Bump PHPUnit to ^9.6.33 to fix CVE-2026-24765 (Dependabot alert #3)

[basi]

Summary

Resolves Dependabot alert #3: https://github.com/basi/cakephp2-php8/security/dependabot/3

• CVE-2026-24765 / GHSA-vvj3-c3rp-c85p (severity: high, CVSS 7.8, CWE-502): PHPUnit's PHPT code-coverage handling (cleanupForCoverage()) deserializes .coverage files via unserialize without an allowed_classes restriction. Patched in 9.6.33 (latest 9.6.x is 9.6.36).

This repository contains no *.phpt tests and CI collects no coverage, so there is no actual attack surface here — the manifest changes below are what resolve the alert. The PR additionally un-breaks CI (every composer install had been failing since Nov 2025) and restores real TLS peer-verification test coverage. Updated after a code review (3 findings addressed — see "Review response" below), then brought up to date with main (#23 switched the CI matrix from PHP 8.2 to 8.4), which required one PHP 8.4 test-expectation fix.

Changes

1. app/composer.json: remove phpunit/phpunit from require-dev (previously 3.7.*, the constraint the alert fired on)
   • The app skeleton pins upstream cakephp/cakephp ~2.9 and php >= 5.3.0; any modern PHPUnit constraint there would be self-contradictory (upstream 2.x CakeTestCase extends the PHPUnit 3 era PHPUnit_Framework_TestCase, and PHPUnit 9.6 requires PHP >= 7.3). The skeleton is not exercised by CI nor by the documented consumption path (README instructs the VCS-repository method), so the dev dependency is vestigial. Removing it resolves the alert without advertising an impossible install
2. composer.json: phpunit/phpunit ^9.5 → ^9.6.33 — raises the floor to the first patched version (a fresh install resolves to 9.6.36)
3. composer.json: ID-scoped advisory policy to un-break CI. Since Composer 2.9, resolution of advisory-affected packages is blocked by default, and cakephp/cakephp-codesniffer ^1.0.0 → squizlabs/php_codesniffer ^1.4 made every CI composer install fail since Nov 2025 (build(deps): bump actions/checkout from 5 to 6 #19, build(deps): bump actions/cache from 4 to 5 #20). config.policy.advisories.ignore-id now lists exactly the two blocking advisories — PKSA-6vdd-n4sx-knhy (phpcs 1.x arbitrary shell execution, GHSA-mhfv-8rc9-w38c) and CVE-2026-67434 (phpcs OS command injection, PKSA-rdkp-vv9z-mjkg / GHSA-hmqg-cxww-wqhq) — each with "on-audit": false and a reason, so only install/update blocking is lifted while composer audit and the post-install warning keep reporting both advisories
   • Note on on-audit semantics: Composer's 06-config.md prose currently describes on-block/on-audit inverted relative to the implementation. The actual behavior (per AdvisoriesPolicyConfig::getIgnoreIdForOperation() in 2.10.2 and verified empirically) is that the flags scope where the ignore applies: "on-audit": false = ignored for blocking, still reported by audit
4. lib/Cake/Test/Case/Network/Http/HttpSocketTest.php + new lib/Cake/Test/test_app/tls_server.php: testVerifyPeer now verifies TLS peer rejection against a local TLS server with a runtime-generated self-signed certificate instead of a dead external host
   • The previous target tv.eurosport.com no longer resolves, which had left the test permanently skipped (no regression coverage for peer verification). Nothing is committed to the repository and nothing can expire: the helper generates a throwaway certificate at runtime — CN=127.0.0.1 with subjectAltName = IP:127.0.0.1, serverAuth EKU and CA:FALSE, built from an explicit OpenSSL config so the fixture does not depend on a system openssl.cnf
   • The test owns the temporary files (OpenSSL config + PEM) and passes their paths to the child over argv (array-form proc_open, no shell escaping); startup is handed back as a JSON line, and the child's stderr is folded into the failure message. Fixture startup problems are test failures, not skips, so environment rot stays visible
   • The assertion is two-sided: a positive control with ssl_allow_self_signed => true must receive an HTTP 200 from the fixture first (proving the server and certificate genuinely work for 127.0.0.1), then the default-configuration client must be rejected with Failed to enable crypto. The child serves both connections with real HTTP responses, and its exit code 0 and the removal of both temporary files are asserted as well
5. lib/Cake/Test/Case/Utility/DebuggerTest.php: update the expected highlight_string() pattern for PHP 8.4 (the <code> element may carry attributes and colors are emitted as 6-digit hex). Needed because the CI matrix now includes PHP 8.4 (see Run CI tests on PHP 8.4 instead of 8.2 #23)

Verification

• Manifest validity: composer validate passes for both root and app/ (Composer 2.10.2)
• Clean resolution without a lock file (replicating CI): phpunit/phpunit → 9.6.36, squizlabs/php_codesniffer → 1.5.6, zero problems, exit 0
• Advisory visibility preserved: post-install prints Found 2 security vulnerability advisories affecting 1 package. and composer audit lists both advisories in full — only the install-time block is lifted
• CI on the current head (with main merged in, matrix PHP 8.0 × mysql/pgsql/sqlite + PHP 8.4 × mysql): all 4 jobs pass — run 32952486089. The hardened testVerifyPeer runs its assertions (not skipped) on every job
• The initial, pre-hardening fixture was also verified locally on PHP 8.0.30/8.2.33 (Docker, sqlite) before the follow-up strengthened it

Review response

Finding	Resolution
[High] app/composer.json deps incompatible with PHPUnit 9 and unverified by CI	Removed the vestigial phpunit/phpunit dev dependency from the skeleton (option 1 of the review); the skeleton reverts to a coherent legacy snapshot
[High] Package-wide advisory ignore hides current and future phpcs advisories	Replaced with ignore-id entries for exactly the two blocking advisories, scoped to lift blocking only; composer audit keeps reporting them. Backporting a phpcs fix / migrating the ruleset remains a separate task
[Medium] testVerifyPeer permanently skipped	Replaced the dead external host with a local self-signed TLS fixture; a follow-up hardened it (SAN certificate from an explicit OpenSSL config, positive control via ssl_allow_self_signed, child stderr/exit-code propagation, fixture problems fail instead of skip)

Out of scope (known separate issues)

• Dependabot alert Add RedisCluster cache engine with PHP 8 support #6 (cakephp/cakephp ~2.9 in app/composer.json, GHSA-wpvj-hjcr-h3p2): the view path traversal itself is being backported in Backport view path containment check for CVE-2026-48820 #22 (draft); note that the backport alone does not close the manifest-based alert — the cakephp/cakephp ~2.9 requirement will still need to be removed/adjusted or the alert dismissed
• bump-version.yml duplicate-tag failure (custom_tag: 1.1.0 already exists): the update to 1.2.0 is staged in Backport view path containment check for CVE-2026-48820 #22

🤖 Generated with Claude Code

[shin2ro]

👍