From 85566e30324c49e84c4ca3d7fd82852d4d95a700 Mon Sep 17 00:00:00 2001 From: Punyapal Shah Date: Tue, 6 Oct 2026 21:12:54 +0530 Subject: [PATCH] fix: declare nikic/php-parser and make the CI matrix real `src/` imports 71 distinct `PhpParser\*` symbols across 465 references, but `nikic/php-parser` was never declared in `require`. It only resolved because `phpunit/phpunit` allowed it, so the version was never ours to control. That mattered once #10 widened the `args` annotations to accept `ArgPlaceholder`, a class added in php-parser 5.9.0. On `prefer-lowest` composer resolves 5.8.0, where that class does not exist, so `composer test:types` fails with 23 `class.notFound` errors. `static.yml` declared a `prefer-lowest` matrix entry but hardcoded `composer update --prefer-stable` in the install step, so both legs installed the same dependency set and PHPStan never saw the floor. CI was green while the code was broken. Adds a `composer audit --locked` step so an abandoned transitive dependency fails CI, which is what the v5.0.5 change was for in the first place. Verified on both legs, at the corner CI resolves (rector 2.7.0, phpstan 2.3.0): composer test:types 0 errors composer test:unit 290/290 composer audit clean Refs #1940 --- .github/workflows/static.yml | 5 ++++- composer.json | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml index c09aec8..732f4da 100644 --- a/.github/workflows/static.yml +++ b/.github/workflows/static.yml @@ -26,7 +26,10 @@ jobs: coverage: none - name: Install Dependencies - run: composer update --prefer-stable --no-interaction --no-progress --ansi + run: composer update --${{ matrix.dependency-version }} --no-interaction --no-progress --ansi + + - name: Audit + run: composer audit --locked --no-interaction - name: Types run: composer test:types diff --git a/composer.json b/composer.json index fce107a..11c35da 100644 --- a/composer.json +++ b/composer.json @@ -24,6 +24,7 @@ ], "require": { "php": "^8.4", + "nikic/php-parser": "^5.9", "rector/rector": "^2.6.1" }, "require-dev": {