The PHP Developer Day in Dresden is starting right now.
Remote
Sebastian Bergmann 
@sebastian@phpc.social
mastodon 4.7.3Created PHPUnit. Co-Founded thePHPcc. Helps developers build better software.
2030 Followers
55 Following
50 Posts
Joined November 15, 2022
PHPUnit Expert:
Consultant Profile:
chaos.social:
RE: https://phpc.social/@sebastian/117330033869348044
The badge on GitHub caught up.
Quoting
Somehow I completely missed this milestone: PHPUnit has now been installed via Composer more than 1,005,280,071 times. 🤯
One billion installs. Thank you to everyone who writes tests, reports bugs, sends pull requests, and supports the project. ❤️
https://packagist.org/packages/phpunit/phpunit/stats#PHPUnit #Packagist #OpenSource
Open quoted postSomehow I completely missed this milestone: PHPUnit has now been installed via Composer more than 1,005,280,071 times. 🤯
One billion installs. Thank you to everyone who writes tests, reports bugs, sends pull requests, and supports the project. ❤️
https://packagist.org/packages/phpunit/phpunit/stats#PHPUnit #Packagist #OpenSource
As of today, PHPUnit 8.5, 9.6, 10.5, 11.5, 12.5, 13.3, and the main branch are also tested with PHP 8.7, which will be released in Q4 2027.
Why this matters, and how PHP and its ecosystem test each other:
https://phpunit.expert/articles/how-php-and-its-ecosystem-test-each-other.html?ref=mastodon
#PHP #PHPUnit
Replying to
@edorian@phpc.social @Synchro@phpc.social Hello Marcus! Just came here to confirm that Volker is a real human with good intentions.
Hello, #PHP 8.7!
Replying to
Rewriting for the sake of rewriting is a waste of resources.
And don't get me started on whether I can trust the new thing to be maintained as well as I trust what it wants to replace.
A car manufacturer lists an Android botnet in its open source attribution. The entry gives away how the list was made: by scanning instead of by declaring.
Why a declared dependency list is worth more than a scanned one, and how the PHPUnit PHAR discloses its own contents:
https://phpunit.expert/articles/your-composer-lock-knows-what-a-carmaker-only-guesses.html?ref=mastodon
Replying to
Want to advance it? Write a PHP backend for Dafny plus its runtime library. Or explore whether PHP could benefit from wrapping the Botan library. Or improve PHPStan or Infection.
A security vulnerability in PHPCSUtils revealed an eval() call in a static analysis tool. Why disable_functions cannot reach eval(), and what a switch in the PHP engine to disable it could look like:
https://phpunit.expert/articles/when-static-analysis-runs-your-code.html?ref=mastodon
2025 and 2026 proved to be a stress test for the supply chains of all package ecosystems.
A review of Composer and Packagist: what PHP does well, what it can learn, and who owns our infrastructure.
https://phpunit.expert/articles/composer-and-packagist-under-supply-chain-stress.html?ref=mastodon
Answers to questions I am asked again and again about PHPUnit, test automation, code coverage, and testing in PHP:
https://phpunit.expert/faq.html?ref=mastodon
My well-tested CSV parser had 100% line and branch coverage and a 100% mutation score. Surely no bugs left, right?
Wrong. Fuzz testing found one almost instantly.
In my new article, I explore fuzz testing for PHP using @nikic@mastodon.social's PHP-Fuzzer and also compare fuzzing with property-based testing:
https://phpunit.expert/articles/security-through-chaos.html?ref=mastodon
PHPUnit 13.3 will be released next Friday, August 7. It ships quite a few impactful improvements I have been working on over the past months.
The ChangeLog lists what's new, but my newsletter, sent right after the release, explains these changes and puts them into perspective.
Not subscribed yet? It's free, and you can unsubscribe anytime:
https://phpunit.de/newsletter
ChangeLog: https://github.com/sebastianbergmann/phpunit/blob/603c565d0bb3f70cd9333cfc6bd13b7dd7b335a4/ChangeLog-13.3.md
#PHPUnit
Replying to
@naderman@phpc.social @edorian@phpc.social I have that on my TODO and hope to implement it later this year.
Replying to
@brendt@phpc.social I do not agree with that statement: PHPUnit is listed as one of these projects in the RFC and I do not think that PHP needs generics beyond what tools such as PHPStan provide.
Here is the material I used for my presentation "Past, Present, Future: The PHPUnit Story" at #phpcon_odawara today:
https://phpunit.expert/presentations/past-present-future-the-phpunit-story.html?ref=mastodon
Replying to
@afilina@phpc.social BTW: Roland Golla, German YouTuber from the PHP community, requested a phpc.tv account today because I asked him to. I do bi-monthly livestreams about new PHPUnit features (in German) with him that he wants to import to phpc.tv. Because I asked him to, so I do not need to link to YouTube for these anymore.
Sei live dabei, wenn ich heute um 14:00 Uhr Roland Golla im Livestream erzähle, was sich bei #PHPUnit gerade so alles tut:
https://www.youtube.com/watch?v=ClBCr4o8CHg&list=PL-Xl37-rETi4ITtOXFM22pEg9SPb-FiU4
Looking forward to this one: on August 6, I'll be at the @engkiosk@podcasts.social Rhine-Ruhr Meetup in Düsseldorf! 🎤
I'll be talking about "Turbo-Charging Your PHPUnit Suite", because slow tests destroy flow, and it doesn't have to be that way.
If you're in the Rhine-Ruhr area, come by and say hi. I always enjoy meeting the community in person.
https://phpunit.expert/events/engineering-kiosk-rhine-ruhr-meetup-august-2026.html
#PHP #PHPUnit #Meetup
Technical debt is not malicious. It is not laziness, incompetence, or carelessness either.
It is the result of constraints, trade-offs, and circumstances we did not witness. Written by people who cared about solving real problems, just like we do.
Why empathy is a technical skill, not just a soft one:
https://phpunit.expert/articles/technical-debt-is-not-malice.html?ref=mastodon
Replying to
@afilina@phpc.social I think so. I presented remotely via Zoom and heard "recording in progress" when I joined. In my conversation with the organizers I brought phpc.tv to their attention and asked them to publish there.
Replying to
@soatok I recently asked about PQC support in PHP on the internals mailinglist (https://externals.io/message/130673)
Can you answer my questions? Thank you!
Replying to
@beberlei@phpc.social I built https://github.com/sebastianbergmann/type for specific use cases I have in PHPUnit.
RE: https://phpc.social/@sebastian/117007183050868222
I have been working on PHPUnit with high intensity recently. I cannot keep this up without more funding.
To everyone who already sponsors my Open Source work: thank you. Your support makes a real difference.
I know times are tough. They are for me, too. If PHPUnit is part of your workflow, please consider sponsoring its continued development:
https://phpunit.de/sponsoring.html
#PHPUnit #OpenSource
Quoting
PHPUnit 13.3 will be released next Friday, August 7. It ships quite a few impactful improvements I have been working on over the past months.
The ChangeLog lists what's new, but my newsletter, sent right after the release, explains these changes and puts them into perspective.
Not subscribed yet? It's free, and you can unsubscribe anytime:
https://phpunit.de/newsletter
ChangeLog: https://github.com/sebastianbergmann/phpunit/blob/603c565d0bb3f70cd9333cfc6bd13b7dd7b335a4/ChangeLog-13.3.md
#PHPUnit
Open quoted postSymfony Language Tools no longer accepts pull requests, and most Laravel packages no longer accept issues.
Both decisions rest on the same premise: the diff has become cheap.
What remains scarce is an understanding of the problem, and the contribution that carries it best is a failing test:
https://phpunit.expert/articles/when-the-diff-is-free.html?ref=mastodon
The book I'm writing stands at roughly 400 pages now.
Maybe it's time to update https://phpunit.expert/book/ with some real information ... soon-ish™.
Replying to
@ilia@phpc.social I do not think PHPUnit should do anything here. Whatever limit is appropriate is a project- and environment-specific decision: suites that collect code coverage or run large integration tests legitimately need more memory than any default PHPUnit could pick, and getting it wrong means a fatal error that kills the whole run. PHPUnit runs arbitrary project code, so it's the least qualified party to choose that number.
Replying to
@saramg@fosstodon.org Monday was invented by the Tuesday Industrial Complex, purely so Tuesday could look good by comparison.
RE: https://phpc.social/@sebastian/116882147948130910
Having just watched "Caramel", I think it's high time I added "The Bear" to my list of all-time favourite series. But ... do I need to update my article now?
RE: https://phpc.social/@sebastian/116879224138213525
This toot should have been an article, and now it is. But it will have to wait its turn to be published.
Quoting
My favourite kind of bug fix: one that only adds a new regression test and does not touch any existing test.
The new test proves the bug is fixed. The untouched existing tests prove the fix does not break any behaviour we rely on; at least none that is covered by a test.
When a bug fix forces you to change existing tests, that is worth a pause: either the tests were coupled to implementation details, or the "bug" was actually documented behaviour someone depends on.
Open quoted postSelecting exactly the tests you want, finer control over the order they run in, faster and clearer output when they fail, and more expressive test doubles.
I walk you through what is new in PHPUnit 13.2:
https://phpunit.expert/articles/precision-and-clarity-what-is-new-in-phpunit-132.html?ref=mastodon
My favourite kind of bug fix: one that only adds a new regression test and does not touch any existing test.
The new test proves the bug is fixed. The untouched existing tests prove the fix does not break any behaviour we rely on; at least none that is covered by a test.
When a bug fix forces you to change existing tests, that is worth a pause: either the tests were coupled to implementation details, or the "bug" was actually documented behaviour someone depends on.
Replying to
@chaos0815@phpc.social Episode 7 of Season 5 of "The Bear" is titled "Caramel". This is what I was referring to.
My favourite kind of bug fix only adds a new regression test and leaves every existing test untouched.
I checked this claim against PHPUnit's own history and learned the most from the counterexamples:
https://phpunit.expert/articles/untouched-tests-are-half-the-proof.html?ref=mastodon
Replying to
@ilia@phpc.social I actually consider memory_limit=-1 the best practice for test execution (it is also what --check-php-configuration recommends). A runaway test suite is a bug to find and fix, not something to paper over in the test runner.
Only one more week until @FrOSCon@bonn.social in Sankt Augustin, the premier German Open Source conference, from the community for the community. 🎉
When I'm not on stage for my presentation "Supply Chain Security in the PHP Ecosystem", you'll find me at @thephpf@phpc.social's booth in the community expo hall.
@beberlei@phpc.social and I cannot wait to meet you all and discuss the work of the foundation.
Come say hi!
https://phpunit.expert/events/froscon-2026.html?ref=mastodon
#FrOSCon #PHP #OpenSource