Mago 1.5.0

This release brings PSR-11 container support, custom help text for disallowed functions, and several important bug fixes for type narrowing and linter false positives.

✨ Features

Analyzer

• PSR-11 container support: New psr-container plugin that infers types from class-string arguments when calling ContainerInterface::get(). This eliminates mixed-method-access and mixed-argument errors when using PSR-11 service containers (#1015) by @Noojuno

  [analyzer]
  plugins = ["psr-container"]

Linter

• Custom help text for disallowed functions: The disallowed-functions rule now supports custom help messages per function or extension. Entries can be simple strings or objects with name and optional help fields (#1024)

  [linter.rules]
  disallowed-functions = {
      functions = [
          "eval",
          { name = "error_log", help = "Use MyLogger instead." },
      ],
      extensions = [
          "curl",
          { name = "ffi", help = "FFI is disabled for security reasons." },
      ],
  }

🐛 Bug Fixes

Analyzer

• Nullsafe operator type narrowing: Fixed incorrect type narrowing in the false branch of if statements using nullsafe operators (?->). Previously, the variable was incorrectly narrowed to null in the else branch. Now if ($user?->isAuthorized()) correctly preserves the original type in the else branch, matching the semantics of $user !== null && $user->isAuthorized() (#1025)

• Redundant instanceof detection: Fixed false positive for undefined variables when a variable is assigned in exhaustive if/elseif branches over a union type. The analyzer now correctly detects redundant instanceof checks and tracks variable assignments across all branches (#1026)

Linter

• False positive in prefer-first-class-callable: Skip suggesting first-class callable syntax for runtime-dependent call targets where conversion would change evaluation semantics. This includes method chains (adminUrlGenerator()->generateUrl()), nullsafe calls ($obj?->method()), and dynamic method names ($obj->$method()) (#1027, #1020) by @kzmshx

🏗️ Internal

• Bump bytes from 1.11.0 to 1.11.1 (#1023) by @dependabot
• Documentation updates and optimizations

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

• @kzmshx
• @Noojuno

Issue Reporters

Thank you to everyone who reported issues that were fixed in this release:

• @bendavies — #1026
• @ddanielou — #1025
• @dragosprotung — #1020
• @joshrai — #1024

Full Changelog: 1.4.1...1.5.0