An unclosed PHP output buffer can cause PHPUnit tests to be marked as "risky". This is not documented, but clear in the source code.

For example:

function do_good_things() {
    return TRUE;

function do_bad_things() {
    ob_start(); // Buffer is not closed
    return TRUE;

class MyTest extends \PHPUnit\Framework\TestCase {
    public function test1() {

    public function test2() {

If you run this, you'll get the second test method marked as "risky":

$ ./vendor/bin/phpunit index.php
PHPUnit 8.2.3 by Sebastian Bergmann and contributors.

.R                                                                  2 / 2 (100%)

Time: 28 ms, Memory: 4.00 MB

There was 1 risky test:

1) MyTest::test2
Test code or tested code did not (only) close its own output buffers

OK, but incomplete, skipped, or risky tests!
Tests: 2, Assertions: 2, Risky: 1.
Final thoughts

Yes, this makes sense, but the docs make it seem like there are no more types of "risky tests" than the ones described in there.

Previous on PHP