Mago 1.46.0

This release fixes a workflow-command injection in the GitHub reporting format (GHSA-f256-xqf4-x8pr), adds a redundant-static linter rule and a --stats shorthand, corrects a batch of generic-narrowing and late-static-binding false positives across the analyzer and codex, and speeds up the PHP parser.

🔒 Security

Reporting

• Workflow-command injection: escapes untrusted values written to workflow commands and log records. (GHSA-f256-xqf4-x8pr, cc8d5e4)

Reported by Liyi Zhou, Ziyue, Strick, Maurice, and Chenchen of the University of Sydney.

✨ Features

Linter

• redundant-static: reports static in a final class where self is equivalent. (#2154, ef06262)

CLI

• --stats: adds a shorthand for count output. (#2130, db4a2cb)

Prelude

• json_validate: asserts non-empty-string when the call succeeds. (#2155, 198f2b4)

🐛 Bug Fixes

Analyzer

• Array entry narrowing: narrows possibly-absent entries on the parent shape, independent of conjunct order. (#2132, 2af1cbc, 784b93b)
• Attribute arguments: validates the types of attribute constructor arguments. (#2161, ebf2f8d)
• Switch labels: detects duplicate and unreachable case labels. (#2162, 4119141)
• Mutation-free calls: narrows repeated calls to mutation-free methods. (#2138, b6e97ee)
• Identical arrays: folds comparisons between identical arrays. (#2149, c2c7bb4)
• Late-static returns: preserves late-static types in generic return positions. (#2151, fe272b8)
• void conditionals: stops demanding a return from conditionals in void functions. (#2160, bd85d70)
• self in attributes: resolves self in attributes applied to class-likes. (#2168, 7f88255)
• Specialized generics: accepts class-strings of specialized generic classes. (#2171, b0b0b91)
• Narrowing leaks: prevents method-call narrowing from leaking across scopes. (42cfd1f)

Codex

• Bounded templates: allows instanceof narrowing of generics parameterised by a bounded template. (#2135, a45ffec, 8b2edf6)
• Template defaults: populates default template arguments when the generic argument is omitted. (#2140, aff9ce8)
• Static return types: preserves generic parameters in static return types. (#2145, 327ca0a)
• void with never: keeps void when combined with never. (#2159, 864d0f7)
• Late-static rebinding: guards exact late-static type rebinding. (fcd42ec)

Linter

• Naming suggestions: suppresses invalid suggestions for constants starting with a number. (#2158, 7c54906)
• missing-docs: renames the exclusion config field. (#2134, a5eab2d)

Syntax

• Method return types: parses grouped static method return types in docblocks. (#2152, 06871ea)
• String interpolation: limits recursion when parsing interpolated strings. (3610502)

Prelude

• Attribute: adds the missing TARGET_CONSTANT constant. (9bef302)

Composer

• Availability markers: unbreaks self-analysis of the availability markers. (#2169, 209f980)

📖 Documentation

Reporting

• --sort: clarifies that the flag is a no-op for some formats. (#2173, #2174, 654b3f4)

🏗️ Internal

Performance

• Parser: streamlines the PHP parser hot paths. (1ec8868)

Analyzer

• Unused templates: uses loop labels for the unused-template checks. (#2133, b4aa9ad)
• Tests: removes invalid attribute stubs. (4d9c611)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

• @dotdash: #2133, #2159, #2160, #2168, #2169, #2171, #2174
• @gsteel: #2155
• @adam-ja: #2134
• @epic-64: #2130

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

• @mathroc: #2132
• @PellegrinoDurante: #2135, #2140
• @BafS: #2138, #2149
• @giorgiopogliani: #2145
• @kryyova: #2151
• @AJenbo: #2152
• @maximal: #2154, #2162
• @Double-Ramzi: #2158
• @ddanielou: #2161
• @Bleksak: #2166, #2167
• @SanderMuller: #2173

Full Changelog: 1.45.0...1.46.0