We do not need to unserialize() objects here

sebastianbergmann · sebastianbergmann · commit 0b3170aaebeb · 2026-01-26T17:22:50.000+01:00
diff --git a/src/Runner/PhptTestCase.php b/src/Runner/PhptTestCase.php
@@ -611,7 +611,7 @@ private function cleanupForCoverage(): array
             $buffer = @file_get_contents($files['coverage']);
 
             if ($buffer !== false) {
-                $coverage = @unserialize($buffer);
+                $coverage = @unserialize($buffer, ['allowed_classes' => false]);
 
                 if ($coverage === false) {
                     $coverage = [];
