What's Changed
Features
- Taint what functions and builtins leave in by-reference parameters by @danog in #12095
- Declare the taint sinks of more builtins, including those declared by stubs by @danog in #12081
- Make taints flow through the builtins that return data from their arguments by @danog in #12084
Fixes
- Don't report the output of print_r() and var_export() when they return it by @danog in #12092
- Report a tainted callable passed to Closure::fromCallable by @danog in #12114
- Apply the @psalm-flow annotations of constructors to new by @danog in #12101
- Report curl options and CURLFile by what they do: SSRF, header injection, files, sleep and callables by @danog in #12099
- Join what each position a purity template is inferred from requires, instead of keeping the deepest by @danog in #12119
- Taint the array a foreach by reference writes into by @danog in #12121
- Accept any instance where a class with purity templates is used without type arguments by @danog in #12118
- Fetch the items destructured from an array without a shape by their keys by @danog in #12107
- Make the taints of promoted constructor parameters flow into their properties by @danog in #12091
Full Changelog: 7.0.0-beta24...7.0.0-rc1