Skip to content

chore(deps): bump vimeo/psalm from 6.16.1 to v7 (master) - #1092

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/master-vimeo-psalm-7.x
Open

chore(deps): bump vimeo/psalm from 6.16.1 to v7 (master)#1092
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/master-vimeo-psalm-7.x

Conversation

@renovate

@renovate renovate Bot commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
vimeo/psalm ^6.16.1 → ^7.0.0-beta22 age confidence

Release Notes

vimeo/psalm (vimeo/psalm)

v7.0.0-beta22

Compare Source

What's Changed

Features
Fixes
Internal changes
  • Check out branch-specific baselines for test-with-real-projects by @​danog in #​11957
Other changes

New Contributors

Full Changelog: vimeo/psalm@7.0.0-beta21...7.0.0-beta22

v7.0.0-beta21

Compare Source

What's Changed

Features
Fixes
Internal changes
  • Use upstreamed amphp/parallel ForkContext by @​danog in #​11947
  • Resolve the taint graph to a fixed point with sink-reachability pruning by @​danog in #​11951
  • Key taint argument nodes by declared parameter index (fix named-argument sinks) by @​danog in #​11954
Other changes
  • Derive data-flow node locations & sink taints from storage (deterministic taint findings) by @​danog in #​11952
  • Make DataFlowNode locations deterministic by construction (private constructor) by @​danog in #​11953
  • Hoist specialized_calls serialization out of the per-edge taint-resolution loop by @​danog in #​11956
  • Fix crash on first-class callables in taint analysis by @​Portll in #​11932
  • Fix MissingOverrideAttribute false positive for private trait methods by @​Eljees in #​11926

New Contributors

Full Changelog: vimeo/psalm@7.0.0-beta20...7.0.0-beta21

v7.0.0-beta20

Compare Source

What's Changed

Features
  • Rewrite dead-code detection on a code-use graph and infer purity across the call
    graph.     Unused-code detection now runs on a directed graph of references between code
    elements (Psalm\Internal\Codebase\CodeUseGraph), in the same way as taint analysis:
    a class, method, property or class constant is only considered used if it is reachable
    from an entry point (the public API, top-level code, free functions, or code outside
    the analysed project). Code referenced only by other unused code — including cycles of
    otherwise unreferenced code — is now reported, and dead reads no longer keep
    constructor-only-written properties alive. MissingPureAnnotation (and its --alter
    fix) is inferred as a fixpoint over the call graph, handling call chains in any order,
    mutual recursion, recursive closures and closures assigned to a variable.
    --find-unused-psalm-suppress now also reports redundant @psalm-suppress on
    classes/interfaces/traits/enums and, under --taint-analysis, on Tainted* issues.
    All non-internal classes and interfaces are marked @api. @​danog in #​11939
  • Add type variable support for class templates: class templates that cannot be inferred
    at the construction site are tracked as type variables whose bounds are reconciled once
    the surrounding function has been analysed, legalizing widening within a template's
    declared bounds and introducing the new IncompatibleTypeParameters issue (level 1),
    documented in https://psalm.dev/docs/annotating_code/type_variables
    by @​muglug in #​11875
Fixes
  • Fix echo/print/exit taint sinks not matching their argument nodes (which broke
    all TaintedHtml detection through those constructs), fix taint tracking through
    namespaced functions, and fix a crash on tainted closure/callable invocations, as part
    of refactoring the DataFlowNode factories
    by @​danog in #​11887
  • Fix multithreaded taint-analysis determinism, and report call-map sinks at the call
    site by @​danog in #​11887
  • Keep foreach key/value non-nullable after a breaking loop
    by @​muglug in #​11874
  • Fix $this failing to parse inside generic type parameters
    by @​alies-dev in #​11768
  • Ignore inline covariant/contravariant variance modifiers in generic type
    parameters instead of reporting UndefinedDocblockClass (backport)
    by @​alies-dev in #​11836
  • PHP 8.5 compatibility: TLiteralFloat now renders NAN values as float(NAN) in
    type keys and IDs instead of crashing, plus assorted 8.5 fixes
    by @​danog in 9d6db9e and ca15124
  • Fix CI setup, static analysis, and dependency compatibility
    by @​muglug in #​11934
Docs
  • Document graph-based unused-code detection, purity inference and extended
    --find-unused-psalm-suppress checking in docs/running_psalm/configuration.md,
    docs/annotating_code/supported_annotations.md,
    docs/running_psalm/issues/MissingPureAnnotation.md and
    docs/running_psalm/issues/UnusedPsalmSuppress.md, and update the CLI help
    by @​danog in #​11939
  • Add docs/annotating_code/type_variables.md and the IncompatibleTypeParameters
    issue page by @​muglug in #​11875
Internal changes
  • Refactor the DataFlowNode factories: mandatory $storage, typed callable kinds,
    and explicit locations by @​danog in #​11887
  • Remove dead write-only static properties and simplify ScopeAnalyzer
    break/continue logic by @​muglug in #​11889
  • Clean up redundant assignment-conditions and repeated getArgs() calls
    by @​muglug in #​11888
  • Pin GitHub Actions to SHA for supply chain security
    by @​riccardosarro in #​11863
  • Test-fixture fixes: whitelist Override in the SuicidalAutoloader fixture and drop
    the incorrect impure- Closure prefix in TypeParseTest
    by @​alies-dev in #​11835 and #​11834
Other changes

New Contributors

Full Changelog: vimeo/psalm@7.0.0-beta19...7.0.0-beta20

v7.0.0-beta19

Compare Source

What's Changed

Fixes
  • Final improvements for reduced scanning by @​danog in #​11809
  • Allow enums to have impure methods by @​danog
  • Switch void/never params to use ParadoxicalCondition issue by @​danog

Full Changelog: vimeo/psalm@7.0.0-beta18...7.0.0-beta19

v7.0.0-beta18

Compare Source

What's Changed

Features
Fixes
Docs
Internal changes
Other changes

Full Changelog: vimeo/psalm@7.0.0-beta17...7.0.0-beta18

v7.0.0-beta17

Compare Source

What's Changed

Features
Fixes
Internal changes

New Contributors

Full Changelog: vimeo/psalm@7.0.0-beta16...7.0.0-beta17

v7.0.0-beta16

Compare Source

This release allows using @psalm-pure on classes, which will mark all methods as pure, and ban property declarations.

What's Changed

Features
Fixes

Full Changelog: vimeo/psalm@7.0.0-beta15...7.0.0-beta16

v7.0.0-beta15

Compare Source

This release features a major refactoring of Psalm's mutability inference system.

This release will likely be followed by a stable release.

The new automated mutability (pure, mutation free, externally mutation free, impure) attribute fixes that will be proposed by Psalm, when applied, will improve Psalm's type inference and especially security analysis, as pure functions are automatically specialized by Psalm, killing false positives during security analysis.

Now, Psalm will always analyze and emit MissingPureAnnotation and MissingImmutableAnnotation issues for all functions, methods and classes that can be marked with one of the following attributes (which can be automatically added by running Psalm with --alter --issues=MissingPureAnnotation,MissingImmutableAnnotation).

For functions and methods, MissingPureAnnotation will be emitted, automatically adding the following annotations:

  • @psalm-pure » - Indicates that the function or method is pure, one whose output is just a function of its input (no mutations or even read property accesses allowed).
  • @psalm-mutation-free » - Used to annotate a class method that does not mutate state, either internally or externally of the class's scope (only internal property reads on $this are allowed for methods)
  • @psalm-external-mutation-free » - Used to annotate a class method that does not mutate state externally of the class's scope (internal property reads and writes on $this and self are allowed for methods)
  • @psalm-impure » - A new annotation, equivalent to the default mutability level of functions and methods (all mutations allowed): Psalm will require the explicit annotation of only abstract methods with this or any of the above annotations through a separate, non-autofixable MissingAbstractPureAnnotation issue, to improve mutability inference for implementors of an interface (though it can be used on all functions and methods as well).

For classes, MissingImmutableAnnotation will be emitted, automatically adding the following annotations:

  • @psalm-immutable » - Used to annotate a class where every property is treated by consumers as @psalm-readonly and every instance method is treated as @psalm-mutation-free.
  • @psalm-external-mutation-free » - Used to annotate a class where every instance method is treated as @psalm-external-mutation-free.
  • @psalm-mutable » - A new annotation, used to annotate a class where at least one property is mutable: this is the default behavior, but it can be explicitly marked for clarity: Psalm will require the explicit annotation of only interfaces with this or any of the above annotations through a separate, non-autofixable MissingInterfaceImmutableAnnotation issue, to improve mutability inference for implementors of an interface (though it can be used on all classes and interfaces as well).

New types

For situations where the callable or Closure needs to be pure, mutation-free or externally mutation-free, the following subtypes are available:

  • Pure (no mutations or even read property accesses allowed), equivalent to marking functions or methods with @psalm-pure
    • pure-callable
    • pure-Closure
  • Mutation-free (only internal property reads on $this are allowed for methods), equivalent to marking functions or methods with @psalm-mutation-free
    • self-accessing-callable
    • self-accessing-Closure
  • Externally mutation-free (internal property reads and writes on $this and self are allowed for methods), equivalent to marking functions or methods with @psalm-external-mutation-free
    • self-mutating-callable
    • self-mutating-Closure
  • Impure (the default behavior, all mutations allowed); functions or methods can also be explicitly marked as impure with @psalm-impure
    • impure-callable (an alias to callable)
    • impure-Closure (an alias to Closure)

This can be useful when the callable is used in a function marked with @psalm-pure or @psalm-mutation-free or @psalm-external-mutation-free.

What's Changed

Features
  • Mutation refactoring, always emit MissingPureAnnotation and MissingImmutableAnnotation issues by @​danog in #​11630
  • Global variables are impure like static variables by @​kkmuffme in #​11659
Fixes

Full Changelog: vimeo/psalm@6.15.1...7.0.0-beta15

v7.0.0-beta14

Compare Source

What's Changed

Features
Fixes
Docs
Other changes

Full Changelog: vimeo/psalm@6.14.3...7.0.0-beta14

v7.0.0-beta13

Compare Source

What's Changed

Features

Full Changelog: vimeo/psalm@7.0.0-beta12...7.0.0-beta13

v7.0.0-beta12

Compare Source

What's Changed

Features
Fixes
Internal changes
  • Improve performance by avoiding repeated scanning of files included/required only once by @​mmcev106 in #​11478
Other changes

New Contributors

Full Changelog: vimeo/psalm@7.0.0-beta11...7.0.0-beta12

v7.0.0-beta11

Compare Source

What's Changed

Features
  • ✨ Full support for iterables for iterator_to_array by @​andrew-demb in #​11430
  • Add an arrayCache configuration key that can be used to disable the newly introduced array cache: this will slightly slow down execution times while reducing RAM usage, avoiding OOM issues on bigger codebases by @​danog

Full Changelog: vimeo/psalm@7.0.0-beta10...7.0.0-beta11

v7.0.0-beta10

Compare Source

What's Changed

Fixes

Full Changelog: vimeo/psalm@7.0.0-beta9...7.0.0-beta10

v7.0.0-beta9

Compare Source

Fixes:

  • Normalize order of taint flow graph issues

Full Changelog: vimeo/psalm@7.0.0-beta8...7.0.0-beta9

v7.0.0-beta8

Compare Source

This release syncs up the 7.x branch with the 6.x branch.

What's Changed

Features
Fixes
Docs
Other changes

New Contributors

Full Changelog: vimeo/psalm@7.0.0-beta7...7.0.0-beta8

v7.0.0-beta7

Compare Source

What's Changed

Fixes
Other changes

New Contributors

Full Changelog: vimeo/psalm@7.0.0-beta6...7.0.0-beta7

v7.0.0-beta6

Compare Source

What's Changed

Features
  • Enable taint analysis by default.
Fixes
Other changes

Full Changelog: vimeo/psalm@7.0.0-beta5...7.0.0-beta6

v7.0.0-beta5: Combined analysis!

Compare Source

This beta release adds a major new feature to Psalm v7: combined analysis!

Combined analysis allows running normal analysis, security analysis and dead code analysis all at the same time, within a single run, greatly reducing overall runtimes!

Future beta releases will also enable taint analysis by default, given that now it can be run alongside normal analysis.

What's Changed

Features

Full Changelog: vimeo/psalm@7.0.0-beta4...7.0.0-beta5

v7.0.0-beta4

Compare Source

Join the new official Psalm news channel and the Psalm community!

The news channel will be used to share inside exclusive news about upcoming Psalm features (including property hook support, coming within the next few releases!), and the community group can be used to discuss and share the way you use Psalm!

What's Changed

Features

Full Changelog: vimeo/psalm@7.0.0-beta3...7.0.0-beta4

v7.0.0-beta3

Compare Source

Add git and composer to the docker image by @​danog.

Full Changelog: vimeo/psalm@7.0.0-beta2...7.0.0-beta3

v7.0.0-beta2

Compare Source

What's Changed

Features
Fixes
Internal changes

Full Changelog: vimeo/psalm@7.0.0-beta1...7.0.0-beta2

v7.0.0-beta1: First Psalm v7 beta!

Compare Source

Announcing the first public beta of Psalm v7!

Psalm v7 brings huge performance improvements to security analysis, up to 10x thanks to a full refactoring of both the internal representation of taints, and optimization of the graph resolution logic.

It also brings performance improvements to dead code analysis, and fixes for list types.

Even more performance improvements and new features will be released soon!

What's Changed

Breaking changes

See here for the full list of breaking changes between v6 and v7.

Features
Fixes
Other changes

Full Changelog: vimeo/psalm@6.9.0...7.0.0-beta1

v6.18.0

Compare Source

What's Changed

Features
Fixes
Internal changes
  • Check out branch-specific baselines for test-with-real-projects by @​danog in #​11957
Other changes

New Contributors

Full Changelog: vimeo/psalm@6.17.2...6.18.0

v6.17.2

Compare Source

What's Changed

Fixes
Other changes

New Contributors

Full Changelog: vimeo/psalm@6.17.1...6.17.2

v6.17.1

Compare Source

What's Changed

Fixes

Full Changelog: vimeo/psalm@6.17.0...6.17.1

v6.17.0

Compare Source

What's Changed

Features
  • Support better template inference with type variables: class templates that cannot be inferred at the construction site are now tracked as type variables whose bounds are reconciled once the surrounding function has been analyzed. This legalizes widening within a template's declared bounds (e.g. new Box(1) followed by $box->set('two') under @template T of int|string) and introduces the new IncompatibleTypeParameters issue (level 1), documented in https://psalm.dev/docs/annotating_code/type_variables/ by @​muglug in #​11875
Fixes
  • [6.x] Fix InterfaceAnalyzer crash when storage is overwritten by reflection by @​alies-dev in #​11760
  • [6.x] Fix $this failing to parse inside generic type parameters by @​alies-dev in #​11768
  • [6.x] Use macOS bundle ID for PhpStorm (support JetBrains Tool installed apps), respect PHPSTORM env var on Darwin by @​alies-dev in #​11801
  • [6.x] Ignore inline covariant/contravariant keywords in generic type parameters instead of reporting UndefinedDocblockClass (backport) by @​alies-dev in #​11836
  • Keep foreach key/value non-nullable after a breaking loop by @​muglug in #​11874
  • PHP 8.5 compatibility: TLiteralFloat now renders NAN values as float(NAN) in type keys and IDs instead of crashing by @​danog in 9d6db9e and ca15124
Docs
  • Add docs/annotating_code/type_variables.md and the IncompatibleTypeParameters issue page by @​muglug in #​11875
Internal changes
  • [6.x] fix tests: drop incorrect impure- Closure prefix in TypeParseTest by @​alies-dev in #​11834
  • [6.x] fix tests: whitelist Override in SuicidalAutoloader fixture by @​alies-dev in #​11835
  • fix: pin GitHub Actions to SHA for supply chain security by @​riccardosarro in #​11863
  • Clean up redundant assignment-conditions and repeated getArgs() calls by @​muglug in #​11888
  • Remove dead write-only static properties and simplify ScopeAnalyzer break/continue logic by @​muglug in #​11889
  • Fix test-with-real-projects.sh on macOS (use gsed when available, tolerate a missing phar) by @​danog in 9d6db9e
  • Fix macOS CI: bump setup-php to v2.37.2 so PHP 8.5 installs on macos-15 by @​danog in a2892df
  • Fix Mockery 1.6.15 compatibility in plugin tests by @​danog in 7b50a17
  • Drop voidParamType test: nikic/php-parser 5.8 rejects void params at parse time by @​danog in 056992a
Other changes

New Contributors

Full Changelog: vimeo/psalm@6.16.1...6.17.0

Configuration

📅 Schedule: (in timezone Europe/Vienna)

  • Branch creation
    • "before 5am on wednesday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added 3. to review dependencies Pull requests that update a dependency file labels Jul 6, 2026
@renovate
renovate Bot force-pushed the renovate/master-vimeo-psalm-7.x branch from 0c10546 to 9de0b05 Compare July 7, 2026 01:03
@renovate renovate Bot changed the title chore(deps): bump vimeo/psalm from 6.13.1 to v7 (master) chore(deps): bump vimeo/psalm from 6.16.1 to v7 (master) Jul 7, 2026
@renovate
renovate Bot force-pushed the renovate/master-vimeo-psalm-7.x branch from 9de0b05 to 8230822 Compare July 12, 2026 15:29
@renovate
renovate Bot force-pushed the renovate/master-vimeo-psalm-7.x branch from 8230822 to 64d10f0 Compare July 21, 2026 03:42
@renovate
renovate Bot force-pushed the renovate/master-vimeo-psalm-7.x branch 2 times, most recently from 85f96b3 to 762f37f Compare August 7, 2026 15:30
@renovate
renovate Bot force-pushed the renovate/master-vimeo-psalm-7.x branch from 762f37f to 6be59d2 Compare August 12, 2026 03:01
@renovate
renovate Bot force-pushed the renovate/master-vimeo-psalm-7.x branch from 6be59d2 to 4116349 Compare August 26, 2026 10:54
@renovate
renovate Bot force-pushed the renovate/master-vimeo-psalm-7.x branch 2 times, most recently from a086841 to 491c69c Compare September 14, 2026 13:04
@renovate
renovate Bot force-pushed the renovate/master-vimeo-psalm-7.x branch 2 times, most recently from 2e217b4 to 5c0b681 Compare September 16, 2026 18:07
@renovate
chore(deps): bump vimeo/psalm from 6.16.1 to v7
ca08382 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate
renovate Bot force-pushed the renovate/master-vimeo-psalm-7.x branch from 5c0b681 to ca08382 Compare September 21, 2026 19:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

3. to review dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants