# phpunit.expert

> Professional services around PHPUnit from Sebastian Bergmann, the creator of PHPUnit. In-depth articles, conference talks, training, and consulting on test automation and software testing with PHPUnit.

## About

- [Sebastian Bergmann](https://phpunit.expert/en.html): Creator of PHPUnit. Provides professional training, workshops, and consulting on test automation for software development teams.

## Articles

- [Stories about systems that resist people](https://phpunit.expert/articles/stories-about-systems-that-resist-people.html): Five of the best television series I have ever seen are about the gap between what people want to achieve and what institutions allow them. They fascinate me because, after decades of developing Open Source software, I know much of this from my own working life.
- [Precision and Clarity: What is new in PHPUnit 13.2?](https://phpunit.expert/articles/precision-and-clarity-what-is-new-in-phpunit-132.html): Selecting exactly the tests you want, finer control over the order they run in, faster and clearer output when they fail, and more expressive test doubles: I walk you through what is new in PHPUnit 13.2.
- [Merging code coverage data](https://phpunit.expert/articles/merging-code-coverage-data.html): Merging code coverage data from parallel CI jobs has long been fragile and error-prone. These problems are finally solved.
- [What your test run already knows](https://phpunit.expert/articles/what-your-test-run-already-knows.html): On every run, PHPUnit knows how long each test took, how much memory it used, and why it failed. Most of that evaporates. otr-report reads it back out of the Open Test Reporting logfile and puts it within reach.
- [Speed as a security feature](https://phpunit.expert/articles/speed-as-a-security-feature.html): How fast is your test suite, and what vulnerabilities does an LLM agent therefore fail to detect? What was long considered a productivity issue is now part of the security debate.
- [Turbo-Charging Your PHPUnit Suite](https://phpunit.expert/articles/turbo-charging-your-phpunit-suite.html): Slow tests destroy flow, kill TDD, and erode trust until nobody runs the suite. The fix has four tiers, and the biggest wins come from test design, not from infrastructure or parallelisation.
- [Test-Driven Security](https://phpunit.expert/articles/test-driven-security.html): For every vulnerability we find in production, there is a test that, had it existed, would have prevented it. Test-Driven Security treats the CWE list as a checklist and PHPUnit as the tool we already have in our workflow.
- [Debugging as a design goal](https://phpunit.expert/articles/debugging-as-a-design-goal.html): Why do some bugs feel like a short detective story, while others feel like a never-ending thriller? I show you which decisions make your software debuggable.
- [Code I do not have does not cause any problems](https://phpunit.expert/articles/code-i-do-not-have-does-not-cause-any-problems.html): Not every problem requires new code. And every line we do not write is a line that will not cause any problems.
- [The attack surface begins in the repository](https://phpunit.expert/articles/the-attack-surface-begins-in-the-repository.html): We protect what exists. But do we ask often enough whether it should exist at all? How removing unused branches can protect against Poisoned Pipeline Execution.
- [Hardening GitHub Actions workflows](https://phpunit.expert/articles/hardening-github-actions-workflows.html): A walk through the GitHub Actions weaknesses in PHPUnit's workflows, how each one could have been exploited, and what was changed to close them.
- [ComoCamp 2026](https://phpunit.expert/articles/comocamp-2026.html): Three days in Vienna, three days of ComoCamp: my report on inspiring workshops, exciting open space sessions, and the uniquely open, collaborative atmosphere.
- [Closures, Clarity, and Control: What is New in PHPUnit 13.1?](https://phpunit.expert/articles/closures-clarity-and-control-what-is-new-in-phpunit-131.html): Closures as data providers, richer Open Test Reporting, custom issue trigger resolvers, and significant changes to code coverage: I walk you through the changes.
- [Technical debt is not malice](https://phpunit.expert/articles/technical-debt-is-not-malice.html): Technical debt is not malice, it is context. An argument for why empathy is a technical skill that matters more than you think.
- [Debugging Performance in PHP](https://phpunit.expert/articles/debugging-performance-in-php.html): "It feels slow" is not a diagnosis. I explain the three disciplines that turn vague complaints into actionable data: tracing, profiling, and benchmarking.
- [The Bouncer in the Dependency Resolver](https://phpunit.expert/articles/the-bouncer-in-the-dependency-resolver.html): Composer 2.9 moved security advisory enforcement from an opt-in third-party package into the resolver itself. This article walks through how the mechanism works, how it relates to the older packages it replaces, and where it can bite you.
- [Everything we have](https://phpunit.expert/articles/everything-we-have.html): In a world with endless possibilities for code to be wrong, one approach alone is not enough to make our software truly robust.
- [Security through chaos](https://phpunit.expert/articles/security-through-chaos.html): This practical deep dive into the philosophy behind "security through chaos" shows that security does not come from perfect foresight, but from surviving chaos.
- [Beyond Best Practices](https://phpunit.expert/articles/beyond-best-practices.html): Testing, code reviews and documentation are all essential prerequisites that constrain the autonomy of AI, thereby safeguarding human agency in software development.
- [Effective Code Reviews](https://phpunit.expert/articles/effective-code-reviews.html): Pair, pull, or post-push? Find the code review strategy that is right for your team.
- [Faster than understanding](https://phpunit.expert/articles/faster-than-understanding.html): An AI coding agent implemented a complex software metric in 15 minutes. I have now spent hours trying to figure out whether the implementation is correct. Is this really a productivity boost?
- [From anti-pattern to clarity](https://phpunit.expert/articles/from-anti-pattern-to-clarity.html): The any() matcher is deprecated. But migration is easier than you think – and leads to better tests.
- [Better than withConsecutive()](https://phpunit.expert/articles/better-than-withconsecutive.html): I explain how PHPUnit 13's parameter set matchers finally solve the problem that made upgrading to PHPUnit 10 such a challenge.
- [Replay Testing](https://phpunit.expert/articles/replay-testing.html): Replay Testing leverages the memory of your event sourcing system to test new versions with real history and shows which oracles truly inspire confidence in your changes.
- [From Events to Insights](https://phpunit.expert/articles/from-events-to-insights.html): Event Storming, DDD, CQRS, and Event Sourcing are intertwined: the tests not only check the events, but also become living documentation and a bridge between technical expertise and code.
- [How my understanding of software changed](https://phpunit.expert/articles/how-my-understanding-of-software-changed.html): A classic database only stores the "now" and forgets history. In this article, I describe my journey to DDD and event sourcing and explain why we need to learn to model time itself.
- [Data Provider or Properties?](https://phpunit.expert/articles/data-provider-or-properties.html): One test, hundreds of inputs, and an automatic edge case search. But property-based testing has a hidden pitfall that many overlook.
- [Smaller input, greater insight](https://phpunit.expert/articles/smaller-input-greater-insight.html): Shrinking is the unsung hero of property-based testing. I show you how it helps to make inevitable errors understandable.
- [Property-Based Testing](https://phpunit.expert/articles/property-based-testing.html): We only test what we think of. That is precisely what can become a problem.
- [Open Source, Open Feeds: Mastodon and PeerTube as online spaces for the PHP community](https://phpunit.expert/articles/open-source-open-feeds-mastodon-and-peertube-as-online-spaces-for-the-php-community.html): With phpc.social and phpc.tv, the PHP community is building its own donation-funded online spaces in the Fediverse – free from algorithms and fascist tech bros.
- [Type-Safe Collections](https://phpunit.expert/articles/type-safe-collections.html): Does PHP really need generics? A controversial thesis with a practical solution.
- [How PHP and its ecosystem test each other](https://phpunit.expert/articles/how-php-and-its-ecosystem-test-each-other.html): PHP tests Laravel, Symfony, PHPUnit, and more every night. PHPUnit tests PHP. This is Open Source collaboration at work.
- [The Stub/Mock Intervention](https://phpunit.expert/articles/the-stub-mock-intervention.html): Self-sabotaging mock objects? With PHPUnit 12.5, that's a thing of the past because the test runner now asks the right question: Do you really need a mock object, or would a test stub suffice?
- [A festive break](https://phpunit.expert/articles/a-festive-break.html): I take a break from my weekly articles and invite you to a free online event where I will present the latest improvements to PHPUnit.
- [A flight recorder for your code](https://phpunit.expert/articles/a-flight-recorder-for-your-code.html): Your PHP project has no tests and an upgrade is pending? The classic dilemma: to introduce tests, you have to change code – to change code, you need tests. How can you break this cycle? With characterisation tests.
- [Seeing the Truth: Test Oracles](https://phpunit.expert/articles/seeing-the-truth-test-oracles.html): Your tests are successful. But are they really? Without a suitable test oracle, you will never know.
- [Testing with DTOs and Value Objects](https://phpunit.expert/articles/testing-with-data-transfer-objects-and-value-objects.html): Know the differences between data transfer objects and value objects and understand why immutability helps with testing.
- [Testing with(out) dependencies](https://phpunit.expert/articles/testing-with-and-without-dependencies.html): Why distinguishing between test stubs and mock objects in PHPUnit significantly improves the quality and readability of tests.
- [Path Coverage or Mutation Testing?](https://phpunit.expert/articles/path-coverage-or-mutation-testing.html): How thoroughly do your tests cover the code, and how reliably do they detect real errors? I show you how to find out.
- [Open Source Blackout](https://phpunit.expert/articles/open-source-blackout.html): Are you prepared for a world in which your projects freeze, deployments stall, and tech giants can no longer rely on free community-run infrastructure?
- [More control, less friction: What's new in PHPUnit 12.4?](https://phpunit.expert/articles/more-control-less-friction-what-is-new-in-phpunit-12.4.html): Discover how PHPUnit 12.4 helps you get there with less friction and more insight.
- [Modern PHP Development](https://phpunit.expert/articles/modern-php-development.html): Modern PHP development combines proven principles with the latest tools. It brings together documentation, quality, automation, and AI.
- [A look ahead to 2035](https://phpunit.expert/articles/a-look-ahead-to-2035.html): I discuss key issues for the future relating to ethics, digital sovereignty, Open Source, and web standards.
- [PHPUnit features that surprise even professionals](https://phpunit.expert/articles/phpunit-features-that-surprise-even-professionals.html): Discover the hidden capabilities of PHPUnit and learn how to get the most out of your tests with clever features.
- [From AmigaBASIC to AI](https://phpunit.expert/articles/from-amigabasic-to-ai.html): A personal journey from my first lines of BASIC on the Amiga to the question of how AI will shape the next generation of developers.
- [Innovation through collaboration: The highlights of PHPUnit 12.3](https://phpunit.expert/articles/innovation-through-collaboration-the-highlights-of-phpunit-12.3.html): Discover how collaboration with real-world developers has shaped the latest advancements in PHPUnit 12.3.
- [Psalm or PHPStan?](https://phpunit.expert/articles/psalm-or-phpstan.html): Psalm or PHPStan: which tool is the better choice for code analysis? Or is it worth combining both tools for maximum code quality?
- [30 Years of PHP, 25 Years of PHPUnit](https://phpunit.expert/articles/30-years-php-25-years-phpunit.html): I look back on 30 years of open source innovations.
- [ComoCamp 2025](https://phpunit.expert/articles/comocamp-2025.html): I am thrilled by the inspiring workshops, exciting open space sessions and the uniquely open, collaborative atmosphere of ComoCamp.
- [SoCraTes 2024](https://phpunit.expert/articles/socrates-2024.html): SoCraTes has enriched and motivated me in a lasting way through inspiring discussions, exciting sessions on topics such as PHP, software testing, security and open-source funding, as well as the special, collaborative atmosphere.
- [PHP_CodeSniffer or PHP-CS-Fixer?](https://phpunit.expert/articles/phpcodesniffer-or-phpcsfixer.html): Should PHP_CodeSniffer or PHP-CS-Fixer be used to get code "in shape"? Should both tools even be used together?
- [PCOV or Xdebug?](https://phpunit.expert/articles/pcov-or-xdebug.html): Should you use PCOV or Xdebug to collect code coverage data? I give a personal answer.
- [PHPUnit Code Sprint: March 2024](https://phpunit.expert/articles/phpunit-code-sprint-march-2024.html): I recollect my experience at the PHPUnit project's most recent code sprint.
- [PHP 7: Security Support Ends. Now what?](https://phpunit.expert/articles/php-7-security-support-ends-now-what.html): Security support for PHP 7 has ended. What does this mean for you?
- [How I manage test fixture](https://phpunit.expert/articles/how-i-manage-test-fixture.html): I reflect on why I no longer write setUp() methods.
- [Ready Or Not, Here It Comes](https://phpunit.expert/articles/ready-or-not-here-it-comes.html): Is your software ready for PHP 8.1? Now is the time to find out.
- [Caching makes everything faster. Right?](https://phpunit.expert/articles/caching-makes-everything-faster-right.html): While working on PHPUnit, I encountered an interesting problem.
- [Failing IT Projects](https://phpunit.expert/articles/failing-it-projects.html): I explain how we can learn from failed IT projects.
- [Who wound the clock?](https://phpunit.expert/articles/who-wound-the-clock.html): I explain why PHPUnit no longer looks at the clock.
- [PHPUnit: A Security Risk?](https://phpunit.expert/articles/phpunit-a-security-risk.html): The long story of a security problem that should not have been one.
- [Migrating to PHPUnit 9](https://phpunit.expert/articles/migrating-to-phpunit-9.html): In the tension between backward compatibility and progress, a good developer experience must not be neglected.
- [Help! My tests stopped working](https://phpunit.expert/articles/help-my-tests-stopped-working.html): Running tests at the touch of a button is a great thing. Updating the testing tool at the touch of a button also sounds promising – or perhaps not?
- [The Death Star](https://phpunit.expert/articles/the-death-star.html): I explain why using overly open version restrictions can lead to problems.
- [PHP 5: Active Support Ends. Now what?](https://phpunit.expert/articles/php-5-active-support-ends-now-what.html): Active support for PHP 5 has ended. What does this mean for you?
- [Questioning Best Practices](https://phpunit.expert/articles/questioning-best-practices.html): Best practices are not set in stone and need to be questioned and then adapted, if need be, every once in a while.

## Presentations

- [30 Years of Code, 25 Years of Tests: A Journey Through Code and Community](https://phpunit.expert/presentations/30-years-of-code-25-years-of-tests.html): Explore how PHP and PHPUnit transformed from humble beginnings into pillars of modern web development.
- [Accelerating development without losing control](https://phpunit.expert/presentations/accelerating-development-without-losing-control.html): AI-assisted development promises speed, but speed without control breeds technical debt and fragility. This hands-on workshop shows PHP developers how to build the automated safety nets that let you move faster because you trust your quality controls, not in spite of them.
- [An evening with Sebastian and Stefan](https://phpunit.expert/presentations/an-evening-with-sebastian-and-stefan.html): Stefan and I put real code under the microscope in a live, public code review. Bring yours for direct feedback on structure, testability, and maintainability.
- [Beneath Every Good Test Pyramid: A Strong Oracle](https://phpunit.expert/presentations/beneath-every-good-test-pyramid-a-strong-oracle.html): Your test pyramid might look perfect on paper, but without strong oracles, it is simply a castle built on sand. Are you measuring what actually matters to your users, or just counting tests?
- [Debugging Performance in PHP](https://phpunit.expert/presentations/debugging-performance-in-php.html): I show you how to diagnose and resolve performance bottlenecks in PHP applications, from visualizing execution and measuring costs to pinpointing slow code and spotting regressions with confidence.
- [Event-Based Testing](https://phpunit.expert/presentations/event-based-testing.html): In this presentation, you will learn best practices for testing software built on architectural patterns such as Event Collaboration and Event Sourcing.
- [Fearless Dependency Upgrades](https://phpunit.expert/presentations/fearless-dependency-upgrades.html): This presentation highlights practical strategies for upgrading dependencies confidently in projects with strong automated testing, as well as solutions for teams without test automation.
- [From Events to Insights: Testing and Documenting Event‑Based Software](https://phpunit.expert/presentations/from-events-to-insights.html): Turning your tests into powerful, visual documentation of behavior for your event-based software.
- [From Examples to Invariants](https://phpunit.expert/presentations/from-examples-to-invariants.html): Write one property. Test infinite cases. Find edge cases automatically with property-based testing.
- [From Mother Sauces to Testable Software](https://phpunit.expert/presentations/from-mother-sauces-to-testable-software.html): Mother sauces, brigade systems, and testable code: discover why genius is the enemy of scalability.
- [Modern PHP Development](https://phpunit.expert/presentations/modern-php-development.html): This presentation reveals how to harness the ongoing evolution of PHP syntax as well as the rise of advanced developer tools for cleaner code, stronger testing, and ultimately higher-quality applications.
- [Old Laws, New Colleagues](https://phpunit.expert/presentations/old-laws-new-colleagues.html): Brooks, Conway, and Goodhart made observations about people and complexity, not about tools. Now AI agents write code. Which laws still hold, which hit harder than ever, and what does teamwork mean when agents join the team?
- [Past, Present, Future: The PHPUnit Story](https://phpunit.expert/presentations/past-present-future-the-phpunit-story.html): Discover the lessons and surprises from 25 years of developing PHPUnit.
- [PHPUnit 10-12: What to know and what to forget](https://phpunit.expert/presentations/phpunit-10-12-what-to-know-and-what-to-forget.html): This presentation is your guide to mastering what's new, how to get ready for the future, and which outdated PHPUnit features you can finally leave behind.
- [PHPUnit 10 for Symfony Developers](https://phpunit.expert/presentations/phpunit-10-for-symfony-developers.html): In this presentation, you will experience new features, big and small, in action and see how they can support you to effectively and efficiently test your software.
- [PHPUnit for Shopware Developers](https://phpunit.expert/presentations/phpunit-for-shopware-developers.html): Find out why PHPUnit is an indispensable tool for your development workflow.
- [So you think you know PHPUnit](https://phpunit.expert/presentations/so-you-think-you-know-phpunit.html): This presentation reveals practical tips and hidden gems in PHPUnit, helping developers of any experience level unlock its full potential and elevate their daily workflow.
- [Speed is a byproduct of trust](https://phpunit.expert/presentations/speed-is-a-byproduct-of-trust.html): AI-assisted tools make it easy to go fast, and just as easy to go fast in the wrong direction. Teams do not move faster despite their quality controls. They move faster because they can trust them.
- [Supply Chain Security in the PHP Ecosystem](https://phpunit.expert/presentations/supply-chain-security-in-the-php-ecosystem.html): Do you know what ends up in your vendor directory, and why? Composer has turned the dependency resolver into a supply chain security checkpoint. This talk shows how it works, where it helps, and where it can bite.
- [Surviving and Thriving with PHPUnit 13](https://phpunit.expert/presentations/surviving-and-thriving-with-phpunit-13.html): Get onto PHPUnit 13 cleanly, get ahead of PHPUnit 14, and get more out of the tests you write every day.
- [Test-Driven Security](https://phpunit.expert/presentations/test-driven-security.html): I argue that security flaws result from a lack of testing, and demonstrate how PHPUnit can help prevent common vulnerabilities, such as SQL Injection or Cross-Site Scripting.
- [Testable Database Interaction](https://phpunit.expert/presentations/testable-database-interaction.html): This presentation reveals practical best practices and proven design patterns for database interaction, focusing on how to build testable software and effectively test your database code.
- [Testing with(out) dependencies](https://phpunit.expert/presentations/testing-without-dependencies.html): This presentation clarifies effective strategies for using PHPUnit's test doubles to write robust, maintainable unit tests, highlighting practical techniques and common pitfalls to avoid.
- [The Architect's Supply Chain](https://phpunit.expert/presentations/the-architects-supply-chain.html): If a dependency is critical to your architecture, its sustainability is your responsibility. It is not the maintainer's problem, not a community concern, but a production risk you own.
- [The PHP Stack’s Supply Chain](https://phpunit.expert/presentations/the-php-stacks-supply-chain.html): This presentation offers a comprehensive look at the PHP software stack's supply chain. We explore not only critical security challenges, but also the vital issue of funding Open Source development.
- [The Web in 2035: A Keynote Panel on the Future of the Web](https://phpunit.expert/presentations/the-web-in-2035.html): Four people who build the web's foundations—and one who shapes its policy—debate whether the next decade of the internet will be open and sustainable or fragmented and opaque, and what we should do about it now.
- [Turbo-Charging Your PHPUnit Suite](https://phpunit.expert/presentations/turbo-charging-your-phpunit-suite.html): Turbo-charge your productivity: discover how to make your test suite blazingly fast!
- [Two-Way Streets: Building Trust Between Language and Ecosystem](https://phpunit.expert/presentations/two-way-streets.html): PHP tests its ecosystem. Its ecosystem tests PHP. How bidirectional validation builds trust and accelerates innovation safely.
- [When best practices become law](https://phpunit.expert/presentations/when-best-practices-become-law.html): Tests and static analysis were once optional. Soon, secure-by-design and verifiable quality won't be. As the CRA, AI Act, and Grundschutz++ converge, best practice is becoming law: here's how to get ready.
- [Your tests are lying to you](https://phpunit.expert/presentations/your-tests-are-lying-to-you.html): Your tests pass. Your coverage is high. Your CI is green. But would they catch a bug?

## Other pages

- [Frequently Asked Questions](https://phpunit.expert/faq.html)
- [Consulting and Coaching](https://phpunit.expert/consulting-and-coaching.html)
- [Articles index](https://phpunit.expert/articles/)
- [Presentations index](https://phpunit.expert/presentations/)
- [German edition of this site](https://phpunit.expert/de.html)