Skip to content

fix(deps): update all non-major dependencies - #1058

Open
renovate-appwrite[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

renovate-appwrite[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate-appwrite

Copy link
Copy Markdown

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending Age Confidence
actions/checkout action minor v6.0.2 → v6.1.0 age confidence
brianium/paratest require-dev minor 7.20.0 → 7.27.5 age confidence
composer (source) stage minor 2.8 → 2.10 2.11 age confidence
fakerphp/faker require-dev minor 1.23.1 → 1.24.1 age confidence
laravel/pint (source) require-dev minor 1.29.1 → 1.32.1 age confidence
mysql (source) minor 8.0.43 → 8.4.11 8.4.13 age confidence
phpstan/phpstan require-dev minor 2.1.54 → 2.3.4 2.3.5 age confidence
phpstan/phpstan-phpunit require-dev minor 2.0.16 → 2.1.1 age confidence
phpunit/phpunit (source) require-dev patch 12.5.23 → 12.5.42 12.5.43 age confidence
swoole/ide-helper require-dev patch 5.1.3 → 5.1.8 age confidence
utopia-php/console require minor ^0.1 || ^0.2 → ^0.1 || ^0.2 || ^0.3 0.3.1 age confidence
utopia-php/pools require minor 2.0.2 → 2.1.2 age confidence

Release Notes

actions/checkout

v6.1.0

Compare Source

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

Compare Source

paratestphp/paratest (brianium/paratest)

v7.27.5

Compare Source

What's Changed

  • Use the static analysis cache when building the merged coverage report by @​simbig in #​1155

Full Changelog: paratestphp/paratest@v7.27.4...v7.27.5

v7.27.4

Compare Source

What's Changed

Full Changelog: paratestphp/paratest@v7.27.3...v7.27.4

v7.27.3

Compare Source

What's Changed

New Contributors

Full Changelog: paratestphp/paratest@v7.27.2...v7.27.3

v7.27.2

Compare Source

What's Changed

New Contributors

Full Changelog: paratestphp/paratest@v7.27.1...v7.27.2

v7.27.1

Compare Source

What's Changed

  • Revert "Flush worker input immediately instead of waiting for the next poll cycles" by @​Slamdunk in #​1152

Full Changelog: paratestphp/paratest@v7.27.0...v7.27.1

v7.27.0

Compare Source

What's Changed

New Contributors

Full Changelog: paratestphp/paratest@v7.26.1...v7.27.0

v7.26.1

Compare Source

What's Changed

Full Changelog: paratestphp/paratest@v7.26.0...v7.26.1

v7.26.0

Compare Source

What's Changed

Full Changelog: paratestphp/paratest@v7.25.0...v7.26.0

v7.25.0

Compare Source

What's Changed

New Contributors

Full Changelog: paratestphp/paratest@v7.24.1...v7.25.0

v7.24.1

Compare Source

What's Changed

New Contributors

Full Changelog: paratestphp/paratest@v7.24.0...v7.24.1

v7.24.0

Compare Source

What's Changed

Full Changelog: paratestphp/paratest@v7.23.1...v7.24.0

v7.23.1

Compare Source

What's Changed

  • bug: fix output count when --shard and #[DataProvider] are used together by @​Slamdunk in #​1121

Full Changelog: paratestphp/paratest@v7.23.0...v7.23.1

v7.23.0

Compare Source

What's Changed

New Contributors

Full Changelog: paratestphp/paratest@v7.22.4...v7.23.0

v7.22.4

Compare Source

What's Changed

New Contributors

Full Changelog: paratestphp/paratest@v7.22.3...v7.22.4

v7.22.3

Compare Source

What's Changed

Full Changelog: paratestphp/paratest@v7.22.2...v7.22.3

v7.22.2

Compare Source

What's Changed

Full Changelog: paratestphp/paratest@v7.22.1...v7.22.2

v7.22.1

Compare Source

What's Changed

Full Changelog: paratestphp/paratest@v7.22.0...v7.22.1

v7.22.0

Compare Source

What's Changed

Full Changelog: paratestphp/paratest@v7.21.1...v7.22.0

v7.21.1

Compare Source

What's Changed

Full Changelog: paratestphp/paratest@v7.21.0...v7.21.1

v7.21.0

Compare Source

What's Changed

Full Changelog: paratestphp/paratest@v7.20.0...v7.21.0

FakerPHP/Faker (fakerphp/faker)

v1.24.1

Compare Source

What's Changed

New Contributors

Full Changelog: FakerPHP/Faker@v1.24.0...v1.24.1

v1.24.0

Compare Source

What's Changed

New Contributors

Full Changelog: FakerPHP/Faker@v1.23.1...v1.24.0

laravel/pint

v1.32.1

Compare Source

Full Changelog: laravel/pint@v1.32.0...v1.32.1

v1.32.0

Compare Source

Full Changelog: laravel/pint@v1.31.1...v1.32.0

v1.31.1

Compare Source

What's Changed

Full Changelog: laravel/pint@v1.31.0...v1.31.1

v1.31.0

Compare Source

Full Changelog: laravel/pint@v1.30.6...v1.31.0

v1.30.6

Compare Source

v1.30.5

Compare Source

What's Changed

  • Keep a wrapped attribute's body in place when collapsing the tag by @​lazerg in #​479

Full Changelog: laravel/pint@v1.30.4...v1.30.5

v1.30.4

Compare Source

What's Changed

  • Keep multiline Blade directive arguments stable across runs by @​lazerg in #​477
  • Surface abort errors when --dirty or --diff is used without Git by @​Can-Kar in #​475

New Contributors

Full Changelog: laravel/pint@v1.30.3...v1.30.4

v1.30.3

Compare Source

Full Changelog: laravel/pint@v1.30.2...v1.30.3

v1.30.2

Compare Source

Full Changelog: laravel/pint@v1.30.1...v1.30.2

v1.30.1

Compare Source

Full Changelog: laravel/pint@v1.30.0...v1.30.1

v1.30.0

Compare Source

What's Changed

New Contributors

Full Changelog: laravel/pint@v1.29.3...v1.30.0

v1.29.3

Compare Source

Full Changelog: laravel/pint@v1.29.2...v1.29.3

v1.29.2

Compare Source

  • fix: no longer accepts loading a configuration over insecure http
  • fix: sends errors to stderr
  • chore: various actions regarding github security
  • chore: uses laravel/agent-detector
phpstan/phpstan-phar-composer-source (phpstan/phpstan)

v2.3.4

Compare Source

v2.3.3

Compare Source

v2.3.2

Compare Source

v2.3.1

Compare Source

v2.3.0

Compare Source

v2.2.17

Compare Source

v2.2.16

Compare Source

v2.2.15

Compare Source

v2.2.14

Compare Source

v2.2.13

Compare Source

v2.2.12

Compare Source

v2.2.11

Compare Source

v2.2.10

Compare Source

v2.2.9

Compare Source

v2.2.8

Compare Source

v2.2.7

Compare Source

v2.2.6

Compare Source

v2.2.5

Compare Source

v2.2.4

Compare Source

v2.2.3

Compare Source

v2.2.2

Compare Source

v2.2.1

Compare Source

v2.2.0

Compare Source

v2.1.56

Compare Source

v2.1.55

Compare Source

phpstan/phpstan-phpunit

v2.1.1

Compare Source

  • 8d16b84 - AssertEmptyIsDiscouragedRule is auto-fixable (#​342)
  • b73700a - Make AssertSameWithCountRule auto-fixable (#​259)
  • ac3237e - Skip named and unpack arguments when autofixing

v2.1.0

Compare Source

  • a31e9de - Merge remote-tracking branch 'origin/2.0.x' into 2.1.x
  • 626549b - Merge pull request #​336 from phpstan/renovate/github-actions
  • ca0a5ae - Update github-actions
  • c38f716 - Merge 2.0.x into 2.1.x
  • 0d17121 - AssertEmptyIsDiscouragedRule: use unique error identifier
  • 414a487 - feat: Discourage assert(Not)Empty if "empty" usage is disallowed (#​325)
  • 3320043 - Merge remote-tracking branch 'origin/2.0.x' into 2.1.x
  • ba569da - Name the node types DataProviderDataRule wants
  • e98eb3d - Require PHPStan 2.3.0
  • 33212d9 - Open 2.1.x-dev

v2.0.21

Compare Source

  • 8dbdc3a - AssertEmptyIsDiscouragedRule: use unique error identifier

AssertEmptyIsDiscouragedRule: in case you are using PHPStan strict-rules assertEmpty: false option, you can ignore the newly added errors by error-identifier phpunit.assertEmpty.

v2.0.20

Compare Source

  • ef0c8f5 - feat: Discourage assert(Not)Empty if "empty" usage is disallowed (#​325)

AssertEmptyIsDiscouragedRule: in case you are using PHPStan strict-rules assertEmpty: false option, you can ignore the newly added errors by error-identifier phpunit.assertEmpty.

v2.0.19

Compare Source

v2.0.18

Compare Source

  • f5dc20f - Fix #[RequiresPhpunit] version requirement being evaluated against PHP version (#​313)
  • 1e573d3 - AttributeVersionRequirementHelper: add defaults to bool parameters (#​312)

v2.0.17

Compare Source

  • c2f9775 - Update actions/cache action to v6 (#​311)
  • 933f682 - Update actions/cache action to v5.1.0 (#​310)
  • 8ec191f - Check #[RequiresPhpunit] in the same way we check #[RequiresPhp] (#​308)
  • d138088 - Implement ClassAttributeRequiresPhpVersionRule (#​305)
  • caada62 - Update github-actions to v7 (#​307)
  • 611a216 - Update github-actions to v3.0.1 (#​306)
  • 2312495 - Extract AttributeVersionRequirementHelper (#​304)
  • 952d0ee - Warn about incomplete versions in #[RequiresPhp] (#​303)
  • bf910b5 - Sanity check #[RequiresPhp] value and range (#​269)
  • d309858 - Update github-actions to f3e473d (#​301)
  • 4a8e26f - Update github-actions (#​300)
  • 2c07f22 - Replace deprecated actions/create-release with softprops/action-gh-release
  • 67c9d57 - Bump GitHub Actions across major versions
  • a7baf3b - Bump GitHub Actions within their current majors
  • 3ea20e6 - Update github-actions
  • 53357ab - Update github-actions
  • 6760e77 - latest infection does not support PHP 8.2 (#​296)
  • ecfa568 - Update release-toot.yml (#​295)
  • 21ea2e9 - name-collision-detector (#​294)
  • 6851172 - Update test assertions
  • e2c6207 - Fix build (#​287)
  • db27c1f - Delete .github/workflows/claude-react-on-comment.yml
  • 1c9e1df - Refactor build workflow to use GITHUB_BASE_REF
  • 53c1301 - Lint workflows
  • fca9e3a - [StepSecurity] ci: Harden GitHub Actions
  • bfdcb62 - Remove PHPSTAN_BOT_TOKEN from checkout step
  • bb6479c - React on issues opened and fall back to issue body
  • 10e8509 - Add CLAUDE.md to export-ignore in .gitattributes
  • 2202890 - Add CLAUDE.md with project documentation for AI assistants
  • ffd7013 - Add Claude React on Comment workflow
sebastianbergmann/phpunit (phpunit/phpunit)

v12.5.42: PHPUnit 12.5.42

Compare Source

Fixed
  • The static analysis cache directory that is automatically created in the operating system's path used for temporary files when no cache directory is configured is not used when the POSIX extension is not loaded

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.41: PHPUnit 12.5.41

Compare Source

Fixed
  • The TeamCity logger writes testSuiteFinished twice for a test class when one of its before-first-test methods errors or fails
  • The TestDox output shows a less important outcome of a test that has more than one outcome, for instance the failure in tearDown() of a test that errored
  • When no static analysis cache directory is configured, the cache directory that is automatically created in the operating system's path used for temporary files is also used when it was created by another user or can be written to by other users

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.40: PHPUnit 12.5.40

Compare Source

Fixed
  • The dependencies of a test that are listed after a dependency on a test that does not return a value, or after a dependency on a larger test, were not checked, so the test was run instead of being skipped when one of these dependencies had not passed
  • Tests could not be run in process isolation when the namespace of the test class begins with a name that the code of the child process imports, for instance CodeCoverage or Facade
  • A test that is run in process isolation aborts the test run when its data set or a value returned by a test it depends on cannot be serialized, for instance because it is a closure
  • When a before-first-test method or an after-last-test method errors or fails, the remaining methods of the same kind are still called, and each of them that does not error or fail itself is reported with the exception of the earlier method
  • When a hook method of a test, for instance a #[Before] method, skips the test, the remaining hook methods of the same kind are still called, so the test is reported as errored instead of skipped when one of them errors
  • An error or failure in a before-first-test method or an after-last-test method that is called again in the child process of a test that is run in process isolation is reported twice, once for the test class and once for the test
  • When a before-first-test method errors, the progress output shows one E for the test class instead of one for each of its tests, only one of its tests is counted as run, and the test that is run next is shown as an error
  • When a before-first-test method fails, the progress output shows nothing for the tests of the test class and only one of them is counted as run
  • The Open Test Reporting XML logfile has no start for a test that errors before it is prepared, for instance because it depends on a test that does not exist, and no end for the test that is run after a test that is skipped because a test it depends on did not pass or because one of its
    requirements is not met
  • The Open Test Reporting XML logfile has an end without an ID for a test that is marked as incomplete before it is prepared, for instance in setUp(), and no end for the test that is run after it
  • The Open Test Reporting XML logfile has no end for the test that is run after a test whose preparation errors, for instance because setUp() raises an exception or the global state cannot be backed up
  • The Open Test Reporting XML logfile has more than one end for a test that has more than one outcome, for instance because tearDown() fails after the test errored
  • The Open Test Reporting XML logfile is not well-formed when a test name, a message, or the string representation of an exception contains ]]>, bytes that are not valid UTF-8, or characters that are not allowed in XML, for instance the escape character of an ANSI escape sequence

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.39: PHPUnit 12.5.39

Compare Source

Fixed
  • #​7053: Extensions loaded using -d extension or -d zend_extension are not loaded in child processes
  • The status of a test whose mock object raises an exception in its destructor is success although the test is reported as errored, so tearDown() sees the wrong status and code coverage records the test as successful
  • Named arguments passed to with() were matched by position instead of by name, so an expectation such as ->with(b: 7) compared the expected value with the first parameter of the method and the parameter named $b was not checked
  • When code coverage is collected and no code coverage driver is available in a child process, a test that is run in process isolation errors and a PHPT test fails instead of a warning being emitted

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.38: PHPUnit 12.5.38

Compare Source

Changed
  • The Software Bill of Materials (SBOM) embedded in the PHAR now uses CycloneDX 1.7 and provides the NTIA minimum elements as well as the data fields that BSI TR-03183-2 (version 2.1.0) requires for logical and identified components, including component creators, original, distribution and effective licences, source code URIs, and the PHP runtime and its extensions as external components
Fixed
  • setUpBeforeClass() and tearDownAfterClass() were run twice for a test class that is the only test class in a test suite of the XML configuration file that has the name of that test class
  • Tests could not be run in process isolation when the path of the bootstrap script, the test file, or the directory for temporary files contained a single quote
  • A test that is run in process isolation aborts the test run when its result cannot be unserialized, for instance because it returns an object that holds a test double
  • Issues that are listed in the baseline are not ignored for tests that are run in a separate process
  • Arguments in the --ARGS-- section of a PHPT test that start with - were interpreted by PHP instead of being passed to the test when the test also has a --STDIN-- section
  • Recording the tests that passed in a child process copied all tests that had passed so far, which made running many tests in process isolation increasingly slow

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.37: PHPUnit 12.5.37

Compare Source

Fixed
  • The class name argument of #[RequiresMethod] is declared as class-string, so static analysis reports an error when it refers to a class that does not exist
  • A #[RequiresMethod] attribute that refers to a class which cannot be loaded, for instance because its parent class does not exist, aborts the test run instead of skipping the test

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.36: PHPUnit 12.5.36

Compare Source

Changed
  • Control characters and ANSI escape sequences in user-supplied strings such as test names, data set names, and messages are now made visible as \u{NNNN} escape sequences instead of being passed through to the terminal

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:

v12.5.35: PHPUnit 12.5.35

Compare Source

Fixed
  • Paths of included files are now escaped when generating the code that is executed in a separate process, so that a path containing special characters no longer produces broken code
  • Tests of a test class that is skipped as a whole are missing from the TestDox output
  • A test that is skipped or marked incomplete before it started is missing from the TestDox output
  • A test that is marked incomplete before it started is not counted in the number of tests that ran
  • No progress is printed for a test that is marked incomplete before it started

Learn how to install or update PHPUnit 12.5 in the documentation.

Keep up to date with PHPUnit:
  • You can follow [@​php

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Only on Monday (* * * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@renovate-appwrite

Copy link
Copy Markdown
Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock
Loading composer repositories with package information
Dependency utopia-php/validators is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires utopia-php/console ^0.1 || ^0.2 || ^0.3 -> satisfiable by utopia-php/console[0.3.0].
    - utopia-php/console 0.3.0 requires utopia-php/validators ^1.0 -> found utopia-php/validators[1.0.0, 1.0.1] but the package is fixed to 2.0.0 (lock file version) by a partial update and that version does not match. Make sure you list it as an argument for the update command.
  Problem 2
    - Root composer.json requires brianium/paratest ^7.20 -> satisfiable by brianium/paratest[v7.27.5].
    - brianium/paratest v7.27.5 requires phpunit/phpunit ^13.4.3 -> found phpunit/phpunit[13.4.3, 13.4.4, 13.4.5, 13.4.6] but it conflicts with your root composer.json require (^12.5).

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

@coderabbitai

coderabbitai Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@appwrite

appwrite Bot commented Nov 9, 2026 •

Copy link
Copy Markdown

🟡 Tier B · Needs changes before merging

The exact Swoole constraint conflicts with the committed lockfile, so dependency installation and the Docker build fail until the lockfile is updated.

This PR updates the pinned checkout action revisions, the Composer image and development requirements, and the MySQL container images. It also broadens the supported utopia-php/console constraint and bumps the Swoole IDE helper requirement.

Verdict New comments Fixed Still open
🛑 Changes requested 1 0 0
Finding Where
🟠 [major] Update the lockfile with the new Swoole version composer.json:64
Fix with agent prompt
### Issue 1
composer.json:64
**[major] Update the lockfile with the new Swoole version**

`composer.lock` still locks `swoole/ide-helper` at 5.1.3, which does not satisfy this exact 5.1.8 requirement. As a result, `composer install` fails in the Docker build and other CI jobs that install dependencies; update the lockfile along with this constraint.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.
📂 Walkthrough · 6
File Change
.github/workflows/codeql-analysis.yml Updates the pinned checkout action to v6.1.0.
.github/workflows/linter.yml Updates the pinned checkout action to v6.1.0.
.github/workflows/tests.yml Updates the pinned checkout action in the test jobs to v6.1.0.
Dockerfile Updates the Composer build-stage image and digest to v2.10.
composer.json Broadens the console dependency constraint and pins the Swoole IDE helper to v5.1.8.
docker-compose.yml Updates both MySQL services to v8.4.11.

Reviewed b263b1c · Details · Comment @appwrite review to re-run, or mention @appwrite with a question.

@appwrite appwrite Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Tier B · 1 blocking finding to address. Summary

Comment thread composer.json
"phpunit/phpunit": "^12.5",
"brianium/paratest": "^7.20",
"swoole/ide-helper": "5.1.3",
"swoole/ide-helper": "5.1.8",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[major] Update the lockfile with the new Swoole version

composer.lock still locks swoole/ide-helper at 5.1.3, which does not satisfy this exact 5.1.8 requirement. As a result, composer install fails in the Docker build and other CI jobs that install dependencies; update the lockfile along with this constraint.

Prompt To Fix With AI
This is a comment left during a code review.
Path: composer.json
Line: 64

Comment:
**[major] Update the lockfile with the new Swoole version**

`composer.lock` still locks `swoole/ide-helper` at 5.1.3, which does not satisfy this exact 5.1.8 requirement. As a result, `composer install` fails in the Docker build and other CI jobs that install dependencies; update the lockfile along with this constraint.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

🟠 Major · bug · Reply if this doesn't apply.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants