ci: runs ci only against stable

* chore: pin GitHub Actions to commit SHAs

* chore: pin GitHub Actions to commit SHAs

.github/SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+**PLEASE DON'T DISCLOSE SECURITY-RELATED ISSUES PUBLICLY, [SEE BELOW](#reporting-a-vulnerability).**
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in Pest, please report it privately using one of the following channels:
+
+1. **GitHub Private Vulnerability Reporting** (preferred) — go to the repository's **Security** tab and click **"Report a vulnerability"**. This creates a private advisory visible only to maintainers and provides a structured workflow for triage, fix coordination, and CVE assignment.
+
+2. **Email** — send the details to Nuno Maduro at **enunomaduro@gmail.com**.
+
+All security vulnerabilities will be promptly addressed.

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: "5.x"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/static.yml

@@ -24,7 +24,7 @@ jobs:
     strategy:
       fail-fast: true
       matrix:
-        dependency-version: [prefer-lowest, prefer-stable]
+        dependency-version: [prefer-stable]
 
     steps:
     - name: Checkout

composer.json

@@ -26,12 +26,12 @@
         "pestphp/pest-plugin-arch": "^4.0.2",
         "pestphp/pest-plugin-mutate": "^4.0.1",
         "pestphp/pest-plugin-profanity": "^4.2.1",
-        "phpunit/phpunit": "^12.5.24",
-        "symfony/process": "^7.4.8|^8.0.8"
+        "phpunit/phpunit": "^12.5.28",
+        "symfony/process": "^7.4.13|^8.1.0"
     },
     "conflict": {
         "filp/whoops": "<2.18.3",
-        "phpunit/phpunit": ">12.5.24",
+        "phpunit/phpunit": ">12.5.28",
         "sebastian/exporter": "<7.0.0",
         "webmozart/assert": "<1.11.0"
     },
@@ -59,11 +59,11 @@
         ]
     },
     "require-dev": {
-        "mrpunyapal/peststan": "^0.2.9",
+        "mrpunyapal/peststan": "^0.2.10",
         "pestphp/pest-dev-tools": "^4.1.0",
         "pestphp/pest-plugin-browser": "^4.3.1",
         "pestphp/pest-plugin-type-coverage": "^4.0.4",
-        "psy/psysh": "^0.12.22"
+        "psy/psysh": "^0.12.23"
     },
     "minimum-stability": "dev",
     "prefer-stable": true,

src/Kernel.php

@@ -163,7 +163,7 @@ final class Kernel
         $this->terminate();
 
         if (is_array($error = error_get_last())) {
-            if (! in_array($error['type'], [E_ERROR, E_CORE_ERROR], true)) {
+            if (! in_array($error['type'], [E_ERROR, E_COMPILE_ERROR, E_CORE_ERROR], true)) {
                 return;
             }
 

src/KernelDump.php

@@ -68,6 +68,10 @@ final class KernelDump
 
         $type = 'INFO';
 
+        if (is_array($error = error_get_last()) && in_array($error['type'], [E_ERROR, E_COMPILE_ERROR, E_CORE_ERROR], true)) {
+            return;
+        }
+
         if ($this->isInternalError($this->buffer)) {
             $type = 'ERROR';
             $this->buffer = str_replace(
@@ -107,7 +111,6 @@ final class KernelDump
      */
     private function isInternalError(string $output): bool
     {
-        return str_contains($output, 'An error occurred inside PHPUnit.')
-            || str_contains($output, 'Fatal error');
+        return str_contains($output, 'An error occurred inside PHPUnit.');
     }
 }

src/Mixins/Expectation.php

@@ -954,6 +954,7 @@ final class Expectation
         } catch (Throwable $e) {
 
             if ($exception instanceof Throwable) {
+                // @phpstan-ignore-next-line
                 expect($e)
                     ->toBeInstanceOf($exception::class, $message)
                     ->and($e->getMessage())->toBe($exceptionMessage ?? $exception->getMessage(), $message);

src/Pest.php

@@ -6,7 +6,7 @@ namespace Pest;
 
 function version(): string
 {
-    return '4.7.0';
+    return '4.7.1';
 }
 
 function testDirectory(string $file = ''): string

src/Plugins/Parallel/Paratest/WrapperRunner.php

@@ -146,7 +146,6 @@ final class WrapperRunner implements RunnerInterface
     public function run(): int
     {
         $directory = dirname(__DIR__);
-        assert($directory !== '');
         ExcludeList::addDirectory($directory);
         TestResultFacade::init();
         EventFacade::instance()->seal();

tests/.pest/snapshots/Visual/Help/visual_snapshot_of_help_command_output.snap

@@ -1,5 +1,5 @@
 
-  Pest Testing Framework 4.7.0.  
+  Pest Testing Framework 4.7.1.  
 
   USAGE: pest <file> [options]  
 

tests/.pest/snapshots/Visual/Version/visual_snapshot_of_help_command_output.snap

@@ -1,3 +1,3 @@
 
-  Pest Testing Framework 4.7.0.  
+  Pest Testing Framework 4.7.1.  
 

tests/.snapshots/success.txt

@@ -4,7 +4,6 @@
   ✓ preset → strict → ignoring ['Pest\Plugins\Tia\BaselineSync', 'usleep']
   ✓ preset → security → ignoring ['eval', 'str_shuffle', 'exec', …]
   ✓ globals
-  ✓ contracts
 
    PASS  Tests\Environments\Windows
   ✓ global functions are loaded
@@ -1938,4 +1937,4 @@
   ✓ pass with dataset with ('my-datas-set-value')
   ✓ within describe → pass with dataset with ('my-datas-set-value')
 
-  Tests:    2 deprecated, 4 warnings, 5 incomplete, 2 notices, 40 todos, 35 skipped, 1329 passed (3010 assertions)
+  Tests:    2 deprecated, 4 warnings, 5 incomplete, 2 notices, 40 todos, 35 skipped, 1328 passed (3008 assertions)

tests/Arch.php

@@ -33,13 +33,3 @@ arch('globals')
     ->expect(['dd', 'dump', 'ray', 'die', 'var_dump', 'sleep'])
     ->not->toBeUsed()
     ->ignoring(Expectation::class);
-
-arch('contracts')
-    ->expect('Pest\Contracts')
-    ->toOnlyUse([
-        'NunoMaduro\Collision\Contracts',
-        'Pest\Factories\TestCaseMethodFactory',
-        'Symfony\Component\Console',
-        'Pest\Arch\Contracts',
-        'Pest\PendingCalls',
-    ])->toBeInterfaces();

tests/Visual/Parallel.php

@@ -24,13 +24,13 @@ test('parallel', function () use ($run) {
         $file = file_get_contents(__FILE__);
         $file = preg_replace(
             '/\$expected = \'.*?\';/',
-            "\$expected = '2 deprecated, 4 warnings, 5 incomplete, 3 notices, 40 todos, 27 skipped, 1313 passed (2959 assertions)';",
+            "\$expected = '2 deprecated, 4 warnings, 5 incomplete, 3 notices, 40 todos, 27 skipped, 1312 passed (2957 assertions)';",
             $file,
         );
         file_put_contents(__FILE__, $file);
     }
 
-    $expected = '2 deprecated, 4 warnings, 5 incomplete, 3 notices, 40 todos, 27 skipped, 1313 passed (2959 assertions)';
+    $expected = '2 deprecated, 4 warnings, 5 incomplete, 3 notices, 40 todos, 27 skipped, 1312 passed (2957 assertions)';
 
     expect($output)
         ->toContain("Tests:    {$expected}")