Dependency major-version upgrades (PHPUnit 13, Symfony 8, relay 3, predis 3, pheanstalk 8, PHP_CodeSniffer 4)

[tonydspaniard]

Tracker for the major dependency bumps that sit outside current constraints. None are urgent — composer.lock is gitignored, so CI already resolves the latest within each constraint (minor/patch updates need no action). These are the cross-major migrations, each deliberate.

Surfaced during #129 (test infra). composer outdated --direct on master.

Candidates (~ = newer major available)

Package	Current	Latest	Notes / what it unblocks
phpunit/phpunit	11.x	13.x	Skips 12. Unblocks brianium/paratest 7.22 (latest paratest requires PHPUnit 13 / php-code-coverage ^14); we're pinned to paratest 7.8.5 by PHPUnit 11. Largest migration.
relay/relay	2.1	3.0	3.0 allows psr/http-message ~1.0 || ~2.0 — a step toward PSR-7 v2 (see below).
neomerx/cors-psr7	3.0.2	3.0.2	Hard blocker for psr/http-message ^2: latest still requires ^1.0, no PSR-7-v2 release. The CORS middleware would need a replacement/fork to move off it.
psr/http-message	1.1	2.0	Gated by both relay 3 and resolving neomerx. Unblocking it would in turn make testcontainers-php installable (its Docker client needs psr/http-message ^2 — the reason #129 uses a docker-CLI helper instead).
symfony/console messenger serializer uid yaml	7.4	8.1	Symfony 8 line; coordinated bump across all five.
predis/predis	2.4	3.5	Pure-PHP Redis client; check API deltas for Cache/Session Predis storage.
pda/pheanstalk	5.1	8.0	Beanstalk client; check Messaging transport usage.
squizlabs/php_codesniffer	3.13	4.0	Lint tooling; php-cs-fixer is the primary style gate so impact is small.

Suggested sequencing

1. PHPUnit 11 → 13 (own PR) — biggest surface; also unlocks paratest 7.22 for Parallel + container-backed test infra: paratest + testcontainers-php #129.
2. relay 2 → 3 + decide CORS path (replace/fork neomerx/cors-psr7) → then psr/http-message 1 → 2. This combination unblocks testcontainers-php; revisit the Parallel + container-backed test infra: paratest + testcontainers-php #129 docker-CLI-vs-testcontainers decision afterward.
3. Symfony 7 → 8 (coordinated), then predis/pheanstalk/php_codesniffer independently.

Each gets its own PR with the suite green on the 8.3 + 8.4 matrix.

[tonydspaniard]

PHPUnit row — partial progress in #226 (PHPUnit 11 → 12, not 13).

Scoping turned up a constraint the table didn't capture: the "13" target can't be reached without dropping PHP 8.3.

	min PHP
PHPUnit 13.2	≥ 8.4.1
paratest 7.22/7.23	~8.4 || ~8.5

The framework declares php: >=8.3 everywhere and CI tests 8.3 + 8.4, so PHPUnit 13 / latest paratest would force raising the floor to 8.4 — a breaking change for consumers and a positioning decision, not a dev-tooling bump.

#226 takes the PHPUnit/paratest row as far as it goes on 8.3: PHPUnit 12.5 (php ≥ 8.3) + paratest 7.20 (php 8.3||8.4||8.5, phpunit ^12.5||^13) — still a 12-minor paratest jump (7.8.5 → 7.20.0). It does not unlock paratest 7.22+ (that, and the testcontainers-php chain via psr/http-message ^2, still want 8.4).

Remaining on this row: the PHPUnit 12 → 13 + paratest 7.23 step is gated on a decision to drop PHP 8.3 (raise the floor to 8.4). Suggest tracking that floor decision explicitly before taking it.