composer(deps-dev): bump vimeo/psalm from 3.11.6 to 3.12.0 in /tools

[dependabot]

Bumps vimeo/psalm from 3.11.6 to 3.12.0.

Release notes

Sourced from vimeo/psalm's releases.

Add --taint-analysis command

This will be the officially-supported taint analysis command going forward.

Add more taint analysis features

Features

• various taint analysis improvements
• added an <extraFiles> tag to tell Psalm about directories it should scan, but not analyse (#3618)

Bugfixes

• add better support for complex switch (true) case statements (#3603)
• allow lists to have their types refined in @psalm-assert calls (#3605)
• treat (Foo\Bar::class)::baz() as Foo\Bar::baz() (#3609)
• @andrei-petre improved error message casing for undefined methods (#3615)
• @iluuu1994 allowed strings with leading backslashes e.g. '\Foo\Bar::baz' to be treated as callables (#3607)
• prevent a crash when analysing an assertion on a class constant where the class doesn’t exist (#3607)

Commits

• d462830 Add --taint-analysis to command line help
• e254579 Add reference to new command
• 81e2745 Add more options
• dddc159 Add explicit path object
• 36f1630 Add more steps for clearer output
• 07a3870 Fix #3610 - add security analysis documeentation
• 02e8313 Allow taintedness to propagate to some stubbed methods
• 317571f Fix reset call
• fbe3433 Use escape terminology
• 07adecc Use correct method id when creating taints
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

Merging #468 into main will not change coverage.
The diff coverage is n/a.

@@            Coverage Diff            @@
##               main     #468   +/-   ##
=========================================
  Coverage     80.92%   80.92%           
  Complexity       41       41           
=========================================
  Files             4        4           
  Lines           194      194           
=========================================
  Hits            157      157           
  Misses           37       37           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 70aa0df...4c108fe. Read the comment docs.