diff --git a/composer.json b/composer.json
index f3223f8..bcac476 100644
--- a/composer.json
+++ b/composer.json
@@ -22,7 +22,7 @@
         "silverstripe/framework": "^4"
     },
     "require-dev": {
-        "sminnee/phpunit": "^5.7",
+        "phpunit/phpunit": "^9",
         "squizlabs/php_codesniffer": "^3.0",
         "silverstripe/versioned": "^1"
     },
diff --git a/tests/unit/JSONDataFormatterTest.php b/tests/unit/JSONDataFormatterTest.php
index fe280b5..86ed7c1 100644
--- a/tests/unit/JSONDataFormatterTest.php
+++ b/tests/unit/JSONDataFormatterTest.php
@@ -27,20 +27,24 @@ public function testJSONTypes()
         $formatter = new JSONDataFormatter();
         $parent = $this->objFromFixture(JSONDataFormatterTypeTestObject::class, 'parent');
         $json = $formatter->convertDataObject($parent);
-        $this->assertRegexp('/"ID":\d+/', $json, 'PK casted to integer');
-        $this->assertRegexp('/"Created":"\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}"/', $json, 'Datetime casted to string');
-        $this->assertContains('"Name":"Parent"', $json, 'String casted to string');
-        $this->assertContains('"Active":true', $json, 'Boolean casted to boolean');
-        $this->assertContains('"Sort":17', $json, 'Integer casted to integer');
-        $this->assertContains('"Average":1.2345', $json, 'Float casted to float');
-        $this->assertContains('"ParentID":0', $json, 'Empty FK is 0');
+        $this->assertMatchesRegularExpression('/"ID":\d+/', $json, 'PK casted to integer');
+        $this->assertMatchesRegularExpression(
+            '/"Created":"\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}"/',
+            $json,
+            'Datetime casted to string'
+        );
+        $this->assertStringContainsString('"Name":"Parent"', $json, 'String casted to string');
+        $this->assertStringContainsString('"Active":true', $json, 'Boolean casted to boolean');
+        $this->assertStringContainsString('"Sort":17', $json, 'Integer casted to integer');
+        $this->assertStringContainsString('"Average":1.2345', $json, 'Float casted to float');
+        $this->assertStringContainsString('"ParentID":0', $json, 'Empty FK is 0');
 
         $child3 = $this->objFromFixture(JSONDataFormatterTypeTestObject::class, 'child3');
         $json = $formatter->convertDataObject($child3);
-        $this->assertContains('"Name":null', $json, 'Empty string is null');
-        $this->assertContains('"Active":false', $json, 'Empty boolean is false');
-        $this->assertContains('"Sort":0', $json, 'Empty integer is 0');
-        $this->assertContains('"Average":0', $json, 'Empty float is 0');
-        $this->assertRegexp('/"ParentID":\d+/', $json, 'FK casted to integer');
+        $this->assertStringContainsString('"Name":null', $json, 'Empty string is null');
+        $this->assertStringContainsString('"Active":false', $json, 'Empty boolean is false');
+        $this->assertStringContainsString('"Sort":0', $json, 'Empty integer is 0');
+        $this->assertStringContainsString('"Average":0', $json, 'Empty float is 0');
+        $this->assertMatchesRegularExpression('/"ParentID":\d+/', $json, 'FK casted to integer');
     }
 }
diff --git a/tests/unit/RestfulServerTest.php b/tests/unit/RestfulServerTest.php
index fbd4428..8d0ea9d 100644
--- a/tests/unit/RestfulServerTest.php
+++ b/tests/unit/RestfulServerTest.php
@@ -49,7 +49,7 @@ protected function urlSafeClassname($classname)
         return str_replace('\\', '-', $classname);
     }
 
-    protected function setUp()
+    protected function setUp(): void
     {
         parent::setUp();
         Director::config()->set('alternate_base_url', $this->baseURI);
@@ -88,11 +88,11 @@ public function testApiAccessBoolean()
         $urlSafeClassname = $this->urlSafeClassname(RestfulServerTestComment::class);
         $url = "{$this->baseURI}/api/v1/$urlSafeClassname/" . $comment1->ID;
         $response = Director::test($url, null, null, 'GET');
-        $this->assertContains('<ID>', $response->getBody());
-        $this->assertContains('<Name>', $response->getBody());
-        $this->assertContains('<Comment>', $response->getBody());
-        $this->assertContains('<Page', $response->getBody());
-        $this->assertContains('<Author', $response->getBody());
+        $this->assertStringContainsString('<ID>', $response->getBody());
+        $this->assertStringContainsString('<Name>', $response->getBody());
+        $this->assertStringContainsString('<Comment>', $response->getBody());
+        $this->assertStringContainsString('<Page', $response->getBody());
+        $this->assertStringContainsString('<Author', $response->getBody());
     }
 
     public function testAuthenticatedGET()
@@ -430,8 +430,8 @@ public function testXMLValueFormatting()
         $urlSafeClassname = $this->urlSafeClassname(RestfulServerTestAuthorRating::class);
         $url = "{$this->baseURI}/api/v1/$urlSafeClassname/" . $rating1->ID;
         $response = Director::test($url, null, null, 'GET');
-        $this->assertContains('<ID>' . $rating1->ID . '</ID>', $response->getBody());
-        $this->assertContains('<Rating>' . $rating1->Rating . '</Rating>', $response->getBody());
+        $this->assertStringContainsString('<ID>' . $rating1->ID . '</ID>', $response->getBody());
+        $this->assertStringContainsString('<Rating>' . $rating1->Rating . '</Rating>', $response->getBody());
     }
 
     public function testXMLValueFormattingWithFieldAlias()
@@ -442,7 +442,7 @@ public function testXMLValueFormattingWithFieldAlias()
         $urlSafeClassname = $this->urlSafeClassname(RestfulServerTestAuthorRating::class);
         $url = "{$this->baseURI}/api/v1/$urlSafeClassname/" . $rating1->ID;
         $response = Director::test($url, null, null, 'GET');
-        $this->assertContains('<rate>' . $rating1->Rating . '</rate>', $response->getBody());
+        $this->assertStringContainsString('<rate>' . $rating1->Rating . '</rate>', $response->getBody());
     }
 
     public function testApiAccessFieldRestrictions()
@@ -453,11 +453,11 @@ public function testApiAccessFieldRestrictions()
         $urlSafeClassname = $this->urlSafeClassname(RestfulServerTestAuthorRating::class);
         $url = "{$this->baseURI}/api/v1/$urlSafeClassname/" . $rating1->ID;
         $response = Director::test($url, null, null, 'GET');
-        $this->assertContains('<ID>', $response->getBody());
-        $this->assertContains('<Rating>', $response->getBody());
-        $this->assertContains('<Author', $response->getBody());
-        $this->assertNotContains('<SecretField>', $response->getBody());
-        $this->assertNotContains('<SecretRelation>', $response->getBody());
+        $this->assertStringContainsString('<ID>', $response->getBody());
+        $this->assertStringContainsString('<Rating>', $response->getBody());
+        $this->assertStringContainsString('<Author', $response->getBody());
+        $this->assertStringNotContainsString('<SecretField>', $response->getBody());
+        $this->assertStringNotContainsString('<SecretRelation>', $response->getBody());
 
         $urlSafeClassname = $this->urlSafeClassname(RestfulServerTestAuthorRating::class);
         $url = "{$this->baseURI}/api/v1/$urlSafeClassname/" . $rating1->ID . '?add_fields=SecretField,SecretRelation';
@@ -481,7 +481,7 @@ public function testApiAccessFieldRestrictions()
             $response->getBody(),
             '"fields" URL parameter filters out disallowed fields from $api_access'
         );
-        $this->assertNotContains(
+        $this->assertStringNotContainsString(
             '<SecretRelation>',
             $response->getBody(),
             '"fields" URL parameter filters out disallowed relations from $api_access'
@@ -490,12 +490,12 @@ public function testApiAccessFieldRestrictions()
         $urlSafeClassname = $this->urlSafeClassname(RestfulServerTestAuthor::class);
         $url = "{$this->baseURI}/api/v1/$urlSafeClassname/" . $author1->ID . '/Ratings';
         $response = Director::test($url, null, null, 'GET');
-        $this->assertContains(
+        $this->assertStringContainsString(
             '<Rating>',
             $response->getBody(),
             'Relation viewer shows fields allowed through $api_access'
         );
-        $this->assertNotContains(
+        $this->assertStringNotContainsString(
             '<SecretField>',
             $response->getBody(),
             'Relation viewer on has-many filters out disallowed fields from $api_access'
@@ -509,8 +509,16 @@ public function testApiAccessRelationRestrictionsInline()
         $urlSafeClassname = $this->urlSafeClassname(RestfulServerTestAuthor::class);
         $url = "{$this->baseURI}/api/v1/$urlSafeClassname/" . $author1->ID;
         $response = Director::test($url, null, null, 'GET');
-        $this->assertNotContains('<RelatedPages', $response->getBody(), 'Restricts many-many with api_access=false');
-        $this->assertNotContains('<PublishedPages', $response->getBody(), 'Restricts has-many with api_access=false');
+        $this->assertStringNotContainsString(
+            '<RelatedPages',
+            $response->getBody(),
+            'Restricts many-many with api_access=false'
+        );
+        $this->assertStringNotContainsString(
+            '<PublishedPages',
+            $response->getBody(),
+            'Restricts has-many with api_access=false'
+        );
     }
 
     public function testApiAccessRelationRestrictionsOnEndpoint()
@@ -695,13 +703,13 @@ public function testCanViewRespectedInList()
         $url = "{$this->baseURI}/api/v1/$urlSafeClassname/";
         $response = Director::test($url, null, null, 'GET');
         $this->assertEquals(200, $response->getStatusCode());
-        $this->assertNotContains('Unspeakable', $response->getBody());
+        $this->assertStringNotContainsString('Unspeakable', $response->getBody());
 
         // JSON content type
         $url = "{$this->baseURI}/api/v1/$urlSafeClassname.json";
         $response = Director::test($url, null, null, 'GET');
         $this->assertEquals(200, $response->getStatusCode());
-        $this->assertNotContains('Unspeakable', $response->getBody());
+        $this->assertStringNotContainsString('Unspeakable', $response->getBody());
         $responseArray = json_decode($response->getBody(), true);
         $this->assertSame(0, $responseArray['totalSize']);
 
@@ -712,7 +720,7 @@ public function testCanViewRespectedInList()
         $url = "{$this->baseURI}/api/v1/$urlSafeClassname/";
         $response = Director::test($url, null, null, 'GET');
         $this->assertEquals(200, $response->getStatusCode());
-        $this->assertContains('Unspeakable', $response->getBody());
+        $this->assertStringContainsString('Unspeakable', $response->getBody());
         // Assumption: default formatter is XML
         $responseArray = Convert::xml2array($response->getBody());
         $this->assertEquals(1, $responseArray['@attributes']['totalSize']);