Update the dev dependencies #193

Merged

thatguygriff merged 1 commits from chore/update-dev-dependencies into main 2026-08-25 02:10:14 +00:00

Conversation 0 Commits 1 Files Changed 1

+53 -67

thatguygriff commented 2026-08-25 02:09:17 +00:00

Owner

Copy Link

Copy Source

Routine catch-up on the test and analysis tooling. Stacked on #192 — until that merges this shows its two commits as well; the change here is the single Update the dev dependencies commit.

Every package is already permitted by the existing constraints, so composer.json does not move and no production dependency is touched.

Package
mockery/mockery	1.6.12	→ 1.6.15
phpstan/phpstan	2.2.2	→ 2.2.9
phpunit/phpunit	10.5.63	→ 10.5.64
hamcrest/hamcrest-php	v2.1.1	→ v3.0.0 — transitive, via mockery
myclabs/deep-copy	1.13.4	→ 1.14.0
nikic/php-parser	v5.7.0	→ v5.8.0
sebastian/recursion-context	5.0.1	→ 5.0.2

Seven packages move, none added or removed.

The one worth watching was PHPStan 2.2.2 → 2.2.9 — seven patch releases of a static analyser routinely means new inferences and therefore newly reported errors. It reports none here, so this needed no code changes.

Not in here, and why

Three updates composer outdated lists are not reachable:

• php-stubs/wordpress-stubs → 7.0.1 — szepeviktor/phpstan-wordpress v2.0.3, the latest release, requires php-stubs/wordpress-stubs ^6.6.2. No published version of it permits 7.x, so resolution fails.
• squizlabs/php_codesniffer → 4.0.4 — WPCS 3.4.1, the latest release, requires squizlabs/php_codesniffer ^3.13.5.
• phpunit/phpunit → 11/12/13 — PHPUnit majors track PHP minimums one to one: 11 needs 8.2, 12 needs 8.3, 13 needs 8.4.1. Reaching 13 would mean dropping 8.1, 8.2 and 8.3 from the matrix.

stripe/stripe-php 17.6.0 → 21.2.1 is deliberately excluded — it is the only production dependency and four majors is a migration, not a lockfile bump. Tracked separately.

Tests

• composer test — 966 tests, 2795 assertions, OK
• composer lint — no errors, on PHPStan 2.2.9
• composer cs — clean
• composer audit — no advisories

Routine catch-up on the test and analysis tooling. Stacked on #192 — until that merges this shows its two commits as well; the change here is the single `Update the dev dependencies` commit. Every package is already permitted by the existing constraints, so **`composer.json` does not move** and no production dependency is touched. | Package | | | |---|---|---| | `mockery/mockery` | 1.6.12 | → 1.6.15 | | `phpstan/phpstan` | 2.2.2 | → 2.2.9 | | `phpunit/phpunit` | 10.5.63 | → 10.5.64 | | `hamcrest/hamcrest-php` | v2.1.1 | → v3.0.0 — transitive, via mockery | | `myclabs/deep-copy` | 1.13.4 | → 1.14.0 | | `nikic/php-parser` | v5.7.0 | → v5.8.0 | | `sebastian/recursion-context` | 5.0.1 | → 5.0.2 | Seven packages move, none added or removed. The one worth watching was **PHPStan 2.2.2 → 2.2.9** — seven patch releases of a static analyser routinely means new inferences and therefore newly reported errors. It reports none here, so this needed no code changes. ## Not in here, and why Three updates `composer outdated` lists are not reachable: - **`php-stubs/wordpress-stubs` → 7.0.1** — `szepeviktor/phpstan-wordpress` v2.0.3, the latest release, requires `php-stubs/wordpress-stubs ^6.6.2`. No published version of it permits 7.x, so resolution fails. - **`squizlabs/php_codesniffer` → 4.0.4** — WPCS 3.4.1, the latest release, requires `squizlabs/php_codesniffer ^3.13.5`. - **`phpunit/phpunit` → 11/12/13** — PHPUnit majors track PHP minimums one to one: 11 needs 8.2, 12 needs 8.3, 13 needs 8.4.1. Reaching 13 would mean dropping 8.1, 8.2 and 8.3 from the matrix. `stripe/stripe-php` 17.6.0 → 21.2.1 is deliberately excluded — it is the only production dependency and four majors is a migration, not a lockfile bump. Tracked separately. ## Tests - `composer test` — 966 tests, 2795 assertions, OK - `composer lint` — no errors, on PHPStan 2.2.9 - `composer cs` — clean - `composer audit` — no advisories

thatguygriff added 1 commit 2026-08-25 02:09:17 +00:00

Update the dev dependencies ... 54a8b906f7

Routine catch-up on the test and analysis tooling. Every package here is
already allowed by the existing constraints, so composer.json does not move
and no production dependency is touched.

  mockery/mockery              1.6.12  -> 1.6.15
  phpstan/phpstan               2.2.2  -> 2.2.9
  phpunit/phpunit             10.5.63  -> 10.5.64
  hamcrest/hamcrest-php        v2.1.1  -> v3.0.0   (transitive, via mockery)
  myclabs/deep-copy            1.13.4  -> 1.14.0
  nikic/php-parser             v5.7.0  -> v5.8.0
  sebastian/recursion-context   5.0.1  -> 5.0.2

Seven patch releases of PHPStan is the one worth watching, since a static
analyser routinely gains inferences between them. It reports no new errors
here, and PHPCS and the suite are unchanged.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01D9acV1mHktGAb1uyvNmrR2

thatguygriff merged commit dfa29745df into main 2026-08-25 02:10:14 +00:00

thatguygriff deleted branch chore/update-dev-dependencies 2026-08-25 02:10:14 +00:00

thatguygriff referenced this pull request 2026-08-25 02:10:30 +00:00

Payments: migrate stripe-php from 17.6.0 to 21.x #194

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

enhancement

Extends an existing feature

feature

New user-facing capability

payments

Billing, Stripe, receipts, reporting

security

Security vulnerability or hardening

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Kydoimos (Kydoimos) thatguygriff (James Griffin-Allwood)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Unsupervised/unsupervised-scheduler#193