[Conductor] Update dev

[private-packagist]

This PR was automatically generated by Conductor.

The PR contains the changes generated by running the following command:

composer update friendsofphp/php-cs-fixer:v3.95.18 phpstan/phpstan:2.2.7 rector/rector:2.5.9 --with-all-dependencies --minimal-changes

Changelog

friendsofphp/php-cs-fixer (Source: GitHub Releases))

v3.95.18

What's Changed

• deps: bump the phpstan group in /dev-tools with 2 updates by @​dependabot[bot] in #​9748
• deps: update dev-tools by @​keradus in #​9754
• perf: Limit token search in simplified_if_return by @​live627 in #​9747
• CI: attach provenance and SBOM attestations to the released image by @​kobihikri in #​9751

New Contributors

• @​kobihikri made their first contribution in #​9751

Full Changelog: v3.95.17...v3.95.18

v3.95.17

What's Changed

• perf: Token::equals() - Avoid building intermediary arrays by @​live627 in #​9739
• perf: Tokens::findSequence() - improve looping logic by @​live627 in #​9737

Full Changelog: v3.95.16...v3.95.17

phpstan/phpstan (Source: GitHub Releases)

2.2.7

Bugfixes 🐛

• Preserve maybe-certainty only for Variable when narrowing the base of ?->, ??, isset() and empty() (#​6109), #​15002, thanks @​staabm and @​VincentLanglet!
• Do not key the container cache on the turbo extension state (#​6121)
• Fill the missing gaps in expr processing (phpstan/phpstan-src@​eea2788)
• Resolve a relative include against the trait file in a trait context (#​6127), thanks @​zonuexe!
• Do not let type narrowing define a certainly-undefined variable (#​6130), #​2032
• Merge all callable acceptors' parameters into NativeParameterReflection when a closure is passed to a union of callables (#​6128), #​15003, thanks @​staabm and @​VincentLanglet!
• Treat a property with a default value as always set in isset resolution (#​6131), #​10786
• Read already-processed expression types from ExpressionResults in NodeScopeResolver (#​6139), #​13253
• Resolve __DIR__ and __FILE__ against the trait file in a trait context (#​6126), #​15015, thanks @​zonuexe!

Performance 🏎️

• Reuse the scope factory of the other flavour (#​6114)
• Remember chain levels that shortcircuit to themselves (phpstan/phpstan-src@​ab11f34), #​14991
• Prevent unnecessary re-creation of union types (#​6117), thanks @​staabm!
• Remember an expression's printed form as the printer produces it (#​6118), #​14991
• Prevent unnecessary re-creation of benevolent union types (#​6119), thanks @​staabm!
• Resume expression-asking fibers with ExpressionResults (phpstan/phpstan-src@​9725942)
• Create merge conditionals from the differing holders only (#​6141)

Internals 🔍

• ExprHandlerRegistry does not need to be AutowiredService (phpstan/phpstan-src@​36392ba)
• Repeat a shadowed class's interfaces on its stub shell (#​6113)
• Run the benchmark on PHP 7.4 in addition to PHP 8.5 (#​6121)
• Check bench/data files with RequiredPhpVersionCommentTest (#​6122), thanks @​staabm!
• Introduce ExpressionResultFactory (phpstan/phpstan-src@​8f5111f)
• ExpressionResult - add beforeScope (phpstan/phpstan-src@​a7094b5)
• ExpressionResult - add Expr (phpstan/phpstan-src@​abcce56)
• Eliminate the OriginalPropertyTypeExpr virtual node (#​6129)
• Eliminate the GetOffsetValueTypeExpr virtual node (#​6129)
• Eliminate the GetIterableKeyTypeExpr virtual node (#​6129)
• Eliminate the GetIterableValueTypeExpr virtual node (#​6129)
• Deduplicate constant-condition vs impossible-check reports via collectors instead of asking the type specifier inline (#​6132)
• Replace SpecifiedTypes::normalize() with symbolic alternative-form entries (#​6133)
• Resolve early-terminating calls to an explicit never type in the call handlers (#​6134)
• Read operand types from ExpressionResults in Throw/BooleanAnd/Coalesce handlers (#​6135)
• Read operand types from ExpressionResults in Ternary/ArrayDimFetch/PropertyFetch handlers (#​6136)
• Read operand types from ExpressionResults in BinaryOp/BooleanOr/MethodCall/Match handlers (#​6137)
• Read expression types from ExpressionResults in NodeScopeResolver and handlers (#​6138)
• Fill the foreach key-loop native types with the native flavour (#​6141)
• Run engine-feeding node-callback gatherers synchronously at the emission position (#​6142)
• Track containsNullsafe on ExpressionResult and propagate it through fetch/call chains (#​6143)

2.2.6

This release fixes 33 issues! 🎉

Major new features 🚀

• PHPStan Turbo (https://github.com/phpstan/turbo-ext/)
  • Optional native PHP extension (PHP 8.3+) written in C++ that makes running PHPStan 10-30 % faster (depending on project specifics)
  • Users installing PHPStan through Composer with phpstan/phpstan get it automatically. Composer package ships prebuilt binaries for the most common platforms — Linux (glibc and musl, x86_64 and arm64), macOS, and Windows (x86_64)
  • Users running standalone phpstan.phar can install the extension with pie install phpstan/turbo
  • The fact that it's enabled can be verified with vendor/bin/phpstan diagnose or running analyse -vvv
  • There's room to improve performance with this technique in the future, but we're shipping it now because it brings real benefits already.

Bleeding edge 🔪

• Report finite-typed values in a constant array haystack that can never be the in_array()/array_search()/array_keys() needle (#​6054), #​14960
• Report ?? null / ??= null on an always-set left side as an unnecessary null coalesce (#​5865), #​4337, #​12179, #​9966, thanks @​VincentLanglet and @​staabm!
• Type DOMDocument load/save/validate string arguments as non-empty-string on PHP 8 (#​6075), #​14979, thanks @​VincentLanglet and @​staabm!

If you want to see the shape of things to come and adopt bleeding edge features early, you can include this config file in your project's phpstan.neon:

includes:
	- vendor/phpstan/phpstan/conf/bleedingEdge.neon

Of course, there are no backwards compatibility guarantees when you include this file. The behaviour and reported errors can change in minor versions with this file included. Learn more

Improvements 🔧

• Implement @​pure-unless-callable-is-impure (#​3482), #​11101, #​11100, thanks @​zonuexe!
• Report invalid $flags constants for preg_replace_callback() and preg_replace_callback_array() (#​6019), #​11437, #​14910, thanks @​staabm and @​VincentLanglet!
• Validate callback signatures for curl_setopt callback options like CURLOPT_PREREQFUNCTION (#​6050), #​14956, thanks @​staabm and @​VincentLanglet!

Bugfixes 🐛

• Do not narrow the left side of ?? to non-null when the coalesce context still permits a falsey value (#​6000), #​13488, thanks @​VincentLanglet and @​staabm!
• Add UnaryOperatorTypeSpecifyingExtension for BcMath\Number so unary +/- infer BcMath\Number (#​5994), #​13965, thanks @​VincentLanglet and @​staabm!
• Narrow explode() result for limit 0, 1, and -1 (#​5993), thanks @​paulbalandan!
• Accept decimal-int-string arguments for %d printf placeholders in strict mode (#​5997), #​13609, thanks @​VincentLanglet and @​staabm!
• Resolve the base of $prop[] = ... to its readable type instead of its writable type (#​5996), #​14054, thanks @​VincentLanglet and @​staabm!
• Invalidate tracked superglobal narrowings after impure function, method, static and constructor calls (#​6007), #​12799, thanks @​VincentLanglet and @​staabm!
• Invalidate volatile expressions on eval/include (#​6009), thanks @​VincentLanglet!
• Do not treat offset writes on ArrayAccess properties as reassignments of readonly properties (#​5995), #​13856, thanks @​VincentLanglet and @​staabm!
• Forget negative function_exists()/class_exists() narrowings when global state may change (#​5998), #​13608, #​12094, thanks @​VincentLanglet and @​staabm!
• Reanalyse trait-consuming files after a body-only trait change even when the trait shares its file with another symbol (#​6033), #​14943
• Negating the smallest integer results in a float (#​6028), #​14946, #​14947, thanks @​zonuexe!
• Fix 'path ... does not exist' false-positive for expr containing DIRECTORY_SEPARATOR (#​6035), #​14944, thanks @​staabm!
• Track file dependencies for global constant fetches (#​6023), thanks @​SanderMuller!
• Track define()'d constants as exported nodes (#​6036), thanks @​SanderMuller!
• Fix filter_var throw-on-failure detection (#​6042), thanks @​simPod!
• Make Type objects behave as the immutable values they are (#​6037)
• Account for subclasses in get_parent_class() of a $this/static value (#​6048), #​14951, thanks @​zonuexe!
• Treat all in-scope variables as used when a closure or constructor body contains include/require/eval (#​6056), #​14962, thanks @​staabm and @​VincentLanglet!
• Treat all in-scope variables as used when an unused-parameter body accesses a variable variable ($$name) (#​6058), #​13960, thanks @​staabm and @​VincentLanglet!
• Resolve static/self/parent relative to @​param-closure-this bound class (#​6061), #​11010, thanks @​calebdw!
• Do not report abstract interface methods provided by a non-abstract built-in parent class in MissingMethodImplementationRule (#​6059), #​14964, thanks @​VincentLanglet!
• Preserve maybe in BitwiseFlagHelper for bitwise-or with dynamic operands (#​6080), thanks @​vrana!
• Treat trait-declared properties as initialized when promoted by an inherited constructor (#​6085), #​14983, thanks @​VincentLanglet and @​staabm!
• Keep the result cache when composer.lock changes but no package version did (#​6086), #​14984, thanks @​SanderMuller!
• Fix "ob_get_*() === false will always evaluate to false" false positive (#​6097), #​14985, thanks @​staabm!
• Invalidate the whole result cache when a changed package registers a container class (#​6088), #​14986, thanks @​SanderMuller!

Performance 🏎️

• Cache ObjectType instead of re-creating it over and over (#​6006), thanks @​staabm!
• Single-flight cold directory scans in OptimizedDirectorySourceLocatorFactory (#​5846), thanks @​SanderMuller!
• Disable zend.assertions as suggested by PHP-Parser (#​6021), thanks @​staabm!
• Faster DuplicateClassDeclarationRule (#​6038), thanks @​staabm!
• Faster DuplicateFunctionDeclarationRule (#​6039), thanks @​staabm!
• Memoize ExprHandler dispatch in MutatingScope::resolveType() (#​6040), thanks @​staabm!
• Replace NodeFinder with direct recursion in shouldInvalidateExpression() (#​6041), thanks @​staabm!
• Return early from ClassReflection::getMethod() cache (#​6043), thanks @​staabm!
• Index PSR autoloader locators by symbol instead of sweeping them per lookup (#​6037)
• Short-circuit no-op remove() comparisons by identity before equals() (#​6037)
• Cache reflections built from the PhpStorm stubs (phpstan/phpstan-src@​ae5fd31)
• Do not park fibers on expressions that can never receive a before-scope (#​6064)
• Extend the compositional-key shortcut to more invalidation scans (#​6064)
• Prevent unnecessary method calls on Type (#​6076), thanks @​staabm!
• Prevent reflection when Property Hooks not supported (#​6082), thanks @​staabm!
• Iterate through nullsafe expression chains (#​6084), thanks @​realFlowControl!
• Iterate in collectInterfaces() (#​6092), thanks @​staabm!
• Iterate in getBooleanExpressionDepth() (#​6091), thanks @​staabm!
• Prevent duplicate filterByTruthyValue() work in NodeScopeResolver (#​6103), thanks @​staabm!
• Run indentation detection, node cloning and node replacing in a single AST traversal and cache per-file fixing data (#​6101), #​14996, thanks @​staabm and @​VincentLanglet!
• Remove unnecessary work in BooleanOrHandler (#​6106), thanks @​staabm!
• Iterative NullsafeOperatorHelper (#​6105), thanks @​staabm!
• Simplify AccessoryArrayListType (#​6107), thanks @​staabm!

Function signature fixes 🤖

• Use list-shapes for functionMap return types that are guaranteed lists (#​6024), thanks @​zonuexe!
• Add array-shape return type for localeconv() and shape-based localtime() return type extension (#​6031), #​14949, thanks @​staabm and @​VincentLanglet!

Internals 🔍

• Refactor: extract ConfiguredPhpVersionRangeHelper (#​6014), thanks @​staabm!
• Utilize ConfiguredPhpVersionRangeHelper (#​6017), thanks @​staabm!
• Add named argument tests for @​pure-unless-callable-is-impure (#​6022), thanks @​zonuexe!
• Rename Test-classes colliding with builtin classes (#​6032), thanks @​staabm!
• Upgrade PHPBench to 1.7.0 and use aggregate-preview report (#​6067), thanks @​dantleech!
• Introduce #[ExtensionInterface] attribute, derive the interface-tag mapping from it (#​6096)
• Introduce ExtensionsCollection, #[AutowiredExtensions] and Container::getExtensionsCollection(), replace extension providers (#​6098)
• Add autoTag parameter to #[AutowiredService], migrate services that must not be auto-tagged (#​6096)
• Introduce #[InstanceofDeprecated] attribute, derive ApiInstanceofTypeRule map from it (#​6096)
• Update composer-attribute-collector: collect attributes without autoloading under PHP < 8 (#​6096)
• Remove obsolete PDO.patch for phpstorm-stubs (#​6073), thanks @​vrana!
• Compile #[AutowiredParameter] references into deferred getParameter() lookups (#​6102)
• Validate service tags in afterCompile() so tags added by any extension are covered (#​6102)
• Discover compiler extensions from the #[ContainerExtension] attribute (#​6102)
• Upgrade nette/di to 3.1.10 and drop the deleted-tag pin (#​6102)

rector/rector (Source: GitHub Releases))

2.5.9

Bugfixes 🐛

• [DeadCode] Remove unreachable class-like checks in Class_-only rules (#​8217)
• [CodingStyle] Use native php-parser node API over class reflection (#​8218)
• [Php80] Remove AstResolver usage on AddParamBasedOnParentClassMethodRector (#​8196)
• Wire RichParser node visitors via DI factory instead of private property hack (#​8215)
• [Php80] Skip promoting a property the parent declares without a native type in ClassPropertyAssignToConstructorPromotionRector (#​8232)
• [DeadCode] Keep empty __construct() in anonymous class that extends parent on RemoveEmptyClassMethodRector (#​8219)
• [DeadCode] Skip negative zero on RemoveDeadZeroAndOneOperationRector (#​8213)
• [DeadCode] Skip protected property on non-final class on RemoveDefaultValueFromAssignedPropertyRector (#​8214)
• [DeadCode] Skip array dim fetch assign on RemoveDefaultValueFromAssignedPropertyRector (#​8212)
• [DeadCode] Skip if/else in loop on RemoveDefaultValueFromAssignedPropertyRector (#​8211)
• [DeadCode] Skip early return in constructor on RemoveDefaultValueFromAssignedPropertyRector (#​8209)

Set changes 🗑️

NullToStrictStringFuncCallArgRector out of the PHP 8.1 set (#​8234)

The rule and all its fixtures stay, so it can still be opted into:

->withRules([NullToStrictStringFuncCallArgRector::class])

Deprecations 💀

TypeDeclarationDocblocks: 3 data provider docblock rules (#​8235)

Data provider docblock typing is not relevant to code quality — it increases maintenance cost and decreases readability of the test class.

Deprecated rules:

• AddReturnArrayDocblockFromDataProviderParamRector
• AddReturnDocblockDataProviderRector
• AddParamArrayDocblockFromDataProviderRector

rectorphp/rector-symfony 🎵

• [Symfony72] Match push() to its own RequestStack variable in PushRequestToRequestStackConstructorRector (#​971)
• [Symfony44] Skip custom isGranted() service calls in controllers in AuthorizationCheckerIsGrantedExtractorRector (#​973)
• [Symfony42] Update Cookie fixture after NewToStaticCallRector config removal (#​974)
• Drop rector/type-perfect, its rules ship in tomasvotruba/type-coverage 2.3 now (#​972)
• Bump dev dependencies, PHPUnit 13 (#​976)
• [deps] Bump symfony/config to ^8.1 (#​977)

Deprecated: SimplifyFormRenderingRector (#​975)

The rule removed the explicit ->createView() call when a form was passed to render():

Symfony supports passing the FormInterface directly, but the shorthand is ambiguous and breaks dynamic forms: forms modified in PRE_SET_DATA/POST_SUBMIT listeners and submitted over AJAX end up with a 422 response and no clear error. Keeping the explicit ->createView() call is the reliable form. See symfony/symfony#​50542.

rectorphp/rector-phpunit 🧪

• [PHPUnit 13] Fix class in expectExceptionMessage() rename to TestCase (#​735)

rectorphp/rector-downgrade-php ⬇️

• [DowngradePhp81] Reference MHASH_* constants by name in DowngradeHashAlgorithmXxHashRector to fix PHP 8.5 deprecation (#​386)

2.5.8

New Features 🥳

• [dx] Add "if" set with if/else/ternary rules (#​8199)
• [DeadCode] Add RemoveDeadInstanceOfAssertRector (#​8202)
• [DeadCode] Add RemoveDoubleSelfAssignRector (#​8203)
• [DeadCode] Add RemoveParentDelegatingClassMethodRector (#​8204)
• [DeadCode] Add RemoveDefaultValueFromAssignedPropertyRector (#​8207)
• [TypeDeclaration] Fix incomplete type on yield variable + yield from in AddParamTypeBasedOnPHPUnitDataProviderRector (#​8206)

Bugfixes 🐛

• Fix LogicalToBooleanRector: parenthesize assignments nested under unary/binary operators (#​8184)
• [TypeDeclaration] Skip trait methods on ParamTypeByMethodCallType rules (#​8189)
• [Php80] Skip promotion when property type is wider than constructor param on ClassPropertyAssignToConstructorPromotionRector (#​8170), Thanks @​ximki-vinki!
• [Php85] Skip outer spread on NestedFuncCallsToPipeOperatorRector (#​8191)
• [DeadCode] Fix crash on float version arg in ConditionResolver (#​8192)
• Make NestedFuncCallsToPipeOperatorRector minimum depth configurable (#​8193)
• Fix codeception data provider detection (#​8194), Thanks @​d-mitrofanov-v!
• Make PHPStan DI-Container available in bootstrap files (#​8190), Thanks @​staabm!
• [Privatization] Skip Symfony Command protected static property in PrivatizeFinalClassPropertyRector (#​8201)
• Bump to PHPStan ^2.2.6 and Fix its Container compatibility in RichParser (#​8208)

Removed 💀

• skip @​ return this on RemoveReturnTagIncompatibleWithNativeTypeRector on Traits (#​8185)
• [DeadCode] Skip string scalar sub type on RemoveReturnTagIncompatibleWithNativeTypeRector (#​8186)

rectorphp/rector-symfony 🎵

• [Symfony73] Remove empty configure() method in CommandHelpToAttributeRector (#​969)
• [Symfony73] Keep AbstractExtension when Twig extension overrides a built-in function/filter (#​968)
• [Symfony73] Wrap scalar groups option in array in ConstraintOptionsToNamedArgumentsRector (#​967)
• [Symfony61] Remove empty configure() method even with empty body (#​966)
• [Symfony61] Remove now empty configure() method in CommandConfigureToAttributeRector (#​965)
• [CodeQuality] Respect typeGuardedClasses and skip closure-only returns in ResponseReturnTypeControllerActionRector (#​964)
• [Symfony44] Return 1 instead of (int) false in ConsoleExecuteReturnIntRector (#​963)
• [CodeQuality] Add union and method call return type support to ResponseReturnTypeControllerActionRector (#​961)
• [Twig30] Add new set for Twig 30 (#​960), Thanks @​MrYamous

rectorphp/rector-doctrine 🟠

• [DataFixtures 17] add new set for doctrine data-fixtures 17 (#​487), Thanks @​MrYamous

rectorphp/rector-phpunit 🟢

• [PHPUnit 13] Add PHPUnit 13 config set (#​733)
• [CodeQuality] Skip super global variables on AssertIssetToSpecificMethodRector (#​732)
• [CodeQuality] Skip anonymous classes in AssertClassToThisAssertRector (#​729)
• [CodeQuality] Move AssertClassToThisAssertRector hook from Class_ to ClassMethod (#​728)
• AssertEqualsToSameRector: skip arrays whose actual value key order is not provably identical (#​727)

Task options

• Recreate commit - Conductor recreates the update commit and overwrites all additional changes made in this branch.
• Details
• Skip - Conductor won't attempt to update the dependency to this exact version again.
• All tasks
• Settings
• Docs

If you close the PR, the task will be skipped and Conductor will schedule the next task. Clicking the "Skip" button in the UI has the same effect. Conductor won't attempt to update the dependency to this exact version again but it will schedule updates to newer versions.

---

Powered by Private Packagist

[private-packagist]

composer.lock

Dev Package changes

Package	Operation	From	To	About
friendsofphp/php-cs-fixer	upgrade	v3.95.16	v3.95.18	diff
phpstan/phpstan	upgrade	2.2.5	2.2.7	diff
rector/rector	upgrade	2.5.7	2.5.9	diff

---

Settings · Docs · Powered by Private Packagist