Skip to content

Add PHP 8.5 partitioned cookie attribute to session_get_cookie_params() and the cookie option shapes - #6004

Merged
staabm merged 1 commit into
phpstan:2.2.xfrom
phpstan-bot:create-pull-request/patch-8lsy9bz
Jul 5, 2026
Merged

Add PHP 8.5 partitioned cookie attribute to session_get_cookie_params() and the cookie option shapes#6004
staabm merged 1 commit into
phpstan:2.2.xfrom
phpstan-bot:create-pull-request/patch-8lsy9bz

Conversation

@phpstan-bot

Copy link
Copy Markdown
Collaborator

Summary

PHP 8.5 adds the partitioned cookie attribute (CHIPS RFC). session_get_cookie_params() now returns a partitioned key, but PHPStan's signature map didn't know about it, so array_key_exists('partitioned', session_get_cookie_params()) was inferred as always evaluating to false on PHP 8.5 — a false positive. This adds partitioned to the affected cookie function signatures for PHP 8.5.

Changes

  • resources/functionMap_php85delta.php:
    • new section: add partitioned: bool to the session_get_cookie_params() return array shape.
    • new section: add partitioned?:bool to the options-array parameter shape of setcookie'1, setrawcookie'1, and session_set_cookie_params'1 (the CHIPS RFC added the attribute to all four cookie functions).
    • old section: record the pre-8.5 signatures for the same functions so the 8.5↔8.4 conversion stays reversible.
  • tests/PHPStan/Analyser/nsrt/session-get-cookie-params-php85.php: new PHP 8.5 (// lint >= 8.5) regression test asserting the full return shape and that array_key_exists('partitioned', session_get_cookie_params()) is true.

Root cause

The base functionMap.php reflects PHP 8.4, where the partitioned cookie attribute does not exist. PHP 8.5 signature differences are layered on via functionMap_php85delta.php, but the delta hadn't been updated for the CHIPS RFC. As a result, on PHP 8.5 the return shape of session_get_cookie_params() was missing the partitioned key, and the input option shapes of the sibling cookie setters were missing it too.

The parallel-construct axis here is the four cookie functions the CHIPS RFC touched: session_get_cookie_params() (return shape) and setcookie / setrawcookie / session_set_cookie_params (options-array parameter shapes). The reported bug was only observable on the return-shape function (the option shapes are not sealed against extra keys, so they didn't produce a visible false positive), but all four are updated together for accuracy and to match php.net / the RFC.

Test

  • tests/PHPStan/Analyser/nsrt/session-get-cookie-params-php85.php asserts the return type of session_get_cookie_params() includes partitioned: bool and that array_key_exists('partitioned', session_get_cookie_params()) narrows to true on PHP 8.5.
  • Verified via bin/phpstan analyse with phpVersion: 80500 that the partitioned key is present (and absent with phpVersion: 80400), and that reading $params['partitioned'] yields bool.

Fixes phpstan/phpstan#14922

…ams()` and the cookie option shapes

- Add `partitioned: bool` to the `session_get_cookie_params()` return array shape in the PHP 8.5 signature delta (`functionMap_php85delta.php`), so `array_key_exists('partitioned', session_get_cookie_params())` is no longer inferred as always-false on PHP 8.5.
- Apply the same CHIPS RFC change to the sibling cookie functions: add `partitioned?:bool` to the options-array shapes of `setcookie`, `setrawcookie`, and `session_set_cookie_params` (their `'1'` variants).
- Record the pre-8.5 signatures in the delta `old` section so the mapping stays reversible.
- Add nsrt regression test `session-get-cookie-params-php85.php` asserting the full return shape and that the `partitioned` key exists.
@VincentLanglet VincentLanglet self-assigned this Jul 4, 2026
@VincentLanglet
VincentLanglet requested a review from staabm July 4, 2026 21:00
@staabm
staabm merged commit 02959ca into phpstan:2.2.x Jul 5, 2026
669 of 671 checks passed
@staabm
staabm deleted the create-pull-request/patch-8lsy9bz branch July 5, 2026 05:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

False positive: session_get_cookie_params() is missing 'partitioned' param

3 participants