psalm/plugin-laravel v4.21.0 on PHP Packagist

This release targets Psalm 7.6. It follows Psalm 7.6's new @mixin lookup order and property type inheritance, and Blade analysis now uses Psalm's public API instead of Psalm internals.

Requirements

Require vimeo/psalm ^7.6.0 and psalm/psalm-plugin-api ^0.4.5 (#2302, #2308, #2309). Until Psalm 7.6.0 is tagged, install it with composer require --dev vimeo/psalm:dev-master; projects on Psalm 7.5 keep v4.20.0.

Fixes

Keep the exact return types and taint sinks of Schema and Http facade calls under Psalm 7.6's mixin lookup order, where a facade's generated @method static would otherwise win over the plugin's stub mixin and Http::get() would lose its SSRF sink (#2302)

 Schema::getTables();
-// mixed
+// list<array{name: string, ...}>

Keep a factory's model binding from protected $model = Widget::class now that Psalm 7.6 gives the property the parent's class-string<TModel> type (#2309)

 final class WidgetFactory extends Factory
 {
     protected $model = Widget::class;
 }
 WidgetFactory::new()->createOne();
-// Model, plus MissingTemplateParam on WidgetFactory
+// Widget

Make Blade templates reportable through Psalm's Codebase::addReportableFiles() instead of writing Psalm's internal project-file list (#2307)

Known issue

On Psalm 7.6, a model scope named like a protected Eloquent\Builder method (for example scopeEnforceOrderBy()) is typed mixed (vimeo/psalm#13769)

Full Changelog: v4.20.0...v4.21.0