composer (master)(deps-dev): bump the development-dependencies group with 6 updates by dependabot[bot] · Pull Request #315 · mimmi20/laminasviewrenderer-vite-url

dependabot · 2026-08-09T02:10:13Z

Updates the requirements on infection/infection, nikic/php-parser, phpstan/phpstan, phpstan/phpstan-deprecation-rules, rector/rector and rector/type-perfect to permit the latest version.
Updates infection/infection to 0.34.1

Release notes

Sourced from infection/infection's releases.

Bugfixes and internal stuff

Fixed

Do not limit the PHPStan process by the memory usage detected for PHPUnit (infection/infection#3341, infection/infection#3358)

Fix the usage of git when the working directory or infection configuration did not match the git root directory (infection/infection#3403, infection/infection#3399)

Fix the PCOV coverage when covered code is outside of the current working directory (infection/infection#3410, infection/infection#3411)

Docs

Various ADRs additions:

Introduce an ADR for the cache naming convention (infection/infection#3328)

Update the covers annotation ADR (infection/infection#3368)

Document ADRs (infection/infection#3369)

Define the PHP version support policy (infection/infection#3372)

Clarify exception assertions in tests (infection/infection#3373)

Fix typo in ADR005 (infection/infection#3377)

Fix incorrect statement in ADR007 (infection/infection#3378)

Do a review of ADR 0003 (infection/infection#3379)

Add an ADR about our usage of assertEquals in our PHPUnit tests (infection/infection#3375)

Add an ADR for event and subscriber names (infection/infection#3374)

Add an ADR about how the public API is defined (infection/infection#3383)

Fix the ADR numbering by (infection/infection#3420)

Add an ADR for the final usage (infection/infection#3381)

Misc:

Add an implementation map for the execution phases (infection/infection#3349)

Fix a typo in CONTRIBUTING.md by @sanmai (infection/infection#3343)

Internal

Various AutoReview related changes/improvements:

Rename some methods of the IO-Detector (infection/infection#3310)

Fix PHPat I/O detection for PHPUnit covers attributes (infection/infection#3276)

Move the public readonly property check to PHPat (infection/infection#3330)

Move the exceptions of the PHPat public property rule as PHPStan false-positives (infection/infection#3347)

Introduce PHPStan deprecration rules (infection/infection#3331)

Enforce the usage of CannotBeInstantiated (infection/infection#3360)

Remove useless inheritdoc PHPDoc tags (infection/infection#3370)

Add PHPat rule to enforce the ADR 0001 (infection/infection#3371)

Introduce a class reflection utility for PHPat (infection/infection#3380)

Use PHPUnit attributes for environment variables (infection/infection#3398)

A few Docker Sandbox related changes:

Allow maintainers to declare their own kits to personalise their sandboxes (infection/infection#3335)

Allow to commit from the Docker Sandbox by (infection/infection#3336)

Update the usages of docker sandbox by (infection/infection#3338)

... (truncated)

Commits

263a6e3 fix(git): Resolve diff paths from the configuration directory (#3399)
d26b3f9 ai: Add a handoff skill (#3421)
9a92be8 ci: Enable back the integration tests on Windows (#1805)
b273136 doc: Add an ADR for the final usage (#3381)
ecea037 test(ast): Add a benchmark for AST processing (#3088)
42100c4 doc: Fix the ADR numbering (#3420)
7a47012 ci: Ignore zizimor error in the metrics collection workflow (#3419)
39a3927 [Conductor] Update phpunit/phpunit to 12.5.32 (#3418)
4e7ecd3 [Conductor] Update carthage-software/mago to 1.45.0 (#3406)
d6c1b77 ci: Collect performance metrics on release tag pushes (#3416)
Additional commits viewable in compare view

Updates nikic/php-parser to 5.8.0

Release notes

Sourced from nikic/php-parser's releases.

PHP-Parser 5.8.0

Fixed

Treat _ as label character in formatting-preserving pretty printer.

Handle comment after object operator in keyword emulator.

Changed

Drop support for pipe operator in constant expression evaluator. It is not supported in constant expressions and may pose security risks, as it allows calls to arbitrary functions.

void parameter types now generate a (recoverable) error during parsing.

Restored reverse emulation support for fn keywords when targeting PHP before 7.4.

Changelog

Sourced from nikic/php-parser's changelog.

Version 5.8.0 (2026-06-04)

Fixed

Treat _ as label character in formatting-preserving pretty printer.

Handle comment after object operator in keyword emulator.

Changed

Drop support for pipe operator in constant expression evaluator. It is not supported in constant expressions and may pose security risks, as it allows calls to arbitrary functions.

void parameter types now generate a (recoverable) error during parsing.

Restored reverse emulation support for fn keywords when targeting PHP before 7.4.

Version 5.7.0 (2025-12-06)

Fixed

Fixed changing modifier on anonymous class with formatting preserving pretty printer.

Emit an error for unparenthesized arrow functions in pipe operator, and print necessary parentheses in the pretty printer.

Fix PHP 8.5 deprecation warning in php-parse binary.

Changed

When targeting PHP 8.4 or newer, omit parentheses around immediately dereferenced new expressions.

Added

Added shouldPrintRawValue attribute to Scalar\Int_, which makes the pretty printer use the rawValue of the node. This can be used to print integers with separators.

Version 5.6.2 (2025-10-21)

Fixed

Fixed formatting-preserving pretty-printing when changing the visibility modifier on a node that has attributes.

Fixed chr() deprecation warning on PHP 8.5.

Added

Added Param::isFinal() method.

Version 5.6.1 (2025-08-13)

... (truncated)

Commits

044a6a3 Release PHP-Parser 5.8.0
ca145ac Try to fix tests on older versions
c81a0af Test PHP 8.6 in CI
b82d4c2 Handle comment after object operator
49429ef Integration test against PHP 8.5
9c3fe25 Drop support for pipe operator in constant expression evaluator
2e66ec3 Fix PHPStan build on latest release (#1148)
b560dba Add missing label characters in PrettyPrinterAbstract::$labelCharMap (#1150)
50f0d9c Restore FnTokenEmulator (#1141)
0512478 Prevent void param type (#1142)
Additional commits viewable in compare view

Updates phpstan/phpstan to 2.2.7

Commits

See full diff in compare view

Updates phpstan/phpstan-deprecation-rules to 2.0.5

Release notes

Sourced from phpstan/phpstan-deprecation-rules's releases.

2.0.5

67bedd6 - Update github-actions (#197)

6be8bd3 - Update actions/cache action to v6 (#198)

0b310ec - Update github-actions to v3.0.1 (#195)

782d848 - Update github-actions to v7 (#196)

85fff9d - Update github-actions to f3e473d (#194)

54db580 - Update github-actions (#193)

99aff1a - Replace deprecated actions/create-release with softprops/action-gh-release

971f8e1 - Bump GitHub Actions across major versions

89fef35 - Bump GitHub Actions within their current majors

0652358 - Update github-actions

02119cc - Update github-actions

389c78c - latest infection does not support PHP 8.2 (#189)

899202d - Update release-toot.yml (#188)

016d677 - name-collision-detector (#187)

945df12 - Delete .github/workflows/claude-react-on-comment.yml

a70b8b1 - Remove default branch determination from workflow

1faeb2e - Lint workflows

534891e - [StepSecurity] ci: Harden GitHub Actions

3acc664 - Remove PHPSTAN_BOT_TOKEN from checkout step

49efeb2 - React on issues opened and fall back to issue body

319c3f6 - Add PHP 8.5 to CI matrix for lint, tests, and static analysis

73feeba - Add missing export-ignore entries to .gitattributes

c6d73e5 - Add CLAUDE.md with project documentation

f9f68eb - Add Claude React on Comment workflow

Commits

67bedd6 Update github-actions (#197)
6be8bd3 Update actions/cache action to v6 (#198)
0b310ec Update github-actions to v3.0.1 (#195)
782d848 Update github-actions to v7 (#196)
85fff9d Update github-actions to f3e473d (#194)
54db580 Update github-actions (#193)
99aff1a Replace deprecated actions/create-release with softprops/action-gh-release
971f8e1 Bump GitHub Actions across major versions
89fef35 Bump GitHub Actions within their current majors
0652358 Update github-actions
Additional commits viewable in compare view

Updates rector/rector to 2.5.9

Release notes

Sourced from rector/rector's releases.

Released Rector 2.5.9

Bugfixes 🐛

[DeadCode] Remove unreachable class-like checks in Class_-only rules (#8217)

[CodingStyle] Use native php-parser node API over class reflection (#8218)

[Php80] Remove AstResolver usage on AddParamBasedOnParentClassMethodRector (#8196)

Wire RichParser node visitors via DI factory instead of private property hack (#8215)

[Php80] Skip promoting a property the parent declares without a native type in ClassPropertyAssignToConstructorPromotionRector (#8232)

[DeadCode] Keep empty __construct() in anonymous class that extends parent on RemoveEmptyClassMethodRector (#8219)

[DeadCode] Skip negative zero on RemoveDeadZeroAndOneOperationRector (#8213)

[DeadCode] Skip protected property on non-final class on RemoveDefaultValueFromAssignedPropertyRector (#8214)

[DeadCode] Skip array dim fetch assign on RemoveDefaultValueFromAssignedPropertyRector (#8212)

[DeadCode] Skip if/else in loop on RemoveDefaultValueFromAssignedPropertyRector (#8211)

[DeadCode] Skip early return in constructor on RemoveDefaultValueFromAssignedPropertyRector (#8209)

Set changes 🗑️

NullToStrictStringFuncCallArgRector out of the PHP 8.1 set (#8234)

The rule and all its fixtures stay, so it can still be opted into:
->withRules([NullToStrictStringFuncCallArgRector::class])
Deprecations 💀

TypeDeclarationDocblocks: 3 data provider docblock rules (#8235)

Data provider docblock typing is not relevant to code quality — it increases maintenance cost and decreases readability of the test class.

Deprecated rules:

AddReturnArrayDocblockFromDataProviderParamRector

AddReturnDocblockDataProviderRector

AddParamArrayDocblockFromDataProviderRector

rectorphp/rector-symfony 🎵

[Symfony72] Match push() to its own RequestStack variable in PushRequestToRequestStackConstructorRector (#971)

[Symfony44] Skip custom isGranted() service calls in controllers in AuthorizationCheckerIsGrantedExtractorRector (#973)

[Symfony42] Update Cookie fixture after NewToStaticCallRector config removal (#974)

... (truncated)

Commits

858b1fb Rector 2.5.9
0b1bf8f Updated Rector to commit 8b14eaa4ae390194eb499a9b003ec4754df93a0f
a88e754 Updated Rector to commit ad881a17abe083f4e08712ec7484068ce24a23ce
e687028 Updated Rector to commit fb1218da767d1b79b3fbad7dca9b0ea931fd35d1
131cad7 Updated Rector to commit ab27b92faaab32e835f2b29791c59cb80fd29c56
9f589db Updated Rector to commit b5b0f88119612be71aee5261c3e9dc2d683a1484
2530409 Updated Rector to commit a4153d97936564a3f146e68462a071f5f1a57b7b
2e0b1dd Updated Rector to commit 91f0ec8e2bee94f51a70378ffb26166a255b9964
b011347 Updated Rector to commit 8d1230149cf09bbb908fa712a2f5a62fce820950
7273c05 Updated Rector to commit a0ad10f150d039cab666b7e87c5af6ad66d7055c
Additional commits viewable in compare view

Updates rector/type-perfect to 2.2.0

Release notes

Sourced from rector/type-perfect's releases.

Type Perfect 2.2.0 - Deprecated & merged into tomasvotruba/type-coverage

This package is deprecated

Keeping 2 very close packages up-to-date is daunting work and keep both behind. T Both focus with custom PHPStan rule on better type coverage and more precise and narrow types if available.

To improve support, the Type Perfect rules have been merged into tomasvotruba/type-coverage as of its 2.3.0 release. This is the final release of rector/type-perfect — it is marked abandoned in composer.json and Composer will now point you at the replacement on every install.

How to switch

1. Swap the package
 "require-dev": {
-    "rector/type-perfect": "^2.1"
+    "tomasvotruba/type-coverage": "^2.3"
 }
composer remove rector/type-perfect --dev
composer require tomasvotruba/type-coverage --dev
If you already use tomasvotruba/type-coverage, only remove rector/type-perfect — keeping both loads every rule twice.

Type Coverage requires PHP ^8.4; Type Perfect required ^8.2.

2. Keep your ignoreErrors as they are

The rules keep the Rector\TypePerfect\ namespace inside Type Coverage, so existing ignore patterns and PHPStan baselines still match. The extension is registered by phpstan/extension-installer, so no includes change is needed either.

3. Enable the rules that used to be on by default

NoParamTypeRemovalRule, NoIssetOnObjectRule and NoEmptyOnObjectRule reported right after install here. In Type Coverage they are opt-in like the rest of the set, one parameter each:
 parameters:
     type_perfect:
         narrow_param: true
         narrow_return: true
         no_mixed_property: true
         no_mixed_caller: true
         null_over_false: true
</tr></table> 

... (truncated)

Commits

33d189f Deprecate package in favor of tomasvotruba/type-coverage (#78)
255b323 NoArrayAccessOnObjectRule: Skip Symfony DomCrawler AbstractUriElement and chi...
bf9bd55 Prepare push repository logic to anywherephp/type-perfect (#75)
See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…with 6 updates Updates the requirements on [infection/infection](https://github.com/infection/infection), [nikic/php-parser](https://github.com/nikic/PHP-Parser), [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source), [phpstan/phpstan-deprecation-rules](https://github.com/phpstan/phpstan-deprecation-rules), [rector/rector](https://github.com/rectorphp/rector) and [rector/type-perfect](https://github.com/rectorphp/type-perfect) to permit the latest version. Updates `infection/infection` to 0.34.1 - [Release notes](https://github.com/infection/infection/releases) - [Changelog](https://github.com/infection/infection/blob/master/CHANGELOG.md) - [Commits](infection/infection@0.34.0...0.34.1) Updates `nikic/php-parser` to 5.8.0 - [Release notes](https://github.com/nikic/PHP-Parser/releases) - [Changelog](https://github.com/nikic/PHP-Parser/blob/master/CHANGELOG.md) - [Commits](nikic/PHP-Parser@v5.7.0...v5.8.0) Updates `phpstan/phpstan` to 2.2.7 - [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits) Updates `phpstan/phpstan-deprecation-rules` to 2.0.5 - [Release notes](https://github.com/phpstan/phpstan-deprecation-rules/releases) - [Commits](phpstan/phpstan-deprecation-rules@2.0.4...2.0.5) Updates `rector/rector` to 2.5.9 - [Release notes](https://github.com/rectorphp/rector/releases) - [Commits](rectorphp/rector@2.5.2...2.5.9) Updates `rector/type-perfect` to 2.2.0 - [Release notes](https://github.com/rectorphp/type-perfect/releases) - [Commits](rectorphp/type-perfect@2.1.4...2.2.0) --- updated-dependencies: - dependency-name: infection/infection dependency-version: 0.34.1 dependency-type: direct:development dependency-group: development-dependencies - dependency-name: nikic/php-parser dependency-version: 5.8.0 dependency-type: direct:development dependency-group: development-dependencies - dependency-name: phpstan/phpstan dependency-version: 2.2.7 dependency-type: direct:development dependency-group: development-dependencies - dependency-name: phpstan/phpstan-deprecation-rules dependency-version: 2.0.5 dependency-type: direct:development dependency-group: development-dependencies - dependency-name: rector/rector dependency-version: 2.5.9 dependency-type: direct:development dependency-group: development-dependencies - dependency-name: rector/type-perfect dependency-version: 2.2.0 dependency-type: direct:development dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-09T02:10:46Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
composer/infection/infection	>= 0.34.1, < 0.35.0	Unknown	Unknown
composer/phpstan/phpstan	>= 2.2.7, < 3.0.0	Unknown	Unknown
composer/phpstan/phpstan-deprecation-rules	>= 2.0.5, < 3.0.0	Unknown	Unknown
composer/phpstan/phpstan-phpunit	>= 2.0.16, < 3.0.0	Unknown	Unknown
composer/rector/rector	>= 2.5.9, < 3.0.0	Unknown	Unknown
composer/rector/type-perfect	>= 2.2.0, < 3.0.0	Unknown	Unknown

Scanned Files

composer.json

socket-security · 2026-08-09T06:57:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	composer/phpstan/phpstan-phpunit@2.0.18.0

View full report

codecov · 2026-08-09T07:06:08Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (8be4ecc) to head (8cc14b5).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff             @@
##              master      #315   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity        23        23           
===========================================
  Files              4         4           
  Lines             81        81           
===========================================
  Hits              81        81

Flag	Coverage Δ
php-8.3	`100.00% <ø> (ø)`
phpunit	`100.00% <ø> (ø)`
ubuntu-latest	`100.00% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

dependabot Bot assigned mimmi20 Aug 9, 2026

dependabot Bot requested a review from mimmi20 as a code owner August 9, 2026 02:10

dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 9, 2026

fix issue

6cd61c9

mimmi20 previously approved these changes Aug 9, 2026

View reviewed changes

fix issue

8cc14b5

mimmi20 dismissed their stale review via 8cc14b5 August 9, 2026 07:03

mimmi20 approved these changes Aug 9, 2026

View reviewed changes

mimmi20 merged commit a6cd8b3 into master Aug 9, 2026
66 checks passed

mimmi20 deleted the dependabot/composer/development-dependencies-24c107bbc3 branch August 9, 2026 07:08

Navigation Menu

composer (master)(deps-dev): bump the development-dependencies group with 6 updates - #315

composer (master)(deps-dev): bump the development-dependencies group with 6 updates#315
mimmi20 merged 3 commits into
masterfrom
dependabot/composer/development-dependencies-24c107bbc3

dependabot Bot commented on behalf of github Aug 9, 2026

Uh oh!

github-actions Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Aug 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 9, 2026

Bugfixes and internal stuff

Fixed

Docs

Internal

PHP-Parser 5.8.0

Fixed

Changed

Version 5.8.0 (2026-06-04)

Fixed

Changed

Version 5.7.0 (2025-12-06)

Fixed

Changed

Added

Version 5.6.2 (2025-10-21)

Fixed

Added

Version 5.6.1 (2025-08-13)

2.0.5

Released Rector 2.5.9

Bugfixes 🐛

Set changes 🗑️

NullToStrictStringFuncCallArgRector out of the PHP 8.1 set (#8234)

Deprecations 💀

TypeDeclarationDocblocks: 3 data provider docblock rules (#8235)

rectorphp/rector-symfony 🎵

Type Perfect 2.2.0 - Deprecated & merged into tomasvotruba/type-coverage

This package is deprecated

How to switch

1. Swap the package

2. Keep your ignoreErrors as they are

3. Enable the rules that used to be on by default

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

socket-security Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Aug 9, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`NullToStrictStringFuncCallArgRector` out of the PHP 8.1 set (#8234)

`TypeDeclarationDocblocks`: 3 data provider docblock rules (#8235)

2. Keep your `ignoreErrors` as they are

github-actions Bot commented Aug 9, 2026 •

edited

Loading

socket-security Bot commented Aug 9, 2026 •

edited

Loading