[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Updates the requirements on vimeo/psalm to permit the latest version.
Updates vimeo/psalm to 7.0.0

Release notes

Sourced from vimeo/psalm's releases.

Psalm 7

Announcing the release of Psalm 7!

Featuring a simply enormous number of new features and bug fixes, such as:

• security analysis on by default: fully refactored for 10x+ performance and much greater coverage, in the same run as type checking and dead code detection;
• much deeper security analysis taint tracking: NoSQL, LLM prompt and URL injection, new sources like php://input and uploaded file names, flows through closures, generators, traits and by-reference parameters, and ready-made stubs for Guzzle, PSR-7, Monolog, MongoDB and more.
• a new purity model based on Hack's capabilities: declare exactly which side effects a function may have (io, time, write-props...), with purity templates for classes, closures and automatically inferred annotations;
• graph-based dead code detection: If nothing reachable uses a class, function, method, constant, variable, etc, Psalm finds it, now properly handling unused cycles as well.
• Template defaults (@template TError of Throwable = RuntimeException) for classes, functions and methods: Result<int> just works, and libraries can add templates without breaking their users.
• PHP 8.5 and 8.6 support: Full support for Partial Function Application, the pipe operator, and much more!
• Daily releases. Features and fixes reach you the day they land, no more waiting on dev-master.
• Framework plugins in the box. The PHPUnit, Symfony, Laravel, Mockery and sabre/event plugins ship with Psalm and switch on by themselves. Zero setup.
• a bigger Psalm maintainer team: @​alies-dev has joined the Psalm maintainer team, contributing many new useful features and bugfixes!
• An official Discord community!
• And so, so many other new features and bugfixes!

Psalm 7 runs on 64-bit PHP 8.2 to 8.6. Upgrading is simple for most projects: see Upgrading below.

Security analysis: faster, always on, in a single run

Taints are now stored as a bitmask, and the taint graph is resolved over compact summaries of each function. This makes security analysis up to 10x faster.

Combined analysis (#11384) runs type checking, security analysis and dead code detection together in one run, so taint analysis is now on by default (#11399).

Taint issues are reported with a SECURITY severity, and with a rank in SARIF reports (#12068, #11383). The results no longer change between runs or with the thread count (#11946, #11952, #11953).

Deeper taint tracking

<?php
$run = function (string $c): void {
    shell_exec($c);
};
$run((string) $_GET['cmd']); // TaintedShell, through the closure
$mongo = new MongoDB\Driver\Manager('mongodb://localhost');
$mongo->executeQuery('db.users', new MongoDB\Driver\Query(['name' => $_GET['name']])); // TaintedNosql
/** @​return mixed */
function body() {
return json_decode((string) file_get_contents('php://input'), true);
}
eval((string) body()); // TaintedEval: php://input is a source

Try it on psalm.dev »

• New taint kinds: TaintedNosql (MongoDB sinks), TaintedLlmPrompt (prompt injection), and TaintedUrlComponent / TaintedUrlPath (query and path injection). curl options and CURLFile are reported by what they do: SSRF, header injection, file access, sleep or callables. Every taint type is now documented (#11944, #11746, #12097, #12099, #12468).

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c2bb4166-56a5-4991-b2b8-c34e7315abef

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn