Skip to content

Update all non-major dependencies - #147

Merged
dragosprotung merged 1 commit into
mainfrom
renovate/all-minor-patch
Aug 24, 2026
Merged

Update all non-major dependencies#147
dragosprotung merged 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
carthage-software/mago ^1.27.1 → ^1.47.3 age adoption passing confidence
phpstan/phpstan ^2.1.54 → ^2.2.9 age adoption passing confidence
phpstan/phpstan-deprecation-rules ^2.0.4 → ^2.0.5 age adoption passing confidence
phpstan/phpstan-phpunit ^2.0.16 → ^2.0.18 age adoption passing confidence
phpstan/phpstan-strict-rules ^2.0.11 → ^2.0.12 age adoption passing confidence
phpstan/phpstan-symfony ^2.0.17 → ^2.0.20 age adoption passing confidence
phpunit/phpunit (source) ^11.5.55 → ^11.5.56 age adoption passing confidence

Release Notes

carthage-software/mago (carthage-software/mago)

v1.47.3: Mago 1.47.3

Compare Source

Mago 1.47.3

Mago 1.47.3 improves pipe expressions, numeric inference, match narrowing, readonly offsets, nullsafe chains, and loop control.

✨ Features

Analyzer
  • Integer ranges: infers ranges when bounded float arithmetic is cast to int. (#​2232, 506066a)
Formatter
  • Pipe formatting: adds preserve-breaking-pipe-expression to retain existing line breaks. (#​2141, 0cfc8ec)

🐛 Bug Fixes

Analyzer
  • Nullsafe chains: narrows receivers after a nullsafe chain is proven non-null. (#​2226, 4e678b8)
  • Readonly offsets: allows offset writes through readonly properties holding ArrayAccess objects. (#​2227, af3c576)
  • Pipe expressions: preserves generic return types through pipe partial applications. (#​2141, 0cfc8ec)
  • Numeric-string unary ops: models signs, increments, and decrements as PHP does. (#​2229, 9316487)
  • Boolean match arms: narrows the original subject for instanceof conditions. (#​2231, d6cdf19)
  • Switch loop levels: resolves numeric break and continue levels across switch. (#​2233, c5eff01)

🏗️ Internal

Performance
  • Match allocations: avoids allocating synthetic variable names during match analysis. (4c2581f)

🙏 Thank You

Contributors

No external pull requests were merged for this release.

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.47.2...1.47.3

v1.47.2: Mago 1.47.2

Compare Source

Mago 1.47.2

Mago 1.47.2 prevents invalid UTF-8 reporting crashes, preserves formatter semantics, and fixes several analyzer false positives.

🐛 Bug Fixes

Analyzer
  • Static class-string calls: preserves generics returned by static factories. (#​2220, 0766957)
  • Array assignments: reports undefined target variables once. (#​2219, 1705475)
  • Promoted property hooks: analyzes hook bodies and records method usage. (#​2218, 0936c30)
Formatter
  • Invoked constructs: preserves required parentheses around invoked require expressions. (#​2221, 38f9e2a)
Reporting
  • Invalid UTF-8: preserves source offsets and prevents rich-reporting panics. (#​2222, e91cc71)

🏗️ Internal

Maintenance
  • Shared internals: deduplicates closure typing, call analysis, and linter utilities. (1668678)
  • Analyzer linting: cleans up Clippy findings after the shared refactor. (782d2cc)

🙏 Thank You

Contributors

No external pull requests were merged for this release.

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.47.1...1.47.2

v1.47.1: Mago 1.47.1

Compare Source

Mago 1.47.1

This patch release has no user-facing changes. It fixes the release pipeline so every supported target and crate can be published successfully.

🏗️ Internal

Release Pipeline
  • PHP SDK tests: skips integration tests when PHP or Composer dependencies are unavailable. (7f9e4ff)
  • Extension crate: adds mago-extension to the crate publishing order. (68c0818)

Full Changelog: carthage-software/mago@1.47.0...1.47.1

v1.47.0: Mago 1.47.0

Compare Source

Mago 1.47.0

Extensions in any language, Sponsored by CHECK24

Thanks to CHECK24 (@​check24-opensource) for sponsoring Mago's new Extension API and PHP SDK.

✨ Features

Extensions
  • Extension API: adds language-neutral workers, a PHP SDK, custom lint rules, analyzer plugins, and CLI tooling. (#​2192)

See the extension documentation to get started.

Analyzer
  • --skip-ignores: disables configured analyzer ignores for a run. (#​2191, f05c849)
  • Array key narrowing: narrows a key after a successful array_key_exists check. (#​2199, c58e48b, 7cc1739)

🐛 Bug Fixes

Analyzer
  • Logical assignments: merges assignments made by short-circuited right-hand expressions. (#​2176, a53bc78)
  • Magic properties: treats magic properties as possibly undefined. (#​2177, cea8d53)
  • Nullable inference: preserves null when inferring into a mixed parameter. (#​2175, 97988bb)
  • Scalar narrowing: prevents scalar intersections from collapsing incorrectly to never. (#​2179, #​2206, 8d34248, c8bd837)
  • Flow structures: returns Flow's concrete StructureType from type_structure(). (#​2186, ccde5ae)
  • Diagnostic casing: preserves method-name casing in unused-method diagnostics. (#​2187, 13090af)
  • Required interfaces: keeps requirement metadata without inheriting interface members. (#​2189, e5a949e, 874ffac)
  • Match subjects: evaluates method-call subjects once for exhaustive matching. (#​2190, #​2208, 7a7faa1)
  • Private trait methods: stops inheriting private trait methods into child classes. (#​2188, 8a8958a)
  • Switch entry flow: keeps independently selected cases reachable after a terminating case. (#​2185, efe7526)
  • Method assertions: invalidates cached nested call results after mutating calls. (#​2180, 353233b)
  • Bool templates: recognizes bool-constrained templates in comparisons. (#​2172, b84241a)
  • Omitted generics: treats missing generic arguments as erased wildcards. (#​2178, f1e029b)
  • Docblock symbols: reports undefined types in class-level member and mixin tags. (#​2193, 2c59ad3)
  • Compound conditions: removes order-dependent impossible-comparison diagnostics. (#​2195, 7ca65e2)
  • Nullable object shapes: preserves object-shape fields in nullable docblock unions. (#​2200, 5029124)
  • Global annotations: honors @var docblocks on global statements. (#​2181, #​2202, a7023c7)
  • Callable class strings: recognizes invokable classes in callable class-string bounds. (#​2207, f77c965)
  • Closure identity: recognizes every closure as an instance of Closure. (#​2203, d54d88e)
  • Symbol references: preserves source files for references returned to extensions. (#​2211, aabe675)
  • Unresolved dependencies: analyzes class bodies and exposes missing dependencies to extensions. (#​2212, 24c9304, f1558d4)
  • Class constants: canonicalizes class names when recording constant references. (#​2213, b59529d)
  • Missing property types: checks declarations without default values. (#​2201, 2e4260f)
Codex
  • @api metadata: preserves @api on properties, methods, and constants. (#​2214, 37450cd)
Linter
  • Language constructs: excludes clone, exit, and die from ambiguous function calls. (#​2196, 828cc42)
PHPDoc Syntax
Prelude
  • Imagick classes: adds missing Imagick class stubs, including ImagickPixel. (#​2210, 5e9b671)
Extensions
  • Windows startup: prevents an authentication race when extension workers connect. (111413a)
WASM
  • Telemetry: excludes unavailable extension orchestrator telemetry from WASM builds. (9e8b752)

📖 Documentation

Extensions
  • Extension guide: documents the architecture, PHP SDK, analyzer plugins, and custom rules. (7d67272)
  • Starter template: recommends the extension template as the quickest starting point. (bb98a97)
Website
  • Version order: lists documentation versions newest first. (#​2204, ffd725e)
  • Rule reference: refreshes the generated linter rule documentation. (3597d38)

🏗️ Internal

Maintenance
  • Codex types: removes dead APIs and deduplicates type and comparator machinery. (3a28052, 3d301af, acd2d56)
  • Analyzer internals: removes dead code and deduplicates reconciler and resolver logic. (02b352e)
  • Formatter internals: simplifies presets, comments, alignment, and printer machinery. (e07980f, e595c13)
  • Shared cleanup: deduplicates extension, codex, analyzer, and linter internals. (4b68329)
  • Clippy policy: updates lint allowances for module roots and rest-pattern maintenance. (82b7522, 2053081, 332368a)
  • Sponsors: refreshes the generated sponsor list. (8cec88c)

🙏 Thank You

Special thanks to CHECK24 for fully funding the Extension API's full-time development.

Contributors

A huge thank you to everyone who contributed code to this release:

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.46.0...1.47.0

v1.46.0: Mago 1.46.0

Compare Source

Mago 1.46.0

This release fixes a workflow-command injection in the GitHub reporting format (GHSA-f256-xqf4-x8pr), adds a redundant-static linter rule and a --stats shorthand, corrects a batch of generic-narrowing and late-static-binding false positives across the analyzer and codex, and speeds up the PHP parser.

🔒 Security

Reporting
  • Workflow-command injection: escapes untrusted values written to workflow commands and log records. (GHSA-f256-xqf4-x8pr, cc8d5e4)

Reported by Liyi Zhou, Ziyue, Strick, Maurice, and Chenchen of the University of Sydney.

✨ Features

Linter
  • redundant-static: reports static in a final class where self is equivalent. (#​2154, ef06262)
CLI
Prelude
  • json_validate: asserts non-empty-string when the call succeeds. (#​2155, 198f2b4)

🐛 Bug Fixes

Analyzer
  • Array entry narrowing: narrows possibly-absent entries on the parent shape, independent of conjunct order. (#​2132, 2af1cbc, 784b93b)
  • Attribute arguments: validates the types of attribute constructor arguments. (#​2161, ebf2f8d)
  • Switch labels: detects duplicate and unreachable case labels. (#​2162, 4119141)
  • Mutation-free calls: narrows repeated calls to mutation-free methods. (#​2138, b6e97ee)
  • Identical arrays: folds comparisons between identical arrays. (#​2149, c2c7bb4)
  • Late-static returns: preserves late-static types in generic return positions. (#​2151, fe272b8)
  • void conditionals: stops demanding a return from conditionals in void functions. (#​2160, bd85d70)
  • self in attributes: resolves self in attributes applied to class-likes. (#​2168, 7f88255)
  • Specialized generics: accepts class-strings of specialized generic classes. (#​2171, b0b0b91)
  • Narrowing leaks: prevents method-call narrowing from leaking across scopes. (42cfd1f)
Codex
  • Bounded templates: allows instanceof narrowing of generics parameterised by a bounded template. (#​2135, a45ffec, 8b2edf6)
  • Template defaults: populates default template arguments when the generic argument is omitted. (#​2140, aff9ce8)
  • Static return types: preserves generic parameters in static return types. (#​2145, 327ca0a)
  • void with never: keeps void when combined with never. (#​2159, 864d0f7)
  • Late-static rebinding: guards exact late-static type rebinding. (fcd42ec)
Linter
  • Naming suggestions: suppresses invalid suggestions for constants starting with a number. (#​2158, 7c54906)
  • missing-docs: renames the exclusion config field. (#​2134, a5eab2d)
Syntax
  • Method return types: parses grouped static method return types in docblocks. (#​2152, 06871ea)
  • String interpolation: limits recursion when parsing interpolated strings. (3610502)
Prelude
  • Attribute: adds the missing TARGET_CONSTANT constant. (9bef302)
Composer
  • Availability markers: unbreaks self-analysis of the availability markers. (#​2169, 209f980)

📖 Documentation

Reporting

🏗️ Internal

Performance
  • Parser: streamlines the PHP parser hot paths. (1ec8868)
Analyzer
  • Unused templates: uses loop labels for the unused-template checks. (#​2133, b4aa9ad)
  • Tests: removes invalid attribute stubs. (4d9c611)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.45.0...1.46.0

v1.45.0: Mago 1.45.0

Compare Source

Mago 1.45.0

This release teaches the analyzer to build keyed array shapes from get_object_vars(), adds @param-closure-this support and an auto-fix for overly-wide return types, introduces a linter rule preferring DateTimeImmutable::createFromTimestamp(), fixes a batch of analyzer false positives, and makes empty reports valid SARIF/JSON documents for CI.

✨ Features

Analyzer
  • get_object_vars() shapes: returns keyed array shapes built from the object's visible properties. (#​2110, a729ce1)
  • @param-closure-this: supports the docblock tag for typing a closure parameter's $this. (#​2131, 6000d41)
  • Overly-wide return types: adds an auto-fix that narrows the declared return type. (#​2068, #​2120, 9e4d186)
Linter
  • prefer-datetimeimmutable-create-from-timestamp: suggests the factory over new DateTimeImmutable('@...'). (#​2118, 38b6152)

🐛 Bug Fixes

Analyzer
  • Readonly promotion: detects reinitialization of promoted readonly properties in parent constructors. (#​2127, 490452e)
  • Escaping breaks: preserves breaks that escape nested loops in reachability analysis. (#​2124, 635eeab)
  • Guarded members: tracks method_exists guards on descendant members. (#​2125, d1b6e9c)
  • PSL analysis: eliminates false positives when analyzing PSL-based code. (6527f24)
  • array_map shapes: preserves array shapes for untyped closures. (#​2122, 816578a)
  • Catch variables: refines definedness for precise conditions in try/catch. (#​2119, aa469b9)
  • Hooked properties: tracks property-hook writes against the read type. (#​2112, bd95ea5)
  • Split property types: supports distinct @property-read and @property-write types. (#​2079, #​2108, b54a881)
  • @property visibility: resolves tags according to call-site visibility. (#​2106, a4b077d)
Codex
  • Enum case literals: infers literal values from class constants, tightening integer conditions. (#​2111, 237465e)
Prelude
  • array_diff: relaxes value parameters to string-castable types. (#​2116, f290239)
Reporting
  • Empty reports: emits valid SARIF, JSON, GitLab, and Checkstyle documents when there are no issues. (#​2128, 003ff32)
Playground
  • Analyzer settings: forwards playground settings so they take effect. (#​2121, 4184888)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.44.0...1.45.0

v1.44.0: Mago 1.44.0

Compare Source

Mago 1.44.0

A faster release with stronger dependent-type analysis, richer guard and linter configuration, and fixes across the CLI, formatter, analyzer, and semantics.

✨ Features

Analyzer
  • Override return types: reports overriding methods that omit a declared return type. (#​2100, 90c04c0)
Linter
  • no-missing-format-argument: detects missing format arguments. (#​2062, 38857dd)
  • missing-docs exclusions: supports configurable exclusions. (#​2102, 4488055)
  • Disallowed symbol levels: configures levels for functions and type instantiations. (#​2101, 34ed400)
Guard
  • @final validation: supports the annotation during structure validation. (#​2065, 78cbbf0)
  • Restrictions: supports dependency restrictions and public-method allowlists. (#​2074, 8d6d359)
CLI

🐛 Bug Fixes

Analyzer
  • Dependent types: resolve them across calls, partials, unpacks, and intersections. (a629700, a231709, 81be763)
  • Integer conditions: preserve ranges for correct impossible and redundant-condition reports. (#​2085, #​2087, 2037b9a, 6d71045)
  • Loop conditions: stabilize types and avoid false diagnostics in do-while iterations. (#​2078, 0205e49, 7afc4eb)
  • isset flow: retains unsafe access and try/catch uncertainty after failed checks. (#​2076, #​2096, b70350c, 23203e5)
  • Readonly initialization: accepts deferred initialization of readonly properties. (#​2095, ad495bd)
  • Magic methods: resolves @method calls backed by inherited methods. (#​2089, fda90f8)
  • Mixin receiver types: binds $this and static to mixin receivers. (#​2086, 07086c5)
  • Property overrides: reports incomparable override types. (#​2103, 80dbbfe)
  • Dynamic property names: reports $property, not $$property. (#​2066, 5d2116d)
  • PHPDoc returns: permits void in nullable docblock return types. (#​2081, #​2082, cdfd166)
  • Optional shapes: recognises optional string-keyed shapes as lists. (#​2073, b15f9e1)
Codex
  • Enum case identity: distinguishes cases during type identity checks. (#​2071, 683220c, 2637cf8)
  • Backed enum values: preserves literal values from known ->value access. (#​2064, 45ad41b)
  • Trait bounds: accepts exact @require-extends classes when validating traits. (#​2069, 84c0766)
Semantics
  • Enum magic methods: permits __call, __callStatic, and __invoke. (#​2075, d0487f2)
Linter
  • Namespaced imports: prevents overlapping fixes in global function imports. (#​2072, 9b40611)
Formatter
Guard
CLI
Distribution
  • Composer package: excludes the repository-only tests suite. (#​2098, 722e39b)

🏗️ Internal

Performance
  • Formatter: reduces printer and pipeline overhead. (f6520a2, ed94713)
  • Linter: reduces traversal and allocation overhead. (d818460)
  • Project analysis: speeds up end-to-end analysis and word interning. (d473383, c0d27c6)
Toolchain
  • Rust: bumps the minimum Rust version to 1.97.0 and removes the nightly pin. (8c8262e, a43077b)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

Renovate Bot

@renovate

renovate Bot commented May 18, 2026

Copy link
Copy Markdown
Contributor Author

automergeComment

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from d1465dd to 87e2a64 Compare May 24, 2026 10:57
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 51173ad to 1ea9530 Compare May 29, 2026 17:30
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 7b153a6 to f0e0422 Compare June 5, 2026 15:12
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 6615530 to f9b83de Compare June 19, 2026 08:58
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from bb7bfb5 to 23716de Compare July 1, 2026 01:44
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 5a39bcc to d57bdf8 Compare July 6, 2026 20:40
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 006d4b4 to 36c9669 Compare July 19, 2026 10:39
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 34c9773 to 91107be Compare July 29, 2026 20:39
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 91107be to d5f6776 Compare August 6, 2026 23:11
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from d5f6776 to e211092 Compare August 23, 2026 03:50
@renovate
Update all non-major dependencies
a767335 
| datasource | package                           | from    | to      |
| ---------- | --------------------------------- | ------- | ------- |
| packagist  | carthage-software/mago            | 1.27.1  | 1.47.3  |
| packagist  | phpstan/phpstan                   | 2.1.54  | 2.2.9   |
| packagist  | phpstan/phpstan-deprecation-rules | 2.0.4   | 2.0.5   |
| packagist  | phpstan/phpstan-phpunit           | 2.0.16  | 2.0.18  |
| packagist  | phpstan/phpstan-strict-rules      | 2.0.11  | 2.0.12  |
| packagist  | phpstan/phpstan-symfony           | 2.0.17  | 2.0.20  |
| packagist  | phpunit/phpunit                   | 11.5.55 | 11.5.56 |
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from e211092 to a767335 Compare August 24, 2026 07:04
@dragosprotung
dragosprotung merged commit 066a9d2 into main Aug 24, 2026
8 checks passed
@dragosprotung
dragosprotung deleted the renovate/all-minor-patch branch August 24, 2026 07:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Subject: Dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dragosprotung