A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies

Matthias Glaub

Last update: Dec 30, 2022

Related tags

Overview

ComposerRequireChecker

A CLI tool to analyze composer dependencies and verify that no unknown symbols are used in the sources of a package. This will prevent you from using "soft" dependencies that are not defined within your composer.json require section.

What's it about?

"Soft" (or transitive) dependencies are code that you did not explicitly define to be there, but use it nonetheless. The opposite is a "hard" (or direct) dependency.

Your code most certainly uses external dependencies. Imagine that you found a library to access a remote API. You require thatvendor/api-lib for your software and use it in your code. This library is a hard dependency.

Then you see that another remote API is available, but no library exists. The use case is simple, so you look around and find that guzzlehttp/guzzle (or any other HTTP client library) is already installed, and you use it right away to fetch some info. Guzzle just became a soft dependency.

Then some day, when you update your dependencies, your access to the second API breaks. Why? Turns out that the reason guzzlehttp/guzzle was installed is that it is a dependency of thatvendor/api-lib you included, and their developers decided to update from an earlier major version to the latest and greatest, simply stating in their changelog: "Version 3.1.0 uses the lates major version of Guzzle - no breaking changes expected."

And you think: What about my broken code?

Composer-require-checker parses your code and your composer.json-file to see whether your code uses symbols that are not declared as a required library, i.e. that are soft dependencies. If you rely on components that are already installed, but you didn't explicitly request them, this tool will complain about them, and you should require them explicitly, making them hard dependencies. This will prevent unexpected updates.

In the situation above you wouldn't get the latest update of thatvendor/api-lib, but your code would continue to work if you also required guzzlehttp/guzzle before the update.

The tool will also check for usage of PHP functions that are only available if an extension is installed, and will complain if that extension isn't explicitly required.

Installation / Usage

Composer require checker is not supposed to be installed as part of your project dependencies.

PHAR file [preferred]

Please check the releases for available phar files. Download the latest release and and run it like this:

php composer-require-checker.phar check /path/to/your/project/composer.json

PHIVE

If you already use PHIVE to install and manage your project’s tooling, then you should be able to simply install ComposerRequireChecker like this:

phive install composer-require-checker

Composer - global command

This package can be easily globally installed by using Composer:

composer global require maglnet/composer-require-checker

If you haven't already setup you composer installation to support global requirements, please refer to the Composer cli - global If this is already done, run it like this:

composer-require-checker check /path/to/your/project/composer.json

A note about Xdebug

If your PHP is including Xdebug when running ComposerRequireChecker, you may experience additional issues like exceeding the Xdebug-related max-nesting-level - and on top, Xdebug slows PHP down.

It is recommended to run ComposerRequireChecker without Xdebug.

If you cannot provide a PHP instance without Xdebug yourself, try setting an environment variable like this for just the command: XDEBUG_MODE=off php composer-require-checker.

Configuration

Composer require checker is configured to whitelist some symbols per default. Have a look at the config file example to see which configuration options are available.

You can now adjust this file, as needed, and tell composer-require-checker to use it for it's configuration.

Note that you'll have to copy it's contents if you want to add something on top. This tool intentionally only reads one configuration file. If you pass only your new settings, you'll get error reports about the PHP core extensions and internal symbols like true or false being undefined.

bin/composer-require-checker check --config-file=path/to/config.json /path/to/your/project/composer.json

Scan Additional Files

To scan files, that are not part of your autoload definition you may add glob patterns to the config file's scan-files section. Copy the default file and add to your copy.

The following example would also scan the file bin/console and all files with .php extension within your bin/ folder:

"scan-files" : ["bin/console", "bin/*.php"]

If you don't like copying the tool's default settings, consider adding these paths to the Composer autoloading section of your project instead.

Usage

Composer require checker runs on an existing directory structure. It does not change your code, and does not even install your composer dependencies. That is a task that is entirely up to you, allowing you to change/improve things after a scan to see if it fixes the issue.

So the usual workflow would be

Clone your repo
composer install your dependencies
composer-require-checker check your code

Dealing with custom installer plugins

Composer require checker only fetches it's knowledge of where files are from your project's composer.json. It does not use Composer itself to understand custom directory structures.

If your project requires to use any install plugins to put files in directories that are not vendor/ or defined via the vendor-dir config setting in composer.json, composer require checker will fail to detect the required code correctly.

As a workaround, you can install your dependencies without plugins just for the scan:

Clone your repo
composer install --no-plugins will put all code into the vendor folder
composer-require-checker check your code
composer install dependencies once again in the correct location

License

This package is made available under the MIT LICENSE.

Credits

This package was initially designed by Marco Pivetta and Matthias Glaub.
And of course all Contributors.

Comments

Add doctrine/conding-standard as phpcs rule

This PR aims to get a coding standard into the project to improve readability and maintainability. I chose doctrine/coding-standard but if wanted we can switch the cs rules or require slevomat/coding-standard or squizlabs/php_codesniffer directly. Also adding / removing rules should be no problem.

At the moment I only installed the package and let phpcbf auto fix the issues that could be fixed. But there are plenty more cs issues to work on.

But before i work more on this i would get your opinion on this topic @Ocramius @maglnet :) I would also add it to the CI and maybe remove the scrutinizer config.
enhancement help wanted bc break dependencies

opened by DanielBadura 16
Configuration options to include packages from require-dev and suggests

It seems that currently only packages used directly in require section are considered. There are multiple cases when packages are optional dependency and as such are only present in suggest (and possibly also require-dev) section. These are currently reported as missing dependency, although they are not hard dependency.
duplicate question

opened by Majkl578 14
Syntax error, unexpected T_MATCH
We encounter some strange behavior lately. On some projects/libraries, the checker returns the following error:

$ vendor/bin/composer-require-checker ComposerRequireChecker 2.1.0@0c66698d487fcb5c66cf07108e2180c818fb2e72 In ParserAbstract.php line 315: Syntax error, unexpected T_MATCH on line 15 check [--config-file CONFIG-FILE] [--ignore-parse-errors] [--] [<composer-json>]

It seems to be somehow related to PHPunit when it is installed as non-dev dependency. Psalm also had a similar problem but fixed it already: https://github.com/vimeo/psalm/issues/3901

The error disappears when I remove the extends Match from \PHPUnit\Framework\MockObject\Builder\ParametersMatch lins 15.

Anyone has a clue what's going on there?
bug enhancement dependencies
opened by rieschl 13

Does not respect PHP Files installed outside of vendor

There are some frameworks that store installed packages somewhere outside the vendor folder. E.g. TYPO3 CMS stored their extensions (installed via composer) somewhere else. Those are reported as missing with default setup:

ComposerRequireChecker 2.1.0@0c66698d487fcb5c66cf07108e2180c818fb2e72
The following unknown symbols were found:
+---------------------------------------------------------+--------------------+
| unknown symbol                                          | guessed dependency |
+---------------------------------------------------------+--------------------+
| TYPO3\CMS\Core\Context\Context                          |                    |
| TYPO3\CMS\Core\Database\Connection                      |                    |
| TYPO3\CMS\Core\Database\Query\QueryBuilder              |                    |
| TYPO3\CMS\Core\Routing\PageArguments                    |                    |
| TYPO3\CMS\Core\Site\Entity\SiteLanguage                 |                    |
| TYPO3\CMS\Core\Site\SiteFinder                          |                    |
| TYPO3\CMS\Core\Utility\ArrayUtility                     |                    |
| TYPO3\CMS\Dashboard\Widgets\AbstractBarChartWidget      |                    |
| TYPO3\CMS\Dashboard\Widgets\AbstractDoughnutChartWidget |                    |
| TYPO3\CMS\Dashboard\Widgets\AbstractListWidget          |                    |
+---------------------------------------------------------+--------------------+

I wonder why the auto generated files vendor/composer/autoload_*.php are not used to find all files. That should find the files as these are generated with the concrete installation path.

Example of vendor/composer/autoload_psr4.php with some TYPO3 extensions (concrete paths can be different depending on options in composer.json):

<?php

// autoload_psr4.php @generated by Composer

$vendorDir = dirname(dirname(__FILE__));
$baseDir = dirname($vendorDir);

return array(
    'phpDocumentor\\Reflection\\' => array($vendorDir . '/phpdocumentor/reflection-common/src', $vendorDir . '/phpdocumentor/reflection-docblock/src', $vendorDir . '/phpdocumentor/type-resolver/src'),
    // ...
    'TYPO3\\CMS\\Recordlist\\' => array($baseDir . '/.Build/web/typo3/sysext/recordlist/Classes'),
    'TYPO3\\CMS\\Frontend\\' => array($baseDir . '/.Build/web/typo3/sysext/frontend/Classes'),
    'TYPO3\\CMS\\Fluid\\' => array($baseDir . '/.Build/web/typo3/sysext/fluid/Classes'),
    'TYPO3\\CMS\\Extbase\\' => array($baseDir . '/.Build/web/typo3/sysext/extbase/Classes'),
    'TYPO3\\CMS\\Dashboard\\' => array($baseDir . '/.Build/web/typo3/sysext/dashboard/Classes'),
    'TYPO3\\CMS\\Core\\' => array($baseDir . '/.Build/web/typo3/sysext/core/Classes'),
    'TYPO3\\CMS\\Backend\\' => array($baseDir . '/.Build/web/typo3/sysext/backend/Classes'),
   // ...

Is there any chance to chance the detection of files to parse in future? Or is there an official way to support these situations?

I guess the issue should be consistent between all those libraries that use an "own installer": https://github.com/composer/installers/tree/master/src/Composer/Installers. Same situation might happen for some projects like code sniffer and others that have their own custom installers, that move vendor code to some other folders.

As far as I can see, right now the following line should be adjusted: https://github.com/maglnet/ComposerRequireChecker/blob/57cbad2ad328b20f01f3ae818d379b6aa6ec3a32/src/ComposerRequireChecker/FileLocator/LocateComposerPackageDirectDependenciesSourceFiles.php#L23

I'm not experienced yet to give any hints how to retrieve the expected folder by an API.

opened by DanielSiepmann 13

GitLab CI Failing even with the command running as expected

My CI script is failing without any error message, do you guys have any idea why?

docker compose exec -T my-app-name bash -c 'php -d xdebug.mode=off ./vendor/maglnet/composer-require-checker/bin/composer-require-checker check --output=json > composer-require-check-report.json'

// I already tried variations, always with the same result.

docker compose exec -T my-app-name php -d xdebug.mode=off ./vendor/maglnet/composer-require-checker/bin/composer-require-checker check --output=json > composer-require-check-report.json

docker compose exec -T my-app-name XDEBUG_MODE=off php ./vendor/maglnet/composer-require-checker/bin/composer-require-checker check --output=json > composer-require-check-report.json

docker compose exec -T my-app-name bash -c 'php -d xdebug.mode=off ./vendor/maglnet/composer-require-checker/bin/composer-require-checker check --output=json' > composer-require-check-report.json

docker compose exec -T my-app-name bash -c 'XDEBUG_MODE=off php ./vendor/maglnet/composer-require-checker/bin/composer-require-checker check --output=json > composer-require-check-report.json'

As mentioned, the command is executing correctly and the file is generated at the end.

The command works well locally (and apparently works well in the runner too, I just don't know why the job is failing.

invalid question

opened by FabianoLothor 11

PHP7.4 as minimum required version

PHP7.2 is running EOL in 1 month and with this in mind I updated the minimum required PHP version. I went up to 7.4.* as I think its not really worth to also maintain for PHP 7.3. But we can, if you want, go down to 7.3.

I also updated all dependencies to the newest minor versions and PHPUnit up to ^9.4.0.
enhancement dependencies

opened by DanielBadura 10
Custom vendor-dir and install paths are not recognised.

Doesn't even need to be automatic, if that became configurable instead of using the harcoded vendor here https://github.com/maglnet/ComposerRequireChecker/blob/master/src/ComposerRequireChecker/FileLocator/LocateComposerPackageDirectDependenciesSourceFiles.php#L15

that would be super helpful :)

If that's something you can agree with I could look into creating a PR.
enhancement

opened by kitsunet 10
provide docker image
It could be really nice if a Docker image was provided, so that one could use a command like

docker run -v $(pwd):/app compoesrrequirechecker

to run the executable
enhancement wontfix
opened by marcosh 10
Cache execution results so that subsequent calls are processed faster
Many dev tools are using cache files (e.g. PHPCSFixer, PHPUnit, PHPStan, Psalm, Deptrac and others), giving us performance boost locally and on CI. Look at this image, where the first run is without cache, and the second run is with cache files used for dev tools:

As you can see, caching can save us minutes or tens of minutes, depending on the project size (as an example, look at the PHP Code Style column, which is PHPCSFixer, that saves 3m 43s with cache being used.

On the other side, please look at the "Check Required Packages" column, where cache is not used - it always takes ~1m, which is too much.

Is it possible to introduce some level of caching, and for example check only changed files?

If this feature is going to be implemented, please consider have an option to define where the cache file should be located, like:

--cache-file=custom/path/to/cache/.php_cs.cache
enhancement question wontfix
opened by maks-rafalko 9

use package's `install-path` instead of guessing

current implementation tries to "guess" the path a required package was installed to. see https://github.com/maglnet/ComposerRequireChecker/blob/b3cd6d30e2335997c5eabb19e3f01d699bc06caa/src/ComposerRequireChecker/FileLocator/LocateComposerPackageDirectDependenciesSourceFiles.php#L33

this might be correct for the most time, but in general this "guessing" seams like a lucky shot. ISSUE: In some cases its is just wrong -- especially when a installer-plugin was used. (some frameworks like typo3 do that).

When using composer2: the actual package install path of each required package can be found as install_path in file $vendorDir . '/composer/installed.json' or $vendorDir . '/composer/installed.php' (just as used in https://github.com/maglnet/ComposerRequireChecker/blob/master/src/ComposerRequireChecker/FileLocator/LocateComposerPackageDirectDependenciesSourceFiles.php#L57)

Example:

click to unfold an examply from my `installed.json`

{
    "packages": [
        {
            "name": "typo3/cms-extbase",
            "version": "v9.5.28",
            "version_normalized": "9.5.28.0",
            "source": {
                "type": "git",
                "url": "https://github.com/TYPO3-CMS/extbase.git",
                "reference": "676336cabfd589c369056c24ab5a2c94ee9f4c1a"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/TYPO3-CMS/extbase/zipball/676336cabfd589c369056c24ab5a2c94ee9f4c1a",
                "reference": "676336cabfd589c369056c24ab5a2c94ee9f4c1a",
                "shasum": ""
            },
            "require": {
                "typo3/cms-core": "9.5.28"
            },
            "conflict": {
                "typo3/cms": "*"
            },
            "suggest": {
                "typo3/cms-scheduler": "Additional scheduler tasks"
            },
            "time": "2021-07-20T09:35:15+00:00",
            "type": "typo3-cms-framework",
            "extra": {
                "typo3/cms": {
                    "Package": {
                        "protected": true,
                        "partOfFactoryDefault": true,
                        "partOfMinimalUsableSystem": true
                    },
                    "extension-key": "extbase"
                },
                "typo3/class-alias-loader": {
                    "class-alias-maps": [
                        "Migrations/Code/ClassAliasMap.php"
                    ]
                }
            },
            "installation-source": "dist",
            "autoload": {
                "psr-4": {
                    "TYPO3\\CMS\\Extbase\\": "Classes/"
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "GPL-2.0-or-later"
            ],
            "authors": [
                {
                    "name": "TYPO3 Core Team",
                    "email": "[email protected]",
                    "role": "Developer"
                }
            ],
            "description": "A framework to build extensions for TYPO3 CMS.",
            "homepage": "https://typo3.org",
            "support": {
                "source": "https://github.com/TYPO3-CMS/extbase/tree/v9.5.28"
            },
            "install-path": "../../Web/typo3/sysext/extbase"
        }
    ]
}

enhancement wontfix

opened by jnkowa-gfk 9

Bump phpstan/phpstan from 0.12.64 to 0.12.80
⚠️ Dependabot is rebasing this PR ⚠️

If you make any changes to it yourself then they will take precedence over the rebase.

Bumps phpstan/phpstan from 0.12.64 to 0.12.80.

Release notes

Sourced from phpstan/phpstan's releases.

0.12.80

Improvements 🔧

Nested generic type bounds (https://github.com/phpstan/phpstan-src/commit/e671cc0a5d5c218d4c10aeea9773eb2189c74a34), #2928, #3922

You can now use for example @template T + @template U of Query<T>.

Useful example: https://phpstan.org/r/29546058-556e-4e76-bccc-f053079e5711

Narrow down type T of RecursiveIteratorIterator (https://github.com/phpstan/phpstan-src/commit/d28b61b986c47f721eab2fef0613ee57b872af4f), #3425

Performance improvement: memoize expensive calls to PHPDocs (#458), thanks @pyguerder!

More SPL iterator stubs (https://github.com/phpstan/phpstan-src/commit/0315dfa437e447e31b964b6ec4696b0e23cd1010)

Unified iterator parameter names across PHP versions (https://github.com/phpstan/phpstan-src/commit/72b02a6706184a164438af095e1910ecd5c7bb31)

Bugfixes 🐛

Fix accepting BenevolentUnionType as part of GenericObjectType (https://github.com/phpstan/phpstan-src/commit/d29d098d62da4c13356c23d599f1f24521d177ab), #4605

Fix inline @var priority with prefixed PHPDoc tags (https://github.com/phpstan/phpstan-src/commit/3186fff7356df4447d38e11c61d43d6ac8405760), #4606

Function signature fixes 🤖

Updated function signatures of zip_read (#461), thanks @spud!

0.12.79

Improvements 🔧

Support for union type as @template type bound (https://github.com/phpstan/phpstan-src/commit/ac7b49ef411606ca90abf973f13f7d1aeea6b1d7), #3769

Support int and string as @template type bound (https://github.com/phpstan/phpstan-src/commit/768bfab11b313811c2feb34a16f50ff8ff3fadd5)

Type-specifying extension for ReflectionClass::isSubclassOf() (https://github.com/phpstan/phpstan-src/commit/d3b5d60d278861a51b4ce282261d7dea7b9db340), #4577

Update BetterReflection to version that uses PHPStan namespace instead of random prefixed one (https://github.com/phpstan/phpstan-src/commit/06ef13e9c30626f657b2be10030cf0c857b1dc35). See rectorphp/rector#5665

Update PhpStorm stubs (https://github.com/phpstan/phpstan-src/commit/5aa8a5589d73ca3e8b87fc6a6110bc92ec766be7)

Add PhpPropertyReflection::getNativeReflection() (https://github.com/phpstan/phpstan-src/commit/5fad625b7770b9c5beebb19ccc1a493839308fb4)

Bleeding edge 🔪

Type inference of new $string leads to object, not mixed (https://github.com/phpstan/phpstan-src/commit/78a9f057d7a1c73cc34af70db406b9392ce0ca3a)

If you want to see the shape of things to come and adopt bleeding edge features early, you can include this config file in your project's phpstan.neon:

includes: - vendor/phpstan/phpstan/conf/bleedingEdge.neon

Of course, there are no backwards compatibility guarantees when you include this file. The behaviour and reported errors can change in minor versions with this file included.

Bugfixes 🐛

... (truncated)

Commits

c6a1b17 PHPStan 0.12.80

9ff8f54 Updated PHPStan to commit e1fa4b3ae9a3b8089a6e1ac58547a781bdd9f466

5751b45 Updated PHPStan to commit 200be1a47c58cabe1a40d9169bd1d9582fd6a66a

f61902c Updated PHPStan to commit 3b950252b1157215323cce513502090421081bd2

dbe3685 Updated PHPStan to commit f5cb7270bba8aa4d633ffc183687b1301b68a56f

5c0e8ed Updated PHPStan to commit d0e6683e2fa7eab044da22c18c5075ec9c5c9888

75e5038 Updated PHPStan to commit 3186fff7356df4447d38e11c61d43d6ac8405760

493cbcf Updated PHPStan to commit ec8912cf9a9858829673c1e0c2f5733614eea2d9

1300089 Updated PHPStan to commit dfcb87ee399b5cbf3bb0bc036cc41f43cfa6fbb5

fd51fb5 Update PHPUnit baseline

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @maglnet.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the .dependabot/config.yml file in this repo:

Update frequency

Out-of-range updates (receive only lockfile updates, if desired)

Security updates (receive only security updates, if desired)

dependencies
opened by dependabot-preview[bot] 9
Lock file maintenance
This PR contains the following updates:

| Update | Change | |---|---| | lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

Configuration

📅 Schedule: Branch creation - "before 2am" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

[ ] If you want to rebase/retry this PR, check this box

Read more about the use of Renovate Bot within ocramius/* projects.
renovate
opened by renovate[bot] 0
Update all non-major dependencies
This PR contains the following updates:

| Package | Type | Update | Change | |---|---|---|---| | phpstan/phpstan | require-dev | patch | ^1.9.4 -> ^1.9.7 | | roave/infection-static-analysis-plugin | require-dev | minor | ^1.27.0 -> ^1.28.0 |

Release Notes

phpstan/phpstan

v1.9.7

Compare Source

Bleeding edge 🔪

Empty skipCheckGenericClasses (https://github.com/phpstan/phpstan-src/commit/28c2c79b16cac6ba6b01f1b4d211541dd49d8a77)

If you want to see the shape of things to come and adopt bleeding edge features early, you can include this config file in your project's phpstan.neon:

includes: - vendor/phpstan/phpstan/conf/bleedingEdge.neon

Of course, there are no backwards compatibility guarantees when you include this file. The behaviour and reported errors can change in minor versions with this file included. Learn more

Improvements 🔧

UnionType::pickTypes overriden in BenevolentUnionType for a more benevolent behaviour (https://github.com/phpstan/phpstan-src/commit/480626ecb52d2e98cc28cee8a18dfb86112b7f8f)

Bugfixes 🐛

Fixed incorrect while loop logic (https://github.com/phpstan/phpstan-src/commit/091fcafb07ac0b3eb261285c049d9c0f214a535c), #8643

Fixed scenario with zero analysed files (https://github.com/phpstan/phpstan-src/commit/6debffdb5892f7fb311a60634ec9cda79b6e3154)

Function signature fixes 🤖

min() and max() do not return false on PHP 8 (#2161), thanks @staabm!

Fix a few MongoDB definitions (#2140), thanks @UCIS!

Internals 🔍

Added missing namespaces in tests (#2156), thanks @staabm!

v1.9.6

Compare Source

Improvements 🔧

Show combined memory usage in parallel mode (#2027), #4683, thanks @janedbal!

Bugfixes 🐛

One-part encapsed string is correctly converted to string (https://github.com/phpstan/phpstan-src/commit/dc77608ee9ab22e352cd3df60ce2bc2d8d135abc), #8635

Conditional expressions - do not take conclusions about identical variable in assignment (https://github.com/phpstan/phpstan-src/commit/cde53d19e9b4edf81f4c469b7f2a2c3634004d86), #8625, #8621

v1.9.5

Compare Source

Improvements 🔧

Improve constant string union handling for concat and encapsed string (#2057), thanks @schlndh!

PhpVersion: supportsDisjunctiveNormalForm (#2130), thanks @janedbal!

Constant scalar types might accept general type from the same family (#2131) - this moves some errors from earlier levels to level 7

Implement OversizedArrayBuilder to improve huge constant array performance (#2116), #8215, thanks @staabm!

Improve performance again by dumbing down nested arrays (#2077)

Result cache should not be invalidated by changes to editorUrl, editorUrlTitle and errorFormat parameters (#2136), thanks @bendavies!

Faster MutatingScope::shouldInvalidateExpression() (#2139), thanks @staabm!

Add ReturnStatementsNode::hasNativeReturnTypehint() (#2141), thanks @janedbal!

TypeNodeResolver - lowercase-string and non-empty-lowercase-string are known (https://github.com/phpstan/phpstan-src/commit/884ceb015c68e8c40a066732b4bc873bed568d38)

Bugfixes 🐛

OversizedArrayType contains at least 1 element (#2126), thanks @staabm!

Fix pathinfo($s, PATHINFO_ALL) return type (#2014), thanks @staabm!

Bump fidry/cpu-core-counter version (#2133), thanks @czukowski!

Fix MixedType::hasOffsetValueType() for subtracted types (#2135), #6705, thanks @herndlm!

Fix dumbed down arrays (#2137), #8004

Return type of parent::__set_state() method is only object (#2138), thanks @blankse!

Fix fatal error when autoloader opens directories (#2154), thanks @staabm!

Fix returntype for DateInterval::createFromDateString (#2038), thanks @verfriemelt-dot-org!

Fix hasSideEffects for AnnotationMethodReflection (#2155), thanks @VincentLanglet!

Fix constant-string handling in union-types (#2134), #8568, #8562, thanks @staabm!

IntersectionType - check if it's an oversized array and return benevolent union in getOffsetValueType (https://github.com/phpstan/phpstan-src/commit/80b5cdd3ecf173f0aaa7354d28537167905aec7c)

Internals 🔍

Use isArray, isConstantArray instead of instanceof in TypeCombinartor::union (#2118), thanks @rajyan!

Fix typo (#2127), thanks @rajyan!

AnalyserIntegrationTest - run with bleedingEdge (https://github.com/phpstan/phpstan-src/commit/db2de6f17469e9bc0d078e09c895d64a39fe14ca)

Refactor options handling in FilterVarDynamicReturnTypeExtension (#2120), thanks @herndlm!

Add Type::isScalar() (#2149), thanks @herndlm!

Removed unused fileName in FetchedNode (#2150), thanks @staabm!

Removed unused NodeList class (#2151), thanks @staabm!

Add namespace to bug-8573.php / fix GenericsIntegrationTest (#2147), thanks @herndlm!

Roave/infection-static-analysis-plugin

v1.28.0

Compare Source

Release Notes for 1.28.0

Feature release (minor)

1.28.0

Total issues resolved: 0

Total pull requests resolved: 1

Total contributors: 1

enhancement

196: Rewrote plugin so that it does only reload mutated code, instead of re-analyzing whole codebase thanks to @Ocramius

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

[ ] If you want to rebase/retry this PR, check this box

Read more about the use of Renovate Bot within ocramius/* projects.
renovate
opened by renovate[bot] 1
Dependency Dashboard
This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

[ ] Update all non-major dependencies (phpstan/phpstan, roave/infection-static-analysis-plugin)

[ ] Lock file maintenance

Detected dependencies

composer

composer.json

php ~8.1.0 || ~8.2.0

nikic/php-parser ^4.15.2

symfony/console ^6.2.3

webmozart/assert ^1.11.0

webmozart/glob ^4.6.0

doctrine/coding-standard ^11.0.0

mikey179/vfsstream ^1.6.11

phing/phing ^2.17.4

phpstan/phpstan ^1.9.4

phpunit/phpunit ^9.5.27

roave/infection-static-analysis-plugin ^1.27.0

vimeo/psalm ^5.4.0

github-actions

.github/workflows/coding-standard.yml

actions/checkout v3

shivammathur/setup-php v2

actions/cache v3

.github/workflows/infection.yml

actions/checkout v3

shivammathur/setup-php v2

actions/cache v3

.github/workflows/phar-creation.yml

actions/checkout v3

shivammathur/setup-php v2

actions/upload-artifact v3

svenstaro/upload-release-action v2

.github/workflows/phpstan.yml

actions/checkout v3

shivammathur/setup-php v2

actions/cache v3

.github/workflows/phpunit.yml

actions/checkout v3

shivammathur/setup-php v2

actions/cache v3

.github/workflows/psalm.yml

actions/checkout v3

shivammathur/setup-php v2

actions/cache v3

.github/workflows/release-on-milestone-closed-triggering-release-event.yml

actions/checkout v3

laminas/automatic-releases v1

laminas/automatic-releases v1

laminas/automatic-releases v1

laminas/automatic-releases v1

laminas/automatic-releases v1

.github/workflows/require-checker.yml

actions/checkout v3

shivammathur/setup-php v2

actions/cache v3

[ ] Check this box to trigger a request for Renovate to run again on this repository
opened by renovate[bot] 0
Remove ext-tokenizer warnings

The article in https://www.php.net/manual/en/tokenizer.installation.php says that it's enabled by default. So there is no need to warn about it. Could you remove it?
enhancement invalid dependencies

opened by xepozz 2

constant checks

with code like

		if (defined('CURLOPT_SSL_VERIFYHOST') && $curlOpt === CURLOPT_SSL_VERIFYHOST) {
			return new UnionType([new ConstantIntegerType(0), new ConstantIntegerType(2)]);
		}

the tool properly detects and reports a error:

php build/composer-require-checker.phar check --config-file /home/runner/work/phpstan-src/phpstan-src/build/composer-require-checker.json
ComposerRequireChecker 4.0.0@baa11a4e9e5072117e3d180ef16c07036cafa4a2
The following 1 unknown symbols were found:
+------------------------+--------------------+
| Unknown Symbol         | Guessed Dependency |
+------------------------+--------------------+
| CURLOPT_SSL_VERIFYHOST | ext-curl           |
+------------------------+--------------------+

doing the same within a loop in a "more dynamic" way does not report any errors:

		$boolConstants = [
			'CURLOPT_AUTOREFERER',
			'CURLOPT_COOKIESESSION',
		];
		foreach ($boolConstants as $constName) {
			if (defined($constName) && constant($constName) === $curlOpt) {
				return new BooleanType();
			}
		}

I think - for consistency it would be helpful if the require checker could detect such constant cases.

found this inconsistency while working on https://github.com/phpstan/phpstan-src/pull/1719/

opened by staabm 2

Parse error with PHP 8.1 code

The parser doesn't handle the new "readonly" keyword properly and throws an error:

ComposerRequireChecker 4.0.0@baa11a4e9e5072117e3d180ef16c07036cafa4a2
In LocateASTFromFiles.php line 46:
                                                                               
  Parsing the file [ [...] /main/vendor/google/apiclient-services/src/Fire  
  store/ReadOnly.php] resulted in an error: Syntax error, unexpected T_READON  
  LY, expecting T_STRING on line 20                                            
                                                                               
In ParserAbstract.php line 318:
                                                                      
  Syntax error, unexpected T_READONLY, expecting T_STRING on line 20  
                                                                      
check [--config-file CONFIG-FILE] [--ignore-parse-errors] [--output OUTPUT] [--] [<composer-json>]
BUILD FAILED

bug dependencies

opened by DaFox 7