Skip to content

Bump the development group with 4 updates - #281

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/composer/development-44b156ce0f
Open

Bump the development group with 4 updates#281
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/composer/development-44b156ce0f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the development group with 4 updates: larastan/larastan, laravel/pint, laravel/telescope and phpunit/phpunit.

Updates larastan/larastan from 3.10.0 to 3.13.2

Release notes

Sourced from larastan/larastan's releases.

3.13.2

What's Changed

Added

  • Read CREATE TABLE statements passed as string literals to DB::statement() and DB::unprepared() in migrations, using the same SQL parsers as schema dumps, by @​tiagoabsantos in #2564. Read more about it here.
  • Infer Arr::map() callback parameter types and the mapped array type by @​Gabrieljr42 in #2587.

Fixed

  • Check model properties in fill() and forceFill() by @​uchimaki-vensley in #2618.
  • Check model properties in withAttributes() by @​uchimaki-vensley in #2599.
  • Check model properties in forceCreateMany() and forceCreateManyQuietly() by @​uchimaki-vensley in #2600.
  • Apply model casts to date columns such as created_at instead of always reading them as dates by @​canvural in 453bff0.
  • Resolve the enum type of AsEnumCollection and AsEnumArrayObject casts by @​lazerg in #2590.
  • Return int|false from model increment() and decrement(), since an updating listener can cancel the update, by @​canvural in 0293dbc.
  • Resolve factory() from the HasFactory generic, including models that set their factory with the $factory property or #[UseFactory], by @​mkantautas in #2615 and @​canvural in 6dfe581.
  • Keep the model template type in forwarded static calls on a class-string<T>, such as $class::findOrFail($id), by @​mkantautas in #2616.
  • Read #[CollectedBy] from parent models on Laravel 13.4 and newer by @​APX403 in #2586. Read more about it here.
  • Keep the relation type after calling when() and unless() on a relation by @​APX403 in #2603.
  • Accept deeper nesting and closures in nested eager-load arrays passed to with(), withOnly(), load(), and loadMissing() by @​lazerg in #2583.
  • Read columns from ulidMorphs(), numericMorphs(), and their nullable variants in migrations by @​mkantautas in #2614.
  • Treat rememberToken() columns as nullable by @​lazerg in #2611.
  • Fall back to the bundled SQL parser when phpmyadmin/sql-parser can't parse a schema dump, instead of losing every table in it, by @​Cayan in #2588.
  • Resolve EventFake methods such as dispatched() and hasDispatched() on the Event facade by @​lazerg in #2574.
  • Resolve QueueFake methods such as pushed() and hasPushed() on the Queue facade by @​canvural in 9c1d4f4.
  • Detect container, request, and config injection in OctaneCompatibilityRule through any constructor argument, make(), get(), and makeWith() calls, and class-string references by @​Gabrieljr42 in #2609.
  • Avoid NoEnvCallsOutsideOfConfigRule false positives when a config file is analysed in editor mode by @​billypoke in #2482.
  • Only count Laravel's view() helper when detecting unused views, and report static::make(), self::make(), and parent::make() in NoModelMakeRule, by @​GTS-MEGHNI in #2598.

New Contributors

Full Changelog: v3.13.1...v3.13.2

3.13.1

What's Changed

Fixed

  • Type argument() and option() calls and check argument and option names in commands registered through the console kernel, including the kernel's $commands property, withCommands(), and app/Console/Commands on Laravel 13.36 and newer, by @​robsonek in #2585.
  • Infer callback parameter types in map() and mapWithKeys() on Eloquent collections again, so mapped values are no longer mixed, by @​canvural in dea9faf.
  • Check model properties in incrementEach() and decrementEach() by @​uchimaki-vensley in #2573.
  • Check model properties in incrementOrCreate() by @​uchimaki-vensley in #2581.

... (truncated)

Commits
  • 0de9aec fix: keep the template type in forwarded static calls on a model class-string...
  • bd8d022 fix: check model properties in fill() and forceFill() (#2618)
  • 6dfe581 refactor: fall back to factory() return type when resolving model factories
  • 3a6aa17 fix: resolve factory() from the HasFactory generic when newFactory() is not o...
  • 51c47c2 fix: read columns from ulidMorphs() and numericMorphs() migrations (#2614)
  • 453bff0 fix: check for casts on date columns too
  • b862d19 chore: fix tests
  • 61403ec fix: treat rememberToken() columns as nullable (#2611)
  • cd61813 fix: keep the relation type after when() and unless() (#2603)
  • 3c8bc5d fix: check model properties in forceCreateMany() and forceCreateManyQuietly()...
  • Additional commits viewable in compare view

Updates laravel/pint from 1.30.5 to 1.32.1

Release notes

Sourced from laravel/pint's releases.

v1.32.1

Full Changelog: laravel/pint@v1.32.0...v1.32.1

v1.32.0

Full Changelog: laravel/pint@v1.31.1...v1.32.0

v1.31.1

What's Changed

Full Changelog: laravel/pint@v1.31.0...v1.31.1

v1.31.0

Full Changelog: laravel/pint@v1.30.6...v1.31.0

v1.30.6

Commits

Updates laravel/telescope from 5.22.1 to 5.26.0

Release notes

Sourced from laravel/telescope's releases.

v5.26.0

v5.25.0

v5.24.0

v5.23.0

Changelog

Sourced from laravel/telescope's changelog.

v5.26.0 - 2026-09-22

v5.25.0 - 2026-09-09

v5.24.0 - 2026-09-08

v5.23.0 - 2026-08-27

Commits

Updates phpunit/phpunit from 12.5.33 to 12.5.42

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 12.5.42

Fixed

  • The static analysis cache directory that is automatically created in the operating system's path used for temporary files when no cache directory is configured is not used when the POSIX extension is not loaded

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

PHPUnit 12.5.41

Fixed

  • The TeamCity logger writes testSuiteFinished twice for a test class when one of its before-first-test methods errors or fails
  • The TestDox output shows a less important outcome of a test that has more than one outcome, for instance the failure in tearDown() of a test that errored
  • When no static analysis cache directory is configured, the cache directory that is automatically created in the operating system's path used for temporary files is also used when it was created by another user or can be written to by other users

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

PHPUnit 12.5.40

Fixed

  • The dependencies of a test that are listed after a dependency on a test that does not return a value, or after a dependency on a larger test, were not checked, so the test was run instead of being skipped when one of these dependencies had not passed
  • Tests could not be run in process isolation when the namespace of the test class begins with a name that the code of the child process imports, for instance CodeCoverage or Facade
  • A test that is run in process isolation aborts the test run when its data set or a value returned by a test it depends on cannot be serialized, for instance because it is a closure
  • When a before-first-test method or an after-last-test method errors or fails, the remaining methods of the same kind are still called, and each of them that does not error or fail itself is reported with the exception of the earlier method
  • When a hook method of a test, for instance a #[Before] method, skips the test, the remaining hook methods of the same kind are still called, so the test is reported as errored instead of skipped when one of them errors
  • An error or failure in a before-first-test method or an after-last-test method that is called again in the child process of a test that is run in process isolation is reported twice, once for the test class and once for the test
  • When a before-first-test method errors, the progress output shows one E for the test class instead of one for each of its tests, only one of its tests is counted as run, and the test that is run next is shown as an error
  • When a before-first-test method fails, the progress output shows nothing for the tests of the test class and only one of them is counted as run
  • The Open Test Reporting XML logfile has no start for a test that errors before it is prepared, for instance because it depends on a test that does not exist, and no end for the test that is run after a test that is skipped because a test it depends on did not pass or because one of its requirements is not met
  • The Open Test Reporting XML logfile has an end without an ID for a test that is marked as incomplete before it is prepared, for instance in setUp(), and no end for the test that is run after it
  • The Open Test Reporting XML logfile has no end for the test that is run after a test whose preparation errors, for instance because setUp() raises an exception or the global state cannot be backed up
  • The Open Test Reporting XML logfile has more than one end for a test that has more than one outcome, for instance because tearDown() fails after the test errored
  • The Open Test Reporting XML logfile is not well-formed when a test name, a message, or the string representation of an exception contains ]]>, bytes that are not valid UTF-8, or characters that are not allowed in XML, for instance the escape character of an ANSI escape sequence

... (truncated)

Changelog

Sourced from phpunit/phpunit's changelog.

[12.5.42] - 2026-10-27

Fixed

  • The static analysis cache directory that is automatically created in the operating system's path used for temporary files when no cache directory is configured is not used when the POSIX extension is not loaded

[12.5.41] - 2026-10-27

Fixed

  • The TeamCity logger writes testSuiteFinished twice for a test class when one of its before-first-test methods errors or fails
  • The TestDox output shows a less important outcome of a test that has more than one outcome, for instance the failure in tearDown() of a test that errored
  • When no static analysis cache directory is configured, the cache directory that is automatically created in the operating system's path used for temporary files is also used when it was created by another user or can be written to by other users

[12.5.40] - 2026-10-16

Fixed

  • The dependencies of a test that are listed after a dependency on a test that does not return a value, or after a dependency on a larger test, were not checked, so the test was run instead of being skipped when one of these dependencies had not passed
  • Tests could not be run in process isolation when the namespace of the test class begins with a name that the code of the child process imports, for instance CodeCoverage or Facade
  • A test that is run in process isolation aborts the test run when its data set or a value returned by a test it depends on cannot be serialized, for instance because it is a closure
  • When a before-first-test method or an after-last-test method errors or fails, the remaining methods of the same kind are still called, and each of them that does not error or fail itself is reported with the exception of the earlier method
  • When a hook method of a test, for instance a #[Before] method, skips the test, the remaining hook methods of the same kind are still called, so the test is reported as errored instead of skipped when one of them errors
  • An error or failure in a before-first-test method or an after-last-test method that is called again in the child process of a test that is run in process isolation is reported twice, once for the test class and once for the test
  • When a before-first-test method errors, the progress output shows one E for the test class instead of one for each of its tests, only one of its tests is counted as run, and the test that is run next is shown as an error
  • When a before-first-test method fails, the progress output shows nothing for the tests of the test class and only one of them is counted as run
  • The Open Test Reporting XML logfile has no start for a test that errors before it is prepared, for instance because it depends on a test that does not exist, and no end for the test that is run after a test that is skipped because a test it depends on did not pass or because one of its requirements is not met
  • The Open Test Reporting XML logfile has an end without an ID for a test that is marked as incomplete before it is prepared, for instance in setUp(), and no end for the test that is run after it
  • The Open Test Reporting XML logfile has no end for the test that is run after a test whose preparation errors, for instance because setUp() raises an exception or the global state cannot be backed up
  • The Open Test Reporting XML logfile has more than one end for a test that has more than one outcome, for instance because tearDown() fails after the test errored
  • The Open Test Reporting XML logfile is not well-formed when a test name, a message, or the string representation of an exception contains ]]>, bytes that are not valid UTF-8, or characters that are not allowed in XML, for instance the escape character of an ANSI escape sequence

[12.5.39] - 2026-10-12

Fixed

  • #7053: Extensions loaded using -d extension or -d zend_extension are not loaded in child processes
  • The status of a test whose mock object raises an exception in its destructor is success although the test is reported as errored, so tearDown() sees the wrong status and code coverage records the test as successful
  • Named arguments passed to with() were matched by position instead of by name, so an expectation such as ->with(b: 7) compared the expected value with the first parameter of the method and the parameter named $b was not checked
  • When code coverage is collected and no code coverage driver is available in a child process, a test that is run in process isolation errors and a PHPT test fails instead of a warning being emitted

[12.5.38] - 2026-10-05

Changed

  • The Software Bill of Materials (SBOM) embedded in the PHAR now uses CycloneDX 1.7 and provides the NTIA minimum elements as well as the data fields that BSI TR-03183-2 (version 2.1.0) requires for logical and identified components, including component creators, original, distribution and effective licences, source code URIs, and the PHP runtime and its extensions as external components

Fixed

... (truncated)

Commits
  • 1d6dbe7 Prepare release
  • 15fb431 Do not require the POSIX extension for using the automatically created static...
  • 191b2e0 Prepare release
  • cf57a7b Only use the automatically created static analysis cache directory when it be...
  • 76ace48 Update dependency phpstan/phpstan to ^2.3.2
  • 0612538 Merge branch '11.5' into 12.5
  • 77233b6 Merge branch '10.5' into 11.5
  • 238bf52 Do not use constructor property promotion
  • dfb5ca5 Update ChangeLog
  • 39eee4a Keep the more important outcome of a test in the TestDox output
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the development group with 4 updates
4681d4b 
Bumps the development group with 4 updates: [larastan/larastan](https://github.com/larastan/larastan), [laravel/pint](https://github.com/laravel/pint), [laravel/telescope](https://github.com/laravel/telescope) and [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit).


Updates `larastan/larastan` from 3.10.0 to 3.13.2
- [Release notes](https://github.com/larastan/larastan/releases)
- [Changelog](https://github.com/larastan/larastan/blob/3.x/RELEASE.md)
- [Commits](larastan/larastan@v3.10.0...v3.13.2)

Updates `laravel/pint` from 1.30.5 to 1.32.1
- [Release notes](https://github.com/laravel/pint/releases)
- [Changelog](https://github.com/laravel/pint/blob/main/CHANGELOG.md)
- [Commits](laravel/pint@v1.30.5...v1.32.1)

Updates `laravel/telescope` from 5.22.1 to 5.26.0
- [Release notes](https://github.com/laravel/telescope/releases)
- [Changelog](https://github.com/laravel/telescope/blob/5.x/CHANGELOG.md)
- [Commits](laravel/telescope@v5.22.1...v5.26.0)

Updates `phpunit/phpunit` from 12.5.33 to 12.5.42
- [Release notes](https://github.com/sebastianbergmann/phpunit/releases)
- [Changelog](https://github.com/sebastianbergmann/phpunit/blob/12.5.42/ChangeLog-12.5.md)
- [Commits](sebastianbergmann/phpunit@12.5.33...12.5.42)

---
updated-dependencies:
- dependency-name: larastan/larastan
  dependency-version: 3.13.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: laravel/pint
  dependency-version: 1.32.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: laravel/telescope
  dependency-version: 5.26.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: phpunit/phpunit
  dependency-version: 12.5.42
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Nov 1, 2026
@github-actions

github-actions Bot commented Nov 1, 2026

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
composer/doctrine/inflector 2.1.1 UnknownUnknown
composer/guzzlehttp/guzzle 8.3.1 UnknownUnknown
composer/larastan/larastan 3.13.2 UnknownUnknown
composer/laravel/framework 13.39.0 UnknownUnknown
composer/laravel/pint 1.32.1 UnknownUnknown
composer/laravel/telescope 5.26.0 UnknownUnknown
composer/league/commonmark 2.10.7 UnknownUnknown
composer/league/uri 7.9.1 UnknownUnknown
composer/league/uri-interfaces 7.9.1 UnknownUnknown
composer/nesbot/carbon 3.15.1 UnknownUnknown
composer/nikic/php-parser 5.9.0 UnknownUnknown
composer/phpstan/phpstan 2.3.4 UnknownUnknown
composer/phpunit/php-code-coverage 12.5.8 UnknownUnknown
composer/phpunit/php-file-iterator 6.0.2 UnknownUnknown
composer/phpunit/php-text-template 5.0.1 UnknownUnknown
composer/phpunit/phpunit 12.5.42 UnknownUnknown
composer/sebastian/diff 7.0.1 UnknownUnknown
composer/sebastian/version 6.0.1 UnknownUnknown
composer/symfony/console 7.4.22 UnknownUnknown
composer/symfony/css-selector 7.4.22 UnknownUnknown
composer/symfony/error-handler 7.4.22 UnknownUnknown
composer/symfony/finder 7.4.22 UnknownUnknown
composer/symfony/http-foundation 7.4.22 UnknownUnknown
composer/symfony/http-kernel 7.4.22 UnknownUnknown
composer/symfony/mailer 7.4.22 UnknownUnknown
composer/symfony/mime 7.4.22 UnknownUnknown
composer/symfony/polyfill-intl-grapheme 1.43.3 UnknownUnknown
composer/symfony/polyfill-mbstring 1.43.3 UnknownUnknown
composer/symfony/process 7.4.22 UnknownUnknown
composer/symfony/routing 7.4.22 UnknownUnknown
composer/symfony/string 7.4.22 UnknownUnknown
composer/symfony/translation 7.4.22 UnknownUnknown
composer/symfony/var-dumper 7.4.22 UnknownUnknown
composer/vlucas/phpdotenv 5.8.0 UnknownUnknown

Scanned Files

  • composer.lock

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants