PHP digest — 12 October 2026

No RFC status changes and no new internals messages by 22:00 UTC. PHPUnit and Pest released maintenance versions; the Symfony item is merged 8.2 development work, not a release.

Symfony 8.2: security tokens record how users authenticated

New in Symfony 8.2: Proving Authentication Methods describes three changes by Nicolas Grekas that extend Symfony 8.2's sudo mode, which checks when a user last entered credentials, to also record how they authenticated:

• Security tokens store the authentication methods proven during the session, named after RFC 8176 and exposed as AuthenticationMethod constants. getAuthenticationProofs() returns method names mapped to the Unix timestamp of their last use. Methods from earlier logins are kept. form_login, json_login and http_basic record AuthenticationMethod::PASSWORD, and the OpenID Connect authenticator uses the ID token's amr claim. Custom authenticators add an AuthenticationMethodBadge to the passport.
• Voters can call requestReAuthentication() on the Vote object, so a denied custom attribute starts the firewall's re-authentication entry point instead of returning 403. The post says this works only when a single attribute is denied. The entry point can read SecurityRequestAttributes::RE_AUTHENTICATION_ATTRIBUTE to see which attribute was denied.
• An OidcAuthorizationRequestEvent listener can set acr_values to ask an OpenID Connect provider for stronger authentication. Because the provider may not comply, the ID token's acr claim is stored in the oidc_acr token attribute for voters to check.

The post cites Symfony pull requests #66065, #66069, #66242 and #66184. They were not inspected here. Symfony 8.2 is not released, so names and behavior may still change.

PHPUnit 13.4.2 and 12.5.39: mock expectations ignored named arguments

At about 15:30 UTC PHPUnit released 13.4.2 and 12.5.39. Both fix bugs that could let tests pass without checking what they appear to check:

• Named arguments passed to with() were matched by position. An expectation such as ->with(b: 7) compared 7 with the method's first parameter, and $b was not checked.
• If a mock object threw an exception in its destructor, the test was reported as errored but its status stayed "success". As a result tearDown() saw the wrong status and code coverage counted the test as successful. In 13.4.2 this also meant #[Retry] did not retry the test and --repeat did not skip the remaining repetitions.

13.4.2 also ignored string keys in the parameter sets passed to withParameterSetsInOrder(), withParameterSetsInAnyOrder() and withParameterSetsInPartialOrder(), and this is now fixed. Other 13.4.2 fixes: expectUserDeprecationMessage() and expectUserDeprecationMessageMatches() now see the deprecations from the retried attempt instead of the previous test's; the compact printer is no longer created when an extension replaces progress output (#7033); and sorting by duration or size no longer recomputes values on every comparison (#7035). Other 12.5.39 fixes: extensions loaded with -d extension/-d zend_extension are now loaded in child processes (#7053), and a missing coverage driver in a child process now gives a warning instead of an error or a failed PHPT test. Neither note mentions a security fix, and no other branch had a new release in the collected feed. The notes do not say so, but expectations that were wrong all along, such as named-argument with() calls, may start failing after the upgrade.

Pest 5.3.2: --shard no longer runs some tests in more than one shard

Pest v5.3.2 (12 October, 17:37 UTC) lists three changes. The main one is #1884. Its description says PHPUnit matches shard filters as unanchored regular expressions against Class::method. So a class whose name starts with the name of a class from another shard also ran in that shard. For example, Tests\Feature\After matched Tests\Feature\AfterAll. When Pest's own suite was split into two shards, 218 tests ran in both. With the fix, none do. The generated filter now requires :: right after each class name, for example Tests\\Feature\\(After(?=::)|AfterAll(?=::)). The other two changes support the worker temporary directory of brianium/paratest 7.26.1 (#1959) and update the CI setup-php action (#1961). The notes do not mention a security fix, and they do not say which Pest versions had the sharding bug. #1959 was not inspected.

Coverage

All 43 sources were collected successfully at 04:01 UTC, and the 24 due feed and index sources again at 10:01, 16:01 and 22:01 UTC (the daily package and adoption sources were not due after 04:01). health --fail-stale reports no failed or stale source. The official RFC index still has 950 entries with no status changes; end_pear_endorsement and reldateformatter are voting. The newest internals message is still 132863 (11 October), covered in the 11 October digest. Package and WordPress version-share observations were not compared, because no baseline comparison has been defined. A freek.dev post today covers PHP 8.6 readonly property defaults. The feature is not new: it was accepted and merged in August. It is now documented from primary sources in Readonly property default values.