[Conductor] Update dev

[private-packagist]

This PR was automatically generated by Conductor.

The PR contains the changes generated by running the following command:

composer update phpstan/phpstan:2.3.1 phpstan/phpstan-phpunit:2.1.1 phpunit/phpunit:10.5.66 rector/rector:2.7.0 --with-all-dependencies --minimal-changes

Changelog

phpstan/phpstan (Source: GitHub Releases)

2.3.1

Same performance, smaller package

We've heard your feedback. PHPStan 2.3.0 was chonky! It weighed 104 MB when downloaded and 268 MB after being unzipped in your vendor/.

Afer #​6703, PHPStan 2.3.1 weighs just under 28 MB when downloaded and 87 MB unzipped.

Improvements 🔧

• Ship the turbo extension as a shared core plus a thin extension per PHP version (#​6703), #​15423
• Build Linux ZTS turbo binaries for PHP 8.3-8.5 too (#​6706), #​15422
• Allow PHP 8.6 in phpstan/turbo (Composer PIE package) (#​6705)

Bugfixes 🐛

• Keep the openssl cipher probe's warnings inside the probe (#​6372), #​15176, thanks @​SanderMuller!
• Create the implicit throw point of a constructor on the new expression (#​6687), #​15396, thanks @​janatjak!
• Read the updated value of consumed prefix mutations (#​6692), #​15411, thanks @​drewmt!
• Cache a function reflection under the file that declares it (#​6698), thanks @​SanderMuller!
• Do not export what is declared inside a function or method body (#​6699), thanks @​SanderMuller!

Performance 🏎️

• Check original type for unresolvable types only when resolved type has one (#​6675), thanks @​Kocal!
• Keep the restored result cache out of forked workers' memory (#​6686), #​15387, thanks @​janedbal!
• Save the result cache when a file has a parse error (#​6694), thanks @​SanderMuller!

Internals 🔍

• Start the cold run of the warm-rewrite test in a new second (#​6697), thanks @​SanderMuller!

2.3.0

This release fixes a whopping 75 issues! 🚀

Read about PHPStan 2.3.0 on the blog » I promise it's worth checking it out yourself, and not just letting your agent summarize it for you 😉 It contains a lot of interactive widgets with practical examples of the new features in action.

Major leap in performance. Back in December 2025 with PHPStan 2.1.33, as an example, analysing WordPress core took 60 seconds. With today's PHPStan 2.3.0, it takes under 8 seconds. Similar performance speedups can be observed across many codebases.

PHPStan Turbo speeds up PHPStan by 60% over the no-Turbo baseline.

Bleeding edge 🔪

• Generics: no more scalar generalization, multi-pass inference for new Foo() from usages, aka "Bidirectional type narrowing" (#​6332), #​6732, #​12704, #​10419, #​14647, #​13431, #​12601, #​12490, #​12420, #​11835, #​11435, #​10290, #​10289, #​5741, #​8031, #​10783, #​15147, #​13325
• Detecting unused variables (#​6330), #​12789, #​12012, #​11483, #​10202
• Unused variables: Report variable writes whose value never reaches a use, per array offset (#​6334)
• Infer signatures of closures from where their values are sent (#​6604, #​6622), #​11317, #​3770
• Apply the effects of a closure's by-ref uses where it is invoked (#​6610), #​7751, #​14248
• Infer the type of a static variable from what the function body does with it (#​6617, #​6619), #​7066

If you want to see the shape of things to come and adopt bleeding edge features early, you can include this config file in your project's phpstan.neon:

includes:
	- vendor/phpstan/phpstan/conf/bleedingEdge.neon

Of course, there are no backwards compatibility guarantees when you include this file. The behaviour and reported errors can change in minor versions with this file included. Learn more

Improvements 🔧

• Single-pass inside-out internals rewrite (#​5857), #​13944, #​12207, #​7155, #​14396, #​11953, #​12780, #​14999, #​13334, #​15004
• Implement @​pure-unless-parameter-passed (#​6018, #​6666), #​11884, thanks @​zonuexe!
• Check preg_quote delimiters in array patterns (#​6474), thanks @​arpitjain099!
• Resolve static::FOO_* and T::FOO_* PHPDoc types once the class is known (#​6638), #​4548, #​11510

Bugfixes 🐛

• Keep property fetches on the receiver when a static method or static closure invalidates it (#​6391), #​13735, thanks @​staabm and @​SanderMuller
• Derive conditional guard types from the branch set difference (#​6380), #​13833, #​9685, #​7706, #​14421
• Build a loop's back edge from its continue statements when the body end is unreachable (#​6420), #​14418, #​13959, #​11919, #​1946
• Widen only the variables a loop can write when its scope converges (#​6421), #​12666
• Infer closure parameter types in array arguments (#​6422), #​6430, #​11215
• Resolve generic parameter types from an array literal argument's skeleton before typing the closures nested in it (#​6482), #​15269
• Preserve conditional expression holders across more scope merges (#​6385), #​9628, #​6830
• Narrow optional array offsets through isset() conditions (#​6382), #​9426, #​6379, #​12786
• Do not read PHP_SBINDIR and PHP_BUILD_PROVIDER off the analysing machine (#​6454), thanks @​SanderMuller!
• Honour the composer.json require.php constraint in Scope::getPhpVersion() (#​6476), #​15270, thanks @​staabm and @​VincentLanglet!
• Skip @​phpstan-assert, conditional return types and call effects when the nullsafe chain may short-circuit (#​6486), #​15016, #​12925, thanks @​VincentLanglet and @​staabm!
• NativeTypedClassConstantRule is scope php-version aware (#​6497), #​13133, thanks @​staabm!
• Keep never in MutatingScope::intersectButNotNever() instead of widening it to null (#​6504), #​15285
• Resolve "supported only on PHP X" checks from Scope::getPhpVersion() instead of the injected PhpVersion (#​6496), #​13133, thanks @​staabm and @​VincentLanglet!
• Resolve property, trait constant, arrow function never and attribute PHP version checks from Scope::getPhpVersion() (#​6510), #​13133, thanks @​staabm and @​VincentLanglet!
• Resolve the printf format parser's PHP version check from Scope::getPhpVersion() (#​6536), thanks @​staabm!
• Resolve PHP version checks in src/Type/Php extensions from Scope::getPhpVersion() (#​6551), thanks @​staabm!
• Resolve PHP version checks in remaining scope-aware extensions from Scope::getPhpVersion() and forbid injecting PhpVersion into them (#​6563), #​15287, thanks @​staabm and @​SanderMuller!
• DeprecatedCastRule: Utilize Scope::getPhpVersion() (#​6600), thanks @​staabm!
• Do not cast floats past the int range, or NAN, where PHP does not (#​6541)
• Ask isCallable() of callable-like arrays and strings only where the answer is consumed (#​6559), #​15292
• Narrow the left side of ?? to null in a non-true context only when its other values cannot satisfy it (#​6581)
• Memoize hasInstanceProperty() into its own cache (#​6597)
• Keep an empty array next to an oversized array in a union (#​6609)
• Do not report a private method overriding a private trait method as unused (#​6191), #​12201, thanks @​Jean-Beru!
• Keep the narrowed bound of a template type that TemplateTypeHelper::resolveTemplateTypes() maps to itself (#​6613), #​15321, thanks @​staabm!
• Do not remember a void equality assertion statement as true when its arguments contain an impure call (#​6625), #​15328
• Compare the element type of a variadic by-ref parameter against its out type (#​6227), #​15066, thanks @​SanderMuller!
• Keep unresolved template arguments of different sites apart, solve covariant ones like Hack (#​6650), #​15331

Performance 🏎️

• Turbo now shadows majority of the analyser engine (#​6499, #​6503, #​6506, #​6508, #​6509, #​6511, #​6521, #​6523, #​6530, #​6532, #​6533, #​6535)
• Resolve constant offsets on constant arrays through the key index (#​6442)
• Speed up enum-case removal, finite type counting, large unions and loop widening of shapes (#​6443)
• Memoize PhpMethodReflection::getName() and return the right operand on a TypeCombinatorCache memo hit (#​6489)
• Harden Turbo traversal, arena, and iterable parity (#​6538)
• Build smaller turbo binaries (#​6552)
• Pass immutable array arguments non-refcounted through zv::Args (#​6561), thanks @​zonuexe!
• Cheaper file cache, type memo bookkeeping and expression-key lookups (#​6568)
• Share one NamespaceUses between the name scopes of a file (#​6583), #​15304
• Share one NamespaceUses between the exported PHPDocs of a file (#​6585)
• Share one contents string per unchanged file in FileNodesFetcher (#​6589), #​15314, thanks @​rubas!
• ParentDirectoryRelativePathHelper: Move repetitive work into constructor (#​6611), thanks @​staabm!
• Make closure signature and static variable inference cheaper (#​6623)
• Faster runs with a warm result cache (#​6627)
• Do not export functions declared inside functions (#​6637)
• Lazier verbosity in ConstantArrayType->checkOurKeys() (#​6649), thanks @​staabm!
• ConstantArrayType: reduce duplicate work in checkOurKeys() (#​6661), thanks @​staabm!
• Return dependencies in the results of the handlers (get rid of old DependencyResolver) (#​6662)
• Add TypeTraverser::mapMemoized() (#​6652), #​15348, thanks @​staabm and @​SanderMuller!

Function signature fixes 🤖

• Declare mutually exclusive constant groups for json_encode, json_decode, filter_var, filter_input, openlog and ZipArchive::open flags (#​6571), #​15306, thanks @​VincentLanglet!
• Generalize keys and values of oversized arrays in ConstantTypeHelper::getTypeFromValue() like OversizedArrayBuilder (#​6572), #​15305, thanks @​staabm!
• Fix stale phpredis signatures in functionMap (#​6587)

Internals 🔍

• Result cache: value and file dependencies declared on the scope (#​6638, #​6644, #​6659), #​15144, phpstan/phpstan-symfony#​455
• Deprecate ResultCacheMetaExtension (phpstan/phpstan-src@​f9140a2)
• OpenSslCipherMethodsProvider: track the supported ciphers as values (phpstan/phpstan-src@​339e91e)
• test: update literal types after template union fix (#​6404), thanks @​calebdw!
• Extract parts of NodeScopeResolver into smaller classes (#​6433)
• Declare the turbo shadowing classes under their real names at activation (#​6490)
• Lint, sanitize and harden the native build (#​6518)
• Let a rule listen for several node types #​6540
• Reuse turbo extension binaries compiled from identical build inputs (#​6588)
• Find the base phar checksum artifact by name (#​6633), thanks @​SanderMuller!
• Use stricter assertions in tests (#​6640), thanks @​staabm!

2.2.17

This is the last release in 2.2.x series. Look forward to PHPStan 2.3.0 which is going to be released next week with the following highlights:

• Massive leap in performance (again!)
• Generics improvements (bidirectional type narrowing which closes #​6732 and dozens of duplicate issues)
• Unused variables detection

Here's what new and changed in PHPStan 2.2.17:

Improvements 🔧

• Compile PHP 8.6 turbo binaries against 8.6.0RC2 (#​6599)
• Build Linux ZTS turbo binaries for PHP 8.6+ (#​6657)
• Point method visibility errors at the method, not its first attribute (#​6630), #​14398, thanks @​Cayan!

Bugfixes 🐛

• Cache parsed ASTs behind the path routing, one cache per parser (#​6569), #​15231, thanks @​SanderMuller!
• Keep optional groups optional within a matched regex alternation branch (#​6596), #​15297
• Do not track string keys of an unpacked non-literal expression in DuplicateKeysInLiteralArraysRule (#​6635), #​15295, thanks @​VincentLanglet and @​staabm!

Performance 🏎️

• Cache a class's ancestors without the class itself (#​6593), thanks @​SanderMuller!

Function signature fixes 🤖

• Fix the return type of SessionHandler::read() to string|false (#​6639), thanks @​Firehed!

Internals 🔍

• Load dead-code-detector in self-analysis only on PHP 8.2 and later (#​6591), thanks @​SanderMuller!
• Mutation testing: diff against a configured branch, cover only the changed files (#​6664)

phpstan/phpstan-phpunit (Source: GitHub Releases))

2.1.1

• 8d16b84 - AssertEmptyIsDiscouragedRule is auto-fixable (#​342)
• b73700a - Make AssertSameWithCountRule auto-fixable (#​259)
• ac3237e - Skip named and unpack arguments when autofixing

2.1.0

• a31e9de - Merge remote-tracking branch 'origin/2.0.x' into 2.1.x
• 626549b - Merge pull request #​336 from phpstan/renovate/github-actions
• ca0a5ae - Update github-actions
• c38f716 - Merge 2.0.x into 2.1.x
• 0d17121 - AssertEmptyIsDiscouragedRule: use unique error identifier
• 414a487 - feat: Discourage assert(Not)Empty if "empty" usage is disallowed (#​325)
• 3320043 - Merge remote-tracking branch 'origin/2.0.x' into 2.1.x
• ba569da - Name the node types DataProviderDataRule wants
• e98eb3d - Require PHPStan 2.3.0
• 33212d9 - Open 2.1.x-dev

2.0.21

• 8dbdc3a - AssertEmptyIsDiscouragedRule: use unique error identifier

AssertEmptyIsDiscouragedRule: in case you are using PHPStan strict-rules assertEmpty: false option, you can ignore the newly added errors by error-identifier phpunit.assertEmpty.

2.0.20

• ef0c8f5 - feat: Discourage assert(Not)Empty if "empty" usage is disallowed (#​325)

AssertEmptyIsDiscouragedRule: in case you are using PHPStan strict-rules assertEmpty: false option, you can ignore the newly added errors by error-identifier phpunit.assertEmpty.

phpunit/phpunit (Source: GitHub Releases))

10.5.66

Changed

• The Software Bill of Materials (SBOM) embedded in the PHAR now uses CycloneDX 1.7 and provides the NTIA minimum elements as well as the data fields that BSI TR-03183-2 (version 2.1.0) requires for logical and identified components, including component creators, original, distribution and effective licences, source code URIs, and the PHP runtime and its extensions as external components

Learn how to install or update PHPUnit 10.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@​phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

rector/rector (Source: GitHub Releases))

2.7.0

New Rules ✨

• Add TernaryToNullsafeCoalesceRector (#​8499)
• Add BoolReturnTypeFromBooleanConstAndStrictReturnsRector for mixed const + strict bool returns (#​8498)
• Add ConstructorReadonlyAssignToDefaultRector for readonly property defaults (#​8502)
• Add RemoveOverriddenAssignBeforeIfElseRector (#​8505)

Performance Improvements 🚀

• Cache class-like name resolution per file version in ShortNameResolver, so name import no longer rescans the whole file for every name - up to ~24 % fewer CPU instructions on large projects (#​8524)
• Cache dry-run files whose FileDiff has no content change (#​8523)
• Key the file cache on project-relative paths, so a cache survives a change of checkout (#​8490)
• Use FileSystem::writeAtomic() in FileCacheStorage to avoid partial cache reads on parallel runs (#​8520)
• Terminate timed-out and unconnected workers (#​8522)
• Fix silently skipped files when the only worker is respawned (#​8521)
• Give the worker the same NDJSON frame limit as the main process (#​8489)
• Bump to PHPStan 2.3

Bugfixes 🐛

• RenamePropertyRector: rename the property both in the trait and in the class property itself (#​8518)
• RenameClassRector: throw on same old and new class in the configuration (#​8515)
• ScalarParamTypeByMethodCallTypeRector: skip string param inference to avoid unsafe scalar coercion (#​8514)
• RepeatedAndNotEqualToNotInArrayRector / RepeatedOrEqualToInArrayRector: skip short-circuit dependent values (#​8516)
• SeparateMultiUseImportsRector: keep trait use adaptations (#​8510)
• Privatize*Rector: drop the final flag when changing protected to private, since private final is forbidden on PHP 8.4 (#​8509)
• AddNameToBooleanArgumentRector / AddNameToNullArgumentRector: skip callees marked @​no-named-arguments (#​8508)
• TypedPropertyFromStrictConstructorRector: skip a protected property redeclared in a child class (#​8503)
• RemoveAlwaysTrueIfConditionRector: skip a maybe-undefined variable (#​8501)
• SingularSwitchToIfRector: skip nested break/continue in the case body (#​8500)
• TypeDeclaration: skip redundant intersection types in union return types (#​8527)
• Naming: keep mass nouns ending in data/info untouched when singularizing (#​8492)

rector-doctrine 🟠

• Add DoctrineQueryBuilderSortDirectionRector (#​524)
• Add DoctrineOrderByAttributeSortDirectionRector (#​525)
• Register the SortDirection rules in the composer-based set and cover Expr\OrderBy::add() (#​530)
• CorrectDefaultTypesOnEntityPropertyRector: support properties initialized as int (#​526)

rector-symfony 🎵

• GetRequestRector: reuse an existing untyped $request param (#​1066)
• CommandConfigureToAttributeRector: do not report a change when nothing is extracted (#​1068)
• Fix PhpAstExtractor import removal in the composer-based Symfony set (#​1070)

rector-phpunit 🟢

• Add WillReturnCallbackFallbackToReturnFalseRector (#​784)
• Extend FlipAssertRector to more assert methods and expected value shapes (#​787)
• AllowMockObjectsForDataProviderRector: skip stub-only ->method() calls (#​790)
• Fix changing keys of data providers for tests with optional arguments (#​783)
• Deprecate ConfiguredMockEntityToSetterObjectRector as experimental (#​789)

Task options

• Recreate commit - Conductor recreates the update commit and overwrites all additional changes made in this branch.
• Details
• Skip - Conductor won't attempt to update the dependency to this exact version again.
• All tasks
• Settings
• Docs

If you close the PR, the task will be skipped and Conductor will schedule the next task. Clicking the "Skip" button in the UI has the same effect. Conductor won't attempt to update the dependency to this exact version again but it will schedule updates to newer versions.

---

Powered by Private Packagist

[private-packagist]

composer.lock

Dev Package changes

Package	Operation	From	To	About
phpstan/phpstan	upgrade	2.2.16	2.3.1	diff
phpstan/phpstan-phpunit	upgrade	2.0.19	2.1.1	diff
phpunit/phpunit	upgrade	10.5.65	10.5.66	diff
rector/rector	upgrade	2.6.7	2.7.0	diff

---

Settings · Docs · Powered by Private Packagist

[private-packagist]

The composer.lock diff comment has been updated to reflect new changes in this PR.