Development Tools

Articles about Development Tools by Sebastian Bergmann

Two swing-top glass jars with rubber seals, filled with preserved pear halves and cloves, stand on a pale blue wooden table. In front of them lie a pear cut in half and star anise, behind them fresh green pears. A visual metaphor for an archive: preserved, closed, and trustworthy only as long as its seal can be checked.

20 October 2026

Laying the past to rest

In 2019, after the break-in at pear.php.net, we suggested that PEAR needed a plan for its retirement. Seven years later, an RFC provides one. What it gets right, and why a frozen archive is not yet a safe one.

Windfall apples in the grass beneath an apple tree, photographed in the warm light of a low sun. The trunk and its shadow are visible at the top of the frame, with red apples covering the ground densely in front of it, many of them bruised. The imagery picks up the metaphor Marco Pivetta uses for mutation testing: shaking the tree does not tell you how much it bears, but which fruit no longer held.

14 October 2026

Where tests end and types begin

In April 2022, I spent two hours talking about mutation testing with Marco Pivetta and Stefan Priebsch. The recording recently resurfaced. What of it has survived four years?

In a dark room, a hand holds a small ultraviolet torch over a printed form titled CREDIT NOTE. Where the beam falls on one of its fields, a handwritten line appears that the form does not show in ordinary light: I am invisible. More sheets with printed charts lie around it on the desk, barely visible in the blue light.

8 October 2026

Your tool has a new reader

Every PHP tool that prints to a terminal now has two readers, and most of us have only been writing for one of them.

Close-up of a red fire extinguisher's valve: the pressure gauge needle sits in the green zone, a yellow plastic seal secures the safety pin, and a yellow tag hangs from the neck. The tag has fields for model number and manufacturer, owner ID, and a monthly inspection record with columns for date, inspector, and comments. Every field is still blank. A visual metaphor for a component record: the form exists, but it only proves something once someone fills it in.

5 October 2026

What ISO/IEC 18974 asks of your composer.lock

ISO/IEC 18974 describes what an open source security assurance program has to prove. Composer already produces much of that evidence as a by-product of every build. What it does not produce: an archive, a second look at software that has already shipped, and a name next to every responsibility.

The key board of a hotel reception, made of dark wood and divided into two rows of narrow compartments. An oval brass plate with a room number sits above each compartment, and below it a hook holds a heavy brass fob with the matching key. A few hooks are empty because their keys are out. A visual metaphor for a number that has exactly one place, leaving nowhere for a second key under the same number to hang.

30 September 2026

One version per process

Andrew Nesbitt explains the size of npm dependency trees with the resolver. In PHP, the resolver is ultimately the engine itself: one name, one definition, one version per process. That is why PHP trees stay small, and why PHPUnit's PHAR has to rename its dependencies.

A sealed shipping box is handed across a counter, along with a clipboard holding a form. A packing note listing the enclosed items with quantities and prices is affixed to the box. A visual metaphor for a bill of materials that is created while packing and ships with the package instead of being guessed at afterwards.

5 August 2026

Your composer.lock knows what a carmaker only guesses

A car manufacturer lists an Android botnet in its open source attribution. The entry gives away how the list was made: by scanning instead of by declaring. Why a declared dependency list is worth more than a scanned one, and how the PHPUnit PHAR discloses its own contents.

A hand presses the red emergency stop button of an industrial machine. A visual metaphor for a switch that halts the execution of code: exactly what zend.disable_eval does for eval().

29 July 2026

When static analysis runs your code

A security vulnerability in PHPCSUtils revealed an eval() call in a static analysis tool. Why disable_functions cannot reach eval(), and what a switch in the PHP engine to disable it could look like.

A heavy steel chain lies on a dark surface. Where a link is missing, a thin knotted orange rope ties the two ends together. A visual metaphor for a supply chain whose strength is decided by its weakest link.

15 July 2026

Composer and Packagist under supply chain stress

2025 and 2026 proved to be a stress test for the supply chains of all package ecosystems. A review of Composer and Packagist: what PHP does well, what it can learn — and who owns our infrastructure.

A glowing cockpit instrument panel in deep blue light, its dials, throttle levers, and backlit gauges tracing speed and status: a metaphor for reading the telemetry your test suite records on every run.

17 June 2026

What your test run already knows

On every run, PHPUnit knows how long each test took, how much memory it used, and why it failed. Most of that evaporates. otr-report reads it back out of the Open Test Reporting logfile and puts it within reach.

Only what must exist has a door. The safest door is the one that was never built.

20 May 2026

The attack surface begins in the repository

We protect what exists. But do we ask often enough whether it should exist at all? How removing unused branches can protect against Poisoned Pipeline Execution.

A heavy steel chain breaks at its central link in a burst of red-orange sparks, with fragments of binary digits scattering outward against a deep blue, circuit-lit background. A visual metaphor for the supply-chain security failure that workflow hardening is meant to prevent.

17 May 2026

Hardening GitHub Actions workflows

A walk through the GitHub Actions weaknesses in PHPUnit's workflows, how each one could have been exploited, and what was changed to close them.

A glowing magnifying glass over a bug symbol, held by a hand, against a dark background of binary code and geometric patterns. A visual metaphor for the disciplined investigation of performance problems.

23 April 2026

Debugging Performance in PHP

“It feels slow” is not a diagnosis. I explain the three disciplines that turn vague complaints into actionable data: tracing, profiling, and benchmarking.

A bouncer in a black suit, earpiece in, hand raised in a firm “stop” gesture at the door of a club. Behind him, a queue of hopeful guests waits behind a golden velvet rope. A visual metaphor for a gatekeeper deciding who gets in and who does not.

18 April 2026

The Bouncer in the Dependency Resolver

Composer 2.9 moved security advisory enforcement from an opt-in third-party package into the resolver itself. This article walks through how the mechanism works, how it relates to the older packages it replaces, and where it can bite you.

This image shows a stylised representation of a DNA double helix, with a single section highlighted. The DNA strands are shown in blue, while a short section of the base pairs and the associated connections glow red. The imagery communicates a mutation or targeted change at the molecular level, as applied in genetic analysis, mutation testing or biotechnological processing. The focused area could symbolise a mutation, repair or targeted intervention, as used in genetic research.

19 November 2025

Path Coverage or Mutation Testing?

How thoroughly do your tests cover the code, and how reliably do they detect real errors? I show you how to find out.

Workspace with various tools that are often used for precise manual work, model making or handicrafts

16 June 2025

Psalm or PHPStan?

Psalm or PHPStan: which tool is the better choice for code analysis? Or is it worth combining both tools for maximum code quality?

Tool wall on which a variety of hand tools are neatly arranged

25 June 2024

PHP_CodeSniffer or PHP-CS-Fixer?

Should PHP_CodeSniffer or PHP-CS-Fixer be used to get code “in shape”? Should both tools even be used together?

A man is sitting on a dune covered with dry grass. He appears pensive or perhaps even sad, as he rests his head on his arm with one hand while looking down.

22 March 2024

PCOV or Xdebug?

Should you use PCOV or Xdebug to collect code coverage data? I give a personal answer.

15 February 2017

The Death Star

I explain why using overly open version restrictions can lead to problems.

Stay up to date

A new article is published every Wednesday. Subscribe to the RSS feed and it arrives straight in your feed reader.

The newsletter brings you a comprehensive analysis of new PHPUnit features, implementation details, and the strategic considerations behind each improvement via email every two months.

Subscribe to the RSS feed Subscribe to the newsletter