[dependabot]

Updates the requirements on vimeo/psalm to permit the latest version.

Release notes

Sourced from vimeo/psalm's releases.

Psalm 7

Announcing the release of Psalm 7!

Featuring a simply enormous number of new features and bug fixes, such as:

• security analysis on by default: fully refactored for 10x+ performance and much greater coverage, in the same run as type checking and dead code detection;
• much deeper security analysis taint tracking: NoSQL, LLM prompt and URL injection, new sources like php://input and uploaded file names, flows through closures, generators, traits and by-reference parameters, and ready-made stubs for Guzzle, PSR-7, Monolog, MongoDB and more.
• a new purity model based on Hack's capabilities: declare exactly which side effects a function may have (io, time, write-props...), with purity templates for classes, closures and automatically inferred annotations;
• graph-based dead code detection: If nothing reachable uses a class, function, method, constant, variable, etc, Psalm finds it, now properly handling unused cycles as well.
• Template defaults (@template TError of Throwable = RuntimeException) for classes, functions and methods: Result<int> just works, and libraries can add templates without breaking their users.
• PHP 8.5 and 8.6 support: Full support for Partial Function Application, the pipe operator, and much more!
• Daily releases. Features and fixes reach you the day they land, no more waiting on dev-master.
• Framework plugins in the box. The PHPUnit, Symfony, Laravel, Mockery and sabre/event plugins ship with Psalm and switch on by themselves. Zero setup.
• a bigger Psalm maintainer team: @​alies-dev has joined the Psalm maintainer team, contributing many new useful features and bugfixes!
• An official Discord community!
• And so, so many other new features and bugfixes!

Psalm 7 runs on 64-bit PHP 8.2 to 8.6. Upgrading is simple for most projects: see Upgrading below.

Security analysis: faster, always on, in a single run

Taints are now stored as a bitmask, and the taint graph is resolved over compact summaries of each function. This makes security analysis up to 10x faster.

Combined analysis (#11384) runs type checking, security analysis and dead code detection together in one run, so taint analysis is now on by default (#11399).

Taint issues are reported with a SECURITY severity, and with a rank in SARIF reports (#12068, #11383). The results no longer change between runs or with the thread count (#11946, #11952, #11953).

Deeper taint tracking

<?php
$run = function (string $c): void {
    shell_exec($c);
};
$run((string) $_GET['cmd']); // TaintedShell, through the closure
$mongo = new MongoDB\Driver\Manager('mongodb://localhost');
$mongo->executeQuery('db.users', new MongoDB\Driver\Query(['name' => $_GET['name']])); // TaintedNosql
/** @​return mixed */
function body() {
return json_decode((string) file_get_contents('php://input'), true);
}
eval((string) body()); // TaintedEval: php://input is a source

Try it on psalm.dev »

• New taint kinds: TaintedNosql (MongoDB sinks), TaintedLlmPrompt (prompt injection), and TaintedUrlComponent / TaintedUrlPath (query and path injection). curl options and CURLFile are reported by what they do: SSRF, header injection, file access, sleep or callables. Every taint type is now documented (#11944, #11746, #12097, #12099, #12468).

... (truncated)

Commits

• 618ca49 Merge pull request #13061 from alies-dev/alies-dev/close-issues
• 209f0e1 Add regression tests for issues fixed on master
• 7cf7d72 Merge pull request #13059 from alies-dev/alies-dev/detect-duplicate-use-state...
• ef22d25 Merge pull request #13060 from danog/upgrading-to-psalm-7-docs
• 4c82e11 style(tests): import DIRECTORY_SEPARATOR in NamespaceTest #5364
• 0f32464 Add the Upgrading to Psalm 7 docs page
• 60c5f49 fix(parser): report duplicate use imports as ParseError #5364
• f8dd6d3 Merge pull request #13058 from danog/announce-discord
• 529fcb8 Don't announce a release twice on Discord when the job is rerun
• 20de184 Don't start a docblock line with @​everyone
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)