Skip to content

chore(deps): update composer dev dependencies - #48

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/composer-dev
Open

chore(deps): update composer dev dependencies#48
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/composer-dev

Conversation

@renovate

@renovate renovate Bot commented Jun 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
carthage-software/mago 1.29.0 → 1.47.2 age confidence
phpunit/phpunit (source) 10.5.63 → 10.5.64 age confidence
rector/rector (source) 2.4.5 → 2.6.3 age confidence
symfony/config (source) 7.4.10 → 7.4.16 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

carthage-software/mago (carthage-software/mago)

v1.47.2: Mago 1.47.2

Compare Source

Mago 1.47.2

Mago 1.47.2 prevents invalid UTF-8 reporting crashes, preserves formatter semantics, and fixes several analyzer false positives.

🐛 Bug Fixes

Analyzer
  • Static class-string calls: preserves generics returned by static factories. (#​2220, 0766957)
  • Array assignments: reports undefined target variables once. (#​2219, 1705475)
  • Promoted property hooks: analyzes hook bodies and records method usage. (#​2218, 0936c30)
Formatter
  • Invoked constructs: preserves required parentheses around invoked require expressions. (#​2221, 38f9e2a)
Reporting
  • Invalid UTF-8: preserves source offsets and prevents rich-reporting panics. (#​2222, e91cc71)

🏗️ Internal

Maintenance
  • Shared internals: deduplicates closure typing, call analysis, and linter utilities. (1668678)
  • Analyzer linting: cleans up Clippy findings after the shared refactor. (782d2cc)

🙏 Thank You

Contributors

No external pull requests were merged for this release.

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.47.1...1.47.2

v1.47.1: Mago 1.47.1

Compare Source

Mago 1.47.1

This patch release has no user-facing changes. It fixes the release pipeline so every supported target and crate can be published successfully.

🏗️ Internal

Release Pipeline
  • PHP SDK tests: skips integration tests when PHP or Composer dependencies are unavailable. (7f9e4ff)
  • Extension crate: adds mago-extension to the crate publishing order. (68c0818)

Full Changelog: carthage-software/mago@1.47.0...1.47.1

v1.47.0: Mago 1.47.0

Compare Source

Mago 1.47.0

Extensions in any language, Sponsored by CHECK24

Thanks to CHECK24 (@​check24-opensource) for sponsoring Mago's new Extension API and PHP SDK.

✨ Features

Extensions
  • Extension API: adds language-neutral workers, a PHP SDK, custom lint rules, analyzer plugins, and CLI tooling. (#​2192)

See the extension documentation to get started.

Analyzer
  • --skip-ignores: disables configured analyzer ignores for a run. (#​2191, f05c849)
  • Array key narrowing: narrows a key after a successful array_key_exists check. (#​2199, c58e48b, 7cc1739)

🐛 Bug Fixes

Analyzer
  • Logical assignments: merges assignments made by short-circuited right-hand expressions. (#​2176, a53bc78)
  • Magic properties: treats magic properties as possibly undefined. (#​2177, cea8d53)
  • Nullable inference: preserves null when inferring into a mixed parameter. (#​2175, 97988bb)
  • Scalar narrowing: prevents scalar intersections from collapsing incorrectly to never. (#​2179, #​2206, 8d34248, c8bd837)
  • Flow structures: returns Flow's concrete StructureType from type_structure(). (#​2186, ccde5ae)
  • Diagnostic casing: preserves method-name casing in unused-method diagnostics. (#​2187, 13090af)
  • Required interfaces: keeps requirement metadata without inheriting interface members. (#​2189, e5a949e, 874ffac)
  • Match subjects: evaluates method-call subjects once for exhaustive matching. (#​2190, #​2208, 7a7faa1)
  • Private trait methods: stops inheriting private trait methods into child classes. (#​2188, 8a8958a)
  • Switch entry flow: keeps independently selected cases reachable after a terminating case. (#​2185, efe7526)
  • Method assertions: invalidates cached nested call results after mutating calls. (#​2180, 353233b)
  • Bool templates: recognizes bool-constrained templates in comparisons. (#​2172, b84241a)
  • Omitted generics: treats missing generic arguments as erased wildcards. (#​2178, f1e029b)
  • Docblock symbols: reports undefined types in class-level member and mixin tags. (#​2193, 2c59ad3)
  • Compound conditions: removes order-dependent impossible-comparison diagnostics. (#​2195, 7ca65e2)
  • Nullable object shapes: preserves object-shape fields in nullable docblock unions. (#​2200, 5029124)
  • Global annotations: honors @var docblocks on global statements. (#​2181, #​2202, a7023c7)
  • Callable class strings: recognizes invokable classes in callable class-string bounds. (#​2207, f77c965)
  • Closure identity: recognizes every closure as an instance of Closure. (#​2203, d54d88e)
  • Symbol references: preserves source files for references returned to extensions. (#​2211, aabe675)
  • Unresolved dependencies: analyzes class bodies and exposes missing dependencies to extensions. (#​2212, 24c9304, f1558d4)
  • Class constants: canonicalizes class names when recording constant references. (#​2213, b59529d)
  • Missing property types: checks declarations without default values. (#​2201, 2e4260f)
Codex
  • @api metadata: preserves @api on properties, methods, and constants. (#​2214, 37450cd)
Linter
  • Language constructs: excludes clone, exit, and die from ambiguous function calls. (#​2196, 828cc42)
PHPDoc Syntax
Prelude
  • Imagick classes: adds missing Imagick class stubs, including ImagickPixel. (#​2210, 5e9b671)
Extensions
  • Windows startup: prevents an authentication race when extension workers connect. (111413a)
WASM
  • Telemetry: excludes unavailable extension orchestrator telemetry from WASM builds. (9e8b752)

📖 Documentation

Extensions
  • Extension guide: documents the architecture, PHP SDK, analyzer plugins, and custom rules. (7d67272)
  • Starter template: recommends the extension template as the quickest starting point. (bb98a97)
Website
  • Version order: lists documentation versions newest first. (#​2204, ffd725e)
  • Rule reference: refreshes the generated linter rule documentation. (3597d38)

🏗️ Internal

Maintenance
  • Codex types: removes dead APIs and deduplicates type and comparator machinery. (3a28052, 3d301af, acd2d56)
  • Analyzer internals: removes dead code and deduplicates reconciler and resolver logic. (02b352e)
  • Formatter internals: simplifies presets, comments, alignment, and printer machinery. (e07980f, e595c13)
  • Shared cleanup: deduplicates extension, codex, analyzer, and linter internals. (4b68329)
  • Clippy policy: updates lint allowances for module roots and rest-pattern maintenance. (82b7522, 2053081, 332368a)
  • Sponsors: refreshes the generated sponsor list. (8cec88c)

🙏 Thank You

Special thanks to CHECK24 for fully funding the Extension API's full-time development.

Contributors

A huge thank you to everyone who contributed code to this release:

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.46.0...1.47.0

v1.46.0: Mago 1.46.0

Compare Source

Mago 1.46.0

This release fixes a workflow-command injection in the GitHub reporting format (GHSA-f256-xqf4-x8pr), adds a redundant-static linter rule and a --stats shorthand, corrects a batch of generic-narrowing and late-static-binding false positives across the analyzer and codex, and speeds up the PHP parser.

🔒 Security

Reporting
  • Workflow-command injection: escapes untrusted values written to workflow commands and log records. (GHSA-f256-xqf4-x8pr, cc8d5e4)

Reported by Liyi Zhou, Ziyue, Strick, Maurice, and Chenchen of the University of Sydney.

✨ Features

Linter
  • redundant-static: reports static in a final class where self is equivalent. (#​2154, ef06262)
CLI
Prelude
  • json_validate: asserts non-empty-string when the call succeeds. (#​2155, 198f2b4)

🐛 Bug Fixes

Analyzer
  • Array entry narrowing: narrows possibly-absent entries on the parent shape, independent of conjunct order. (#​2132, 2af1cbc, 784b93b)
  • Attribute arguments: validates the types of attribute constructor arguments. (#​2161, ebf2f8d)
  • Switch labels: detects duplicate and unreachable case labels. (#​2162, 4119141)
  • Mutation-free calls: narrows repeated calls to mutation-free methods. (#​2138, b6e97ee)
  • Identical arrays: folds comparisons between identical arrays. (#​2149, c2c7bb4)
  • Late-static returns: preserves late-static types in generic return positions. (#​2151, fe272b8)
  • void conditionals: stops demanding a return from conditionals in void functions. (#​2160, bd85d70)
  • self in attributes: resolves self in attributes applied to class-likes. (#​2168, 7f88255)
  • Specialized generics: accepts class-strings of specialized generic classes. (#​2171, b0b0b91)
  • Narrowing leaks: prevents method-call narrowing from leaking across scopes. (42cfd1f)
Codex
  • Bounded templates: allows instanceof narrowing of generics parameterised by a bounded template. (#​2135, a45ffec, 8b2edf6)
  • Template defaults: populates default template arguments when the generic argument is omitted. (#​2140, aff9ce8)
  • Static return types: preserves generic parameters in static return types. (#​2145, 327ca0a)
  • void with never: keeps void when combined with never. (#​2159, 864d0f7)
  • Late-static rebinding: guards exact late-static type rebinding. (fcd42ec)
Linter
  • Naming suggestions: suppresses invalid suggestions for constants starting with a number. (#​2158, 7c54906)
  • missing-docs: renames the exclusion config field. (#​2134, a5eab2d)
Syntax
  • Method return types: parses grouped static method return types in docblocks. (#​2152, 06871ea)
  • String interpolation: limits recursion when parsing interpolated strings. (3610502)
Prelude
  • Attribute: adds the missing TARGET_CONSTANT constant. (9bef302)
Composer
  • Availability markers: unbreaks self-analysis of the availability markers. (#​2169, 209f980)

📖 Documentation

Reporting

🏗️ Internal

Performance
  • Parser: streamlines the PHP parser hot paths. (1ec8868)
Analyzer
  • Unused templates: uses loop labels for the unused-template checks. (#​2133, b4aa9ad)
  • Tests: removes invalid attribute stubs. (4d9c611)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.45.0...1.46.0

v1.45.0: Mago 1.45.0

Compare Source

Mago 1.45.0

This release teaches the analyzer to build keyed array shapes from get_object_vars(), adds @param-closure-this support and an auto-fix for overly-wide return types, introduces a linter rule preferring DateTimeImmutable::createFromTimestamp(), fixes a batch of analyzer false positives, and makes empty reports valid SARIF/JSON documents for CI.

✨ Features

Analyzer
  • get_object_vars() shapes: returns keyed array shapes built from the object's visible properties. (#​2110, a729ce1)
  • @param-closure-this: supports the docblock tag for typing a closure parameter's $this. (#​2131, 6000d41)
  • Overly-wide return types: adds an auto-fix that narrows the declared return type. (#​2068, #​2120, 9e4d186)
Linter
  • prefer-datetimeimmutable-create-from-timestamp: suggests the factory over new DateTimeImmutable('@...'). (#​2118, 38b6152)

🐛 Bug Fixes

Analyzer
  • Readonly promotion: detects reinitialization of promoted readonly properties in parent constructors. (#​2127, 490452e)
  • Escaping breaks: preserves breaks that escape nested loops in reachability analysis. (#​2124, 635eeab)
  • Guarded members: tracks method_exists guards on descendant members. (#​2125, d1b6e9c)
  • PSL analysis: eliminates false positives when analyzing PSL-based code. (6527f24)
  • array_map shapes: preserves array shapes for untyped closures. (#​2122, 816578a)
  • Catch variables: refines definedness for precise conditions in try/catch. (#​2119, aa469b9)
  • Hooked properties: tracks property-hook writes against the read type. (#​2112, bd95ea5)
  • Split property types: supports distinct @property-read and @property-write types. (#​2079, #​2108, b54a881)
  • @property visibility: resolves tags according to call-site visibility. (#​2106, a4b077d)
Codex
  • Enum case literals: infers literal values from class constants, tightening integer conditions. (#​2111, 237465e)
Prelude
  • array_diff: relaxes value parameters to string-castable types. (#​2116, f290239)
Reporting
  • Empty reports: emits valid SARIF, JSON, GitLab, and Checkstyle documents when there are no issues. (#​2128, 003ff32)
Playground
  • Analyzer settings: forwards playground settings so they take effect. (#​2121, 4184888)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.44.0...1.45.0

v1.44.0: Mago 1.44.0

Compare Source

Mago 1.44.0

A faster release with stronger dependent-type analysis, richer guard and linter configuration, and fixes across the CLI, formatter, analyzer, and semantics.

✨ Features

Analyzer
  • Override return types: reports overriding methods that omit a declared return type. (#​2100, 90c04c0)
Linter
  • no-missing-format-argument: detects missing format arguments. (#​2062, 38857dd)
  • missing-docs exclusions: supports configurable exclusions. (#​2102, 4488055)
  • Disallowed symbol levels: configures levels for functions and type instantiations. (#​2101, 34ed400)
Guard
  • @final validation: supports the annotation during structure validation. (#​2065, 78cbbf0)
  • Restrictions: supports dependency restrictions and public-method allowlists. (#​2074, 8d6d359)
CLI

🐛 Bug Fixes

Analyzer
  • Dependent types: resolve them across calls, partials, unpacks, and intersections. (a629700, a231709, 81be763)
  • Integer conditions: preserve ranges for correct impossible and redundant-condition reports. (#​2085, #​2087, 2037b9a, 6d71045)
  • Loop conditions: stabilize types and avoid false diagnostics in do-while iterations. (#​2078, 0205e49, 7afc4eb)
  • isset flow: retains unsafe access and try/catch uncertainty after failed checks. (#​2076, #​2096, b70350c, 23203e5)
  • Readonly initialization: accepts deferred initialization of readonly properties. (#​2095, ad495bd)
  • Magic methods: resolves @method calls backed by inherited methods. (#​2089, fda90f8)
  • Mixin receiver types: binds $this and static to mixin receivers. (#​2086, 07086c5)
  • Property overrides: reports incomparable override types. (#​2103, 80dbbfe)
  • Dynamic property names: reports $property, not $$property. (#​2066, 5d2116d)
  • PHPDoc returns: permits void in nullable docblock return types. (#​2081, #​2082, cdfd166)
  • Optional shapes: recognises optional string-keyed shapes as lists. (#​2073, b15f9e1)
Codex
  • Enum case identity: distinguishes cases during type identity checks. (#​2071, 683220c, 2637cf8)
  • Backed enum values: preserves literal values from known ->value access. (#​2064, 45ad41b)
  • Trait bounds: accepts exact @require-extends classes when validating traits. (#​2069, 84c0766)
Semantics
  • Enum magic methods: permits __call, __callStatic, and __invoke. (#​2075, d0487f2)
Linter
  • Namespaced imports: prevents overlapping fixes in global function imports. (#​2072, 9b40611)
Formatter
Guard
CLI
Distribution
  • Composer package: excludes the repository-only tests suite. (#​2098, 722e39b)

🏗️ Internal

Performance
  • Formatter: reduces printer and pipeline overhead. (f6520a2, ed94713)
  • Linter: reduces traversal and allocation overhead. (d818460)
  • Project analysis: speeds up end-to-end analysis and word interning. (d473383, c0d27c6)
Toolchain
  • Rust: bumps the minimum Rust version to 1.97.0 and removes the nightly pin. (8c8262e, a43077b)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.43.0...1.44.0

v1.43.0: Mago 1.43.0

Compare Source

Mago 1.43.0

A fix-focused release clearing false positives across the analyzer, codex, linter, and formatter. is_callable narrowing, strict in_array, type-alias recursion, ::class array keys, no-dead-store, and member-access chains. Plus sqlsrv stubs and internal HIR groundwork for the upcoming rule-based checker.

✨ Features

Prelude
  • sqlsrv extension: added function and constant stubs for the sqlsrv extension. (#​2045, e8f1ed3)

🐛 Bug Fixes

Analyzer
  • is_callable narrowing: no more false invalid-callable after narrowing to a callable type. (#​2037, 938a511)
  • Strict in_array: keeps the value's type on a negative result instead of wrongly excluding it. (#​2048, 3a69d09)
  • redundant-logical-operation: suppressed during loop pre-condition analysis. (#​2054, 4b4a7d4)
Codex
  • Enum generic narrowing: preserves generic type parameters when narrowing with enum type arguments. (#​2035, 0c5fdad)
  • Type-alias recursion: rejects aliases shadowing symbols and handles self-references, fixing a stack overflow. (#​2050, cde8037)
  • ::class array keys: no false invalid-array-index for literal class-string keys. (#​2056, e0dc158)
Prelude
  • Named arguments: dropped @no-named-arguments from native functions that accept them. (#​2043, 3e77dff)
Linter
Formatter
  • **Member-access chai

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/composer-dev branch from 8497d8c to e33f569 Compare June 17, 2026 19:09
@renovate renovate Bot changed the title chore(deps): update composer dev dependencies to v1.30.0 chore(deps): update composer dev dependencies Jun 17, 2026
@renovate
renovate Bot force-pushed the renovate/composer-dev branch 8 times, most recently from a395b5a to a7ec7d9 Compare June 27, 2026 12:47
@renovate
renovate Bot force-pushed the renovate/composer-dev branch 4 times, most recently from 4af49d1 to b6a7562 Compare July 9, 2026 10:26
@renovate
renovate Bot force-pushed the renovate/composer-dev branch 3 times, most recently from 5c429a7 to 2df86e7 Compare July 19, 2026 02:37
@renovate
renovate Bot force-pushed the renovate/composer-dev branch 4 times, most recently from 30359b7 to 0b40846 Compare July 31, 2026 01:00
@renovate
renovate Bot force-pushed the renovate/composer-dev branch 4 times, most recently from 3204b4f to 528bcda Compare August 7, 2026 22:39
@renovate
renovate Bot force-pushed the renovate/composer-dev branch 4 times, most recently from 27d5b33 to d0ae62d Compare August 18, 2026 22:39
@renovate
renovate Bot force-pushed the renovate/composer-dev branch from d0ae62d to 79b2241 Compare August 19, 2026 22:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants