psalm/plugin-laravel v4.15.7 on PHP Packagist

Taint accuracy for named arguments, plus three Eloquent and Collection narrowings.

Fixes

🛡️ Fix taint false positives when a value is passed as a named argument (#1396). Psalm attributes a named argument's taint to the parameter at its written position instead of the one it names (vimeo/psalm#11923), so an unrelated request value could be reported against a file, SQL, or HTML sink.

 // sinkNamed(string $path = 'safe', string $label = 'x'), file sink on $path
 sinkNamed(label: (string) $request->input('page'));
-// TaintedFile (before): the taint landed on $path, which never saw the request
+// no issue: the argument is attributed to $label

Narrow AbstractPaginator::getCollection() and AbstractCursorPaginator::getCollection() to Eloquent\Collection when the paginator holds models (#1397). The 33 methods that exist only on the Eloquent collection (load*, find, fresh, modelKeys, toQuery, ...) are now reachable.

 $users = User::paginate();
 $users->getCollection()->load('posts');
-// UndefinedMethod (before): Support\Collection<int, User> has no load()
+// now resolves: Eloquent\Collection<int, User>

Add select() stubs for Collection, LazyCollection, and Eloquent\Collection (#1399), including the select(null) branch and the variadic form.

 $rows = collect([['a' => 1, 'b' => 2]])->select('a');
-// Collection<array-key, mixed>&static (before); select('a', 'b') reported TooManyArguments
+// Collection<array-key, array<array-key, mixed>>

Resolve Auth::guard() and Auth::shouldUse() when the guard name is a string-backed enum case (#1405). Previously any non-literal argument dropped all narrowing back to the bare contract.

 Auth::guard(Guards::Admin)->user();
-// Illuminate\Contracts\Auth\Guard (before)
+// now resolves through SessionGuard to the configured user model

Changes

<experimental value="true" /> now also enables findSerializedQueuedModels, unless the project sets that flag explicitly (#1400). experimental is the early-access switch for rules that are off by default and on their way to becoming default.

Full Changelog: v4.15.6...v4.15.7