[knittingcode]

Summary

Updates the dev dependency phpunit/phpunit from 13.4.3 to 13.4.5 to fix advisory GHSA-9vw2-f4vp-x7gf (Packagist PKSA-qhjm-rpqc-qkn6, no CVE).

Motivation

• Advisory: PHPUnit 13.4.0 to 13.4.3 let other local users execute code through a shared temporary directory used for PHPT code coverage. It was reported 2026-10-27; fixed releases are 13.4.4 and 13.4.5.
• Impact on CI: composer audit (BE-03) now fails on every CI run, including main after test(stack): report why an interrupted restore check of ST-50 failed #38: run 40669720894 on 999d4d1.
• Why it's urgent: it blocks the other pull requests too. CI runs on test(auth): pin that a 401 answer to logout resolves and signs out #33 (40669321115), docs(api): declare the 500 of session routes when the session store fails #31 (40669324998) and build(deps): bump github.com/go-chi/chi/v5 from 5.3.2 to 5.4.0 in /docker/edge/caddy #37 (40669014889) fail at BE-03 the same way.
• Pre-existing: main 202ea9e itself is affected, so the failure is not caused by test(stack): report why an interrupted restore check of ST-50 failed #38.

Implementation

• How: composer update phpunit/phpunit --with-dependencies --no-install, run in the project's PHP 8.5.12 API image with Composer 2.9.7.
• Lock file: exactly one package update.
• Constraint: the project's bump-after-update: true raised it from ^13 to ^13.4.5, so a vulnerable version can't be locked again.
• Dependencies: 13.4.5 requires sebastian/git-state ^1.1; the lock already has 1.1.0.

Testing

Local runs, in a throwaway container from the API image:

• composer validate: valid.
• composer audit --locked: no advisories.
• phpunit --testsuite unit: 156 tests OK on PHPUnit 13.4.5.

CI run 40671261985 on this head (e9c22e3):

• BE-03 now passes: No security vulnerability advisories found. Backend 18/18 (unit 156, integration 278, 53/53 negative controls), frontend 5/5, application stack 124/124, production-like 39/39.
• Trivy fails, for a reason unrelated to this change (13/14): new advisory CVE-2026-116587 / GHSA-mgcc-cww5-fp2q (HIGH, a denial of service when go-jose parses JWKs) in the Caddy binary of edge-prod.
  • go-jose/v4 4.1.5 is fixed in 4.1.6.
  • go-jose/v3 3.0.5 has no fix. It comes in through caddypki, then smallstep, then go.step.sm/crypto.
  • This needs a separate owner decision and blocks every CI run, main included.

Security considerations

• PHPUnit is a dev dependency only. Runtime images run composer install --no-dev, so it isn't installed in production.
• No scanner or audit configuration is changed, and no advisory is ignored.

Known limitations

CI can't go fully green until the go-jose finding in the edge image is resolved separately.

[knittingcode]

Superseded by #42 (squash commit 1badf76). Verified against main 1badf76: backend/composer.json and backend/composer.lock are byte-identical to this PR's head e9c22e3 (phpunit/phpunit 13.4.5, GHSA-9vw2-f4vp-x7gf). Main CI run 40745073009 passes BE-03 composer audit. Closed without merging; the branch is kept.