Update dependency phpunit/phpunit to v12.5.8 [SECURITY] #87

reactphp-parallel-renovate-runner · 2026-01-28T06:19:57Z

This PR contains the following updates:

Package	Change	Age	Confidence
phpunit/phpunit (source)	`12.4.1` -> `12.5.8`

GitHub Vulnerability Alerts

CVE-2026-24765

Overview

A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage() method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious .coverage files are present prior to the execution of the PHPT test.

Technical Details

Affected Component: PHPT test runner, method cleanupForCoverage()
Affected Versions: <= 8.5.51, <= 9.6.32, <= 10.5.61, <= 11.5.49, <= 12.5.7

Vulnerable Code Pattern

if ($buffer !== false) {
    // Unsafe call without restrictions
    $coverage = @&#8203;unserialize($buffer);
}

The vulnerability occurs when a .coverage file, which should not exist before test execution, is deserialized without the allowed_classes parameter restriction. An attacker with local file write access can place a malicious serialized object with a __wakeup() method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.

Attack Prerequisites and Constraints

This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through:

CI/CD Pipeline Attacks: A malicious pull request that places a .coverage file alongside test files, executed when the CI system runs tests using PHPUnit and collects code coverage information
Local Development Environment: An attacker with shell access or ability to write files to the project directory
Compromised Dependencies: A supply chain attack inserting malicious files into a package or monorepo

Critical Context: Running test suites from unreviewed pull requests without isolated execution is inherently a code execution risk, independent of this specific vulnerability. This represents a broader class of Poisoned Pipeline Execution (PPE) attacks affecting CI/CD systems.

Proposed Remediation Approach

Rather than just silently sanitizing the input via ['allowed_classes' => false], the maintainer has chosen to make the anomalous state explicit by treating pre-existing .coverage files for PHPT tests as an error condition.

Rationale for Error-Based Approach:

Visibility Over Silence: When an invariant is violated (a .coverage file existing before test execution), the error must be visible in CI/CD output, alerting operators to investigate the root cause rather than proceeding with sanitized input
Operational Security: A .coverage file should never exist before tests run, coverage data is generated by executing tests, not sourced from artifacts. Its presence indicates:
- A malicious actor placed it intentionally
- Build artifacts from a previous run contaminated the environment
- An unexpected filesystem state requiring investigation
Defense-in-Depth Principle: Protecting a single deserialization call does not address the fundamental attack surface. Proper mitigations for PPE attacks lie outside PHPUnit's scope:
- Isolate CI/CD runners (ephemeral, containerized environments)
- Restrict code execution on protected branches
- Scan pull requests and artifacts for tampering
- Use branch protection rules to prevent unreviewed code execution

Severity Classification

Attack Vector (AV): Local (L) — requires write access to the file system where tests execute
Attack Complexity (AC): Low (L) — exploitation is straightforward once the malicious file is placed
Privileges Required (PR): Low (L) — PR submitter status or contributor role provides sufficient access
User Interaction (UI): None (N) — automatic execution during standard test execution
Scope (S): Unchanged (U) — impact remains within the affected test execution context
Confidentiality Impact (C): High (H) — full remote code execution enables complete system compromise
Integrity Impact (I): High (H) — arbitrary code execution allows malicious modifications
Availability Impact (A): High (H) — full code execution permits denial-of-service actions

Mitigating Factors (Environmental Context)

Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration:

Ephemeral Runners: Use containerized, single-use CI/CD runners that discard filesystem state between runs
Code Review Enforcement: Require human review and approval before executing code from pull requests
Branch Protection: Enforce branch protection rules that block unreviewed code execution
Artifact Isolation: Separate build artifacts from source; never reuse artifacts across independent builds
Access Control: Limit file write permissions in CI environments to authenticated, trusted actors

Fixed Behaviour

When a .coverage file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. This ensures:

Visibility: The error appears prominently in CI/CD output and test logs
Investigation: Operations teams can investigate the root cause (potential tampering, environment contamination)
Fail-Fast Semantics: Test execution stops rather than proceeding with an unexpected state

Recommendation

Update to the patched version immediately if a project runs PHPT tests using PHPUnit with coverage instrumentation in any CI/CD environment that executes code from external contributors. Additionally, audit the project's CI/CD configuration to ensure:

Pull requests from forks or untrusted sources execute in isolated environments
Branch protection rules require human review before code execution
CI/CD runners are ephemeral and discarded after each build
Build artifacts are not reused across independent runs without validation

PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

CVE-2026-24765 / GHSA-vvj3-c3rp-c85p

More information

Details

Overview

A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage() method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious .coverage files are present prior to the execution of the PHPT test.

Technical Details

Affected Component: PHPT test runner, method cleanupForCoverage()
Affected Versions: <= 8.5.51, <= 9.6.32, <= 10.5.61, <= 11.5.49, <= 12.5.7

Vulnerable Code Pattern

if ($buffer !== false) {
    // Unsafe call without restrictions
    $coverage = @&#8203;unserialize($buffer);
}

The vulnerability occurs when a .coverage file, which should not exist before test execution, is deserialized without the allowed_classes parameter restriction. An attacker with local file write access can place a malicious serialized object with a __wakeup() method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.

Attack Prerequisites and Constraints

This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through:

CI/CD Pipeline Attacks: A malicious pull request that places a .coverage file alongside test files, executed when the CI system runs tests using PHPUnit and collects code coverage information
Local Development Environment: An attacker with shell access or ability to write files to the project directory
Compromised Dependencies: A supply chain attack inserting malicious files into a package or monorepo

Critical Context: Running test suites from unreviewed pull requests without isolated execution is inherently a code execution risk, independent of this specific vulnerability. This represents a broader class of Poisoned Pipeline Execution (PPE) attacks affecting CI/CD systems.

Proposed Remediation Approach

Rather than just silently sanitizing the input via ['allowed_classes' => false], the maintainer has chosen to make the anomalous state explicit by treating pre-existing .coverage files for PHPT tests as an error condition.

Rationale for Error-Based Approach:

Visibility Over Silence: When an invariant is violated (a .coverage file existing before test execution), the error must be visible in CI/CD output, alerting operators to investigate the root cause rather than proceeding with sanitized input
Operational Security: A .coverage file should never exist before tests run, coverage data is generated by executing tests, not sourced from artifacts. Its presence indicates:
- A malicious actor placed it intentionally
- Build artifacts from a previous run contaminated the environment
- An unexpected filesystem state requiring investigation
Defense-in-Depth Principle: Protecting a single deserialization call does not address the fundamental attack surface. Proper mitigations for PPE attacks lie outside PHPUnit's scope:
- Isolate CI/CD runners (ephemeral, containerized environments)
- Restrict code execution on protected branches
- Scan pull requests and artifacts for tampering
- Use branch protection rules to prevent unreviewed code execution

Severity Classification

Attack Vector (AV): Local (L) — requires write access to the file system where tests execute
Attack Complexity (AC): Low (L) — exploitation is straightforward once the malicious file is placed
Privileges Required (PR): Low (L) — PR submitter status or contributor role provides sufficient access
User Interaction (UI): None (N) — automatic execution during standard test execution
Scope (S): Unchanged (U) — impact remains within the affected test execution context
Confidentiality Impact (C): High (H) — full remote code execution enables complete system compromise
Integrity Impact (I): High (H) — arbitrary code execution allows malicious modifications
Availability Impact (A): High (H) — full code execution permits denial-of-service actions

Mitigating Factors (Environmental Context)

Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration:

Ephemeral Runners: Use containerized, single-use CI/CD runners that discard filesystem state between runs
Code Review Enforcement: Require human review and approval before executing code from pull requests
Branch Protection: Enforce branch protection rules that block unreviewed code execution
Artifact Isolation: Separate build artifacts from source; never reuse artifacts across independent builds
Access Control: Limit file write permissions in CI environments to authenticated, trusted actors

Fixed Behaviour

When a .coverage file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. This ensures:

Visibility: The error appears prominently in CI/CD output and test logs
Investigation: Operations teams can investigate the root cause (potential tampering, environment contamination)
Fail-Fast Semantics: Test execution stops rather than proceeding with an unexpected state

Recommendation

Update to the patched version immediately if a project runs PHPT tests using PHPUnit with coverage instrumentation in any CI/CD environment that executes code from external contributors. Additionally, audit the project's CI/CD configuration to ensure:

Pull requests from forks or untrusted sources execute in isolated environments
Branch protection rules require human review before code execution
CI/CD runners are ephemeral and discarded after each build
Build artifacts are not reused across independent runs without validation

Severity

CVSS Score: 7.8 / 10 (High)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

sebastianbergmann/phpunit (phpunit/phpunit)

`v12.5.8`: PHPUnit 12.5.8

Compare Source

Changed

To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

`v12.5.7`: PHPUnit 12.5.7

Compare Source

Fixed

#6362: Manually instantiated test doubles are broken since PHPUnit 11.2
#6470: Infinite recursion in Count::getCountOf() for unusal implementations of Iterator or IteratorAggregate

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

`v12.5.6`: PHPUnit 12.5.6

Compare Source

Changed

Reverted a change that caused a build failure for the PHP project's nightly community job

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

`v12.5.5`: PHPUnit 12.5.5

Compare Source

Deprecated

#6461: any() matcher (soft deprecation)

Fixed

#6470: Mocking a class with a property hook setter accepting more types than the property results in a fatal error

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

`v12.5.4`: PHPUnit 12.5.4

Compare Source

Changed

The #[AllowMockObjectsWithoutExpectations] attribute can now be used on the method level

Fixed

#6446: Test runner crashes with Timer::start() has to be called before Timer::stop()

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

`v12.5.3`: PHPUnit 12.5.3

Compare Source

Changed

The message emitted when a test method creates a mock object but does not configure any expectations for it has been improved

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

`v12.5.2`: PHPUnit 12.5.2

Compare Source

Added

Attribute #[AllowMockObjectsWithoutExpectations] for excluding tests from the check that emits the notice for test methods that create a mock object but do not configure an expectation for it

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

`v12.5.1`: PHPUnit 12.5.1

Compare Source

Added

TestCase::getStubBuilder() (analogous to TestCase::getMockBuilder()) for creating (partial) test stubs using a fluent API

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

`v12.5.0`: PHPUnit 12.5.0

Compare Source

Added

#6376: --all CLI option to ignore test selection configured in XML configuration file
#6422: Make <source> element in XML code coverage report optional

Changed

#6380: Allow Throwable in expectExceptionObject()
A PHPUnit notice is now emitted for test methods that create a mock object but do not configure an expectation for it

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

`v12.4.5`: PHPUnit 12.4.5

Compare Source

Changed

Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

Fixed

#6426: Fix migration of configuration without schema location

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

`v12.4.4`: PHPUnit 12.4.4

Compare Source

Fixed

#6408: Exception in a data provider method leads to internal PHPUnit error
#6410: Test runner's shutdown handler is called in system-under-test's child process

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

`v12.4.3`: PHPUnit 12.4.3

Compare Source

Fixed

#6402: Avoid reading from STDOUT when rewind() fails

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

`v12.4.2`: PHPUnit 12.4.2

Compare Source

Changed

Skipped tests alone no longer lead to a yellow background for the test result summary

Fixed

#6391: Errors during backup of global variables and static properties are not reported

Learn how to install or update PHPUnit 12.4 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.
You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

github-actions · 2026-01-28T06:20:17Z

🏰 Composer Production Dependency changes 🏰

Prod Packages	Operation	Base	Target	Link
nikic/php-parser	Upgraded	v5.6.1	v5.7.0	Compare
phpunit/php-code-coverage	Upgraded	12.4.0	12.5.2	Compare
phpunit/phpunit	Upgraded	12.4.1	12.5.8	Compare
sebastian/comparator	Upgraded	7.1.3	7.1.4	Compare
theseer/tokenizer	Upgraded	1.2.3	2.0.1	Compare

Update dependency phpunit/phpunit to v12.5.8 [SECURITY]

9d2ff0d

reactphp-parallel-renovate-runner bot requested a review from WyriHaximus as a code owner January 28, 2026 06:19

reactphp-parallel-renovate-runner bot added Dependencies 📦 Pull requests that update a dependency file PHP 🐘 Hypertext Pre Processor labels Jan 28, 2026

github-actions bot added this to the 6.0.0 milestone Jan 28, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update dependency phpunit/phpunit to v12.5.8 [SECURITY] #87

Update dependency phpunit/phpunit to v12.5.8 [SECURITY] #87

Uh oh!

reactphp-parallel-renovate-runner bot commented Jan 28, 2026

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Update dependency phpunit/phpunit to v12.5.8 [SECURITY] #87

Are you sure you want to change the base?

Update dependency phpunit/phpunit to v12.5.8 [SECURITY] #87

Uh oh!

Conversation

reactphp-parallel-renovate-runner bot commented Jan 28, 2026

GitHub Vulnerability Alerts

CVE-2026-24765

Overview

Technical Details

Vulnerable Code Pattern

Attack Prerequisites and Constraints

Proposed Remediation Approach

Rationale for Error-Based Approach:

Severity Classification

Mitigating Factors (Environmental Context)

Fixed Behaviour

Recommendation

PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

Details

Overview

Technical Details

Vulnerable Code Pattern

Attack Prerequisites and Constraints

Proposed Remediation Approach

Rationale for Error-Based Approach:

Severity Classification

Mitigating Factors (Environmental Context)

Fixed Behaviour

Recommendation

Severity

References

Release Notes

v12.5.8: PHPUnit 12.5.8

Changed

Keep up to date with PHPUnit:

v12.5.7: PHPUnit 12.5.7

Fixed

Keep up to date with PHPUnit:

v12.5.6: PHPUnit 12.5.6

Changed

Keep up to date with PHPUnit:

v12.5.5: PHPUnit 12.5.5

Deprecated

Fixed

Keep up to date with PHPUnit:

v12.5.4: PHPUnit 12.5.4

Changed

Fixed

Keep up to date with PHPUnit:

v12.5.3: PHPUnit 12.5.3

Changed

Keep up to date with PHPUnit:

v12.5.2: PHPUnit 12.5.2

Added

Keep up to date with PHPUnit:

v12.5.1: PHPUnit 12.5.1

Added

Keep up to date with PHPUnit:

v12.5.0: PHPUnit 12.5.0

Added

Changed

Keep up to date with PHPUnit:

v12.4.5: PHPUnit 12.4.5

Changed

Fixed

Keep up to date with PHPUnit:

v12.4.4: PHPUnit 12.4.4

Fixed

Keep up to date with PHPUnit:

v12.4.3: PHPUnit 12.4.3

Fixed

Keep up to date with PHPUnit:

v12.4.2: PHPUnit 12.4.2

Changed

Fixed

Keep up to date with PHPUnit:

Configuration

Uh oh!

`v12.5.8`: PHPUnit 12.5.8

`v12.5.7`: PHPUnit 12.5.7

`v12.5.6`: PHPUnit 12.5.6

`v12.5.5`: PHPUnit 12.5.5

`v12.5.4`: PHPUnit 12.5.4

`v12.5.3`: PHPUnit 12.5.3

`v12.5.2`: PHPUnit 12.5.2

`v12.5.1`: PHPUnit 12.5.1

`v12.5.0`: PHPUnit 12.5.0

`v12.4.5`: PHPUnit 12.4.5

`v12.4.4`: PHPUnit 12.4.4

`v12.4.3`: PHPUnit 12.4.3

`v12.4.2`: PHPUnit 12.4.2