What's Changed
Features
- Support conditional taint sinks: @psalm-taint-sink ($mode is 0 ? null : 'html') $content by @danog in #12458
- Load the stubs Psalm ships for libraries when the scanned code uses one of their classes by @danog in #12460
- Add library stubs for the taints of Guzzle, PSR-7 messages and PSR-18 clients by @danog in #12461
- Add a library stub for the file and SSRF sinks of Monolog's stream and socket handlers by @danog in #12462
- Add a library stub for the SQL and file sinks and the escapes of phpClickHouse by @danog in #12463
- Add a library stub for the file sinks and the cell values of PhpSpreadsheet by @danog in #12464
- Add a library stub for the file sinks of Archive_Tar by @danog in #12465
- Add a library stub for the file sinks of php-vips images by @danog in #12466
- Add a library stub for the emails webklex/php-imap receives as taint sources by @danog in #12467
- Add @psalm-cli-only: what command-line code prints isn't an HTML sink by @danog in #12459
Fixes
- Remove what escaping removes from one returned expression from that return only by @danog in #12471
- Apply conditional taint sinks to calls of first-class callables and closures by @danog in #12473
Full Changelog: 7.0.0-rc8...7.0.0-rc9