Bump vimeo/psalm from 3.5.1 to 3.5.3

[dependabot-preview]

Bumps vimeo/psalm from 3.5.1 to 3.5.3.

Release notes

Sourced from vimeo/psalm's releases.

Add automatic fix for unnecessary @​var annotations

Features

• Psalter you can now automatically remove unnecessary @var annotations with
  vendor/bin/psalter --issues=UnnecessaryVarAnnotation (#2173)

Bugfixes

• Allow @method annotations to override presumed-immutable methods (#2170)
• Always use most immediate function storage when analysing preloaded functions (#2169)
• Only complain about missing array offset if it's properly missing (#2172)
• Support empty arrays in late-resolved constants (#2175)

Allow config for checking that array offsets exist

Features

Allow errors when string offsets may not exist

Given the code

/**
 * @param array<string, Exception> $arr
 */
function shouldTakeArrayOfExceptions(array $arr) : void {
  echo $arr['foo']->getMessage();
}

shouldTakeArrayOfExceptions(
  ["bar" => new Exception('hello')]
);

Psalm by default doesn't see the error, but now with the config flag ensureArrayStringOffsetsExist="true" Psalm will complain when calling $arr['foo']->getMessage();.

It's not on by default because too much existing code would be broken.

Detecting unnecessary @​var annotations

Thanks to an idea from @​iluuu1994, Psalm now catches unnecessary @var annotations when unused code detection is turned on (with --find-unused-variables or --find-unused-code).

function getString() : string {
  return "hello";
}

/** @var string */
$a = getString(); // now UnnecessaryVarAnnotation is emitted

echo $a;
</tr></table> ... (truncated)

Commits

• c3e781c Turn on unused code detection in Psalter for UnnecessaryVarAnnotation
• cbc1426 Fix #2175 - support late-resolved empty arrays
• 4823ec5 Add slashes
• 4ff3a55 Fix typo
• 79f2f41 Fix typo
• 0972deb Add test for array assertion type
• 4ec966d Fix variable
• 73eb71b I think I understand strpos/strrpos a little better now
• 4832aa6 Fix incorrect location for substitution
• cf799d0 Fix #2173 - remove @​var annotations automatically
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

If all status checks pass Dependabot will automatically merge this pull request.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.