limit is actually exhausted
• 88e68d1 Ignore (maybe too) defensive code from coverage that cannot be reached
• fdcc32a Add tests
• 1193213 Ignore (maybe too) defensive code from coverage that cannot be reached
• 4d35beb Add tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)