Bump the composer-development-tools group with 3 updates

[dependabot]

Bumps the composer-development-tools group with 3 updates: friendsofphp/php-cs-fixer, phpunit/phpunit and rector/rector.

Updates friendsofphp/php-cs-fixer from 3.95.24 to 3.95.25

Release notes

Sourced from friendsofphp/php-cs-fixer's releases.

v3.95.25 Adalbertus

What's Changed

• deps: bump phpstan/phpstan from 2.2.9 to 2.2.12 in /dev-tools in the phpstan group by @​dependabot[bot] in PHP-CS-Fixer/PHP-CS-Fixer#9822
• deps: bump crate-ci/typos from 1.49.0 to 1.50.1 in /.github/workflows in the all group across 1 directory by @​dependabot[bot] in PHP-CS-Fixer/PHP-CS-Fixer#9824
• deps: bump shipmonk/dead-code-detector from 1.3.3 to 1.4.0 in /dev-tools in the shipmonk group across 1 directory by @​dependabot[bot] in PHP-CS-Fixer/PHP-CS-Fixer#9823
• fix: IsNullFixer - handle is_null() calls using named arguments by @​lazerg in PHP-CS-Fixer/PHP-CS-Fixer#9828
• fix: IsNullFixer - do not fix is_null() calls using argument unpacking by @​lazerg in PHP-CS-Fixer/PHP-CS-Fixer#9830
• UX: init - use outlined messages by @​keradus in PHP-CS-Fixer/PHP-CS-Fixer#9826
• fix: handle missing terminator after ?? in AssignNullCoalescingToCoalesceEqualFixer by @​calebdw in PHP-CS-Fixer/PHP-CS-Fixer#9831

New Contributors

• @​calebdw made their first contribution in PHP-CS-Fixer/PHP-CS-Fixer#9831

Full Changelog: PHP-CS-Fixer/PHP-CS-Fixer@v3.95.24...v3.95.25

Changelog

Sourced from friendsofphp/php-cs-fixer's changelog.

Changelog for v3.95.25

• fix: handle missing terminator after ?? in AssignNullCoalescingToCoalesceEqualFixer (#9831)
• fix: IsNullFixer - do not fix is_null() calls using argument unpacking (#9830)
• fix: IsNullFixer - handle is_null() calls using named arguments (#9828)
• UX: init - use outlined messages (#9826)
• deps: bump crate-ci/typos from 1.49.0 to 1.50.1 in /.github/workflows in the all group across 1 directory (#9824)
• deps: bump phpstan/phpstan from 2.2.9 to 2.2.12 in /dev-tools in the phpstan group (#9822)
• deps: bump shipmonk/dead-code-detector from 1.3.3 to 1.4.0 in /dev-tools in the shipmonk group across 1 directory (#9823)

Commits

• 2cdfc1f prepared the 3.95.25 release
• 38656cc fix: handle missing terminator after ?? in `AssignNullCoalescingToCoalesceE...
• e080515 UX: init - use outlined messages (#9826)
• ab7bb8b fix: IsNullFixer - do not fix is_null() calls using argument unpacking (#9830)
• bda6d10 fix: IsNullFixer - handle is_null() calls using named arguments (#9828)
• b7da2d3 deps: bump shipmonk/dead-code-detector from 1.3.3 to 1.4.0 in /dev-tools in t...
• 9020ad1 deps: bump crate-ci/typos from 1.49.0 to 1.50.1 in /.github/workflows in the ...
• 207b03d deps: bump phpstan/phpstan from 2.2.9 to 2.2.12 in /dev-tools in the phpstan ...
• 945e6d8 bumped version
• See full diff in compare view

Updates phpunit/phpunit from 13.3.2 to 13.3.3

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.3.3

Fixed

• Paths of included files are now escaped when generating the code that is executed in a separate process, so that a path containing special characters no longer produces broken code
• Tests of a test class that is skipped as a whole are missing from the TestDox output
• A test that is skipped or marked incomplete before it started is missing from the TestDox output
• A test that is marked incomplete before it started is not counted in the number of tests that ran
• No progress is printed for a test that is marked incomplete before it started

---

Learn how to install or update PHPUnit 13.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

Changelog

Sourced from phpunit/phpunit's changelog.

[13.3.3] - 2026-09-09

Fixed

• Paths of included files are now escaped when generating the code that is executed in a separate process, so that a path containing special characters no longer produces broken code
• Tests of a test class that is skipped as a whole are missing from the TestDox output
• A test that is skipped or marked incomplete before it started is missing from the TestDox output
• A test that is marked incomplete before it started is not counted in the number of tests that ran
• No progress is printed for a test that is marked incomplete before it started

Commits

• 0d87110 Prepare release
• 3b1f4f5 Merge branch '12.5' into 13.3
• 345ac22 Prepare release
• 5e40e6e Merge branch '12.5' into 13.3
• 59f3db3 Update ChangeLog
• a1edaae Print the progress of a test that is marked incomplete before it started
• 8478cb9 Show a test that is skipped or marked incomplete before it started in the Tes...
• 4e8c9a3 Count a test that is marked incomplete before it started as a test that ran
• 746ec48 Show the tests of a test class that is skipped as a whole in the TestDox output
• b126fb3 Merge branch '12.5' into 13.3
• Additional commits viewable in compare view

Updates rector/rector from 2.6.6 to 2.6.7

Release notes

Sourced from rector/rector's releases.

Released Rector 2.6.7

Agentic Experience

This release improves Rector for automated, CI and non-interactive workflows: validate configuration without processing files, limit the amount of changes per run, select multiple rules at once, and get more useful machine-readable output.

• Bump PHPStan to ^2.2.14 and PHP-Parser to ^5.9, regenerate preload (#8491)

New validate-config command (#8450, #8452)

New validate-config command checks rector.php for configuration issues without processing any source files.

vendor/bin/rector validate-config

It reports deprecated rules and configuration, invalid skips, duplicated rule registrations and other config hygiene issues. A valid config exits with 0, while detected issues exit with 1, so the command can be used directly as a CI gate.

For machine-readable output:

vendor/bin/rector validate-config --output-format=json

{
    "valid": true,
    "issue_count": 0
}

Limit a run with --max-changes (#8449)

New --max-changes option lets automated runs process changes in smaller batches:

vendor/bin/rector process --dry-run --max-changes=50

The limit counts applied rule changes rather than files. The current file is always finished before Rector stops, so the final number may be slightly above the requested limit.

Run multiple rules with --only (#8451)

--only can now be repeated to run several selected rules in a single pass:

vendor/bin/rector process \
    --only=App\\Rector\\FooRector \
    --only=App\\Rector\\BarRector

... (truncated)

Commits

• f4aa224 Rector 2.6.7
• 668bc22 Updated Rector to commit 85a5406bd628b1eb1d53c529e53ef33b873e1fb9
• 9d41ae7 Updated Rector to commit 71a969fbd931a4f206a504d981e2aa7543dd2351
• a2c6be3 Updated Rector to commit 71a969fbd931a4f206a504d981e2aa7543dd2351
• a6b4c3e Updated Rector to commit 6d8240575626342682a62f2c6f016f1579cca59e
• 11f9ea3 Updated Rector to commit 9c56f19713758c6f4cfd534a17bf5c9f91a52bb9
• 7d3b83f Updated Rector to commit 222bbf2f4e10e311a826a5375b0726c5bd4cf124
• 21ace77 Updated Rector to commit c6d15cd2c8f8a6684f48a9ab45db34934c3b4a75
• e5bdae7 Updated Rector to commit 15412f07928be9b60f752facb1397ebe25f034f9
• 3c05554 Updated Rector to commit 15412f07928be9b60f752facb1397ebe25f034f9
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 5d49907f-7e0a-43a6-9e91-da58ebf0c755

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}