Development Tools

Articles about Development Tools by Sebastian Bergmann

A hand presses the red emergency stop button of an industrial machine. A visual metaphor for a switch that halts the execution of code: exactly what zend.disable_eval does for eval().

July 29, 2026

When static analysis runs your code

A security vulnerability in PHPCSUtils revealed an eval() call in a static analysis tool. Why disable_functions cannot reach eval(), and what a switch in the PHP engine to disable it could look like.

A heavy steel chain lies on a dark surface. Where a link is missing, a thin knotted orange rope ties the two ends together. A visual metaphor for a supply chain whose strength is decided by its weakest link.

July 15, 2026

Composer and Packagist under supply chain stress

2025 and 2026 proved to be a stress test for the supply chains of all package ecosystems. A review of Composer and Packagist: what PHP does well, what it can learn — and who owns our infrastructure.

A glowing cockpit instrument panel in deep blue light, its dials, throttle levers, and backlit gauges tracing speed and status: a metaphor for reading the telemetry your test suite records on every run.

June 17, 2026

What your test run already knows

On every run, PHPUnit knows how long each test took, how much memory it used, and why it failed. Most of that evaporates. otr-report reads it back out of the Open Test Reporting logfile and puts it within reach.

Only what must exist has a door. The safest door is the one that was never built.

May 20, 2026

The attack surface begins in the repository

We protect what exists. But do we ask often enough whether it should exist at all? How removing unused branches can protect against Poisoned Pipeline Execution.

A heavy steel chain breaks at its central link in a burst of red-orange sparks, with fragments of binary digits scattering outward against a deep blue, circuit-lit background. A visual metaphor for the supply-chain security failure that workflow hardening is meant to prevent.

May 17, 2026

Hardening GitHub Actions workflows

A walk through the GitHub Actions weaknesses in PHPUnit's workflows, how each one could have been exploited, and what was changed to close them.

A glowing magnifying glass over a bug symbol, held by a hand, against a dark background of binary code and geometric patterns. A visual metaphor for the disciplined investigation of performance problems.

April 23, 2026

Debugging Performance in PHP

"It feels slow" is not a diagnosis. I explain the three disciplines that turn vague complaints into actionable data: tracing, profiling, and benchmarking.

A bouncer in a black suit, earpiece in, hand raised in a firm "stop" gesture at the door of a club. Behind him, a queue of hopeful guests waits behind a golden velvet rope. A visual metaphor for a gatekeeper deciding who gets in and who does not.

April 18, 2026

The Bouncer in the Dependency Resolver

Composer 2.9 moved security advisory enforcement from an opt-in third-party package into the resolver itself. This article walks through how the mechanism works, how it relates to the older packages it replaces, and where it can bite you.

This image shows a stylised representation of a DNA double helix, with a single section highlighted. The DNA strands are shown in blue, while a short section of the base pairs and the associated connections glow red. The imagery communicates a mutation or targeted change at the molecular level, as applied in genetic analysis, mutation testing or biotechnological processing. The focused area could symbolise a mutation, repair or targeted intervention, as used in genetic research.

November 19, 2025

Path Coverage or Mutation Testing?

How thoroughly do your tests cover the code, and how reliably do they detect real errors? I show you how to find out.

Workspace with various tools that are often used for precise manual work, model making or handicrafts

June 16, 2025

Psalm or PHPStan?

Psalm or PHPStan: which tool is the better choice for code analysis? Or is it worth combining both tools for maximum code quality?

Tool wall on which a variety of hand tools are neatly arranged

June 25, 2024

PHP_CodeSniffer or PHP-CS-Fixer?

Should PHP_CodeSniffer or PHP-CS-Fixer be used to get code "in shape"? Should both tools even be used together?

A man is sitting on a dune covered with dry grass. He appears pensive or perhaps even sad, as he rests his head on his arm with one hand while looking down.

March 22, 2024

PCOV or Xdebug?

Should you use PCOV or Xdebug to collect code coverage data? I give a personal answer.

February 15, 2017

The Death Star

I explain why using overly open version restrictions can lead to problems.

Stay up to date

Receive a comprehensive analysis of new PHPUnit features, implementation details, and the strategic considerations behind each improvement via email every two months.

Subscribe now