[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vimeo/psalm	7.0.0-rc2 → 7.0.0-rc10

---

Release Notes

vimeo/psalm

v7.0.0-rc10

Compare Source

What's Changed

Features

• Add the file sinks of php-vips sources, targets and findLoad() to its stub by @​danog in #​12478

Other changes

• [7.x] Fix: class templates in namespaced @​method parameter types resolve as classes by @​alies-dev in #​12477

Full Changelog: vimeo/psalm@7.0.0-rc9...7.0.0-rc10

v7.0.0-rc9

Compare Source

What's Changed

Features

• Support conditional taint sinks: @​psalm-taint-sink ($mode is 0 ? null : 'html') $content by @​danog in #​12458
• Load the stubs Psalm ships for libraries when the scanned code uses one of their classes by @​danog in #​12460
• Add library stubs for the taints of Guzzle, PSR-7 messages and PSR-18 clients by @​danog in #​12461
• Add a library stub for the file and SSRF sinks of Monolog's stream and socket handlers by @​danog in #​12462
• Add a library stub for the SQL and file sinks and the escapes of phpClickHouse by @​danog in #​12463
• Add a library stub for the file sinks and the cell values of PhpSpreadsheet by @​danog in #​12464
• Add a library stub for the file sinks of Archive_Tar by @​danog in #​12465
• Add a library stub for the file sinks of php-vips images by @​danog in #​12466
• Add a library stub for the emails webklex/php-imap receives as taint sources by @​danog in #​12467
• Add @​psalm-cli-only: what command-line code prints isn't an HTML sink by @​danog in #​12459

Fixes

• Remove what escaping removes from one returned expression from that return only by @​danog in #​12471
• Apply conditional taint sinks to calls of first-class callables and closures by @​danog in #​12473

Full Changelog: vimeo/psalm@7.0.0-rc8...7.0.0-rc9

v7.0.0-rc8

Compare Source

What's Changed

Features

• Let plugins add taint paths: Codebase::getTaintNode(), getTaintPropertyNode(), addTaintPath() by @​danog in #​12454
• Let @​psalm-flow set and return properties of $this by name by @​danog in #​12456
• Name a keyed taint store of static by the class the method is called on by @​danog in #​12457
• Support @​psalm-taint-source input return['key']: a source under a key of the return only by @​danog in #​12455

Other changes

• Document every taint type by @​danog in #​12468

Full Changelog: vimeo/psalm@7.0.0-rc7...7.0.0-rc8

v7.0.0-rc7

Compare Source

What's Changed

Features

• Remove the html taint from json_encode() called with JSON_HEX_TAG and JSON_HEX_AMP by @​danog in #​12453

Full Changelog: vimeo/psalm@7.0.0-rc6...7.0.0-rc7

v7.0.0-rc6

Compare Source

What's Changed

Features

• Support the decimal-int-string and non-decimal-int-string types by @​danog in #​12417
• Support conditional types on a type depending on a template by @​danog in #​12420
• Support exact intersections of scalar and conditional types by @​danog in #​12418

Fixes

• Give the overrides specialized by call the object and the arguments of a virtual call by @​danog in #​12427

Full Changelog: vimeo/psalm@7.0.0-rc5...7.0.0-rc6

v7.0.0-rc5

Compare Source

What's Changed

Features

• Support global constant wildcards in types by @​danog in #​12419

Full Changelog: vimeo/psalm@7.0.0-rc4...7.0.0-rc5

v7.0.0-rc4

Compare Source

What's Changed

Fixes

• Read the WordPress hash notation after a @​return or @​var type as a description by @​danog in #​12416

Internal changes

• Require psalm/psalm-plugin-api 0.4.1 by @​danog in #​12424

Full Changelog: vimeo/psalm@7.0.0-rc3...7.0.0-rc4

v7.0.0-rc3

Compare Source

What's Changed

Features

• Let @​psalm-flow ($this) -> return carry the taints of the object a method is called on by @​danog in #​12302
• Add , to make issues impossible to suppress by @​danog in #​12130
• Report int-mask values compared by value with a set other than the empty or the full one by @​danog in #​12203
• Add a time capability for reading the clock by @​danog in #​12261
• Accept taint complements ~(kind|kind): every taint, custom ones included, but the kinds listed by @​danog in #​12300
• Support @​psalm-flow ($compute()) -> return: what a callable parameter returns flows to the return by @​danog in #​12299
• Follow values through keyed stores: @​psalm-flow ($value) -> Store::$data[$key] and back to return by @​danog in #​12312
• Store what callables return in keyed stores: @​psalm-flow ($compute()) -> Store::$data[$key] by @​danog in #​12327
• Declare custom taints in psalm.xml, optionally added to the input aliases by @​danog in #​12330
• Report invalid taint and flow annotations, also in stubs, as InvalidDocblock by @​danog in #​12333
• Report every docblock issue of the stubs the config and plugins add by @​danog in #​12334
• Add the _ purity to the closure parameters a function-like calls with --alter by @​danog in #​12019
• Let plugins give the capabilities a call of a method requires by @​danog in #​12329
• Declare what the methods of the SPL classes do by @​danog in #​12122
• Charge ArrayObject and ArrayIterator mutators write-props only when their storage is an object by @​danog in #​12190
• Resolve taints over compact states, so that large graphs fit in memory by @​danog in #​12105
• Taint analysis: sinks on the values of an array parameter only ($param[*]) by @​danog in #​12171
• Give decoded user input back the nosql taint the string type took away by @​danog in #​12338
• Taint analysis: keep the calls of a callee that only reads shared state specialized by @​danog in #​12397
• Taint analysis: know more array keys (literal unions, array_map(), convergences, key starts of lists) and stop at keys overwritten in specialized calls by @​danog in #​12375
• Taint analysis: share and split the filters of specialized calls by what their walks observe by @​danog in #​12374
• Add a PHP 8.6 call map by @​danog in #​12407
• Add Codebase::getReceiverTaintPath(), the path along which a method of a builtin class returns what its object holds by @​danog in #​12414

Fixes

• Declare the capabilities of the Random extension's randomizer and engines by @​danog in #​12311
• Don't taint the overrides of sibling classes through inherited method calls by @​danog in #​12100
• Infer the bounds, not mixed, for templates of new that a class doesn't pass to its parent by @​danog in #​12125
• Keep the variables a loop defines, with their types, where the next iteration starts by @​danog in #​12155
• Resolve global constants holding enum cases when they're fetched by @​danog in #​12173
• Suggest a class contract that also covers the known subclasses and the purity template bounds by @​danog in #​12186
• Specialize a specialized function passed as a callable, whose edge hid its return from its calls by @​danog in #​12201
• Link a specialized override's by-ref params to the overridden method without cutting off its calls by @​danog in #​12202
• Forget the array offsets a write through a non-literal key may overwrite by @​danog in #​12174
• Treat builtins that read files, streams and the network as impure by @​danog in #​12214
• Narrow the subject of a match without a default arm to the values of its arms past it by @​danog in #​12225
• Take only the column of each row into the values array_column() returns, and the index into its keys by @​danog in #​12226
• Track taints through global variables, with a node per global shared by $GLOBALS and global by @​danog in #​12243
• Don't narrow strings to objects with __toString() through instanceof by @​danog in #​12310
• Let a specialized call read what its other calls leave in a static property by @​danog in #​12254
• Keep the taints of arrays encoded into strings by json_encode(), serialize(), print_r(), ... in taint analysis by @​danog in #​12257
• Taint the result of a call on an interface or base class with the returns of its overrides by @​danog in #​12262
• Drop an optional array key, and its taint, where array_key_exists() or isset() is negated by @​danog in #​12298
• Keep the shape of arrays unpacking shapes with optional string keys by @​danog in #​12301
• Charge igbinary_serialize() and igbinary_unserialize() like serialize() and unserialize() by @​danog in #​12306
• Narrow by @​psalm-assert types that expand to a union, such as key-of<A::B> or a template bound by @​danog in #​12230
• Treat the objects a closure captures as not fresh, and infer writes to fresh objects as free by @​danog in #​12268
• Charge the destructors of what an overwritten or unset property, array element or variable held by @​danog in #​12309
• Forget what mutation-free methods returned when a later call may write their receiver by @​danog in #​12191
• Fix master CI by @​danog in #​12335
• Share what keyed stores hold between specialized calls by @​danog in #​12336
• Specialize the taints of Type::getString() and getAtomicStringFromLiteral() per call by @​danog in #​12337
• Declare what the phpredis classes do: commands need io, subscribe callbacks are charged by @​danog in #​12308
• Don't report calling a closure or an invokable object as a tainted callable by @​danog in #​12093
• Assign under each literal the key of an array assignment can be (master) by @​danog in #​12152
• Don't report an instanceof && property check on a template param as redundant by @​danog in #​12342
• Fix master CI after the latest merges by @​danog in #​12347
• Merge a key check's array node away where the array it checks is merged back in by @​danog in #​12349
• Assign under each literal the key of an array assignment can be by @​danog in #​12150
• Tell array keys apart by their start where only that is known statically by @​danog in #​12106
• Declare that preg_last_error(), preg_last_error_msg() and json_last_error_msg() only read globals by @​danog in #​12351
• Charge a call on a mixed value as a call that may do anything by @​danog in #​12362
• Infer literal class-string for Foo::class in constants outside class context by @​rela589n in #​12364
• Fix the taint resolution hang on Psalm's own code (self-analysis/Shepherd) by @​danog in #​12361
• Fix master CI after the latest merges (template bounds, self-analysis) by @​danog in #​12350
• Don't suggest a purity annotation below the lower bound of the purity template a method depends on by @​danog in #​12358
• Declare what the methods of SplObjectStorage do, so a new storage can be filled for free by @​danog in #​12297
• Charge calls of methods not known by name what the class contract allows, or impure without one by @​danog in #​12304
• Charge a method found through @​mixin what the __call() of the class using the mixin does by @​danog in #​12307
• Parse @​psalm-flow annotations in one place, for the docblock check and for the code applying them by @​danog in #​12369
• Don't require a class-level purity annotation on interfaces whose methods all have their own by @​danog in #​12303
• Fix master CI: keyed store read flows, empty @​psalm-taint-escape, test data and the preloader list by @​danog in #​12345
• Drop the taints a narrowed type can't carry, also where it can carry others by @​danog in #​12348
• Track taints through the static variables of function-likes across their calls by @​danog in #​12255
• Declare what the mongodb driver classes do: ids, cursors, servers, the manager and subscribers by @​danog in #​12332
• Taint analysis: keep the keys of the elements an assignment copies or a foreach loop transforms by @​danog in #​12373
• Fix master CI: copies of narrowed foreach variables, the marker interface test, a docblock by @​danog in #​12379
• Cut the memory of the taint resolution on large code bases (20.5 GB → 3.1 GB on Psalm's own code) by @​danog in #​12393
• Fix master's self-analysis: read php-64bit from composer.json, and type capability sets with time by @​danog in #​12396
• [6.x] Keep config untouched when --set-baseline runs with --use-baseline by @​alies-dev in #​12385
• Don't let a later call of an inherited method take the taints out of what earlier calls passed by @​danog in #​12383
• Purity: capability sets as int-masks, fresh objects, property reads of contracted objects, WeakMap, closures and purity templates through parents by @​danog in #​12380
• Fix covariance checks of templates, narrowing by || with calls asserting nothing, and redundant instanceof of generic subclasses by @​danog in #​12378
• Taint analysis: track file-scope variables, globals and ancestor constructors called by name by @​danog in #​12376
• Don't crash re-analyzing inherited method bodies of files a partial run doesn't analyze by @​danog in #​12384
• Report sinks on the values of a stubbed method's parameter by @​danog in #​12408
• Don't crash when destructuring an ArrayAccess object that isn't Traversable by @​danog in #​12409
• Require fidry/cpu-core-counter 1.2 by @​danog in #​12412
• Fix conditional return types of stubbed methods also declared in vendor by @​danog in #​12413
• Don't treat generator functions without a return as void by @​danog in #​12421
• Parse is not and nullable/intersection if-branches in conditional types by @​danog in #​12415

Internal changes

• Fix macOS CI: bump setup-php to 2.40.0 by @​danog in #​12296
• Allow running Psalm on PHP 8.6 by @​LordSimal in #​12323
• Rename Capabilities::allows to Capabilities::allowsAnyOf by @​danog in #​12328
• Test that a keyed store read under a key that isn't a parameter is an invalid @​psalm-flow by @​danog in #​12371
• Fix master CI: CapabilitiesTest PHP versions and self-analysis by @​danog in #​12372
• Fix master CI: declare MongoDB\Driver\Monitoring\Subscriber, read QUERY_STRING with a default in a test by @​danog in #​12390
• Type capability sets as int-masks, comparing exact sets with Capabilities::equals() by @​danog in #​12204
• Merge 6.x into master by @​danog in #​12406
• CI: balance the unit test runners by test time and run them on all cores; move to PHPUnit 10.5-13 and ParaTest 7 by @​danog in #​12405
• Require psalm/psalm-plugin-api 0.4.0 by @​danog in #​12410
• Regenerate the preloader list by @​danog in #​12411
• Fix master's self-analysis: mark the receiverTaintPaths provider pure by @​danog in #​12426
• Release master and 6.x every hour when all their checks passed by @​danog in #​12422

Other changes

• Add timeout to macOS Psalm scan job by @​austenstone in #​12324
• Bump actions/upload-artifact from 7.0.1 to 7.0.2 by @​dependabot[bot] in #​12321
• Bump shivammathur/setup-php from 2.37.1 to 2.40.0 by @​dependabot[bot] in #​12320
• Report UnsafeGenericInstantiation only for purity templates the constructor's parameters take by @​danog in #​12177
• Analyze the taints of an inherited method again for each class it is run on by @​danog in #​12156
• Fix crash and lost aliases for interfaces declared with class_alias() by @​Hoticus in #​12294
• Don't let the keys of an array hold a value assigned under a variable key (#​12105 port) by @​danog in #​12146
• [6.x] Fix crash when destructuring into offsets of an undefined variable by @​alies-dev in #​11996
• [6.x] Apply --threads to the scan phase when --scan-threads is not given by @​alies-dev in #​12382
• [6.x] Resolve self and parent in @param-out against the declaring class by @​alies-dev in #​12391
• [6.x] Fix: crash on unknown @​psalm- tags in property, constant and enum case docblocks by @​alies-dev in #​12394
• [6.x] Fix: resolve templates and conditional returns in method keys seeded by assertions by @​alies-dev in #​12392
• [6.x] Resolve object-shape properties on intersections with mixin or final classes by @​alies-dev in #​12111
• Do not report PropertyNotSetInConstructor for virtual hooked properties by @​ybai08 in #​12404
• Read @​phpstan-require-extends and @​phpstan-require-implements by @​ybai08 in #​12403

New Contributors

• @​LordSimal made their first contribution in #​12323
• @​austenstone made their first contribution in #​12324
• @​Hoticus made their first contribution in #​12294
• @​rela589n made their first contribution in #​12364
• @​ybai08 made their first contribution in #​12404

Full Changelog: vimeo/psalm@7.0.0-rc2...7.0.0-rc3

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "before 5am on saturday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.