Bump shivammathur/setup-php in the github-actions group (#1706)

Bumps the github-actions group with 1 update: [shivammathur/setup-php](https://github.com/shivammathur/setup-php).


Updates `shivammathur/setup-php` from 2.37.0 to 2.37.1
- [Release notes](https://github.com/shivammathur/setup-php/releases)
- [Commits](accd6127cb...7c071dfe9d)

---
updated-dependencies:
- dependency-name: shivammathur/setup-php
  dependency-version: 2.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+**PLEASE DON'T DISCLOSE SECURITY-RELATED ISSUES PUBLICLY, [SEE BELOW](#reporting-a-vulnerability).**
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in Pest, please report it privately using one of the following channels:
+
+1. **GitHub Private Vulnerability Reporting** (preferred) — go to the repository's **Security** tab and click **"Report a vulnerability"**. This creates a private advisory visible only to maintainers and provides a structured workflow for triage, fix coordination, and CVE assignment.
+
+2. **Email** — send the details to Nuno Maduro at **enunomaduro@gmail.com**.
+
+All security vulnerabilities will be promptly addressed.

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: "5.x"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/static.yml

@@ -24,14 +24,14 @@ jobs:
     strategy:
       fail-fast: true
       matrix:
-        dependency-version: [prefer-lowest, prefer-stable]
+        dependency-version: [prefer-stable]
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2
       with:
         php-version: 8.4
         tools: composer:v2
@@ -44,7 +44,7 @@ jobs:
       run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
     - name: Cache Composer dependencies
-      uses: actions/cache@v5
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
         key: static-php-8.4-${{ matrix.dependency-version }}-composer-${{ hashFiles('**/composer.json', '**/composer.lock') }}

.github/workflows/tests.yml

@@ -32,10 +32,10 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2
       with:
         php-version: ${{ matrix.php }}
         tools: composer:v2
@@ -48,7 +48,7 @@ jobs:
       run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
     - name: Cache Composer dependencies
-      uses: actions/cache@v5
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
         key: ${{ matrix.os }}-php-${{ matrix.php }}-symfony-${{ matrix.symfony }}-composer-${{ hashFiles('**/composer.json', '**/composer.lock') }}

composer.json

@@ -18,7 +18,7 @@
     ],
     "require": {
         "php": "^8.4",
-        "brianium/paratest": "^7.22.3",
+        "brianium/paratest": "^7.22.4",
         "nunomaduro/collision": "^8.9.4",
         "nunomaduro/termwind": "^2.4.0",
         "pestphp/pest-plugin": "^5.0.0",
@@ -58,12 +58,12 @@
         ]
     },
     "require-dev": {
-        "mrpunyapal/peststan": "^0.2.9",
+        "mrpunyapal/peststan": "^0.2.10",
         "laravel/pao": "^1.0.6",
         "pestphp/pest-dev-tools": "^5.0.0",
         "pestphp/pest-plugin-browser": "^5.0.0",
         "pestphp/pest-plugin-type-coverage": "^5.0.0",
-        "psy/psysh": "^0.12.22"
+        "psy/psysh": "^0.12.23"
     },
     "minimum-stability": "dev",
     "prefer-stable": true,

src/Kernel.php

@@ -163,7 +163,7 @@ final class Kernel
         $this->terminate();
 
         if (is_array($error = error_get_last())) {
-            if (! in_array($error['type'], [E_ERROR, E_CORE_ERROR], true)) {
+            if (! in_array($error['type'], [E_ERROR, E_COMPILE_ERROR, E_CORE_ERROR], true)) {
                 return;
             }
 

src/KernelDump.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace Pest;
 
+use Laravel\Pao\Execution;
 use Pest\Support\View;
 use Symfony\Component\Console\Output\OutputInterface;
 
@@ -28,6 +29,10 @@ final class KernelDump
      */
     public function enable(): void
     {
+        if (class_exists(Execution::class) && Execution::running()) {
+            return;
+        }
+
         ob_start(function (string $message): string {
             $this->buffer .= $message;
 
@@ -68,6 +73,10 @@ final class KernelDump
 
         $type = 'INFO';
 
+        if (is_array($error = error_get_last()) && in_array($error['type'], [E_ERROR, E_COMPILE_ERROR, E_CORE_ERROR], true)) {
+            return;
+        }
+
         if ($this->isInternalError($this->buffer)) {
             $type = 'ERROR';
             $this->buffer = str_replace(
@@ -107,7 +116,6 @@ final class KernelDump
      */
     private function isInternalError(string $output): bool
     {
-        return str_contains($output, 'An error occurred inside PHPUnit.')
-            || str_contains($output, 'Fatal error');
+        return str_contains($output, 'An error occurred inside PHPUnit.');
     }
 }

src/Mixins/Expectation.php

@@ -954,6 +954,7 @@ final class Expectation
         } catch (Throwable $e) {
 
             if ($exception instanceof Throwable) {
+                // @phpstan-ignore-next-line
                 expect($e)
                     ->toBeInstanceOf($exception::class, $message)
                     ->and($e->getMessage())->toBe($exceptionMessage ?? $exception->getMessage(), $message);

src/Pest.php

@@ -6,7 +6,7 @@ namespace Pest;
 
 function version(): string
 {
-    return '5.0.0-rc.7';
+    return '5.0.0-rc.9';
 }
 
 function testDirectory(string $file = ''): string

src/Plugins/Parallel/Paratest/WrapperRunner.php

@@ -151,7 +151,6 @@ final class WrapperRunner implements RunnerInterface
     public function run(): int
     {
         $directory = dirname(__DIR__);
-        assert($directory !== '');
         ExcludeList::addDirectory($directory);
         TestResultFacade::init();
         EventFacade::instance()->seal();

tests/.pest/snapshots/Visual/Help/visual_snapshot_of_help_command_output.snap

@@ -1,5 +1,5 @@
 
-  Pest Testing Framework 5.0.0-rc.7.  
+  Pest Testing Framework 5.0.0-rc.9.  
 
   USAGE: pest <file> [options]  
 

tests/.pest/snapshots/Visual/Version/visual_snapshot_of_help_command_output.snap

@@ -1,3 +1,3 @@
 
-  Pest Testing Framework 5.0.0-rc.7.  
+  Pest Testing Framework 5.0.0-rc.9.  
 

tests/.snapshots/success.txt

@@ -4,7 +4,6 @@
   ✓ preset → strict → ignoring ['Pest\Plugins\Tia\BaselineSync', 'usleep']
   ✓ preset → security → ignoring ['eval', 'str_shuffle', 'exec', …]
   ✓ globals
-  ✓ contracts
 
    PASS  Tests\Environments\Windows
   ✓ global functions are loaded
@@ -74,9 +73,9 @@
   ↓ is marked as todo 3
   ↓ shouldBeMarkedAsTodo
 
-   PASS  Tests\Features\Coverage
+   WARN  Tests\Features\Coverage
   ✓ it has plugin
-  ✓ it adds coverage if --coverage exist
+  - it adds coverage if --coverage exist → Coverage is not available
   ✓ it adds coverage if --min exist
   ✓ it generates coverage based on file input
 
@@ -1940,4 +1939,4 @@
   ✓ pass with dataset with ('my-datas-set-value')
   ✓ within describe → pass with dataset with ('my-datas-set-value')
 
-  Tests:    2 deprecated, 4 warnings, 5 incomplete, 2 notices, 40 todos, 34 skipped, 1332 passed (3020 assertions)
+  Tests:    2 deprecated, 4 warnings, 5 incomplete, 2 notices, 40 todos, 35 skipped, 1330 passed (3013 assertions)

tests/Arch.php

@@ -33,13 +33,3 @@ arch('globals')
     ->expect(['dd', 'dump', 'ray', 'die', 'var_dump', 'sleep'])
     ->not->toBeUsed()
     ->ignoring(Expectation::class);
-
-arch('contracts')
-    ->expect('Pest\Contracts')
-    ->toOnlyUse([
-        'NunoMaduro\Collision\Contracts',
-        'Pest\Factories\TestCaseMethodFactory',
-        'Symfony\Component\Console',
-        'Pest\Arch\Contracts',
-        'Pest\PendingCalls',
-    ])->toBeInterfaces();

tests/Visual/Parallel.php

@@ -24,13 +24,13 @@ test('parallel', function () use ($run) {
         $file = file_get_contents(__FILE__);
         $file = preg_replace(
             '/\$expected = \'.*?\';/',
-            "\$expected = '2 deprecated, 4 warnings, 5 incomplete, 3 notices, 40 todos, 26 skipped, 1316 passed (2969 assertions)';",
+            "\$expected = '2 deprecated, 4 warnings, 5 incomplete, 3 notices, 40 todos, 27 skipped, 1314 passed (2962 assertions)';",
             $file,
         );
         file_put_contents(__FILE__, $file);
     }
 
-    $expected = '2 deprecated, 4 warnings, 5 incomplete, 3 notices, 40 todos, 26 skipped, 1316 passed (2969 assertions)';
+    $expected = '2 deprecated, 4 warnings, 5 incomplete, 3 notices, 40 todos, 27 skipped, 1314 passed (2962 assertions)';
 
     expect($output)
         ->toContain("Tests:    {$expected}")