Update dependency vimeo/psalm to v7 by renovate[bot] · Pull Request #1171 · thephpleague/commonmark

renovate · 2026-11-02T20:28:20Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
vimeo/psalm	`^4.24.0 \|\| ^5.0.0 \|\| ^6.0.0` → `^4.24.0 \|\| ^5.0.0 \|\| ^6.0.0 \|\| ^7.0.0`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

vimeo/psalm

`v7.3.0`

Compare Source

What's Changed

Features

⭐️ Let plugins declare the issues Psalter can fix by @alies-dev in #13515

Fixes

[7.x] Keep statements of inlined constructor callees: ~15% less wall time and CPU on Laravel (arrayCache=false) by @jarstelfox in #13495
Fix: crash when a class is named only in a template's bound by @alies-dev in #13503
✨ Fix param-conditional return taking both branches for $this/static param types by @alies-dev in #13494
Fix: crash of multi-threaded runs without posix by @alies-dev in #13517
Fix: NoInterfaceProperties on a hooked interface property of an intersection type by @alies-dev in #13452
Fix: whitespace around | in docblock types drops union members or invalidates @method by @alies-dev in #13457
Fix Psalter ignoring the type of static property fetches by @alies-dev in #13529
Fix: hooked interface properties on intersections with a generic interface or a class by @alies-dev in #13530
Fix crash when scope summaries contain non-UTF-8 strings by @MohannadElemary in #13518
Fix: class property checks lost on intersections with a hooked interface by @alies-dev in #13532
Fix: Psalter rewrites self/static/parent in static property references when renaming a class by @alies-dev in #13533

Internal changes

Perf: Avoid quadratic copying when closing dependent classlikes in Populator (~2.5% faster on a big app) by @alies-dev in #13508
chore(baseline): drop the ImplicitToStringCast entry that #11798 made unused by @jirkace in #13507
Fix PHPUnit plugin diagnostics in self-analysis by @orklah in #13524
Perf: Skip building code use edges that are not recorded when consolidating analysed data (~2% faster on a big app) by @alies-dev in #13509

Other changes

Fix method name casing in MissingOverrideAttribute check by @maximal in #11798
Fix CI Windows path by @orklah in #13525

Full Changelog: vimeo/psalm@7.2.1...7.3.0

`v7.2.1`

Compare Source

What's Changed

Fixes

fix(traits): a visibility a trait gives to the methods it uses from another trait reaches its class #6025 by @jirkace in #13276
fix(new-static): do not report UnsafeInstantiation for a class implementing an interface with a constructor #6481 by @jirkace in #13265
fix(operands): don't report ** of different numeric types in strict operands mode by @jirkace in #12638
fix(statements): analyse an interface or an enum declared in another statement by @jirkace in #13129
fix(assertions): inherit assert-if-true/false from an overridden method and resolve static to the called class #6164 by @jirkace in #13283
fix(traits): ignore type arguments of require-extends and require-implements by @jirkace in #12955
fix(arrays): keep a list a list when a nested item of it is written through its own key by @jirkace in #12647
fix(assertions): bool variable identity with true/false keeps its assignment clauses by @jirkace in #12772
feat(property_exists): type property_exists() of a declared property as true so redundant checks are reported #10436 by @jirkace in #13284
fix(analysis): check property initialisation at every constructor return by @jirkace in #13085
Do not report a non-empty-array assertion on a possibly empty array as redundant by @jirkace in #13310
Do not report a paradox between the conditions of one match arm by @jirkace in #13311
Do not treat the value of a CLI option as a path to check by @jirkace in #13321
Do not require every key of a literal union after array_key_exists by @jirkace in #13317
Use the class of an intersection that declares the property by @jirkace in #13320
Narrow after a negated instanceof static by @jirkace in #13312
fix(reconciler): a variable holding one literal key is that key for empty() by @jirkace in #13366
fix(closure): capturing an undefined variable by reference is not an undefined variable by @jirkace in #13363
feat(stubs): add the constants of the curl, ldap and openssl extensions by @jirkace in #13349
fix(loop): link the data flow of the last loop pass to the reads of the first by @jirkace in #13343
Infer a template from a class-string bounded template input by @jirkace in #13331
Fix InternalClass and InternalProperty not reported outside classes by @roxblnfk in #13137
[7.x] Cut ~280 MB per forked worker's taint graph by unserializing paths without a property table by @jarstelfox in #13080
fix(enums): value-of<> of a constant of an enum resolves the constant by @jirkace in #13300
Cast the index column of array_column to array keys by @jirkace in #13313
fix(algebra): a condition is paradoxical when all the clauses of its negation are implied by @jirkace in #13358
fix(traits): follow a method of a nested trait when checking what a constructor sets by @jirkace in #12673
fix(inheritance): check omitted optional parameters of interfaces, accept variadic parameters by @jirkace in #13095
Fix --init error level for paths containing vendor or stub by @MohannadElemary in #13338
Falsy nullsafe call result no longer makes its receiver null (#6237, #6717) by @jirkace in #12739
Honour the visibility of a trait alias when following constructor calls by @jirkace in #13319
fix(cli): don't print git's stderr when collecting source control info by @jirkace in #13417
fix(assignment): nested write to an existing list offset keeps the list by @jirkace in #13408
fix(call): @param-out template is not widened by the argument's own type by @jirkace in #13426
fix(templates): resolve the own templates of an implemented template argument at the call by @jirkace in #13400
fix(templates): get_class($x) binds a class-string template to the class of $x by @jirkace in #13378
fix(magic-get): call __get with the property name as written, not as a string literal by @jirkace in #13397
fix(cast): string cast of an intersection uses the narrowest __toString by @jirkace in #13421
fix(language-server): the quick fix for an issue inserts the suppression instead of rewriting the line by @jirkace in #13383
fix(loops): break N tells the outer loop it targets about the break by @jirkace in #13376
fix(config): an issue named twice in the issueHandlers keeps what both elements say by @jirkace in #13404
fix(docblock): trailing semicolon after a parameter name by @jirkace in #13410
[7.x] Cut forked taint runs ~40% (700 s to 413 s) by serializing taint nodes with an index into a list of locations by @jarstelfox in #13074
fix(ternary): keep variables assigned in every branch of a nested ternary or match by @jirkace in #13395
fix(docblock): a TypeParseTreeException in a @mixin / @psalm-require-* type is an issue, not a crash by @GBra-4-669 in #13158
fix(array-fetch): a missing literal key in isset/?? no longer makes the fetch mixed by @jirkace in #13427
Forget the issues of the old body of a method whose body got shorter by @jirkace in #13476
fix(templates): resolve the other templates a constraint names when new leaves a template unbound by @jirkace in #13090
fix(static-props): static::$x is not the same variable as self::$x by @jirkace in #13364
fix(assertions): say "empty array" when an array is compared with [] by @jirkace in #12652

Docs

docs: correct resolveFromConfigFile default and cacheDirectory note by @ZainnQureshii in #13481

Internal changes

Fix CI after interaction between two PR by @orklah in #13490
fix CI after regression by @orklah in #13492

Other changes

fix(templates): equality bounds that are type variables of the same type are one type by @jirkace in #13403
fix(plugins): FunctionCasingChecker and trait aliases by @jirkace in #13416

New Contributors

@ZainnQureshii made their first contribution in #13481
@MohannadElemary made their first contribution in #13338
@GBra-4-669 made their first contribution in #13158

Full Changelog: vimeo/psalm@7.2.0...7.2.1

`v7.2.0`

Compare Source

What's Changed

Features

Report HiddenGeneratorReturn for a value a generator returns through a type without Generator by @alies-dev & @azjezz in #13485

Fixes

fix(docblock): check the classes of @global types by @jirkace in #13170
Fix: static bound to a receiver is bound again on every call inside a template argument (also fixes OOM) by @alies-dev in #13442
Fix: show the auto-fix suggestion footer when taint analysis runs by @alies-dev in #13450
fix(types): combining object shapes keeps the properties of both by @jirkace in #13444
fix(stubs): the inner iterator template of the SPL iterator wrappers has a default by @jirkace in #13443
fix(types): a narrower native return type wins over an inherited docblock with a __toString coercion by @jirkace in #12959
Give MethodParamsProviderEvent the location of the call by @jirkace in #13325
fix(scanner): suppress MissingClassConstType on the class by @jirkace in #12932
Accept non-ASCII variable names in @param, @param-out, @global and @property by @jirkace in #12700
fix(callmap): mysqli get_warnings may return false by @jirkace in #12826
fix(alter): keep the data flow of a read fixed as possibly undefined by @jirkace in #13386
Infer a literal string for trim() of a literal string by @jirkace in #12602
Keep $this as it was after following a method called in a constructor by @jirkace in #13332
fix(by-ref): accept a constant or call result for a parameter only the stub takes by reference #7505 by @jirkace in #13263
fix(stubs): type array_find, array_find_key, array_first and array_last by @jirkace in #12642
Treat a while loop whose condition holds for the literal start as always entered by @jirkace in #12622
fix(throws): report uncaught exceptions thrown inside foreach, for and while loops by @jirkace in #13229
fix(loop): the value of a foreach iteration is not the one the last iteration ended with by @jirkace in #13437
Don't crash psalter on properties declared together by @jirkace in #12599
Honour an inline @psalm-suppress UnusedVariable by @jirkace in #12611
Don't report a nullable array key from an ignored nullable return by @jirkace in #12605
Keep a concatenation with mixed no emptier than its other operand by @jirkace in #12591
Accept in by @jirkace in #12600
Apply a conditional @psalm-taint-escape to calls of instance methods by @jirkace in #12621
Accept interfaces in universalObjectCrates and cover their implementations by @jirkace in #12612
fix(ternary): narrow by the branch that finishes when the other one throws or exits by @jirkace in #12639
fix(properties): report docblock type issues of a typed property at the docblock by @jirkace in #12636
Scan the classes of the global variables of the config by @jirkace in #12631
Give the closure of a method of a generic object the templates of the object by @jirkace in #12624
fix(int-range): don't overflow the bound for a comparison with PHP_INT_MAX or PHP_INT_MIN by @jirkace in #12644
fix(property-fetch): read a shape property of an interface intersected with an object shape by @jirkace in #12666
fix(property-assign): assign a private property of the current class on an object of a child class by @jirkace in #12669
fix(callmap): accept any type as the argument of assert() by @jirkace in #12664
fix(param-default): report a new-expression default that cannot satisfy an interface type by @jirkace in #12661
fix(reconciler): don't take the id of static::class or self::class for a literal array key by @jirkace in #12650
Report str_replace() with fewer replacements than searches by @jirkace in #12604
fix(static-calls): self::, static:: and parent:: return the static type of the calling class by @jirkace in #12643
feat(assertions): add @psalm-assert array-key-exists $array[$key] by @jirkace in #12634
fix(conditions): the right operand of && keeps what the left one guards by @jirkace in #12657
fix(try): a finally also sees what a try nested in the body throws or returns by @jirkace in #12675
Fix: empty array takes both branches of a conditional with a union subject containing non-empty-array by @alies-dev in #12447
Fix: empty and falsy conditional conditions resolve to the else branch by @alies-dev in #12448
fix(assertions): keep every alternative of a union in @psalm-assert-if-true/false by @jirkace in #12635
Don't report a generator that never finishes as returning never by @jirkace in #12698
fix(callmap): choose an overload by the parameter a named argument names by @jirkace in #12683
Keep what a continue assigns to loop-defined variables in the do-while condition by @jirkace in #12699
Keep analyzing after an undefined or possibly undefined variable in a closure use list by @jirkace in #12704
Include the properties of the traits a class uses in properties-of by @jirkace in #12711
Give a variable assigned in finally the type it has after the finally block by @jirkace in #12733
Concatenate literals with small int ranges as literals (#10947) by @jirkace in #12740
Evaluate the conditional type of a parameter in the body of the function by @jirkace in #12736
Keep a boolean variable's narrowing after an || with it as left operand (#12395) by @jirkace in #12751
Report comparisons guaranteed by an int range bound as redundant (#8059) by @jirkace in #12741
Keep an instantiable class among its @psalm-inheritors when narrowing a negated instanceof by @jirkace in #12713
Read the flags of html functions by name for taint analysis (#12250) by @jirkace in #12759
interface-string and enum-string only accept literals of interfaces and enums (#12577) by @jirkace in #12754
fix(include): normalize the path of a file_exists guard by @jirkace in #12778
fix(taint): keep pseudo-property taint when read through an object shape by @jirkace in #12793
fix(traits): honour insteadof and trait-qualified aliases by @jirkace in #12775
fix(attributes): analyse the attributes of class constants by @jirkace in #12789
feat(sarif): add a security-severity score to the rules of taint issues by @jirkace in #12809
fix(properties): a property typed with an imported alias is invariant with the parent's by @jirkace in #12827
fix(unused-code): keep the method of a callable array passed as array|callable by @jirkace in #12848
fix(callables): a callable array of an intersection finds the method in any of its types by @jirkace in #12831
Report a negated method_exists() of a class with the method as impossible by @jirkace in #12730
Remove the excluded classes from the bound of a template param after a negated instanceof by @jirkace in #12718
fix(types): reconcile type variables of namespaced file-scope code by @jirkace in #12858
fix(args): named argument named like the variadic parameter is not a duplicate by @jirkace in #12866
feat(constants): resolve << and >> in constant expressions by @jirkace in #12878
fix(operators): allow arithmetic on BcMath\Number by @jirkace in #12870
fix(types): no redundant property initialization check in constructor by @jirkace in #12859
fix(types): (array) on a Closure is a one-element list by @jirkace in #12881
fix(array-access): name the array in messages when the expression has no variable id by @jirkace in #12887
fix(docblock): a @method named like a type keyword is a method by @jirkace in #12895
fix(switch): keep analysing a switch after a paradoxical default by @jirkace in #12879
fix(cli): --version does not need the autoloaders of the project by @jirkace in #12917
fix(call): a method of an intersected type is not routed through __call of another by @jirkace in #12970
fix(stubs): class_parents, class_implements and class_uses never return false for an object by @jirkace in #12905
fix(loop): a variable unset in a loop body is possibly undefined in the next iteration by @jirkace in #12960
fix(switch): variables assigned by every case count as assigned in the enclosing scope by @jirkace in #12933
fix(templates): resolve inherited method docblock types through subclass templates by @jirkace in #12951
fix(enum): resolve value-of argument of Enum::from and tryFrom by @jirkace in #12943
fix(messages): name a missing return type mixed in the signature mismatch by @jirkace in #12820
parent::/self::/static:: calls of a method returning $this return $this (#12275) by @jirkace in #12753
fix(assertions): keep every member of a union in assert-if-true and assert-if-false by @jirkace in #12836
fix(array_filter): narrow the result of a call with a string callable by @jirkace in #12991
fix(static-call): a static call of a method no class defines keeps its return type while properties are collected by @jirkace in #13081
fix(unused): magic methods keep their required params and __callStatic is used by magic static calls by @jirkace in #13007
fix(analysis): drop known elements of a variable redeclared by @var by @jirkace in #13088
feat(generators): report an implicit return of a generator whose return type isn't nullable by @jirkace in #13102
fix(echo): cast an object operand to string whatever the analysis mode by @jirkace in #13104
fix(types): resolve static of parent:: calls to the calling class by @jirkace in #12845
fix(foreach): assign the key after the value like PHP by @jirkace in #12792
A static call of an inaccessible method goes to __callStatic (#11876) by @jirkace in #12767
fix(templates): a template replaced by an intersection keeps the intersection by @jirkace in #12976
fix(foreach): type the key and the value of a class-string-map by @jirkace in #12818
Check the native type of a parameter or property whose docblock type is mixed or a template by @jirkace in #12703
Combine enum ->value/->name types across the receiver's parts (#11171) by @jirkace in #12744
fix(reconciler): narrow iterable with a class through Traversable by @jirkace in #12773
fix(unused): analyse the arguments of a call to an unknown function or class by @jirkace in #12802
fix(docblock): check only the last docblock type of a property or constant by @jirkace in #13117
fix(cli): only a SARIF report keeps a taint analysis in GitHub Actions from failing by @jirkace in #13233
fix(types): keep the type of a declared key when combining unsealed arrays by @jirkace in #13175
foreach over a nullable or falsable value may not run (#12513) by @jirkace in #12746
fix(try): a variable assigned in a do-while that runs once is assigned after the try by @jirkace in #13205
fix(args): report unpacking a union of an array and a non-iterable type by @jirkace in #13127
fix(constructors): a class marked @psalm-consistent-constructor keeps the constructor it inherits by @jirkace in #13084
fix(properties): keep the initializing class of a property assigned a template-replaced type #10097 by @jirkace in #13260
fix(stubs): iterating a Ds map, set, vector or deque is mutation-free #12433 by @jirkace in #13272
fix(static): resolve static in the parameters of a static method called by class name to that class #5535 by @jirkace in #13261
fix(array-functions): array_udiff() and the other callback-comparing diff functions return the first array's entries #10062 by @jirkace in #13270
fix(destructuring): report MixedAssignment for a mixed value destructured by key #4345 by @jirkace in #13274
fix(assertions): keep the existing array type where a negated array assertion holds #13166 by @jirkace in #13269
A type alias that uses the template of its class is an InvalidDocblock, in or out of a namespace by @jirkace in #12734
A literal naming a function is a string for a Closure|string param (#12585) by @jirkace in #12755
fix(traits): do not inherit a private property imported from a trait into subclasses #5062 by @jirkace in #13264
fix(scanner): resolving a class_exists guard must not run the autoloader by @jirkace in #12807
fix(reconciler): negate the nested assertions of an assigning condition by @jirkace in #13124
Fix: namespaced printing drops class-string type arguments and the interface-string kind by @alies-dev in #13479
Fix: crash on first-class callables in count()/gettype()/get_class() conditions by @alies-dev & @azjezz in #13484
Infer 'Array' for array-to-string casts by @alies-dev & @azjezz in #13486

Docs

docs: link memoizeMethodCallResults to memoization by @alies-dev in #13456

Internal changes

Add Tempest to the perf corpus and bump corpus projects by @alies-dev in #13459
Stop bundling psalm/plugin-sabre-event and allow psalm/plugin-phpunit 1.0 by @alies-dev in #13478
Allow psalm/plugin-phpunit 0.22 by @alies-dev in #13480
Refactor to prevent ComplexMethod by @orklah in #13482

Full Changelog: vimeo/psalm@7.1.0...7.2.0

`v7.1.0`

Compare Source

What's Changed

Features

fix(parser): allow a trailing comma in array and list shapes by @jirkace in #13228

Fixes

✨ [#11509] Fix regression about iterables, list and conditional types by @andrew-demb in #11558
test(psalter): pin a constructor inherited from another file with MissingThrowsDocblock by @jirkace in #13346
feat(stubs): substr of a non-empty-string from its start is non-empty by @jirkace in #12921
fix(properties): the self of a trait property signature is the using class by @jirkace in #12919
fix(isset): a variable not set by the isset branch stays possibly undefined after the if by @jirkace in #13046
fix(unused): a call on the left of ?? is used by the coalesce by @jirkace in #13231
fix(call): give the callback of usort() and its siblings the element type of the array by @jirkace in #13347
fix(call): keep the narrowed type of an unchanged argument in strict_types by @jirkace in #13341
fix(parser): accept a name after the = or ... of a callable param by [@jirkace](https://redirect.git

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

colinodell · 2026-11-08T15:14:18Z

@copilot are we running v7 in CI?

Copilot · 2026-11-08T15:15:12Z

@copilot are we running v7 in CI?

No. The Psalm CI job runs on PHP 7.4, and its composer update cannot select Psalm 7 because Psalm 7 requires PHP 8.2.27 or newer; it will resolve to a compatible Psalm 6 release. We’d need a PHP 8.2+ Psalm job to exercise v7.

Update dependency vimeo/psalm to v7

d82f6a7

Copilot started work on behalf of colinodell November 8, 2026 15:14

View session

Copilot finished work on behalf of colinodell November 8, 2026 15:15

Copilot AI requested a review from colinodell November 8, 2026 15:15

Navigation Menu

Repository navigation

Update dependency vimeo/psalm to v7 - #1171

Update dependency vimeo/psalm to v7#1171
renovate[bot] wants to merge 1 commit into
2.10from
renovate/vimeo-psalm-7.x

renovate Bot commented Nov 2, 2026 •

edited

Loading

Uh oh!

colinodell commented Nov 8, 2026

Uh oh!

Copilot AI commented Nov 8, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

renovate Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v7.3.0

What's Changed

Features

Fixes

Internal changes

Other changes

v7.2.1

What's Changed

Fixes

Docs

Internal changes

Other changes

New Contributors

v7.2.0

What's Changed

Features

Fixes

Docs

Internal changes

v7.1.0

What's Changed

Features

Fixes

Configuration

Uh oh!

colinodell commented Nov 8, 2026

Uh oh!

Copilot AI commented Nov 8, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

renovate Bot commented Nov 2, 2026 •

edited

Loading

`v7.3.0`

`v7.2.1`

`v7.2.0`

`v7.1.0`