vimeo/psalm 7.0.0-rc3 on PHP Packagist

What's Changed

Features

Let @psalm-flow ($this) -> return carry the taints of the object a method is called on by @danog in #12302
Add , to make issues impossible to suppress by @danog in #12130
Report int-mask values compared by value with a set other than the empty or the full one by @danog in #12203
Add a time capability for reading the clock by @danog in #12261
Accept taint complements ~(kind|kind): every taint, custom ones included, but the kinds listed by @danog in #12300
Support @psalm-flow ($compute()) -> return: what a callable parameter returns flows to the return by @danog in #12299
Follow values through keyed stores: @psalm-flow ($value) -> Store::$data[$key] and back to return by @danog in #12312
Store what callables return in keyed stores: @psalm-flow ($compute()) -> Store::$data[$key] by @danog in #12327
Declare custom taints in psalm.xml, optionally added to the input aliases by @danog in #12330
Report invalid taint and flow annotations, also in stubs, as InvalidDocblock by @danog in #12333
Report every docblock issue of the stubs the config and plugins add by @danog in #12334
Add the _ purity to the closure parameters a function-like calls with --alter by @danog in #12019
Let plugins give the capabilities a call of a method requires by @danog in #12329
Declare what the methods of the SPL classes do by @danog in #12122
Charge ArrayObject and ArrayIterator mutators write-props only when their storage is an object by @danog in #12190
Resolve taints over compact states, so that large graphs fit in memory by @danog in #12105
Taint analysis: sinks on the values of an array parameter only ($param[*]) by @danog in #12171
Give decoded user input back the nosql taint the string type took away by @danog in #12338
Taint analysis: keep the calls of a callee that only reads shared state specialized by @danog in #12397
Taint analysis: know more array keys (literal unions, array_map(), convergences, key starts of lists) and stop at keys overwritten in specialized calls by @danog in #12375
Taint analysis: share and split the filters of specialized calls by what their walks observe by @danog in #12374
Add a PHP 8.6 call map by @danog in #12407
Add Codebase::getReceiverTaintPath(), the path along which a method of a builtin class returns what its object holds by @danog in #12414

Fixes

Declare the capabilities of the Random extension's randomizer and engines by @danog in #12311
Don't taint the overrides of sibling classes through inherited method calls by @danog in #12100
Infer the bounds, not mixed, for templates of new that a class doesn't pass to its parent by @danog in #12125
Keep the variables a loop defines, with their types, where the next iteration starts by @danog in #12155
Resolve global constants holding enum cases when they're fetched by @danog in #12173
Suggest a class contract that also covers the known subclasses and the purity template bounds by @danog in #12186
Specialize a specialized function passed as a callable, whose edge hid its return from its calls by @danog in #12201
Link a specialized override's by-ref params to the overridden method without cutting off its calls by @danog in #12202
Forget the array offsets a write through a non-literal key may overwrite by @danog in #12174
Treat builtins that read files, streams and the network as impure by @danog in #12214
Narrow the subject of a match without a default arm to the values of its arms past it by @danog in #12225
Take only the column of each row into the values array_column() returns, and the index into its keys by @danog in #12226
Track taints through global variables, with a node per global shared by $GLOBALS and global by @danog in #12243
Don't narrow strings to objects with __toString() through instanceof by @danog in #12310
Let a specialized call read what its other calls leave in a static property by @danog in #12254
Keep the taints of arrays encoded into strings by json_encode(), serialize(), print_r(), ... in taint analysis by @danog in #12257
Taint the result of a call on an interface or base class with the returns of its overrides by @danog in #12262
Drop an optional array key, and its taint, where array_key_exists() or isset() is negated by @danog in #12298
Keep the shape of arrays unpacking shapes with optional string keys by @danog in #12301
Charge igbinary_serialize() and igbinary_unserialize() like serialize() and unserialize() by @danog in #12306
Narrow by @psalm-assert types that expand to a union, such as key-of<A::B> or a template bound by @danog in #12230
Treat the objects a closure captures as not fresh, and infer writes to fresh objects as free by @danog in #12268
Charge the destructors of what an overwritten or unset property, array element or variable held by @danog in #12309
Forget what mutation-free methods returned when a later call may write their receiver by @danog in #12191
Fix master CI by @danog in #12335
Share what keyed stores hold between specialized calls by @danog in #12336
Specialize the taints of Type::getString() and getAtomicStringFromLiteral() per call by @danog in #12337
Declare what the phpredis classes do: commands need io, subscribe callbacks are charged by @danog in #12308
Don't report calling a closure or an invokable object as a tainted callable by @danog in #12093
Assign under each literal the key of an array assignment can be (master) by @danog in #12152
Don't report an instanceof && property check on a template param as redundant by @danog in #12342
Fix master CI after the latest merges by @danog in #12347
Merge a key check's array node away where the array it checks is merged back in by @danog in #12349
Assign under each literal the key of an array assignment can be by @danog in #12150
Tell array keys apart by their start where only that is known statically by @danog in #12106
Declare that preg_last_error(), preg_last_error_msg() and json_last_error_msg() only read globals by @danog in #12351
Charge a call on a mixed value as a call that may do anything by @danog in #12362
Infer literal class-string for Foo::class in constants outside class context by @rela589n in #12364
Fix the taint resolution hang on Psalm's own code (self-analysis/Shepherd) by @danog in #12361
Fix master CI after the latest merges (template bounds, self-analysis) by @danog in #12350
Don't suggest a purity annotation below the lower bound of the purity template a method depends on by @danog in #12358
Declare what the methods of SplObjectStorage do, so a new storage can be filled for free by @danog in #12297
Charge calls of methods not known by name what the class contract allows, or impure without one by @danog in #12304
Charge a method found through @mixin what the __call() of the class using the mixin does by @danog in #12307
Parse @psalm-flow annotations in one place, for the docblock check and for the code applying them by @danog in #12369
Don't require a class-level purity annotation on interfaces whose methods all have their own by @danog in #12303
Fix master CI: keyed store read flows, empty @psalm-taint-escape, test data and the preloader list by @danog in #12345
Drop the taints a narrowed type can't carry, also where it can carry others by @danog in #12348
Track taints through the static variables of function-likes across their calls by @danog in #12255
Declare what the mongodb driver classes do: ids, cursors, servers, the manager and subscribers by @danog in #12332
Taint analysis: keep the keys of the elements an assignment copies or a foreach loop transforms by @danog in #12373
Fix master CI: copies of narrowed foreach variables, the marker interface test, a docblock by @danog in #12379
Cut the memory of the taint resolution on large code bases (20.5 GB → 3.1 GB on Psalm's own code) by @danog in #12393
Fix master's self-analysis: read php-64bit from composer.json, and type capability sets with time by @danog in #12396
[6.x] Keep config untouched when --set-baseline runs with --use-baseline by @alies-dev in #12385
Don't let a later call of an inherited method take the taints out of what earlier calls passed by @danog in #12383
Purity: capability sets as int-masks, fresh objects, property reads of contracted objects, WeakMap, closures and purity templates through parents by @danog in #12380
Fix covariance checks of templates, narrowing by || with calls asserting nothing, and redundant instanceof of generic subclasses by @danog in #12378
Taint analysis: track file-scope variables, globals and ancestor constructors called by name by @danog in #12376
Don't crash re-analyzing inherited method bodies of files a partial run doesn't analyze by @danog in #12384
Report sinks on the values of a stubbed method's parameter by @danog in #12408
Don't crash when destructuring an ArrayAccess object that isn't Traversable by @danog in #12409
Require fidry/cpu-core-counter 1.2 by @danog in #12412
Fix conditional return types of stubbed methods also declared in vendor by @danog in #12413
Don't treat generator functions without a return as void by @danog in #12421
Parse is not and nullable/intersection if-branches in conditional types by @danog in #12415

Internal changes

Fix macOS CI: bump setup-php to 2.40.0 by @danog in #12296
Allow running Psalm on PHP 8.6 by @LordSimal in #12323
Rename Capabilities::allows to Capabilities::allowsAnyOf by @danog in #12328
Test that a keyed store read under a key that isn't a parameter is an invalid @psalm-flow by @danog in #12371
Fix master CI: CapabilitiesTest PHP versions and self-analysis by @danog in #12372
Fix master CI: declare MongoDB\Driver\Monitoring\Subscriber, read QUERY_STRING with a default in a test by @danog in #12390
Type capability sets as int-masks, comparing exact sets with Capabilities::equals() by @danog in #12204
Merge 6.x into master by @danog in #12406
CI: balance the unit test runners by test time and run them on all cores; move to PHPUnit 10.5-13 and ParaTest 7 by @danog in #12405
Require psalm/psalm-plugin-api 0.4.0 by @danog in #12410
Regenerate the preloader list by @danog in #12411
Fix master's self-analysis: mark the receiverTaintPaths provider pure by @danog in #12426
Release master and 6.x every hour when all their checks passed by @danog in #12422

Other changes

Add timeout to macOS Psalm scan job by @austenstone in #12324
Bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #12321
Bump shivammathur/setup-php from 2.37.1 to 2.40.0 by @dependabot[bot] in #12320
Report UnsafeGenericInstantiation only for purity templates the constructor's parameters take by @danog in #12177
Analyze the taints of an inherited method again for each class it is run on by @danog in #12156
Fix crash and lost aliases for interfaces declared with class_alias() by @Hoticus in #12294
Don't let the keys of an array hold a value assigned under a variable key (#12105 port) by @danog in #12146
[6.x] Fix crash when destructuring into offsets of an undefined variable by @alies-dev in #11996
[6.x] Apply --threads to the scan phase when --scan-threads is not given by @alies-dev in #12382
[6.x] Resolve self and parent in @param-out against the declaring class by @alies-dev in #12391
[6.x] Fix: crash on unknown @psalm- tags in property, constant and enum case docblocks by @alies-dev in #12394
[6.x] Fix: resolve templates and conditional returns in method keys seeded by assertions by @alies-dev in #12392
[6.x] Resolve object-shape properties on intersections with mixin or final classes by @alies-dev in #12111
Do not report PropertyNotSetInConstructor for virtual hooked properties by @ybai08 in #12404
Read @phpstan-require-extends and @phpstan-require-implements by @ybai08 in #12403

New Contributors

@LordSimal made their first contribution in #12323
@austenstone made their first contribution in #12324
@Hoticus made their first contribution in #12294
@rela589n made their first contribution in #12364
@ybai08 made their first contribution in #12404

Full Changelog: 7.0.0-rc2...7.0.0-rc3