chore: pin GitHub Actions to commit SHAs

.github/SECURITY.md

@@ -1,13 +0,0 @@
-# Security Policy
-
-**PLEASE DON'T DISCLOSE SECURITY-RELATED ISSUES PUBLICLY, [SEE BELOW](#reporting-a-vulnerability).**
-
-## Reporting a Vulnerability
-
-If you discover a security vulnerability in Pest, please report it privately using one of the following channels:
-
-1. **GitHub Private Vulnerability Reporting** (preferred) — go to the repository's **Security** tab and click **"Report a vulnerability"**. This creates a private advisory visible only to maintainers and provides a structured workflow for triage, fix coordination, and CVE assignment.
-
-2. **Email** — send the details to Nuno Maduro at **enunomaduro@gmail.com**.
-
-All security vulnerabilities will be promptly addressed.

.github/dependabot.yml

@@ -1,19 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    target-branch: "5.x"
-    groups:
-      github-actions:
-        patterns:
-          - "*"

.github/workflows/static.yml

@@ -24,7 +24,7 @@ jobs:
     strategy:
       fail-fast: true
       matrix:
-        dependency-version: [prefer-stable]
+        dependency-version: [prefer-lowest, prefer-stable]
 
     steps:
     - name: Checkout

composer.json

@@ -26,12 +26,12 @@
         "pestphp/pest-plugin-arch": "^4.0.2",
         "pestphp/pest-plugin-mutate": "^4.0.1",
         "pestphp/pest-plugin-profanity": "^4.2.1",
-        "phpunit/phpunit": "^12.5.28",
-        "symfony/process": "^7.4.13|^8.1.0"
+        "phpunit/phpunit": "^12.5.24",
+        "symfony/process": "^7.4.8|^8.0.8"
     },
     "conflict": {
         "filp/whoops": "<2.18.3",
-        "phpunit/phpunit": ">12.5.28",
+        "phpunit/phpunit": ">12.5.24",
         "sebastian/exporter": "<7.0.0",
         "webmozart/assert": "<1.11.0"
     },
@@ -59,11 +59,11 @@
         ]
     },
     "require-dev": {
-        "mrpunyapal/peststan": "^0.2.10",
+        "mrpunyapal/peststan": "^0.2.9",
         "pestphp/pest-dev-tools": "^4.1.0",
         "pestphp/pest-plugin-browser": "^4.3.1",
         "pestphp/pest-plugin-type-coverage": "^4.0.4",
-        "psy/psysh": "^0.12.23"
+        "psy/psysh": "^0.12.22"
     },
     "minimum-stability": "dev",
     "prefer-stable": true,

src/Kernel.php

@@ -163,7 +163,7 @@ final class Kernel
         $this->terminate();
 
         if (is_array($error = error_get_last())) {
-            if (! in_array($error['type'], [E_ERROR, E_COMPILE_ERROR, E_CORE_ERROR], true)) {
+            if (! in_array($error['type'], [E_ERROR, E_CORE_ERROR], true)) {
                 return;
             }
 

src/KernelDump.php

@@ -4,7 +4,6 @@ declare(strict_types=1);
 
 namespace Pest;
 
-use Laravel\Pao\Execution;
 use Pest\Support\View;
 use Symfony\Component\Console\Output\OutputInterface;
 
@@ -29,10 +28,6 @@ final class KernelDump
      */
     public function enable(): void
     {
-        if (class_exists(Execution::class) && Execution::running()) {
-            return;
-        }
-
         ob_start(function (string $message): string {
             $this->buffer .= $message;
 
@@ -73,10 +68,6 @@ final class KernelDump
 
         $type = 'INFO';
 
-        if (is_array($error = error_get_last()) && in_array($error['type'], [E_ERROR, E_COMPILE_ERROR, E_CORE_ERROR], true)) {
-            return;
-        }
-
         if ($this->isInternalError($this->buffer)) {
             $type = 'ERROR';
             $this->buffer = str_replace(
@@ -116,6 +107,7 @@ final class KernelDump
      */
     private function isInternalError(string $output): bool
     {
-        return str_contains($output, 'An error occurred inside PHPUnit.');
+        return str_contains($output, 'An error occurred inside PHPUnit.')
+            || str_contains($output, 'Fatal error');
     }
 }

src/Mixins/Expectation.php

@@ -954,7 +954,6 @@ final class Expectation
         } catch (Throwable $e) {
 
             if ($exception instanceof Throwable) {
-                // @phpstan-ignore-next-line
                 expect($e)
                     ->toBeInstanceOf($exception::class, $message)
                     ->and($e->getMessage())->toBe($exceptionMessage ?? $exception->getMessage(), $message);

src/Pest.php

@@ -6,7 +6,7 @@ namespace Pest;
 
 function version(): string
 {
-    return '4.7.2';
+    return '4.7.0';
 }
 
 function testDirectory(string $file = ''): string

src/Plugins/Parallel/Paratest/WrapperRunner.php

@@ -146,6 +146,7 @@ final class WrapperRunner implements RunnerInterface
     public function run(): int
     {
         $directory = dirname(__DIR__);
+        assert($directory !== '');
         ExcludeList::addDirectory($directory);
         TestResultFacade::init();
         EventFacade::instance()->seal();

tests/.pest/snapshots/Visual/Help/visual_snapshot_of_help_command_output.snap

@@ -1,5 +1,5 @@
 
-  Pest Testing Framework 4.7.2.  
+  Pest Testing Framework 4.7.0.  
 
   USAGE: pest <file> [options]  
 

tests/.pest/snapshots/Visual/Version/visual_snapshot_of_help_command_output.snap

@@ -1,3 +1,3 @@
 
-  Pest Testing Framework 4.7.2.  
+  Pest Testing Framework 4.7.0.  
 

tests/.snapshots/success.txt

@@ -4,6 +4,7 @@
   ✓ preset → strict → ignoring ['Pest\Plugins\Tia\BaselineSync', 'usleep']
   ✓ preset → security → ignoring ['eval', 'str_shuffle', 'exec', …]
   ✓ globals
+  ✓ contracts
 
    PASS  Tests\Environments\Windows
   ✓ global functions are loaded
@@ -1937,4 +1938,4 @@
   ✓ pass with dataset with ('my-datas-set-value')
   ✓ within describe → pass with dataset with ('my-datas-set-value')
 
-  Tests:    2 deprecated, 4 warnings, 5 incomplete, 2 notices, 40 todos, 35 skipped, 1328 passed (3008 assertions)
+  Tests:    2 deprecated, 4 warnings, 5 incomplete, 2 notices, 40 todos, 35 skipped, 1329 passed (3010 assertions)

tests/Arch.php

@@ -33,3 +33,13 @@ arch('globals')
     ->expect(['dd', 'dump', 'ray', 'die', 'var_dump', 'sleep'])
     ->not->toBeUsed()
     ->ignoring(Expectation::class);
+
+arch('contracts')
+    ->expect('Pest\Contracts')
+    ->toOnlyUse([
+        'NunoMaduro\Collision\Contracts',
+        'Pest\Factories\TestCaseMethodFactory',
+        'Symfony\Component\Console',
+        'Pest\Arch\Contracts',
+        'Pest\PendingCalls',
+    ])->toBeInterfaces();

tests/Visual/Parallel.php

@@ -24,13 +24,13 @@ test('parallel', function () use ($run) {
         $file = file_get_contents(__FILE__);
         $file = preg_replace(
             '/\$expected = \'.*?\';/',
-            "\$expected = '2 deprecated, 4 warnings, 5 incomplete, 3 notices, 40 todos, 27 skipped, 1312 passed (2957 assertions)';",
+            "\$expected = '2 deprecated, 4 warnings, 5 incomplete, 3 notices, 40 todos, 27 skipped, 1313 passed (2959 assertions)';",
             $file,
         );
         file_put_contents(__FILE__, $file);
     }
 
-    $expected = '2 deprecated, 4 warnings, 5 incomplete, 3 notices, 40 todos, 27 skipped, 1312 passed (2957 assertions)';
+    $expected = '2 deprecated, 4 warnings, 5 incomplete, 3 notices, 40 todos, 27 skipped, 1313 passed (2959 assertions)';
 
     expect($output)
         ->toContain("Tests:    {$expected}")