Skip to content

chore(deps): update dependency vimeo/psalm to v7 - #5793

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/vimeo-psalm-7.x
Closed

chore(deps): update dependency vimeo/psalm to v7#5793
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/vimeo-psalm-7.x

Conversation

@renovate

@renovate renovate Bot commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
vimeo/psalm ^6.20.0 → ^7.0.0-rc7 age confidence

Release Notes

vimeo/psalm

v7.0.0-rc7

Compare Source

What's Changed

Features
  • Remove the html taint from json_encode() called with JSON_HEX_TAG and JSON_HEX_AMP by @​danog in #​12453

Full Changelog: vimeo/psalm@7.0.0-rc6...7.0.0-rc7

v7.0.0-rc6

Compare Source

What's Changed

Features
Fixes
  • Give the overrides specialized by call the object and the arguments of a virtual call by @​danog in #​12427

Full Changelog: vimeo/psalm@7.0.0-rc5...7.0.0-rc6

v7.0.0-rc5

Compare Source

What's Changed

Features

Full Changelog: vimeo/psalm@7.0.0-rc4...7.0.0-rc5

v7.0.0-rc4

Compare Source

What's Changed

Fixes
Internal changes

Full Changelog: vimeo/psalm@7.0.0-rc3...7.0.0-rc4

v7.0.0-rc3

Compare Source

What's Changed

Features
  • Let @​psalm-flow ($this) -> return carry the taints of the object a method is called on by @​danog in #​12302
  • Add , to make issues impossible to suppress by @​danog in #​12130
  • Report int-mask values compared by value with a set other than the empty or the full one by @​danog in #​12203
  • Add a time capability for reading the clock by @​danog in #​12261
  • Accept taint complements ~(kind|kind): every taint, custom ones included, but the kinds listed by @​danog in #​12300
  • Support @​psalm-flow ($compute()) -> return: what a callable parameter returns flows to the return by @​danog in #​12299
  • Follow values through keyed stores: @​psalm-flow ($value) -> Store::$data[$key] and back to return by @​danog in #​12312
  • Store what callables return in keyed stores: @​psalm-flow ($compute()) -> Store::$data[$key] by @​danog in #​12327
  • Declare custom taints in psalm.xml, optionally added to the input aliases by @​danog in #​12330
  • Report invalid taint and flow annotations, also in stubs, as InvalidDocblock by @​danog in #​12333
  • Report every docblock issue of the stubs the config and plugins add by @​danog in #​12334
  • Add the _ purity to the closure parameters a function-like calls with --alter by @​danog in #​12019
  • Let plugins give the capabilities a call of a method requires by @​danog in #​12329
  • Declare what the methods of the SPL classes do by @​danog in #​12122
  • Charge ArrayObject and ArrayIterator mutators write-props only when their storage is an object by @​danog in #​12190
  • Resolve taints over compact states, so that large graphs fit in memory by @​danog in #​12105
  • Taint analysis: sinks on the values of an array parameter only ($param[*]) by @​danog in #​12171
  • Give decoded user input back the nosql taint the string type took away by @​danog in #​12338
  • Taint analysis: keep the calls of a callee that only reads shared state specialized by @​danog in #​12397
  • Taint analysis: know more array keys (literal unions, array_map(), convergences, key starts of lists) and stop at keys overwritten in specialized calls by @​danog in #​12375
  • Taint analysis: share and split the filters of specialized calls by what their walks observe by @​danog in #​12374
  • Add a PHP 8.6 call map by @​danog in #​12407
  • Add Codebase::getReceiverTaintPath(), the path along which a method of a builtin class returns what its object holds by @​danog in #​12414
Fixes
  • Declare the capabilities of the Random extension's randomizer and engines by @​danog in #​12311
  • Don't taint the overrides of sibling classes through inherited method calls by @​danog in #​12100
  • Infer the bounds, not mixed, for templates of new that a class doesn't pass to its parent by @​danog in #​12125
  • Keep the variables a loop defines, with their types, where the next iteration starts by @​danog in #​12155
  • Resolve global constants holding enum cases when they're fetched by @​danog in #​12173
  • Suggest a class contract that also covers the known subclasses and the purity template bounds by @​danog in #​12186
  • Specialize a specialized function passed as a callable, whose edge hid its return from its calls by @​danog in #​12201
  • Link a specialized override's by-ref params to the overridden method without cutting off its calls by @​danog in #​12202
  • Forget the array offsets a write through a non-literal key may overwrite by @​danog in #​12174
  • Treat builtins that read files, streams and the network as impure by @​danog in #​12214
  • Narrow the subject of a match without a default arm to the values of its arms past it by @​danog in #​12225
  • Take only the column of each row into the values array_column() returns, and the index into its keys by @​danog in #​12226
  • Track taints through global variables, with a node per global shared by $GLOBALS and global by @​danog in #​12243
  • Don't narrow strings to objects with __toString() through instanceof by @​danog in #​12310
  • Let a specialized call read what its other calls leave in a static property by @​danog in #​12254
  • Keep the taints of arrays encoded into strings by json_encode(), serialize(), print_r(), ... in taint analysis by @​danog in #​12257
  • Taint the result of a call on an interface or base class with the returns of its overrides by @​danog in #​12262
  • Drop an optional array key, and its taint, where array_key_exists() or isset() is negated by @​danog in #​12298
  • Keep the shape of arrays unpacking shapes with optional string keys by @​danog in #​12301
  • Charge igbinary_serialize() and igbinary_unserialize() like serialize() and unserialize() by @​danog in #​12306
  • Narrow by @​psalm-assert types that expand to a union, such as key-of<A::B> or a template bound by @​danog in #​12230
  • Treat the objects a closure captures as not fresh, and infer writes to fresh objects as free by @​danog in #​12268
  • Charge the destructors of what an overwritten or unset property, array element or variable held by @​danog in #​12309
  • Forget what mutation-free methods returned when a later call may write their receiver by @​danog in #​12191
  • Fix master CI by @​danog in #​12335
  • Share what keyed stores hold between specialized calls by @​danog in #​12336
  • Specialize the taints of Type::getString() and getAtomicStringFromLiteral() per call by @​danog in #​12337
  • Declare what the phpredis classes do: commands need io, subscribe callbacks are charged by @​danog in #​12308
  • Don't report calling a closure or an invokable object as a tainted callable by @​danog in #​12093
  • Assign under each literal the key of an array assignment can be (master) by @​danog in #​12152
  • Don't report an instanceof && property check on a template param as redundant by @​danog in #​12342
  • Fix master CI after the latest merges by @​danog in #​12347
  • Merge a key check's array node away where the array it checks is merged back in by @​danog in #​12349
  • Assign under each literal the key of an array assignment can be by @​danog in #​12150
  • Tell array keys apart by their start where only that is known statically by @​danog in #​12106
  • Declare that preg_last_error(), preg_last_error_msg() and json_last_error_msg() only read globals by @​danog in #​12351
  • Charge a call on a mixed value as a call that may do anything by @​danog in #​12362
  • Infer literal class-string for Foo::class in constants outside class context by @​rela589n in #​12364
  • Fix the taint resolution hang on Psalm's own code (self-analysis/Shepherd) by @​danog in #​12361
  • Fix master CI after the latest merges (template bounds, self-analysis) by @​danog in #​12350
  • Don't suggest a purity annotation below the lower bound of the purity template a method depends on by @​danog in #​12358
  • Declare what the methods of SplObjectStorage do, so a new storage can be filled for free by @​danog in #​12297
  • Charge calls of methods not known by name what the class contract allows, or impure without one by @​danog in #​12304
  • Charge a method found through @​mixin what the __call() of the class using the mixin does by @​danog in #​12307
  • Parse @​psalm-flow annotations in one place, for the docblock check and for the code applying them by @​danog in #​12369
  • Don't require a class-level purity annotation on interfaces whose methods all have their own by @​danog in #​12303
  • Fix master CI: keyed store read flows, empty @​psalm-taint-escape, test data and the preloader list by @​danog in #​12345
  • Drop the taints a narrowed type can't carry, also where it can carry others by @​danog in #​12348
  • Track taints through the static variables of function-likes across their calls by @​danog in #​12255
  • Declare what the mongodb driver classes do: ids, cursors, servers, the manager and subscribers by @​danog in #​12332
  • Taint analysis: keep the keys of the elements an assignment copies or a foreach loop transforms by @​danog in #​12373
  • Fix master CI: copies of narrowed foreach variables, the marker interface test, a docblock by @​danog in #​12379
  • Cut the memory of the taint resolution on large code bases (20.5 GB → 3.1 GB on Psalm's own code) by @​danog in #​12393
  • Fix master's self-analysis: read php-64bit from composer.json, and type capability sets with time by @​danog in #​12396
  • [6.x] Keep config untouched when --set-baseline runs with --use-baseline by @​alies-dev in #​12385
  • Don't let a later call of an inherited method take the taints out of what earlier calls passed by @​danog in #​12383
  • Purity: capability sets as int-masks, fresh objects, property reads of contracted objects, WeakMap, closures and purity templates through parents by @​danog in #​12380
  • Fix covariance checks of templates, narrowing by || with calls asserting nothing, and redundant instanceof of generic subclasses by @​danog in #​12378
  • Taint analysis: track file-scope variables, globals and ancestor constructors called by name by @​danog in #​12376
  • Don't crash re-analyzing inherited method bodies of files a partial run doesn't analyze by @​danog in #​12384
  • Report sinks on the values of a stubbed method's parameter by @​danog in #​12408
  • Don't crash when destructuring an ArrayAccess object that isn't Traversable by @​danog in #​12409
  • Require fidry/cpu-core-counter 1.2 by @​danog in #​12412
  • Fix conditional return types of stubbed methods also declared in vendor by @​danog in #​12413
  • Don't treat generator functions without a return as void by @​danog in #​12421
  • Parse is not and nullable/intersection if-branches in conditional types by @​danog in #​12415
Internal changes
Other changes

New Contributors

Full Changelog: vimeo/psalm@7.0.0-rc2...7.0.0-rc3

v7.0.0-rc2

Compare Source

What's Changed

Features
Fixes
  • Remove the taints a value's type cannot hold, at returns, sources and assignments by @​danog in #​12079
  • Report the taint flows a plugin connects to a sink from a node without location by @​danog in #​12082
  • [6.x] Resolve parent:: first-class callables of @method pseudo-methods by @​alies-dev in #​12148
  • [6.x] Fix: type aliases depend on declaration order by @​alies-dev in #​12149
  • Narrow an array key loosely equal to a non-numeric string to that string, since PHP 8 by @​danog in #​12153
  • Give array items written by reference the types the call or the foreach leaves in them by @​danog in #​12154
  • Keep the instances of @​psalm-taint-specialize classes from changing, specialize the classes extending them, and calls on them by @​danog in #​12083
  • Check what a method with @​psalm-self-out stores in $this against its self-out type by @​danog in #​12120
  • Charge the class purity templates constructors depend on at new by @​danog in #​12116
  • Convert an object to a string with the taints of what its __toString returns by @​danog in #​12127
  • Don't taint what an array held under a literal key assigned or unset since then by @​danog in #​12128
  • Fix the taint flows of builtins missed or wrong since #​12084 by @​danog in #​12129
  • Forget what is known about superglobals after a call that may write globals by @​danog in #​12175
  • Forget static properties after a method call that may write globals but not properties by @​danog in #​12176
  • Don't taint a variable with what it held before an if/else that assigns it in every branch by @​danog in #​12143
  • Keep whether a value is fresh or global when a @​var docblock replaces its type by @​danog in #​12178
  • Leave a specialized call through all call sites of an exit it reaches through shared state by @​danog in #​12141
  • Take no taint of an array element into a cast or a concatenation of the array by @​danog in #​12163
  • Narrow static properties after an early return when they were not in scope by @​danog in #​12180
  • Track taint through methods called on a new specialized instance by @​danog in #​12170
  • Reset $_SESSION after session_unset() by @​TheNetherWatcher in #​12087
  • Taint flows that reach a visited node with other open array assignments by @​danog in #​12094
  • Infer the type of what array_replace_recursive() returns by @​danog in #​12132
  • Check trait methods against the purity template bindings of the class using the trait by @​danog in #​12126
  • Check @​psalm-self-out types like @​return types, so conditional purity arguments outside their bound are reported by @​danog in #​12189
  • Declare what the SPL autoload functions do, and that class_implements() of a class name may autoload by @​danog in #​12192
  • Fix the TypeError calling a closure held in a variable, and a TaintTest case a merge broke by @​danog in #​12194
  • Remember the results of a pure class's methods like those of an immutable class's by @​danog in #​12193
  • Rename a duplicated TaintTest case, so that both run by @​danog in #​12198
  • Keep the baseline's code samples a list by @​danog in #​12197
  • Fix the self-analysis errors left by the taint merges by @​danog in #​12199
  • Fix Shepherd's taint resolution blowup: widen the flows reaching a node through many call entries by @​danog in #​12195
  • [6.x] Model nullsafe short-circuiting across the whole chain by @​alies-dev in #​12064
  • Write into the array what a foreach by reference's value variable holds in the loop, not before it by @​danog in #​12196
  • Fix a self-analysis error left on master by a baseline mismatch by @​danog in #​12207
  • Write the terminal report to STDOUT instead of echoing it, as it is not HTML output by @​danog in #​12200
  • Fix the self-analysis, unit test and stubs build failures from the 6.x merge by @​danog in #​12208
  • Make printf, vprintf, print_r, var_dump and var_export sinks of the same taint kinds as echo by @​danog in #​12210
  • Treat vfprintf, gzpassthru, highlight_file and printing highlight_string as io, like printf by @​danog in #​12211
  • Make writes to streams opened on php://output or php://stdout html sinks, as they are the response by @​danog in #​12209
  • Make debug_zval_dump a sink of the same taint kinds as echo, like var_dump by @​danog in #​12212
  • Add OutputStreamTaintAnalyzer to the preloader list and test has_quotes output stream sinks alone by @​danog in #​12220
  • Make implode() and join() fetch the values of the array in taint analysis by @​danog in #​12256
  • Keep the items a list surely has out of the items appended to it by @​danog in #​12266
  • Keep the literal items before an unpacked list out of the list's value type by @​danog in #​12267
  • Allow writing the properties of fresh objects in pure functions outside of classes by @​danog in #​12265
  • Charge write-props for writing an array element of a property of a call result by @​danog in #​12264
  • Charge write-props for writing another non-fresh instance of the same class by @​danog in #​12269
  • Remove the nosql taint from scalar, array-key and numeric values by @​danog in #​12274
  • Treat calls on $this of methods returning their receiver as $this in fluent chains by @​danog in #​12263
  • Require read-globals for debug_backtrace(), as the call stack it returns differs per call site by @​danog in #​12260
  • Treat the command-line options getopt() returns as a taint source of user input by @​danog in #​12246
  • Treat $argv, bound with global or read through $GLOBALS too, as a taint source of user input by @​danog in #​12245
  • Don't report what fprintf and vfprintf write to output streams only as numbers, as for printf by @​danog in #​12224
  • Don't report what printf and vprintf print only as numbers, as sprintf's return already isn't by @​danog in #​12213
  • Don't taint what vsprintf returns of values it formats only as numbers, as for sprintf by @​danog in #​12215
  • Don't taint the value a whole tainted array held under a literal key overwritten since then by @​danog in #​12273
  • Track taint through the bodies of trait methods, keyed by the class using the trait by @​danog in #​12272
  • Keep the items after an unpacked array of unknown length out of the known list slots by @​danog in #​12271
Docs
Internal changes
Other changes

New Contributors

Full Changelog: vimeo/psalm@7.0.0-rc1...7.0.0-rc2

v7.0.0-rc1

Compare Source

What's Changed

Features
  • Taint what functions and builtins leave in by-reference parameters by @​danog in #​12095
  • Declare the taint sinks of more builtins, including those declared by stubs by @​danog in #​12081
  • Make taints flow through the builtins that return data from their arguments by @​danog in #​12084
Fixes
  • Don't report the output of print_r() and var_export() when they return it by @​danog in #​12092
  • Report a tainted callable passed to Closure::fromCallable by @​danog in #​12114
  • Apply the @​psalm-flow annotations of constructors to new by @​danog in #​12101
  • Report curl options and CURLFile by what they do: SSRF, header injection, files, sleep and callables by @​danog in #​12099
  • Join what each position a purity template is inferred from requires, instead of keeping the deepest by @​danog in #​12119
  • Taint the array a foreach by reference writes into by @​danog in #​12121
  • Accept any instance where a class with purity templates is used without type arguments by @​danog in #​12118
  • Fetch the items destructured from an array without a shape by their keys by @​danog in #​12107
  • Make the taints of promoted constructor parameters flow into their properties by @​danog in #​12091

Full Changelog: vimeo/psalm@7.0.0-beta24...7.0.0-rc1

v7.0.0-beta24

Compare Source

What's Changed

Fixes
  • Purity and taint fixes: getters, explicit/overridden annotations, defaults, void templates, ext stubs, socket builtins by @​danog in #​12073
  • Fix taint false negatives and positives through nested arrays and with unused-variable tracking by @​danog in #​12072
  • Purity templates: omitted purity arguments, instanceof narrowing, inference of templated calls by @​danog in #​12077
Internal changes
  • Transpile the Hack conformance fixtures into a Psalm test suite by @​danog in #​12049

Full Changelog: vimeo/psalm@7.0.0-beta23...7.0.0-beta24

v7.0.0-beta23

Compare Source

What's Changed

Features
Fixes

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • "before 5am on tuesday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
chore(deps): update dependency vimeo/psalm to v7
05105e7 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot added 3. to review Waiting for reviews dependencies labels Oct 22, 2026
@hamza221 hamza221 closed this Oct 22, 2026
@hamza221
hamza221 deleted the renovate/vimeo-psalm-7.x branch October 22, 2026 14:24
@codecov

codecov Bot commented Oct 22, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@renovate

renovate Bot commented Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 7.x releases. But if you manually upgrade to 7.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hamza221 hamza221 Awaiting requested review from hamza221 hamza221 is a code owner
@GVodyanov GVodyanov Awaiting requested review from GVodyanov GVodyanov is a code owner
@SebastianKrupinski SebastianKrupinski Awaiting requested review from SebastianKrupinski SebastianKrupinski is a code owner

Assignees

@hamza221 hamza221

@GVodyanov GVodyanov

@SebastianKrupinski SebastianKrupinski

Labels

3. to review Waiting for reviews dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@hamza221 @GVodyanov @SebastianKrupinski