7.0.0-rc3

What's Changed

Features

• Let @psalm-flow ($this) -> return carry the taints of the object a method is called on by @danog in #12302
• Add , to make issues impossible to suppress by @danog in #12130
• Report int-mask values compared by value with a set other than the empty or the full one by @danog in #12203
• Add a time capability for reading the clock by @danog in #12261
• Accept taint complements ~(kind|kind): every taint, custom ones included, but the kinds listed by @danog in #12300
• Support @psalm-flow ($compute()) -> return: what a callable parameter returns flows to the return by @danog in #12299
• Follow values through keyed stores: @psalm-flow ($value) -> Store::$data[$key] and back to return by @danog in #12312
• Store what callables return in keyed stores: @psalm-flow ($compute()) -> Store::$data[$key] by @danog in #12327
• Declare custom taints in psalm.xml, optionally added to the input aliases by @danog in #12330
• Report invalid taint and flow annotations, also in stubs, as InvalidDocblock by @danog in #12333
• Report every docblock issue of the stubs the config and plugins add by @danog in #12334
• Add the _ purity to the closure parameters a function-like calls with --alter by @danog in #12019
• Let plugins give the capabilities a call of a method requires by @danog in #12329
• Declare what the methods of the SPL classes do by @danog in #12122
• Charge ArrayObject and ArrayIterator mutators write-props only when their storage is an object by @danog in #12190
• Resolve taints over compact states, so that large graphs fit in memory by @danog in #12105
• Taint analysis: sinks on the values of an array parameter only ($param[*]) by @danog in #12171
• Give decoded user input back the nosql taint the string type took away by @danog in #12338
• Taint analysis: keep the calls of a callee that only reads shared state specialized by @danog in #12397
• Taint analysis: know more array keys (literal unions, array_map(), convergences, key starts of lists) and stop at keys overwritten in specialized calls by @danog in #12375
• Taint analysis: share and split the filters of specialized calls by what their walks observe by @danog in #12374
• Add a PHP 8.6 call map by @danog in #12407
• Add Codebase::getReceiverTaintPath(), the path along which a method of a builtin class returns what its object holds by @danog in #12414

Fixes

• Declare the capabilities of the Random extension's randomizer and engines by @danog in #12311
• Don't taint the overrides of sibling classes through inherited method calls by @danog in #12100
• Infer the bounds, not mixed, for templates of new that a class doesn't pass to its parent by @danog in #12125
• Keep the variables a loop defines, with their types, where the next iteration starts by @danog in #12155
• Resolve global constants holding enum cases when they're fetched by @danog in #12173
• Suggest a class contract that also covers the known subclasses and the purity template bounds by @danog in #12186
• Specialize a specialized function passed as a callable, whose edge hid its return from its calls by @danog in #12201
• Link a specialized override's by-ref params to the overridden method without cutting off its calls by @danog in #12202
• Forget the array offsets a write through a non-literal key may overwrite by @danog in #12174
• Treat builtins that read files, streams and the network as impure by @danog in #12214
• Narrow the subject of a match without a default arm to the values of its arms past it by @danog in #12225
• Take only the column of each row into the values array_column() returns, and the index into its keys by @danog in #12226
• Track taints through global variables, with a node per global shared by $GLOBALS and global by @danog in #12243
• Don't narrow strings to objects with __toString() through instanceof by @danog in #12310
• Let a specialized call read what its other calls leave in a static property by @danog in #12254
• Keep the taints of arrays encoded into strings by json_encode(), serialize(), print_r(), ... in taint analysis by @danog in #12257
• Taint the result of a call on an interface or base class with the returns of its overrides by @danog in #12262
• Drop an optional array key, and its taint, where array_key_exists() or isset() is negated by @danog in #12298
• Keep the shape of arrays unpacking shapes with optional string keys by @danog in #12301
• Charge igbinary_serialize() and igbinary_unserialize() like serialize() and unserialize() by @danog in #12306
• Narrow by @psalm-assert types that expand to a union, such as key-of<A::B> or a template bound by @danog in #12230
• Treat the objects a closure captures as not fresh, and infer writes to fresh objects as free by @danog in #12268
• Charge the destructors of what an overwritten or unset property, array element or variable held by @danog in #12309
• Forget what mutation-free methods returned when a later call may write their receiver by @danog in #12191
• Fix master CI by @danog in #12335
• Share what keyed stores hold between specialized calls by @danog in #12336
• Specialize the taints of Type::getString() and getAtomicStringFromLiteral() per call by @danog in #12337
• Declare what the phpredis classes do: commands need io, subscribe callbacks are charged by @danog in #12308
• Don't report calling a closure or an invokable object as a tainted callable by @danog in #12093
• Assign under each literal the key of an array assignment can be (master) by @danog in #12152
• Don't report an instanceof && property check on a template param as redundant by @danog in #12342
• Fix master CI after the latest merges by @danog in #12347
• Merge a key check's array node away where the array it checks is merged back in by @danog in #12349
• Assign under each literal the key of an array assignment can be by @danog in #12150
• Tell array keys apart by their start where only that is known statically by @danog in #12106
• Declare that preg_last_error(), preg_last_error_msg() and json_last_error_msg() only read globals by @danog in #12351
• Charge a call on a mixed value as a call that may do anything by @danog in #12362
• Infer literal class-string for Foo::class in constants outside class context by @rela589n in #12364
• Fix the taint resolution hang on Psalm's own code (self-analysis/Shepherd) by @danog in #12361
• Fix master CI after the latest merges (template bounds, self-analysis) by @danog in #12350
• Don't suggest a purity annotation below the lower bound of the purity template a method depends on by @danog in #12358
• Declare what the methods of SplObjectStorage do, so a new storage can be filled for free by @danog in #12297
• Charge calls of methods not known by name what the class contract allows, or impure without one by @danog in #12304
• Charge a method found through @mixin what the __call() of the class using the mixin does by @danog in #12307
• Parse @psalm-flow annotations in one place, for the docblock check and for the code applying them by @danog in #12369
• Don't require a class-level purity annotation on interfaces whose methods all have their own by @danog in #12303
• Fix master CI: keyed store read flows, empty @psalm-taint-escape, test data and the preloader list by @danog in #12345
• Drop the taints a narrowed type can't carry, also where it can carry others by @danog in #12348
• Track taints through the static variables of function-likes across their calls by @danog in #12255
• Declare what the mongodb driver classes do: ids, cursors, servers, the manager and subscribers by @danog in #12332
• Taint analysis: keep the keys of the elements an assignment copies or a foreach loop transforms by @danog in #12373
• Fix master CI: copies of narrowed foreach variables, the marker interface test, a docblock by @danog in #12379
• Cut the memory of the taint resolution on large code bases (20.5 GB → 3.1 GB on Psalm's own code) by @danog in #12393
• Fix master's self-analysis: read php-64bit from composer.json, and type capability sets with time by @danog in #12396
• [6.x] Keep config untouched when --set-baseline runs with --use-baseline by @alies-dev in #12385
• Don't let a later call of an inherited method take the taints out of what earlier calls passed by @danog in #12383
• Purity: capability sets as int-masks, fresh objects, property reads of contracted objects, WeakMap, closures and purity templates through parents by @danog in #12380
• Fix covariance checks of templates, narrowing by || with calls asserting nothing, and redundant instanceof of generic subclasses by @danog in #12378
• Taint analysis: track file-scope variables, globals and ancestor constructors called by name by @danog in #12376
• Don't crash re-analyzing inherited method bodies of files a partial run doesn't analyze by @danog in #12384
• Report sinks on the values of a stubbed method's parameter by @danog in #12408
• Don't crash when destructuring an ArrayAccess object that isn't Traversable by @danog in #12409
• Require fidry/cpu-core-counter 1.2 by @danog in #12412
• Fix conditional return types of stubbed methods also declared in vendor by @danog in #12413
• Don't treat generator functions without a return as void by @danog in #12421
• Parse is not and nullable/intersection if-branches in conditional types by @danog in #12415

Internal changes

• Fix macOS CI: bump setup-php to 2.40.0 by @danog in #12296
• Allow running Psalm on PHP 8.6 by @LordSimal in #12323
• Rename Capabilities::allows to Capabilities::allowsAnyOf by @danog in #12328
• Test that a keyed store read under a key that isn't a parameter is an invalid @psalm-flow by @danog in #12371
• Fix master CI: CapabilitiesTest PHP versions and self-analysis by @danog in #12372
• Fix master CI: declare MongoDB\Driver\Monitoring\Subscriber, read QUERY_STRING with a default in a test by @danog in #12390
• Type capability sets as int-masks, comparing exact sets with Capabilities::equals() by @danog in #12204
• Merge 6.x into master by @danog in #12406
• CI: balance the unit test runners by test time and run them on all cores; move to PHPUnit 10.5-13 and ParaTest 7 by @danog in #12405
• Require psalm/psalm-plugin-api 0.4.0 by @danog in #12410
• Regenerate the preloader list by @danog in #12411
• Fix master's self-analysis: mark the receiverTaintPaths provider pure by @danog in #12426
• Release master and 6.x every hour when all their checks passed by @danog in #12422

Other changes

• Add timeout to macOS Psalm scan job by @austenstone in #12324
• Bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #12321
• Bump shivammathur/setup-php from 2.37.1 to 2.40.0 by @dependabot[bot] in #12320
• Report UnsafeGenericInstantiation only for purity templates the constructor's parameters take by @danog in #12177
• Analyze the taints of an inherited method again for each class it is run on by @danog in #12156
• Fix crash and lost aliases for interfaces declared with class_alias() by @Hoticus in #12294
• Don't let the keys of an array hold a value assigned under a variable key (#12105 port) by @danog in #12146
• [6.x] Fix crash when destructuring into offsets of an undefined variable by @alies-dev in #11996
• [6.x] Apply --threads to the scan phase when --scan-threads is not given by @alies-dev in #12382
• [6.x] Resolve self and parent in @param-out against the declaring class by @alies-dev in #12391
• [6.x] Fix: crash on unknown @psalm- tags in property, constant and enum case docblocks by @alies-dev in #12394
• [6.x] Fix: resolve templates and conditional returns in method keys seeded by assertions by @alies-dev in #12392
• [6.x] Resolve object-shape properties on intersections with mixin or final classes by @alies-dev in #12111
• Do not report PropertyNotSetInConstructor for virtual hooked properties by @ybai08 in #12404
• Read @phpstan-require-extends and @phpstan-require-implements by @ybai08 in #12403

New Contributors

• @LordSimal made their first contribution in #12323
• @austenstone made their first contribution in #12324
• @Hoticus made their first contribution in #12294
• @rela589n made their first contribution in #12364
• @ybai08 made their first contribution in #12404

Full Changelog: 7.0.0-rc2...7.0.0-rc3