[dependabot]

Bumps vimeo/psalm from 5.26.1 to 7.0.1.

Release notes

Sourced from vimeo/psalm's releases.

7.0.1

What's Changed

Fixes

• Report each property write in a restricted purity context once by @​danog in vimeo/psalm#13067
• [7.x] Cut peak memory 22 to 25% (4.6 to 3.6 GB on Laravel) by stopping workers before unpacking their results by @​jarstelfox in vimeo/psalm#12573
• Fix: code used only from __destruct and other magic methods is reported unused by @​alies-dev in vimeo/psalm#13069
• Don't report strtolower() of a Stringable object as redundant by @​jirkace in vimeo/psalm#12598
• Fix: __callStatic and the code it uses reported unused by @​alies-dev in vimeo/psalm#13073
• Don't crash on a constant dividing by a zero constant of another class (#12066) by @​jirkace in vimeo/psalm#12761
• fix(readonly): promoted properties of a readonly class are readonly by @​jirkace in vimeo/psalm#12909
• fix(var-docblock): a @​var line without a name does not take the name of the previous line by @​jirkace in vimeo/psalm#12670
• fix(messages): say that the (unset) cast was removed in PHP 8.0 by @​jirkace in vimeo/psalm#12824
• fix(messages): explain impossible negated checks and calls without effect by @​jirkace in vimeo/psalm#13006
• fix(types): array intersected with iterable is an array of the iterable's types by @​jirkace in vimeo/psalm#13004
• fix(messages): do not tell to install a polyfill that may not ship the symbol by @​jirkace in vimeo/psalm#12813

Docs

• Document that taint analysis runs by default by @​roxblnfk in vimeo/psalm#13072

Internal changes

• Add regression tests for 92 issues already fixed in Psalm 7 by @​alies-dev in vimeo/psalm#13063
• Let a Psalm process of the end-to-end tests run for 300 seconds by @​jirkace in vimeo/psalm#12613
• Push the files composer build regenerates instead of failing by @​danog in vimeo/psalm#13138

New Contributors

• @​roxblnfk made their first contribution in vimeo/psalm#13072

Full Changelog: vimeo/psalm@7.0.0...7.0.1

Psalm 7

Announcing the release of Psalm 7!

Featuring a simply enormous number of new features and bug fixes, such as:

• security analysis on by default: fully refactored for 10x+ performance and much greater coverage, in the same run as type checking and dead code detection;
• much deeper security analysis taint tracking: NoSQL, LLM prompt and URL injection, new sources like php://input and uploaded file names, flows through closures, generators, traits and by-reference parameters, and ready-made stubs for Guzzle, PSR-7, Monolog, MongoDB and more.
• a new purity model based on Hack's capabilities: declare exactly which side effects a function may have (io, time, write-props...), with purity templates for classes, closures and automatically inferred annotations;
• graph-based dead code detection: If nothing reachable uses a class, function, method, constant, variable, etc, Psalm finds it, now properly handling unused cycles as well.
• Template defaults (@template TError of Throwable = RuntimeException) for classes, functions and methods: Result<int> just works, and libraries can add templates without breaking their users.
• PHP 8.5 and 8.6 support: Full support for Partial Function Application, the pipe operator, and much more!
• Daily releases. Features and fixes reach you the day they land, no more waiting on dev-master.
• Framework plugins in the box. The PHPUnit, Symfony, Laravel, Mockery and sabre/event plugins ship with Psalm and switch on by themselves. Zero setup.
• a bigger Psalm maintainer team: @​alies-dev has joined the Psalm maintainer team, contributing many new useful features and bugfixes!
• An official Discord community!
• And so, so many other new features and bugfixes!

Psalm 7 runs on 64-bit PHP 8.2 to 8.6. Upgrading is simple for most projects: see Upgrading below.

Security analysis: faster, always on, in a single run

... (truncated)

Commits

• c390923 Update the files composer build generates
• 6a88f99 Merge pull request #13138 from danog/auto-push-composer-build
• 356d3a8 Check composer build patches with a copy of the checker and parse-mode tokens
• 8b3bfa2 Only push composer build patches that change generated data files
• b0f46ed Push the files composer build regenerates instead of failing
• 6a8c211 Merge pull request #12813 from jirkace/fix-12234
• 5bb65c1 Merge pull request #13004 from jirkace/fix/11183-array-implements-iterable-do...
• eacc973 Merge pull request #13006 from jirkace/fix/11053-clearer-impossible-and-unuse...
• f520ba7 Merge pull request #12824 from jirkace/fix-11639
• 9f1ed18 Merge pull request #12670 from jirkace/fix/8461-var-docblock-var-id-carryover
• Additional commits viewable in compare view