[dependabot]

Bumps the composer group with 6 updates in the /agent directory:

Package	From	To
react/http	1.11.0	1.11.1
laravel/pint	1.30.4	1.32.1
phpstan/phpstan	2.2.10	2.3.4
phpunit/phpunit	11.5.50	13.4.5
symfony/process	7.3.11	8.1.10
vlucas/phpdotenv	5.7.0	5.8.0

Updates react/http from 1.11.0 to 1.11.1

Release notes

Sourced from react/http's releases.

v1.11.1

This is a SECURITY release for the 1.x series of ReactPHP's HTTP component.

• Security fix: This release fixes a high severity security issue in ReactPHP's HTTP client and server components that affects all versions between v0.6.0 and v1.11.0. All users are encouraged to upgrade immediately. (GHSA-x424-64qh-5j54 reported by @​jsifuentes and @​raiFork and fixed by @​jsifuentes and @​clue)

• Security fix: This release fixes a high severity security issue in ReactPHP's HTTP client component that affects all versions between v1.0.0 and v1.11.0. All users are encouraged to upgrade immediately. (GHSA-g4f2-2pf3-2pwj reported by @​EQSTLab and fixed by @​WyriHaximus)

• Improve test suite PHP 8.4 and 8.5 compatibility. (#546, #547 and #551 by @​WyriHaximus)

Changelog

Sourced from react/http's changelog.

1.11.1 (2026-09-09)

• Security fix: This release fixes a high severity security issue in ReactPHP's HTTP client and server components that affects all versions between v0.6.0 and v1.11.0. All users are encouraged to upgrade immediately. (GHSA-x424-64qh-5j54 reported and fixed by @​jsifuentes)

• Security fix: This release fixes a high severity security issue in ReactPHP's HTTP client component that affects all versions between v1.0.0 and v1.11.0. All users are encouraged to upgrade immediately. (GHSA-g4f2-2pf3-2pwj reported by @​EQSTLab and fixed by @​WyriHaximus)

• Feature: Improve test suite PHP 8.4 and 8.5 compatibility. (#546, #547, and #551 by @​WyriHaximus)

Commits

• e5b8eb2 Prepare v1.11.1 release
• a7aa204 Merge commit from fork
• c0865b4 Merge commit from fork
• cf55239 Merge pull request #547 from WyriHaximus-labs/1.x-PHP8.5
• 9bfb2de [1.x] Fix reflection setAccessible deprecation warnings
• 2558622 [1.x] Enforce client response max headers size
• 58bc906 Limit ChunkedDecoder trailer size to avoid unbounded buffering
• b6d4688 fix cases where a malformed HTTP request with 'Transfer-Encoding: chunked' co...
• d7e1847 Merge pull request #551 from WyriHaximus-labs/1.x-update-test-environment-for...
• 28f2cfb [1.x] Update test environment for PHP 7.2 to compatible PHPUnit version
• Additional commits viewable in compare view

Updates laravel/pint from 1.30.4 to 1.32.1

Release notes

Sourced from laravel/pint's releases.

v1.32.1

Full Changelog: laravel/pint@v1.32.0...v1.32.1

v1.32.0

Full Changelog: laravel/pint@v1.31.1...v1.32.0

v1.31.1

What's Changed

• deps: composer update by @​calebdw in laravel/pint#489

Full Changelog: laravel/pint@v1.31.0...v1.31.1

v1.31.0

Full Changelog: laravel/pint@v1.30.6...v1.31.0

v1.30.6

• fix: catch \ParseError in PhpFragmentFormatter by @​calebdw in laravel/pint#483
• fix: enable caching when blade formatting is active by @​calebdw in laravel/pint#481
• fix: Support Bun as a JS runtime for Prettier by @​jackbayliss in laravel/pint#488
• fix(blade): keep import-mutating fixers away from raw PHP islands by @​muhannad17 in laravel/pint#487

v1.30.5

What's Changed

• Keep a wrapped attribute's body in place when collapsing the tag by @​lazerg in laravel/pint#479

Full Changelog: laravel/pint@v1.30.4...v1.30.5

Commits

• 006bd78 release: v1.32.1
• 10cc988 fix: never leaves a trailing comma on a multiline directive argument
• dea4e95 release: v1.32.0
• b136ceb release: v1.31.1
• 0f79321 deps: composer update (#489)
• 0730363 release: v1.31.0
• 212fa79 release: v1.30.6
• 830e279 chore: bumps deps
• 7dc4335 merge main
• 8058bed review fixes + edge-case tests
• Additional commits viewable in compare view

Updates phpstan/phpstan from 2.2.10 to 2.3.4

Commits

• See full diff in compare view

Updates phpunit/phpunit from 11.5.50 to 13.4.5

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.4.5

Fixed

• The static analysis cache directory that is automatically created in the operating system's path used for temporary files when no cache directory is configured is not used when the POSIX extension is not loaded

---

Learn how to install or update PHPUnit 13.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.4.4

Fixed

• The TeamCity logger writes testSuiteFinished twice for a test class when one of its before-first-test methods errors or fails
• The TestDox output shows a less important outcome of a test that has more than one outcome, for instance the failure in tearDown() of a test that errored
• When the test run is interrupted by a signal while a test is run in process isolation, the result of the test is discarded and the test is counted as passed, and the TestDox output cannot be printed
• When no static analysis cache directory is configured, the cache directory that is automatically created in the operating system's path used for temporary files is also used when it was created by another user or can be written to by other users
• The directory in the operating system's path used for temporary files in which the temporary files for collecting code coverage for a PHPT test are created has a fixed name, and is also used when it was created by another user, who can then replace the code of the PHPT test before it is executed

---

Learn how to install or update PHPUnit 13.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.4.3

Fixed

• The dependencies of a test that are listed after a dependency on a test that does not return a value, or after a dependency on a larger test, were not checked, so the test was run instead of being skipped when one of these dependencies had not passed
• Tests could not be run in process isolation when the namespace of the test class begins with a name that the code of the child process imports, for instance CodeCoverage or Facade
• A test that is run in process isolation aborts the test run when its data set or a value returned by a test it depends on cannot be serialized, for instance because it is a closure
• When a before-first-test method or an after-last-test method errors or fails, the remaining methods of the same kind are still called, and each of them that does not error or fail itself is reported with the exception of the earlier method
• When a hook method of a test, for instance a #[Before] method, skips the test, the remaining hook methods of the same kind are still called, so the test is reported as errored instead of skipped when one of them errors
• An error or failure in a before-first-test method or an after-last-test method that is called again in the child process of a test that is run in process isolation is reported twice, once for the test class and once for the test
• When a before-first-test method errors, the progress output shows one E for the test class instead of one for each of its tests, only one of its tests is counted as run, and the test that is run next is shown as an error
• When a before-first-test method fails, the progress output shows nothing for the tests of the test class and only one of them is counted as run
• The Open Test Reporting XML logfile has no start for a test that errors before it is prepared, for instance because it depends on a test that does not exist, and no end for the test that is run after a test that is skipped because a test it depends on did not pass or because one of its requirements is not met
• The Open Test Reporting XML logfile has no entry for a test that is marked as incomplete before it is prepared, for instance in setUp(), and reports the test that is run after it as aborted with the message of the incomplete test
• The Open Test Reporting XML logfile has no end for the test that is run after a test whose preparation errors, for instance because setUp() raises an exception or the global state cannot be backed up
• The Open Test Reporting XML logfile reports a test that has more than one outcome, for instance because tearDown() fails after the test errored, with its last outcome instead of its most severe one, and with more than one end when the preparation of the test errored
• The Open Test Reporting XML logfile is not well-formed when a test name, a message, the output of a test, or the string representation of an exception contains ]]>, bytes that are not valid UTF-8, or characters that are not allowed in XML, for instance the escape character of an ANSI escape sequence

... (truncated)

Changelog

Sourced from phpunit/phpunit's changelog.

[13.4.5] - 2026-10-27

Fixed

• The static analysis cache directory that is automatically created in the operating system's path used for temporary files when no cache directory is configured is not used when the POSIX extension is not loaded

[13.4.4] - 2026-10-27

Fixed

• The TeamCity logger writes testSuiteFinished twice for a test class when one of its before-first-test methods errors or fails
• The TestDox output shows a less important outcome of a test that has more than one outcome, for instance the failure in tearDown() of a test that errored
• When the test run is interrupted by a signal while a test is run in process isolation, the result of the test is discarded and the test is counted as passed, and the TestDox output cannot be printed
• When no static analysis cache directory is configured, the cache directory that is automatically created in the operating system's path used for temporary files is also used when it was created by another user or can be written to by other users
• The directory in the operating system's path used for temporary files in which the temporary files for collecting code coverage for a PHPT test are created has a fixed name, and is also used when it was created by another user, who can then replace the code of the PHPT test before it is executed

[13.4.3] - 2026-10-16

Fixed

• The dependencies of a test that are listed after a dependency on a test that does not return a value, or after a dependency on a larger test, were not checked, so the test was run instead of being skipped when one of these dependencies had not passed
• Tests could not be run in process isolation when the namespace of the test class begins with a name that the code of the child process imports, for instance CodeCoverage or Facade
• A test that is run in process isolation aborts the test run when its data set or a value returned by a test it depends on cannot be serialized, for instance because it is a closure
• When a before-first-test method or an after-last-test method errors or fails, the remaining methods of the same kind are still called, and each of them that does not error or fail itself is reported with the exception of the earlier method
• When a hook method of a test, for instance a #[Before] method, skips the test, the remaining hook methods of the same kind are still called, so the test is reported as errored instead of skipped when one of them errors
• An error or failure in a before-first-test method or an after-last-test method that is called again in the child process of a test that is run in process isolation is reported twice, once for the test class and once for the test
• When a before-first-test method errors, the progress output shows one E for the test class instead of one for each of its tests, only one of its tests is counted as run, and the test that is run next is shown as an error
• When a before-first-test method fails, the progress output shows nothing for the tests of the test class and only one of them is counted as run
• The Open Test Reporting XML logfile has no start for a test that errors before it is prepared, for instance because it depends on a test that does not exist, and no end for the test that is run after a test that is skipped because a test it depends on did not pass or because one of its requirements is not met
• The Open Test Reporting XML logfile has no entry for a test that is marked as incomplete before it is prepared, for instance in setUp(), and reports the test that is run after it as aborted with the message of the incomplete test
• The Open Test Reporting XML logfile has no end for the test that is run after a test whose preparation errors, for instance because setUp() raises an exception or the global state cannot be backed up
• The Open Test Reporting XML logfile reports a test that has more than one outcome, for instance because tearDown() fails after the test errored, with its last outcome instead of its most severe one, and with more than one end when the preparation of the test errored
• The Open Test Reporting XML logfile is not well-formed when a test name, a message, the output of a test, or the string representation of an exception contains ]]>, bytes that are not valid UTF-8, or characters that are not allowed in XML, for instance the escape character of an ANSI escape sequence
• The Open Test Reporting XML logfile reports an issue that is triggered before a test is prepared, for instance in setUp(), with an empty ID before the start of the test

[13.4.2] - 2026-10-12

Fixed

• #7033: Compact printer is created although an extension replaces the progress output
• #7035: Sorting tests by duration recomputes the duration of a test suite for every comparison
• Sorting tests by size recomputes the size of a test suite for every comparison
• expectUserDeprecationMessage() and expectUserDeprecationMessageMatches() did not see the deprecations triggered by an attempt of a retried test and saw those of the previously run test instead
• The status of a test whose mock object raises an exception in its destructor is success although the test is reported as errored, so #[Retry] does not retry the test, --repeat does not skip the remaining repetitions, tearDown() sees the wrong status, and code coverage records the test as successful
• Named arguments passed to with() were matched by position instead of by name, so an expectation such as ->with(b: 7) compared the expected value with the first parameter of the method and the parameter named $b was not checked
• String keys of the parameter sets passed to withParameterSetsInOrder(), withParameterSetsInAnyOrder(), and withParameterSetsInPartialOrder() were ignored, so a parameter set such as ['b' => 7] compared the expected value with the first parameter of the method and the parameter named $b was not checked

... (truncated)

Commits

• 941457a Prepare release
• 2080b37 Merge branch '12.5' into 13.4
• 1d6dbe7 Prepare release
• ef98204 Merge branch '12.5' into 13.4
• 15fb431 Do not require the POSIX extension for using the automatically created static...
• 71b681a Prepare release
• c056074 Merge branch '12.5' into 13.4
• 191b2e0 Prepare release
• ae31c78 Create the temporary files for collecting code coverage for a PHPT test in a ...
• c4c4f06 Merge branch '12.5' into 13.4
• Additional commits viewable in compare view

Updates symfony/process from 7.3.11 to 8.1.10

Release notes

Sourced from symfony/process's releases.

v8.1.10

Changelog (symfony/process@v8.1.9...v8.1.10)

• bug #67385 Fix cleanup after forking (@​nicolas-grekas)

[SECURITY] Security release

v8.1.9

Changelog (symfony/process@v8.1.7...v8.1.9)

• bug #66696 Don't let inherited SYMFONY_DOTENV_VARS override explicitly passed env vars (@​KalimeroMK)
• bug #66620 Fix waitUntil() missing output read by its own status updates (@​KalimeroMK)

v8.1.7

Changelog (symfony/process@v8.1.6...v8.1.7)

• bug #65784 Use an absolute path for the cmd.exe fallback on Windows (@​nicolas-grekas)

v8.1.6

Changelog (symfony/process@v8.1.5...v8.1.6)

• bug #65739 Ignore invalid env var names and non-scalar env values (@​nicolas-grekas, @​dionisvl)
• bug #65738 Stop leaking CGI/FastCGI request-context vars to subprocesses (@​nicolas-grekas)

v8.1.5

Changelog (symfony/process@v8.1.0...v8.1.5)

• bug #65498 Do not wait for output when the input iterator has more data (@​nicolas-grekas)

v8.1.0

Changelog (symfony/process@v8.1.0-RC1...v8.1.0)

• no significant changes

v8.1.0-RC1

Changelog (symfony/process@v8.1.0-BETA2...v8.1.0-RC1)

• bug #64347 Stop leaking CGI/FastCGI request-context vars to subprocesses (@​nicolas-grekas)

v8.1.0-BETA2

Changelog (symfony/process@v8.1.0-BETA1...v8.1.0-BETA2)

• bug #64058 Ignore array env values before proc_open (@​dionisvl)

v8.1.0-BETA1

Changelog (symfony/process@v8.0.13...v8.1.0-BETA1)

• bug #64347 Stop leaking CGI/FastCGI request-context vars to subprocesses (@​nicolas-grekas)
• bug #64058 Ignore array env values before proc_open (@​dionisvl)

... (truncated)

Commits

• 08aa69f Merge branch '7.4' into 8.1
• a5a6912 Merge branch '6.4' into 7.4
• f83dad5 [Process] Keep the script of PhpProcess when a forked child exits under phpdbg
• 3413f90 Merge branch '7.4' into 8.1
• a9fff7e Merge branch '6.4' into 7.4
• 967422e [DomCrawler][HttpKernel][Process][Translation] Fix cleanup after forking
• 11188bf Merge branch '7.4' into 8.1
• 5447017 Merge branch '6.4' into 7.4
• e6bcb99 [Process] Fix flaky testWaitUntilSeesOutputWrittenBeforeItIsCalled on Windows
• 59a682f Merge branch '7.4' into 8.1
• Additional commits viewable in compare view

Updates vlucas/phpdotenv from 5.7.0 to 5.8.0

Release notes

Sourced from vlucas/phpdotenv's releases.

v5.8.0

What's Changed

• Rename nul.env test fixture to prevent Windows checkout failure by @​littfed in phpdotenv/phpdotenv#620
• Report unterminated double-quoted values instead of dropping them by @​GrahamCampbell in phpdotenv/phpdotenv#621
• Recognise a multiline closing quote at the start of a line by @​GrahamCampbell in phpdotenv/phpdotenv#622

New Contributors

• @​littfed made their first contribution in phpdotenv/phpdotenv#620

Full Changelog: phpdotenv/phpdotenv@v5.7.0...v5.8.0

Commits

• 9614910 Bump branch alias
• 7f5e066 Recognise a multiline closing quote at the start of a line (#622)
• 3f7ae97 Report unterminated double-quoted values instead of dropping them (#621)
• d704058 Rename nul.env test fixture to prevent Windows checkout failure (#620)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions