What changed
PHPUnit 13.3.6, released September 25, 2026, changed handling of test-controlled names, messages and terminal output: ANSI/control characters and bidirectional formatting characters are rendered visibly instead of passed through, and newlines in compact-output test identifiers no longer forge additional record headers. PHPUnit 13.4.0, released October 2, added a whole-run `--timeout` option and changed compact reporting so output produced by a test is attributed to that test. In an October 8 PHP Foundation analysis, maintainer Sebastian Bergmann explained why the same CLI output now has two readers—a coding agent interpreting bytes and a person viewing a terminal—and why differing renderings create a trust problem.
Why it matters
Agents commonly invoke PHPUnit without supervision and summarise its logs to a human. A malicious or unusual test name can inject terminal erase sequences or text resembling a failure record, creating disagreement about what ran. A hanging test can consume an agent's execution budget and, if killed externally, leave no useful summary. PHPUnit's changes make its own output harder to spoof and enable bounded, inspectable failure. They do not eliminate prompt injection from arbitrary test output, stop malicious code execution or replace sandboxing and credential isolation.
Terminal output and compact records become harder to spoof
The 13.3.6 release escapes control and Unicode bidirectional formatting characters in test-controlled strings as visible `\u{NNNN}` sequences rather than silently stripping them. This prevents escape sequences from rewriting what a reviewer sees while an agent sees different bytes. Compact-output record headers are constrained to one line so a newline inside a data-provider name cannot invent a new `--- FAILURE:` record. Multiline message bodies can still contain misleading lines; compact output is for reading, not a machine-authenticated event stream.
A test-run limit that preserves evidence
PHPUnit 13.4 adds `--timeout` to bound the entire invocation, including bootstrap and suite loading. On timeout, PHPUnit aims to stop scheduling tests, produce logs and results, and exit with code 124. With pcntl available, an active test can be interrupted and reported with a stack trace. This is not a per-test CPU quota and cannot make arbitrary PHP execution safe.
Output becomes attributed, not passed through
PHPUnit 13.4's compact format reports text printed by tests in a `--- OUTPUT:` record associated with the test, unless strict-output checks already classify it as risky. This reduces ambiguity for CI readers and coding agents, but exit codes and structured results should determine pass/fail rather than LLM interpretation of free-form logs.
The next boundary remains a plan
The PHP Foundation says PHPUnit 13.5 is expected to add `--show-effective-configuration`, allowing a harness to inspect scripts, extensions and test paths without executing them. That option is prospective, not part of 13.4. Sandbox, network and credential restrictions remain the harness's responsibility. PHPUnit 13 requires PHP 8.4 or newer; test major-version compatibility before upgrading.