What's Changed
Features
- Taint flows into and out of $this properties matched by array key by @danog in #12476
- Report exceptions that are created but never thrown or used by @danog in #12487
- Load a library stub when the scanned code declares one of its functions by @danog in #12481
- Taint the property or array element a @psalm-flow names, and apply receiver flows of constructors by @danog in #12485
- Add a library stub for the taint flows of webmozart/assert's assertions by @danog in #12483
- Add library stubs for the taints of amphp/http-client, byte-stream, file and process, and amp's delay() by @danog in #12482
- Add a library stub for the NoSQL sinks of mongodb/mongodb's Collection and Database by @danog in #12484
- Read and write the properties of a class through the array property @psalm-taint-property-bag names by @danog in #12486
- Take the operand of a field's $eq in a filter literal given to a nosql sink for no NoSQL injection by @danog in #12491
- Let plugins get the taint nodes of the return, arguments and object of a call, and assign properties by @danog in #12489
Fixes
- Resolve class-template type variables at read sites; fix deferred-model regressions by @danog in #11966
- Cut code location snippets in O(length), not O(file offset) by @iamcal in #12508
- Set each element a foreach loop copies through a receiver property flow to the property of its key by @danog in #12488
- Make Union::equals() independent of cached ids by @danog in #12505
- Keep the parameter sinks of a stub method when a later stub redeclares it by @danog in #12479
- Keep the kind of a string compared with !== '' by @danog in #12528
Internal changes
- Add agent instructions (CLAUDE.md, AGENTS.md, skills) by @danog in #12504
- Fix master's self-analysis and code style in ReceiverPropertyTaints by @danog in #12509
- Agent instructions: documentation shows more examples and less text by @danog in #12510
- Pin grpc to 1.84.0 in the PHP 7.1 stub image by @danog in #12511
- Apply the changes queued with the maintainers' Telegram bot every hour by @danog in #12520
- Add CLAUDE.md importing AGENTS.md by @danog in #12523
- Install PECL extensions with PIE in the stub images by @danog in #12521
- Check the PIE package versions in the stub image build by @danog in #12526
- Fix master CI: self-analysis errors and code style by @danog in #12527
- Don't cancel running stub builds on master and 6.x by @danog in #12529
New Contributors
Full Changelog: 7.0.0-rc10...7.0.0-rc11