Pest PHP bug: a misplaced failure message silently passes flawed tests
A developer discovered that their Pest PHP tests were falsely passing because the toContain method is variadic, meaning any text added as a failure message is treated as a second search needle instead. When using not->toContain, the framework catches the failure thrown by the missing 'message' string and incorrectly reports the assertion as successful. This flaw meant a stale pricing claim the developer specifically wrote a test to catch went undetected in published blog posts. Unlike 66 other Pest expectation methods, toContain and toContainEqual do not accept a dedicated message parameter, making the API inconsistent. The developer recommends wrapping such checks in toBeFalse or a similar method that properly supports a message argument, and always deliberately triggering a failure before trusting any load-bearing test.