composer (4.x)(deps-dev): bump the development-dependencies group with 4 updates

[dependabot]

Updates the requirements on infection/infection, nikic/php-parser, phpstan/phpstan and rector/rector to permit the latest version.
Updates infection/infection to 0.34.0

Release notes

Sourced from infection/infection's releases.

0.34.0

Added:

• Support positional arguments to mimic --filter and --test-framewor-extra-args options by @​maks-rafalko in infection/infection#3284
• Allow skipping run command with positional args by @​maks-rafalko in infection/infection#3285

Changed:

• Deprecate --filter options in favor of new positional arguments for filtering source by @​maks-rafalko in infection/infection#3308
• Support sebastian/diff: 9 by @​sidz in infection/infection#3298
• feat: Add our own local unified diff output builder by @​theofidry in infection/infection#3300
• Add support for positional arguments for config:list-sources command by @​maks-rafalko in infection/infection#3307

Full Changelog: infection/infection@0.33.3...0.34.0

Commits

• 373c2ab Allow skipping run command with positional args (#3285)
• d8b56fc Add support for positional arguments for config:list-sources command (#3307)
• 2960c35 Deprecate --filter options in favor of new positional arguments for filteri...
• 0efff96 Support positional arguments to mimic --filter and `--test-framewor-extra-a...
• cd433d3 refactor(autoreview): Refine autoreview I/O detection for source classes (#3286)
• 371d88d refactor(autoreview): Move the PHPUnit related code from IoCodeDetector to th...
• a6fd990 refactor(autoreview): Minor variable and method renames (#3305)
• f75942d feat: Add our own local unified diff output builder (#3300)
• 9031987 docs: Improve the description of the Differ service (#3304)
• af20b6b Support sebastian/diff: 9 (#3298)
• Additional commits viewable in compare view

Updates nikic/php-parser to 5.8.0

Release notes

Sourced from nikic/php-parser's releases.

PHP-Parser 5.8.0

Fixed

• Treat _ as label character in formatting-preserving pretty printer.
• Handle comment after object operator in keyword emulator.

Changed

• Drop support for pipe operator in constant expression evaluator. It is not supported in constant expressions and may pose security risks, as it allows calls to arbitrary functions.
• void parameter types now generate a (recoverable) error during parsing.
• Restored reverse emulation support for fn keywords when targeting PHP before 7.4.

Changelog

Sourced from nikic/php-parser's changelog.

Version 5.8.0 (2026-06-04)

Fixed

• Treat _ as label character in formatting-preserving pretty printer.
• Handle comment after object operator in keyword emulator.

Changed

• Drop support for pipe operator in constant expression evaluator. It is not supported in constant expressions and may pose security risks, as it allows calls to arbitrary functions.
• void parameter types now generate a (recoverable) error during parsing.
• Restored reverse emulation support for fn keywords when targeting PHP before 7.4.

Version 5.7.0 (2025-12-06)

Fixed

• Fixed changing modifier on anonymous class with formatting preserving pretty printer.
• Emit an error for unparenthesized arrow functions in pipe operator, and print necessary parentheses in the pretty printer.
• Fix PHP 8.5 deprecation warning in php-parse binary.

Changed

• When targeting PHP 8.4 or newer, omit parentheses around immediately dereferenced new expressions.

Added

• Added shouldPrintRawValue attribute to Scalar\Int_, which makes the pretty printer use the rawValue of the node. This can be used to print integers with separators.

Version 5.6.2 (2025-10-21)

Fixed

• Fixed formatting-preserving pretty-printing when changing the visibility modifier on a node that has attributes.
• Fixed chr() deprecation warning on PHP 8.5.

Added

• Added Param::isFinal() method.

Version 5.6.1 (2025-08-13)

... (truncated)

Commits

• 044a6a3 Release PHP-Parser 5.8.0
• ca145ac Try to fix tests on older versions
• c81a0af Test PHP 8.6 in CI
• b82d4c2 Handle comment after object operator
• 49429ef Integration test against PHP 8.5
• 9c3fe25 Drop support for pipe operator in constant expression evaluator
• 2e66ec3 Fix PHPStan build on latest release (#1148)
• b560dba Add missing label characters in PrettyPrinterAbstract::$labelCharMap (#1150)
• 50f0d9c Restore FnTokenEmulator (#1141)
• 0512478 Prevent void param type (#1142)
• Additional commits viewable in compare view

Updates phpstan/phpstan to 2.2.5

Commits

• See full diff in compare view

Updates rector/rector to 2.5.7

Release notes

Sourced from rector/rector's releases.

Released Rector 2.5.7

This release sharpens the PHPUnit code-quality sets, adds a focused narrow asserts set, deprecates two blurry Symfony web-test rules, and fixes a handful of docblock false-positives in dead-code removal.

New Features 🎉

PHPUnit: PHPUNIT_NARROW_ASSERTS set

A new set focused on narrowing broad asserts to their specific, more descriptive method — e.g. assertTrue(isset($a['b'])) → assertArrayHasKey('b', $a). ([rector-phpunit #716])

use Rector\PHPUnit\Set\PHPUnitSetList;
return RectorConfig::configure()
->withSets([PHPUnitSetList::PHPUNIT_NARROW_ASSERTS]);

withPreparedSets() gains phpunitNarrowAsserts + phpunitMockToStub

The 2 PHPUnit sets are now toggleable like any other prepared set. (#8178)

return RectorConfig::configure()
    ->withPreparedSets(
        phpunitNarrowAsserts: true,
        phpunitMockToStub: true,
    );

PHPUnit: flip with($this->callback(...)) on void methods to willReturnCallback()

VoidMethodWithCallbackToWillReturnCallbackRector (renamed + refocused) drops the pointless return value and types the closure as void, matching the mocked void method. ([rector-phpunit #724])

 $this->createMock(SomeClass::class)
     ->method('run')
-    ->with($this->callback(function ($arg) {
-        echo $arg;
-
-        return true;
-    }));
+    ->willReturnCallback(function ($arg): void {
+        echo $arg;
+    });

... (truncated)

Commits

• ba22f8c Rector 2.5.7
• 1109537 Updated Rector to commit 653ec233fa55057fb11a6c133ed5c8d57dec9ff2
• e363554 Updated Rector to commit 3c481b689cd746323dfad98782cd7939f28035e4
• fb62051 Updated Rector to commit 3c481b689cd746323dfad98782cd7939f28035e4
• 561c81c Updated Rector to commit 51d61737c5fbaed10c5f711bbc8074720452417e
• 9f3ea3a Updated Rector to commit e713102f40682bc65311d3a50e5490e6acc452f3
• 78b5c28 Updated Rector to commit 306b852af3e4d0045034a6865bffe311ccdf38c9
• 4bb232c Updated Rector to commit 0e269a0d17470ec8331efb518efcfd5fa6e7162d
• eab289b Updated Rector to commit cc1a748e25adb989f2cf42f0329792810d79d216
• 4ebe4bc Updated Rector to commit ed944a11e6e3a83bac0f9e1f4a413bcc7153fca7
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
composer/infection/infection	>= 0.34.0, < 0.35.0	Unknown	Unknown
composer/nikic/php-parser	>= 5.8.0, < 6.0.0	Unknown	Unknown
composer/phpstan/phpstan	>= 2.2.5, < 3.0.0	Unknown	Unknown
composer/rector/rector	>= 2.5.7, < 3.0.0	Unknown	Unknown

Scanned Files

• composer.json

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (f763840) to head (ebb47ca).
⚠️ Report is 3 commits behind head on 4.x.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff             @@
##                 4.x      #712   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity        43        43           
===========================================
  Files              4         4           
  Lines            236       236           
===========================================
  Hits             236       236           

Flag	Coverage Δ
php-8.3	100.00% <ø> (ø)
phpunit	100.00% <ø> (ø)
ubuntu-latest	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.