Bump the development group across 1 directory with 4 updates

[dependabot]

Bumps the development group with 4 updates in the / directory: phpstan/phpstan, phpstan/phpstan-strict-rules, phpunit/phpunit and squizlabs/php_codesniffer.

Updates phpstan/phpstan from 1.10.36 to 1.12.34

Release notes

Sourced from phpstan/phpstan's releases.

1.12.34

• Revert "Tell coding agent PHPStan 2.x is available" (phpstan/phpstan-src@643c2a3), #14614
• Message from the future (phpstan/phpstan-src@c2fbb22)

1.12.33

Suggest to coding agents that PHPStan 2.x is available to upgrade to from 1.12.x (phpstan/phpstan-src@8c66d82)

1.12.32

Alternative solution to disable cloning with --prefer-source that does not need another repository

1.12.31

Custom Composer source for cloning phpstan/phpstan. Learn more: https://github.com/phpstan/phpstan-phar-composer-source

This hotfix release fixes PHPStan version number in CLI output.

1.12.30

Custom Composer source for cloning phpstan/phpstan. Learn more: https://github.com/phpstan/phpstan-phar-composer-source

1.12.29

Fix PHPStan Pro flickering (phpstan/phpstan-src@90b1048), #13381

1.12.28

Improvements 🔧

• More precise elapsed time if it's a low number (phpstan/phpstan-src@7644bd0)

Bugfixes 🐛

• Fix recursion with object shapes in @property referencing other class and then back in recursive manner (phpstan/phpstan-src@33c2cb1), #13057
• Fix @var PHPDoc type inheritance for class constants (#4008), #10911, thanks @​VincentLanglet!
• Allow getenv(null) for PHP 8.0+ (#4007), #13065, thanks @​VincentLanglet!
• Properly restore error handler for collecting errors (phpstan/phpstan-src@43c44ee)
• Fix infinite recursion with TemplateIterableType (phpstan/phpstan-src@400ba6d), #13218
• Avoid error with constant name $ (#4006), #12095, thanks @​VincentLanglet!
• Array without 0 in key type is not a list (#4018), #9487, thanks @​VincentLanglet!
• Fix HasOffsetValueType::searchArray (#4013), thanks @​VincentLanglet!
• Rework ArrayReplaceFunctionReturnTypeExtension (#3958), #12828, thanks @​VincentLanglet!

Function signature fixes 🤖

• Update PDO errorCode return type (#4005), #12571, thanks @​VincentLanglet!
• Fix return type of bzdecompress() (#4088), thanks @​jlherren!
• Improve mb_convert_encoding return type (#4010), thanks @​VincentLanglet!

Internals 🔍

... (truncated)

Commits

• 4dd89ca PHPStan 1.12.34
• c2fbb22 Updated PHPStan to commit c2fbb2235c20c60bf853ec80ca8ff4c0c4f6e30f
• 37982d6 PHPStan 1.12.33
• 8c66d82 Updated PHPStan to commit 8c66d8255b29e146f6f150abae579f1f6f9170a5
• 2770dcd PHPStan 1.12.32
• b22655c Updated PHPStan to commit b22655c3f410cd3a6a0d69650018c9ad7147dc8c
• 8623477 Alternative solution to disable cloning with --prefer-source that does not ...
• a7630bb PHPStan 1.12.31
• 7ebf37e PHPStan 1.12.30
• e3713dc Custom Composer source for cloning phpstan/phpstan
• Additional commits viewable in compare view

Updates phpstan/phpstan-strict-rules from 1.5.1 to 1.6.2

Release notes

Sourced from phpstan/phpstan-strict-rules's releases.

1.6.2

• b564ca4 - Handle SimpleXMLElement in VariablePropertyFetchRule
• ed6fea0 - Added strictRulesInstalled parameter
• a4a6a08 - Remove dead test because of raised min-php version
• b60bffc - Fix
• 5d50bde - Fix
• 0368403 - Fix
• 1721dbf - Fix after PHPStan update
• e208c93 - Fix after PHPStan update
• 63956f7 - Moved illegalConstructorMethodCall rules from phpstan to phpstan-strict-rules
• ad53bd9 - Remove options removed in PHPStan 2.0
• 914b5e3 - Everything from Bleeding Edge enabled
• 988fab9 - Add more separate rule toggles
• e227ffd - Merge remote-tracking branch 'origin/1.6.x' into 2.0.x
• 90006f2 - Merge branch '1.6.x' into 2.0.x
• 1062d48 - Fix
• 5eec39f - Set polluteScopeWithBlock to false
• 8e2c8b0 - Fix deprecations
• 1ccec91 - Remove unnecessary dependency on nikic/php-parser
• f8092f9 - Update build-cs
• f647999 - Stop testing PHP 7.2 and 7.3
• f6fb84e - Open 2.0.x

1.6.1

• daeec74 - Check if treatPhpDocTypesAsCertain tip is enabled
• 876574c - Fix build
• a567f7b - Pin build-cs
• 2462e57 - Test newer PHP versions

1.6.0

• 363f921 - Update lock-closed-issues.yml
• bd4fada - Merge remote-tracking branch 'origin/1.5.x' into 1.6.x
• c7b4d28 - Merge remote-tracking branch 'origin/1.5.x' into 1.6.x
• 1a51fae - Merge remote-tracking branch 'origin/1.5.x' into 1.6.x
• b5233d5 - Fix build
• d0dc2f0 - Update README.md
• 85fdc50 - Merge remote-tracking branch 'origin/1.5.x' into 1.6.x
• 3d0ba5f - Merge remote-tracking branch 'origin/1.5.x' into 1.6.x
• 3d33475 - Fix UselessCastRuleTest.
• 2bc3967 - Update metcalfc/changelog-generator action to v4.3.1
• 5981dc4 - Update cbrgm/mastodon-github-action action to v2
• 2090cfc - Update metcalfc/changelog-generator action to v4.2.0
• 1b125fb - Update dessant/lock-threads action to v5
• a3b0404 - Merge branch '1.5.x' into 1.6.x
• 3a67365 - Merge branch '1.5.x' into 1.6.x
• 50aab8d - Open 1.6.x-dev
• aeaa022 - Update actions/checkout action to v4
• b7edb14 - Rename abstract OperandInArithmeticIncrementOrDecrementRuleTest
• 88e714c - BooleanInBooleanAndRule, BooleanInBooleanOrRule - different identifier and description for logical operators
• 477f53a - Error identifiers

... (truncated)

Commits

• b564ca4 Handle SimpleXMLElement in VariablePropertyFetchRule
• daeec74 Check if treatPhpDocTypesAsCertain tip is enabled
• 876574c Fix build
• a567f7b Pin build-cs
• 2462e57 Test newer PHP versions
• 363f921 Update lock-closed-issues.yml
• bd4fada Merge remote-tracking branch 'origin/1.5.x' into 1.6.x
• 2e193a0 ArrayFilterStrictRule - get rid of different behavour with `treatPhpDocTypesA...
• c7b4d28 Merge remote-tracking branch 'origin/1.5.x' into 1.6.x
• 8afd4af Loosen up ArrayFilterStrictRule for unions with clearly truthy/falsey types
• Additional commits viewable in compare view

Updates phpunit/phpunit from 9.6.13 to 9.6.36

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 9.6.36

Changed

• Use spl_object_id() instead of spl_object_hash() (which will be deprecated in PHP 8.6)
• Use the error suppression operator (@) when calling DeepCopy\DeepCopy::copy() because it uses spl_object_hash() (which will be deprecated in PHP 8.6)

---

Learn how to install or update PHPUnit 9.6 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 9.6.35

Changed

• #6797: Adapt code generated for test double of interface with constructor for PHP 8.6

---

Learn how to install or update PHPUnit 9.6 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 9.6.34

Fixed

• Regression introduced in PHPUnit 9.6.33

---

Learn how to install or update PHPUnit 9.6 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 9.6.33

Changed

• To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

---

... (truncated)

Changelog

Sourced from phpunit/phpunit's changelog.

[9.6.36] - 2026-08-11

Changed

• Use spl_object_id() instead of spl_object_hash() (which will be deprecated in PHP 8.6)
• Use the error suppression operator (@) when calling DeepCopy\DeepCopy::copy() because it uses spl_object_hash() (which will be deprecated in PHP 8.6)

[9.6.35] - 2026-07-06

Changed

• #6797: Adapt code generated for test double of interface with constructor for PHP 8.6

[9.6.34] - 2026-01-27

Fixed

• Regression introduced in PHPUnit 9.6.33

[9.6.33] - 2026-01-27

Changed

• To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

[9.6.32] - 2026-01-24

Changed

• PHPUnit\Framework\MockObject exceptions are now subtypes of PHPUnit\Exception

[9.6.31] - 2025-12-06

• No changes; phpunit.phar rebuilt with PHP 8.4 to work around PHP-Scoper issue #1139

[9.6.30] - 2025-12-01

Changed

• Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

[9.6.29] - 2025-09-24

• No changes; phpunit.phar rebuilt with updated dependencies

[9.6.28] - 2025-09-23

• No changes; phpunit.phar rebuilt with updated dependencies

[9.6.27] - 2025-09-14

... (truncated)

Commits

• abab27e Prepare release
• 0f2534e Merge branch '8.5' into 9.6
• 416a546 Prepare release
• 5a107b8 Use spl_object_id() instead of spl_object_hash() which is deprecated in PHP 8.6
• 752b775 Update dependencies
• 6d4bde7 Update github-actions
• 1d44ec6 Update dependency seld/phar-utils to ^1.2.2
• bb949f1 Update github-actions
• 4efef5e Update dependency seld/phar-utils to ^1.2.2
• b760399 Sync PHP settings
• Additional commits viewable in compare view

Updates squizlabs/php_codesniffer from 3.7.2 to 3.13.6

Commits

• See full diff in compare view