psalm/plugin-laravel v3.14.0

v3.14.0 - π

on PHP Packagist

What’s Changed

Focuses on wide range of type-infer and security features.

Security

• Detect user-controlled container resolution as unsafe reflection (CWE-470) (#1075) @alies-dev
• Detect timing-unsafe comparisons of secrets (CWE-208) (#1013) @alies-dev
• Add html_url taint kind for URL-context XSS distinct from e() (#1014) @alies-dev

Relationships

• Fix MissingTemplateParam on in-body belongsToMany()/morphToMany() pivot chains (#1090) @alies-dev
• Fix mixed collapse when chaining off relation methods (replace $this by static in generic templates, use @template-covariant for relationships) (#1055) @alies-dev

Filesystem

• Narrow FilesystemAdapter listing methods to list<string> (#1094) @alies-dev

Pagination

• Narrow Storage::disk() to FilesystemAdapter so temporaryUrl() and url() resolve (#1093) @alies-dev
• Return the concrete paginator from paginate() and preserve the related-model template through relations (#1082) @alies-dev

Forms

• Narrow FormRequest magic property reads ($request->field calls) (#1022) @alies-dev

Best Practices

• Add opt-in ImplicitQueryBuilderCall rule for direct model query and scope calls. Requires writing User::query()->where... instead of (User::where...) (#1068) @alies-dev

Other Features and Fixes

• Infer app(Foo::class) as Foo when the booted app cannot resolve it (Laravel packages) (#1076) @alies-dev
• Narrow when()/unless() callback return types (#997) @alies-dev
• Suppress false PossiblyUnusedMethod on Eloquent trait boot/initialize hooks (#1080) @alies-dev
• Fix false-positive UndefinedMethod on $app->when()->needs() chains (#1077) @alies-dev

Internal changes

• Raise minimum Laravel 12.x version to ^12.4 (Laravel 11.x is still supported on v3.x plugin) (#1089) @alies-dev
• CI: add a new /psalm-delta workflow to benchmark plugin over real apps and libs (#1079, #1086, #1084) @alies-dev

Full Changelog: v3.13.2...v3.14.0