v4.14.0 - π+1

What's Changed

v4.14.0 spans Eloquent type inference and security: three new security detectors, relationship and filesystem narrowing, paginator fixes, and an opt-in query-builder best-practice rule.

Security 🛡️

• Detect user-controlled container resolution as unsafe reflection (CWE-470) (#1075)
• Detect timing-unsafe comparisons of secrets (CWE-208) (#1013)
• Add html_url taint kind for URL-context XSS distinct from e() (#1014)

Best Practices ⭐️

• Add opt-in ImplicitQueryBuilderCall rule for direct model query and scope calls. It requires writing User::query()->where(...) instead of User::where(...) (#1068)

Relationships

• Fix MissingTemplateParam on in-body belongsToMany()/morphToMany() pivot chains (#1090)
• Fix mixed collapse when chaining off relation methods, by replacing $this with static in generic templates and using @template-covariant for relationships (#1055)

Filesystem

• Narrow Storage::disk() to FilesystemAdapter so temporaryUrl() and url() resolve (#1093)
• Narrow FilesystemAdapter listing methods to list<string> (#1094)

Forms

• Narrow FormRequest magic property reads ($request->field calls) (#1022)

Other Features and Fixes

• Infer app(Foo::class) as Foo when the booted app cannot resolve it (Laravel packages) (#1076)
• Fix false-positive UndefinedMethod on $app->when()->needs() chains (#1077)
• Narrow when()/unless() callback return types (#997)
• Return the concrete paginator from paginate() and preserve the related-model template through relations (#1082)
• Suppress false PossiblyUnusedMethod on Eloquent trait boot/initialize hooks (#1080)

Internal changes

• Raise minimum Laravel to ^12.4 (#1089)
• CI: add a new /psalm-delta workflow to benchmark the plugin over real apps and libraries (#1079, #1086, #1084)

Full Changelog: v4.13.2...v4.14.0