Bump the development-dependencies group with 3 updates #38

dependabot · 2025-10-01T00:05:53Z

Bumps the development-dependencies group with 3 updates: phpstan/phpstan, phpstan/phpstan-strict-rules and squizlabs/php_codesniffer.

Updates phpstan/phpstan from 2.1.22 to 2.1.29

Release notes

Sourced from phpstan/phpstan's releases.

2.1.29

Improvements 🔧

Custom Composer source for cloning phpstan/phpstan

Learn more: https://github.com/phpstan/phpstan-phar-composer-source

Add optional strict check for printf parameter types (#4349), #13496, thanks @schlndh!

Set parameter checkStrictPrintfPlaceholderTypes: true to turn this on

Bugfixes 🐛

After trim($s) !== '' the $s can still be mixed (phpstan/phpstan-src@88b7f50), #13552

Fix false positive about never written property when assigned in foreach key or value (phpstan/phpstan-src@4b4836a), #9213

Improve function signatures with functionMap only for built-in symbols (phpstan/phpstan-src@326c6ec), #13556, #12151, #11303, #9486

[PHP 8.5] Fix warning: "unexpected NAN value was coerced to string" (#4368), thanks @staabm!

Function signature fixes 🤖

Added proc_open() stub for param-out (#4261), #13197, #11777, thanks @staabm!

Internals 🔍

Add non regression test for issue #9386 (#4348), thanks @VincentLanglet!

Faster code downgrade to speed up CI (#4352), thanks @staabm!

Refactor TooWideTypeCheck - report errors based on narrowed original type (phpstan/phpstan-src@5468ddd)

Use TooWideTypeCheck in TooWideParameterOutTypeCheck (phpstan/phpstan-src@0e695a4)

TooWideTypeCheck - do not report PHPDocs that are not subtype of native type (phpstan/phpstan-src@2ecc069)

TooWidePropertyTypeRule - property without native type and with default value is not implicitly nullable (phpstan/phpstan-src@6115511)

Simplify many processAssignVar with new processVirtualAssign method (phpstan/phpstan-src@4d119ba), #9213

Added comment (#4358), thanks @staabm!

Switch to ramsey/composer-install action (#4365)

2.1.28

Improvements 🔧

[PHP 8.5] Add support for #[\NoDiscard] (#4253), thanks @DanielEScherzer!

Narrow l/r/trim() arg on comparison to '' (#4340), thanks @staabm!

... (truncated)

Commits

d618573 PHPStan 2.1.29
34e54be Update errors identifiers
1611a88 Updated PHPStan to commit 1611a884837df994eb91bc6fdf23c661c4ce361f
e93ad8d Rename branch
9adbff9 Updated PHPStan to commit 9adbff9b289197cff7817f12b7477f32728d55c7
64c1547 Custom Composer source for cloning phpstan/phpstan
17f859d Re-enable PHPCS
4664230 Update baselines
fad1c40 Remove tests about polyfills
217fca4 Re-enable more
Additional commits viewable in compare view

Updates phpstan/phpstan-strict-rules from 2.0.6 to 2.0.7

Release notes

Sourced from phpstan/phpstan-strict-rules's releases.

2.0.7

d6211c4 - enable checkStrictPrintfPlaceholderTypes

6b78d53 - Update README.md

0435aeb - Consolidate overwriteVariablesWithLoop rule details

e861638 - Simplify tests in which checkNullables is always true

11b6403 - Simplify tests in which treatPhpDocTypesAsCertain is always true

b043bd8 - Simplify RequireParentConstructCallRule

9f76a17 - Update actions/checkout action to v5

2b69ec5 - Update Eomm/why-don-t-you-tweet action to v2

Commits

d6211c4 enable checkStrictPrintfPlaceholderTypes
6b78d53 Update README.md
0435aeb Consolidate overwriteVariablesWithLoop rule details
e861638 Simplify tests in which checkNullables is always true
11b6403 Simplify tests in which treatPhpDocTypesAsCertain is always true
b043bd8 Simplify RequireParentConstructCallRule
9f76a17 Update actions/checkout action to v5
2b69ec5 Update Eomm/why-don-t-you-tweet action to v2
See full diff in compare view

Updates squizlabs/php_codesniffer from 3.13.2 to 4.0.0

Release notes

Sourced from squizlabs/php_codesniffer's releases.

4.0.0 - 2025-09-16

This release contains breaking changes.

Upgrade guides for both ruleset maintainers/end-users, as well as for sniff developers and integrators, have been published to the Wiki.

You are strongly encouraged to read the upgrade guide applicable to your situation before upgrading.

This release includes all improvements and bugfixes from PHP_CodeSniffer 4.0.0-beta1, 4.0.0-RC1, 3.13.3 and 3.13.4.

Changed

Tokenizer/PHP: fully qualified exit/die/true/false/null will be tokenized as the keyword token and the token 'content' will include the leading backslash. #1201

Wherever possible based on the PHP 7.2 minimum version, parameter types have been added to all methods. #1237

The supported PHPUnit version constraints have been updated to ^8.4.0 || ^9.3.4 || ^10.5.32 || 11.3.3 - 11.5.28 || ^11.5.31. #1247

External standards using the PHP_CodeSniffer native framework may need to update their own PHPUnit version constraints.

Various housekeeping, including improvements to the tests and documentation.

Fixed

Fixed bug #1082: new exit codes weren't applied when running phpcbf on code provided via STDIN.

Thanks to Dan Wallis for the patch.

Fixed bug #1172: // phpcs:set for inline array properties did not handle a single item array with the value true, false or null correctly.

Fixed bug #1174: progress bar wasn't showing files as fixed when running phpcbf in parallel mode.

Fixed bug #1226: PHP 8.5 "Using null as an array offset" deprecation notice.

Other

Please be aware that the master branch has been renamed to 3.x and the default branch has changed to the 4.x branch.

If you contribute to PHP_CodeSniffer, you will need to update your local git clone.

If you develop against PHP_CodeSniffer and run your tests against dev branches of PHPCS, you will need to update your workflows.

Statistics

Closed: 5 issues Merged: 35 pull requests

Follow @phpcs on Mastodon or @PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

4.0.0RC1 - 2025-06-18

This release includes all improvements and bugfixes from PHP_CodeSniffer 4.0.0-beta1, 3.13.1 and 3.13.2.

Changed

The error code Squiz.Functions.FunctionDeclarationArgumentSpacing.SpacingAfterVisbility has been changed to Squiz.Functions.FunctionDeclarationArgumentSpacing.SpacingAfterVisibility. #1136

The following sniff(s) have received efficiency improvements:

Generic.ControlStructures.InlineControlStructure #880

Thanks to Rodrigo Primo for the patch.

Fixed

Fixed bug #3889 : A selective phpcs:enable could sometimes override a later selective phpcs:ignore.

... (truncated)

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

Changelog

The file documents changes to the PHP_CodeSniffer project for the 3.x series of releases.

[3.13.4] - 2025-09-05

Fixed

Fixed bug #1213: ability to run tests for external standards using the PHPCS native test framework was broken.

Thanks to [Juliette Reinders Folmer][@jrfnl] for the patch.

Fixed bug #1215: PHP 8.5 "Using null as an array offset" deprecation notices.

Thanks to [Juliette Reinders Folmer][@jrfnl] for the patch.

#1213: PHPCSStandards/PHP_CodeSniffer#1213 #1215: PHPCSStandards/PHP_CodeSniffer#1215

[3.13.3] - 2025-09-04

Added

Tokenizer support for PHP 8.4 dereferencing of new expressions without wrapping parentheses. #1160

Thanks to [Juliette Reinders Folmer][@jrfnl] for the patch.

Tokenizer support for PHP 8.4 abstract properties. #1183

The File::getMemberProperties() method now also supports abstract properties through a new is_abstract array index in the return value. #1184

Additionally, the following sniffs have been updated to support abstract properties:

Generic.PHP.LowerCaseConstant #1185

Generic.PHP.UpperCaseConstant #1185

PSR2.Classes.PropertyDeclaration #1188

Squiz.Commenting.VariableComment #1186

Squiz.WhiteSpace.MemberVarSpacing #1187

Thanks to [Juliette Reinders Folmer][@jrfnl] for the patches

Tokenizer support for the PHP 8.4 "exit as a function call" change. #1201

When exit/die is used as a fully qualified "function call", it will now be tokenized as T_NS_SEPARATOR + T_EXIT.

Additionally, the following sniff has been updated to handle fully qualified exit/die correctly:

Squiz.PHP.NonExecutableCode

Thanks to [Juliette Reinders Folmer][@jrfnl] for the patches

Changed

Tokenizer/PHP: fully qualified true/false/null will now be tokenized as T_NS_SEPARATOR + T_TRUE/T_FALSE/T_NULL. #1201

Previously, these were tokenized as T_NS_SEPARATOR + T_STRING.

Additionally, the following sniffs have been updated to handle fully qualified true/false/null correctly:

Generic.CodeAnalysis.UnconditionalIfStatement

Generic.ControlStructures.DisallowYodaConditions

PEAR.Functions.ValidDefaultValue

Thanks to [Juliette Reinders Folmer][@jrfnl] for the patches.

Generic.PHP.Syntax: the sniff is now able to scan input provided via STDIN on non-Windows OSes. #915

Thanks to [Rodrigo Primo][@rodrigoprimo] for the patch.

PSR2.ControlStructures.SwitchDeclaration: the WrongOpener* error code is now auto-fixable if the identified "wrong opener" is a semi-colon. #1161

Thanks to [Juliette Reinders Folmer][@jrfnl] for the patch.

The PSR2.Classes.PropertyDeclaration will now check that the abstract modifier keyword is placed before a visibility keyword. #1188

Errors will be reported via a new AbstractAfterVisibility error code.

... (truncated)

Commits

06113cf Merge pull request #1260 from PHPCSStandards/feature/changelog-4.0.0
7bb1928 Merge branch '3.x' into 4.x
8222a52 Merge pull request #1261 from PHPCSStandards/feature/release-checklist-fix-order
82f2cd8 Release checklist: fix order
68e414d Changelog for the 4.0.0 release
2f9900a Merge branch '3.x' into 4.x
38efc5d Merge pull request #1259 from PHPCSStandards/feature/update-release-checklist...
230c7c2 Update release checklist and document branch management
c66fd3c Merge branch '3.x' into 4.x
3acd7ee Merge pull request #1258 from PHPCSStandards/feature/updates-for-branch-rename
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the development-dependencies group with 3 updates: [phpstan/phpstan](https://github.com/phpstan/phpstan), [phpstan/phpstan-strict-rules](https://github.com/phpstan/phpstan-strict-rules) and [squizlabs/php_codesniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer). Updates `phpstan/phpstan` from 2.1.22 to 2.1.29 - [Release notes](https://github.com/phpstan/phpstan/releases) - [Changelog](https://github.com/phpstan/phpstan/blob/2.1.x/CHANGELOG.md) - [Commits](phpstan/phpstan@2.1.22...2.1.29) Updates `phpstan/phpstan-strict-rules` from 2.0.6 to 2.0.7 - [Release notes](https://github.com/phpstan/phpstan-strict-rules/releases) - [Commits](phpstan/phpstan-strict-rules@2.0.6...2.0.7) Updates `squizlabs/php_codesniffer` from 3.13.2 to 4.0.0 - [Release notes](https://github.com/PHPCSStandards/PHP_CodeSniffer/releases) - [Changelog](https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/4.x/CHANGELOG-3.x.md) - [Commits](PHPCSStandards/PHP_CodeSniffer@3.13.2...4.0.0) --- updated-dependencies: - dependency-name: phpstan/phpstan dependency-version: 2.1.29 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: phpstan/phpstan-strict-rules dependency-version: 2.0.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: squizlabs/php_codesniffer dependency-version: 4.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file php Pull requests that update Php code labels Oct 1, 2025

Alkarex merged commit 9f62852 into main Oct 1, 2025
1 check passed

Alkarex deleted the dependabot/composer/development-dependencies-856bd62d55 branch October 1, 2025 08:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the development-dependencies group with 3 updates #38

Bump the development-dependencies group with 3 updates #38

Uh oh!

dependabot bot commented on behalf of github Oct 1, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump the development-dependencies group with 3 updates #38

Bump the development-dependencies group with 3 updates #38

Uh oh!

Conversation

dependabot bot commented on behalf of github Oct 1, 2025

2.1.29

Improvements 🔧

Bugfixes 🐛

Function signature fixes 🤖

Internals 🔍

2.1.28

Improvements 🔧

2.0.7

4.0.0 - 2025-09-16

Changed

Fixed

Other

Statistics

4.0.0RC1 - 2025-06-18

Changed

Fixed

Changelog

[3.13.4] - 2025-09-05

Fixed

[3.13.3] - 2025-09-04

Added

Changed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant