Bump phan/phan from 2.4.6 to 2.4.8

[dependabot-preview]

Bumps phan/phan from 2.4.6 to 2.4.8.

Changelog

Sourced from phan/phan's changelog.

Jan 25 2020, Phan 2.4.8

Bug fixes:

• Fix bug introduced in 2.4.7 where there were more false positives when --no-progress-bar was used. (#3677)

Jan 22 2020, Phan 2.4.7

New features(CLI, Configs):

• Add an environment variable PHAN_NO_UTF8=1 to always avoid UTF-8 in progress bars. This may help with terminals or logs that have issues with UTF-8 output. Error messages will continue to include UTF-8 when part of the error.
• Allow phan --init to complete even if composer.json has no configured autoload directories, as long as at least one directory or file was configured.
• Add a setting error_prone_truthy_condition_detection that can be enabled to warn about error-prone truthiness/falsiness checks. New issue types:
  • PhanSuspiciousTruthyCondition (e.g. for if ($x) where $x is object|int)
  • PhanSuspiciousTruthyString (e.g. for ?string - '0' is also falsey in PHP)
• Limit calculation of max memory usage to the running worker processes with --processes N (#3606)
• Omit options that should almost always be on (e.g. analyze_signature_compatibility) from the output of phan --init (#3660)
• Allow phan --init to create config file with target_php_version of '7.4' or '8.0' based on composer.json (#3671)

New Features(Analysis):

• Infer that merging defined variables with possibly undefined variables is also possibly undefined. (#1942)
• Add a fallback when some types of conditional check results in a empty union type in a loop: If all types assigned to the variable in a loop in a function are known, then try applying the condition to the union of those types. (#3614) (This approach was chosen because it needs to run only once per function)
• Infer that assignment operations (e.g. +=) create variables if they were undefined.
• Properly infer that class constants that weren't literal int/float/strings have real type sets in their union types.
• Normalize union types of generic array elements after fetching $x[$offset]. (e.g. change bool|false|null to ?bool)
• Normalize union types of result of ?? operator.
• Fix false positives in redundant condition detection for the real types of array accesses. (#3638, #3645, #3650)
• Support the non-empty-string type in phpdoc comments (neither '' nor '0'). Warn about redundant/impossible checks of non-empty-string.
• Support the non-zero-int type in phpdoc comments. Infer it in real types and warn about redundant checks for zero/truthiness.
• Support the the non-empty-mixed in phpdoc comments and in inferences.
• Fix false positives possibly undefined variable warnings after conditions such as if (X || count($x = [])), if (X && preg_match(..., $matches)), etc.

Bug fixes:

• Fix a crash analyzing assignment operations on $GLOBALS such as $GLOBALS['var'] += expr; (#3615)
• Fix false positive Phan[Possibly]UndeclaredGlobalVariable after conditions such as assert($var instanceof MyClass when the variable was not assigned to within the file or previously analyzed files. (#3616)
• Fix line number of 0 for some nodes when simplify_ast is enabled. (#3649)

Plugins:

• Make Phan use the real type set of the return value of the function being analyzed when plugins return a union type without a real type set.

Maintenance:

... (truncated)

Commits

• dc94f53 Merge pull request #3678 from TysonAndre/fix-false-positive
• d199ae8 Run phpcbf
• 765b153 Fix false positives that are emitted when --no-progress-bar is used
• a300b03 Merge pull request #3673 from TysonAndre/fix-false-positive-complex-condition
• f070765 Release 2.4.7, fix false positive after condition with ||/&&
• b85445b Allow phan --init to create target_php_version 7.4 or 8.0
• 3416211 Update composer.lock
• a24099e Merge pull request #3669 from TysonAndre/scalar_implicit_partial
• 6315cb3 Make scalar_implicit_partial handle non-zero-int
• b5240fa Merge pull request #3668 from TysonAndre/template-type-can-cast
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

If all status checks pass Dependabot will automatically merge this pull request.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)