[westonruter]

Updates PHPStan from 2.3.2 to 2.3.4. The phpstan/phpstan-phpunit extension is already at its latest version (2.1.1).

Baselines are regenerated with composer phpstan:baselines, and none of them change: PHPStan 2.3.4 reports exactly the same errors as 2.3.2.

Changes since 2.3.2

2.3.3:

• Regex parsing for preg_match() / preg_match_all() shape inference now uses a parser generated by phplrt instead of Hoa, fixing a number of inferred shapes: assertions are zero-width, groups in negative assertions are never set, backreferences and subroutine calls are parsed, and conditional subpatterns, branch reset groups, duplicate group names, and quantified atoms that can match an empty string are handled more accurately (Replace Hoa with a regex parser generated by phplrt phpstan/phpstan-src#6851).
• Literal types are inferred for word date format characters, such as date( 'D' ) and date( 'F' ) (Infer literal types for word date format characters phpstan/phpstan-src#6838).
• The Turbo extension supports PHP 8.2 (Support PHP 8.2 in the Turbo extension phpstan/phpstan-src#6825).
• Type resolution fixes: generic static types inside a class, properties, and class constants (Resolve type arguments of generic static types inside the class, in properties and in class constants phpstan/phpstan-src#6826); the PHPDoc type of an overridable class constant is no longer used as its native type; tentative return types of built-in methods are used as native return types; catch blocks that no throw point reaches and attribute groups of closures and arrow functions are now analyzed (Native types of class constants and tentative return types, walk dead catches and closure attributes phpstan/phpstan-src#6859).
• Robustness fixes: an exception from a bootstrap autoloader no longer aborts the analysis (Do not let a bootstrap autoloader's exception abort the analysis phpstan/phpstan-src#6294), a container another process has not yet journaled is no longer deleted (Do not delete a container that another process has not journaled yet phpstan/phpstan-src#6797), global constant discovery after class name tokens is fixed (Fix global constant discovery after class name tokens phpstan/phpstan-src#6756), and name scopes are no longer reused or cached incorrectly (Do not cache isGeneric() or the class PHPDoc while the class name scope is created phpstan/phpstan-src#6726, Do not reuse name scopes built from the simplified AST for an analysed file phpstan/phpstan-src#6833).
• Updated phpdoc-parser, mainly printer fixes and a faster parse of generics (Update phpdoc-parser phpstan/phpstan-src#6854).
• Performance: the restart ini is kept out of the container key (Keep the restart ini out of the container key phpstan/phpstan-src#6834).

2.3.4:

• TypeCombinator::union() fixes for constant scalars refined by accessory types, which are now compared against and absorbed into the other union members correctly (Compare constant scalars refined by accessory types against other union members in TypeCombinator::union() phpstan/phpstan-src#6863).
• The composed ini is kept when a forked worker ends (Keep the composed ini when a forked worker ends phpstan/phpstan-src#6865).
• Updated phpdoc-parser: name nodes, quoted keys in Doctrine annotation arguments, and printer fixes.
• Rules on CollectedDataNode are listed in --debug output (Print the rules on CollectedDataNode in --debug output phpstan/phpstan-src#6723).
• A bleeding-edge change reuses the errors of CollectedDataNode rules from the result cache. Core does not include bleedingEdge.neon, so it does not apply here.

Follow-up to r64757.

Trac ticket: https://core.trac.wordpress.org/ticket/65817

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Performing the upgrade, regenerating the baselines, and drafting this description.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

🤖 Generated with Claude Code

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs.

Core Committers: Use this line as a base for the props when committing in SVN:

Props westonruter, mukesh27, lancewillett.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

---

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

• @propsbot add <username> to give props to a GitHub user. Requires write access.
• @propsbot remove <username> to leave a user out of the props. Requires write access.
• @propsbot refresh to refresh this list. Adding the props-bot label works too.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[mukeshpanchal27]

🚀

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the PHPStan 2.3.4 dependency update.

No open issues 🎉

What changed in this PR

Updates WordPress’s PHPStan development dependency from 2.3.2 to 2.3.4 to incorporate upstream static-analysis fixes.

Changes:

• Pins phpstan/phpstan to version 2.3.4.
• Leaves the PHPUnit extension unchanged; the PR reports no baseline changes after regeneration.

File	Description
composer.json	Updates the pinned PHPStan version to 2.3.4.

_{Review effort: Balanced}

[lancewillett]

Reviewed the PHPStan 2.3.4 pin. Installed the updated dependencies in an isolated checkout and ran the full configured analysis: no errors. Current CI is green, including static analysis; Copilot reports no active findings. No new tests or baseline changes are needed for this dependency update.

_{AI review · gpt-6}

[westonruter]

I'm waiting a couple days from the release to let any issues shake loose before committing.