chore(deps): update composer dev dependencies - #111
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/composer-dev
branch
from
July 24, 2026 04:59
7dc6d30 to
6227b19
Compare
renovate
Bot
force-pushed
the
renovate/composer-dev
branch
from
July 27, 2026 10:02
6227b19 to
a926890
Compare
renovate
Bot
force-pushed
the
renovate/composer-dev
branch
4 times, most recently
from
August 6, 2026 00:44
ba7c9e7 to
3d8379a
Compare
renovate
Bot
force-pushed
the
renovate/composer-dev
branch
from
August 12, 2026 08:35
3d8379a to
fc87e24
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.43.0→1.46.02.5.7→2.6.2Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
carthage-software/mago (carthage-software/mago)
v1.46.0: Mago 1.46.0Compare Source
Mago 1.46.0
This release fixes a workflow-command injection in the GitHub reporting format (GHSA-f256-xqf4-x8pr), adds a
redundant-staticlinter rule and a--statsshorthand, corrects a batch of generic-narrowing and late-static-binding false positives across the analyzer and codex, and speeds up the PHP parser.🔒 Security
Reporting
cc8d5e4)Reported by Liyi Zhou, Ziyue, Strick, Maurice, and Chenchen of the University of Sydney.
✨ Features
Linter
redundant-static: reportsstaticin a final class whereselfis equivalent. (#2154,ef06262)CLI
--stats: adds a shorthand for count output. (#2130,db4a2cb)Prelude
json_validate: assertsnon-empty-stringwhen the call succeeds. (#2155,198f2b4)🐛 Bug Fixes
Analyzer
2af1cbc,784b93b)ebf2f8d)caselabels. (#2162,4119141)b6e97ee)c2c7bb4)fe272b8)voidconditionals: stops demanding a return from conditionals invoidfunctions. (#2160,bd85d70)selfin attributes: resolvesselfin attributes applied to class-likes. (#2168,7f88255)b0b0b91)42cfd1f)Codex
instanceofnarrowing of generics parameterised by a bounded template. (#2135,a45ffec,8b2edf6)aff9ce8)327ca0a)voidwithnever: keepsvoidwhen combined withnever. (#2159,864d0f7)fcd42ec)Linter
7c54906)missing-docs: renames the exclusion config field. (#2134,a5eab2d)Syntax
06871ea)3610502)Prelude
Attribute: adds the missingTARGET_CONSTANTconstant. (9bef302)Composer
209f980)📖 Documentation
Reporting
--sort: clarifies that the flag is a no-op for some formats. (#2173, #2174,654b3f4)🏗️ Internal
Performance
1ec8868)Analyzer
b4aa9ad)4d9c611)🙏 Thank You
Contributors
A huge thank you to everyone who contributed code to this release:
Issue Reporters
Thank you to everyone who reported issues that shaped this release:
Full Changelog: carthage-software/mago@1.45.0...1.46.0
v1.45.0: Mago 1.45.0Compare Source
Mago 1.45.0
This release teaches the analyzer to build keyed array shapes from
get_object_vars(), adds@param-closure-thissupport and an auto-fix for overly-wide return types, introduces a linter rule preferringDateTimeImmutable::createFromTimestamp(), fixes a batch of analyzer false positives, and makes empty reports valid SARIF/JSON documents for CI.✨ Features
Analyzer
get_object_vars()shapes: returns keyed array shapes built from the object's visible properties. (#2110,a729ce1)@param-closure-this: supports the docblock tag for typing a closure parameter's$this. (#2131,6000d41)9e4d186)Linter
prefer-datetimeimmutable-create-from-timestamp: suggests the factory overnew DateTimeImmutable('@...'). (#2118,38b6152)🐛 Bug Fixes
Analyzer
490452e)635eeab)method_existsguards on descendant members. (#2125,d1b6e9c)6527f24)array_mapshapes: preserves array shapes for untyped closures. (#2122,816578a)aa469b9)bd95ea5)@property-readand@property-writetypes. (#2079, #2108,b54a881)@propertyvisibility: resolves tags according to call-site visibility. (#2106,a4b077d)Codex
237465e)Prelude
array_diff: relaxes value parameters to string-castable types. (#2116,f290239)Reporting
003ff32)Playground
4184888)🙏 Thank You
Contributors
A huge thank you to everyone who contributed code to this release:
Issue Reporters
Thank you to everyone who reported issues that shaped this release:
Full Changelog: carthage-software/mago@1.44.0...1.45.0
v1.44.0: Mago 1.44.0Compare Source
Mago 1.44.0
A faster release with stronger dependent-type analysis, richer guard and linter configuration, and fixes across the CLI, formatter, analyzer, and semantics.
✨ Features
Analyzer
90c04c0)Linter
no-missing-format-argument: detects missing format arguments. (#2062,38857dd)missing-docsexclusions: supports configurable exclusions. (#2102,4488055)34ed400)Guard
@finalvalidation: supports the annotation during structure validation. (#2065,78cbbf0)8d6d359)CLI
-yself-update: adds a shorthand for--no-confirm. (#2011,d231964)🐛 Bug Fixes
Analyzer
a629700,a231709,81be763)2037b9a,6d71045)do-whileiterations. (#2078,0205e49,7afc4eb)issetflow: retains unsafe access and try/catch uncertainty after failed checks. (#2076, #2096,b70350c,23203e5)ad495bd)@methodcalls backed by inherited methods. (#2089,fda90f8)$thisandstaticto mixin receivers. (#2086,07086c5)80dbbfe)$property, not$$property. (#2066,5d2116d)voidin nullable docblock return types. (#2081, #2082,cdfd166)b15f9e1)Codex
683220c,2637cf8)->valueaccess. (#2064,45ad41b)@require-extendsclasses when validating traits. (#2069,84c0766)Semantics
__call,__callStatic, and__invoke. (#2075,d0487f2)Linter
9b40611)Formatter
match-arm docblocks. (#2060, #2063,3057c15)bc0090e)035d956,2923585)Guard
@self: scopes permits to the active rule namespace. (#2084,6a2a317)CLI
head. (#2090, #2097,9e504a6)Distribution
testssuite. (#2098,722e39b)🏗️ Internal
Performance
f6520a2,ed94713)d818460)d473383,c0d27c6)Toolchain
8c8262e,a43077b)🙏 Thank You
Contributors
A huge thank you to everyone who contributed code to this release:
Issue Reporters
Thank you to everyone who reported issues that shaped this release:
Full Changelog: carthage-software/mago@1.43.0...1.44.0
rectorphp/rector (rector/rector)
v2.6.2: Released Rector 2.6.2Compare Source
The 2.6.0 release introduced composer-based sets. This release finishes the job: every extension package now ships a single composer-based set, and the per-version set providers behind the old guessing game are gone.
Each rule inside checks
composer.json/installed.jsonon its own and runs only if the installed package version matches its constraint. NoSymfonySetList::SYMFONY_63, no picking a PHPUnit version by hand. We're working hard to bring Drupal and Laravel community packages to the same system.Run only the PHP rules (#8322)
A new
--phpoption on theprocesscommand runs only rules bound to a minimal PHP version — those implementingMinPhpVersionInterface. Useful to split a PHP upgrade from the rest, without a second config:New features 🥳
--phpoption to run only PHP version rules (#8322)withComposerBased()(#8332), load Doctrine and Twig composer-based sets (#8313)--onlyrule exists but is not registered inrector.php(#8300)New rules 🎉
rector-src
RemoveRedundantTypeCheckRector(#8307)rector-symfony
EnableValidationAttributesRector(#1004)Simple(Pre|Form)AuthenticatorInterfacefromCoretoHttpnamespace (#1031)rector-phpunit
AnyMatcherToNewAnyInvokedCountRectorfor the deprecatedany()matcher (#764)Bugfixes 🐛
withPhpSets()version (#8315) —withPhpSets(php82: true)withsymfony/polyfill-php83installed no longer produces PHP 8.3 codeInlineConstructorDefaultToPropertyRectoron non-final class (#8310) and on a property defined in the parent whenparent::__construct()is called (#8297)SimpleXMLElementonIssetOnPropertyObjectToPropertyExistsRector(#8284)RemoveParentDelegatingConstructorRectoron protected parent constructor (#8309)assert()enforcement that producesNeverTypeonNarrowWideUnionReturnTypeRector(#8282)AssignArrayToStringRectoron a variable re-assigned as string (#8293)ArrayToFirstClassCallableRectorwhen the arg type does not accept aClosure(#8288), drop the Symfony PHP closure check (#8291)Set changes 📈
DeprecatedAnnotationToDeprecatedAttributeRectorfrom the PHP 8.4 set and polyfills (#8326)AddOverrideAttributeToOverriddenMethodsRectorfrom the PHP 8.3 and polyfill sets (#8321)RemoveReadonlyPropertyVisibilityOnReadonlyClassRector(#8289),SimplifyBoolIdenticalTrueRectorandUnwrapSprintfOneArgumentRector(#8285) to the dead-code setPropertyExistsWithoutAssertRectorin the composer-based set (#761)Deprecations 💀
Deprecated rules run without any effect, and print a warning and will be removed in a future major release.
These were deprecated as not part of any set, risky, opinionated or excluded by most users. The goal is to keep Rector valuable and reliable for the every day user.
rector-src
DeprecatedAnnotationToDeprecatedAttributeRectorandConstAndTraitDeprecatedAttributeRector(#8347)AddInterfaceByTraitRector(#8346)RemoveAnnotationRector(#8345)ScalarValueToConstFetchRector(#8344)FuncCallToMethodCallRector(#8343)AddReturnArrayDocblockBasedOnArrayMapRector(#8342)AddAssertArrayFromClassMethodDocblockRector(#8341)AddParamArrayDocblockBasedOnArrayMapRector(#8340)AddReturnDocblockForDimFetchArrayFromAssignsRector(#8338)AddSensitiveParameterAttributeRector(#8337)PropertyHookRector— property hooks are a matter of preference (#8331)JsonThrowOnErrorRector— can cause BC breaks (#8327)CoalesceToTernaryRector— risky (#8324)ChangeNestedIfsToEarlyReturnRector(#8304),ChangeNestedForeachIfsToEarlyContinueRector(#8303),ReturnBinaryOrToEarlyReturnRector(#8302),ChangeOrIfContinueToMultiContinueRector(#8299)DisallowedEmptyRuleFixerRector(#8290)NestedFuncCallsToPipeOperatorRectorandSequentialAssignmentsToPipeOperatorRector(#8286)SwitchNegatedTernaryRector(#8283)cacheClass()— the file-vs-memory cache storage choice moved intoCacheFactory; onlyFileCacheStorageis ever useful to end users (#8311)symfonyRouteandsymfonyValidatorargs inwithAttributesSets()(#8317)ComposerTriggeredSetin favor ofComposerPackageConstraintInterface(#8296)withComposerBased(netteUtils:)argument (#8329)rector-symfony
ActionSuffixRemoverRector(#1022)ControllerMethodInjectionToConstructorRector(#1020)TraitGetByTypeToInjectRector(#1002)RemoveDefaultGetBlockPrefixRector(#1017)rector-doctrine
RemoveEmptyTableAttributeRector(#505)MoveCurrentDateTimeDefaultInEntityToConstructorRector, drop theforce_nullableoption (#504)Removals 💀
nette/utilsset and its singleUtilsJsonStaticCallNamedArgRectorrule (#8329) — the only third-party-library rule left in rector-src, readability onlyNewInInitializerRector(#8328)SymfonySetProvider,PHPUnitSetProvider(#8295) andDoctrineSetProvider(#8298) from the collectorTwigSetProvider(#1015) and the empty Symfony per-version set providers (#1012)PHPUnitSetProvider(#759)DoctrineSetProvider(#501), drop the unusedsymfony/yamldependency (#500)rectorphp/rector-symfony 🎵
AsTwigFilter/AsTwigFunctionrules into a single rule, addgetTests()support (#1027), restore the merged rules as deprecated (#1028)ControllerMethodInjectionToConstructorRector: re-use the parent protected property (#1003), skip event and session params (#1005), use#[Required]autowire()when the parent has a constructor (#1006), skip type-guarded classes and use a unique autowire method name (#1007), re-use an existing#[Required]method (#1008)LoadValidatorMetadataToAttributeRector: skip non-constant constraint args (#1000) and constraints without their own constructor (#1001)AddParamTypeDeclarationto nullable types where the upstream param defaults to null (#1023)GetRequestRector(#1013), move it to the Symfony 2.5 set (#1009)Twig_Tests_EnvironmentTest_Extensionrename (#1016)rectorphp/rector-phpunit 🧪
AddDoesNotPerformAssertionToNonAssertingTestRector: add the attribute directly and skip traits (#765), removeaddToAssertionCount()calls (#763), skip TwigIntegrationTestCasechildren (#762)Internals and CI 🧰
*.php.incsuffix, not bare*.inc(#8306)--onlyquote variants, revive the orphaned rules-summary test (#8334), remove the attributes e2e test (#8333)list-non-composer-based-rules.php(#8276)actions/checkoutto v5 for Node.js 24 (#8335), bump outdated actions to current majors (#8336), bump lock-threads, stale and typos actions (#8339)v2.6.1: Released Rector 2.6.1Compare Source
Bugfix 🐛
composer-basedcommand on a lazy-initialized property, e.g. PHPStanUnionType::$normalized([#8280])Composer-based sets keep growing: Twig, nette/utils and the rest of Symfony 📦
Follow-up release to 2.6.0. The composer-based rollout continues - Twig and nette/utils join, and every remaining Symfony rule now declares the package version its target API was added in.
The new Twig composer-based set replaces the
twig112→twig127→ ... →twig30chain with a single set, where every rule checks the installedtwig/twigversion:final class SomeTwigUse { - public function run(Twig_Environment $twigEnvironment) + public function run(\Twig\Environment $twigEnvironment) { - return new Twig_SimpleFilter('some_filter', 'strlen'); + return new \Twig\TwigFilter('some_filter', 'strlen'); } }Package bonding (composer-based rollout) 📦
nette/utilsrules to the installed package version;nette-utils4.phpbecomescomposer-based.phpand is loaded as a single set ([#8275])LoadValidatorMetadataToAttributeRectorin the composer-based set - the last interface-bonded rule left outside it ([#997])ContainerInterfaceServiceToServiceContainerRectortosymfony/dependency-injection>=6.0 ([#999])AddGetReferenceTypeRectortodoctrine/data-fixtures>=1.6 and the annotation-to-attribute sets to their package constraints ([#497])RemoveExpectAnyFromMockRectorto PHPUnit 11+ ([#756]) ** landed in 2.6.0, missing from its release notes
The per-version sets are not touched - every rule stays registered where it was.
Set changes 📈
ConsistentImplodeRectorfrom the coding style level - the swappedimplode($array, $glue)signature was removed in PHP 8.0, so the rule belongs to thephp80set only, where it already is ([#8273])DoctrineSetList::COMPOSER_BASEDconstant, remove the emptyDOCTRINE_BUNDLE_210set ([#499])Bugfixes 🐛
AddParamArrayDocblockFromAssignsParamToParamReferenceRector([#8271])returninConsoleExecuteReturnIntRectoron a trailing comment ([#992]), plus a fixture for a block comment with a commented-out return ([#993])(int)cast on amatchreturn inConsoleExecuteReturnIntRector- amatchof int constants is aUnionType, so theinstanceof IntegerTypecheck missed it ([#998])public function execute(InputInterface $input, OutputInterface $output): int { - return (int) match ($input->getArgument('type')) { + return match ($input->getArgument('type')) { 'a' => 0, default => 1, }; }Deprecations 💀
Deprecated rules still run, but print a warning and will be removed in a future major release.
These are coding standard preferences or opinionated rewrites - a coding standard tool is the better place for them.
rector-src
WrapEncapsedVariableInCurlyBracesRector- also removed from the coding style level ([#8272])function run($world) { - echo "Hello $world!"; + echo "Hello {$world}!"; }The actual PHP 8.2 deprecation,
${var}, is covered byVariableInStringInterpolationFixerRectorin thephp82set.CountArrayToEmptyArrayComparisonRector- also removed from the coding style level ([#8274])ArraySpreadInsteadOfArrayMergeRector- the spread result is harder to read, and...mid-array looks dangerous in review ([#8277])UnusedForeachValueToArrayKeysRector- also removed from the code quality level ([#8278])rector-doctrine
GetRepositoryServiceLocatorToRepositoryServiceInjectionRector- it resolved the repository class by running a regular expression over the entity file contents ([#498])Renames 🔄
ReplaceServiceArgumentRector→ContainerInterfaceServiceToServiceContainerRector, no longer configurable ([#999])Both sets configured it with the same 2 values, for a single Symfony 6.0 BC break - the
Psr\Container\ContainerInterfaceandSymfony\...\DependencyInjection\ContainerInterfacealiases of theservice_containerConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.