All Versions
71
Latest Version
Avg Release Cycle
8 days
Latest Release
1032 days ago

Changelog History
Page 1

  • v4.3.1 Changes

    December 03, 2020
    • prevent false-positive on isset in a finally block when checking a catch variable (#4764)
    • prevent bug when calling parent constructor during property initialisation checks (#4760)
    • 🛠 fix false-positive bug when an assignment with a ternary re-assigns a ternary variable (#4759)

  • v4.3.0 Changes

    December 02, 2020

    🔋 Features

    • UnusedConstructor is now a separate issue from UnusedMethod. This allows people to use the private constructor pattern to prevent instantiation of classes that just have static methods (#4656)
    • 👍 RedundantCast is now a separate issue from RedundantCondition. It is now emitted for more redundant casts thanks to @orklah adding better detection (#4695)
    • 👍 @odoucet added support for the CodeClimate output format (#4387)
    • ✅ @weirdan added a test to ensure all new Psalm annotations are documented (#4723)
    • RedundantPropertyInitializationCheck is now emitted for isset checks on class properties that Psalm thinks should be defined. This allows users who prefer to initialize properties outside constructors to silence just that issue (#4732)

    🛠 Bugfixes

    Psalter

    • 👍 @orklah added support for adding static return types when running in PHP 8 (#4641)
    • 👍 @orklah added support for adding int|string phpdoc standin for array-key (#4645)
    • 👍 @orklah added support for adding string phpdoc standin for Foo::class (#4651)
    • 👉 use union types in PHP 8 wherever possible (#4643)

    Taint analysis

    PHP 8 compatibility

    • Promoted properties are always treated as initialised (#4615)
    • Flag invalid attribute arguments (#4611)
    • Ensure classes used as attributes themselves have the Attribute attribute (#4475)
    • Ensure the Attribute attribute is only valid on classes (#4609)
    • 🛠 @orklah fixed param names on core functions to enable named-argument calling in PHP 8 (#4745)
    • 🛠 @orklah fixed return type additions when returning from finally (#4746)

    Miscellaneous

    • 👍 Allow the Phar to run in PHP 7.2 (#4640)
    • Prevent crash with recursively-defined @psalm-type in root namespace (#4653)
    • @staabm made many file-based functions impure (#4674, #4676, #4679, #4678)
    • @erikjwaxx narrowed the return type for $a <=> $b (#4680)
    • @orklah prevented the use of illegal array keys (#4660)
    • 👍 @BenMorel added a better return type for `PDOStatement::fetchObject' (#4682)
    • treat isset like !== null when the variable is defined (#4699)
    • 🛠 @orklah fixed an incorrect cast to int when the integer is very large (#4702)
    • 🛠 @LeSuisse fixed a bug in the taink sink map (#4703)
    • @orklah fixed reconciliation of is_object($some_iterable) (#4712)
    • 👉 use correct keys when a list with a known length is compared to an array (#3017)
    • template types are no longer substituted when they’re defined on the same class (#4733)
    • 👍 provide better support for nested template type definitions (#4731)
    • @orklah ensured that non-emptiness is treated as a docblock-level assertion (#4736)
    • 👍 @orklah added much better typing for bitshift operators (#4740)
    • simplified assertions generated from array_key_exists to prevent performance degradation (#4743)
    • prevent stubs from breaking implicit docblock param inference (#4705)
    • 👍 allow errors stemming from @final attribute to be suppressed (#4751)

  • v4.2.1 Changes

    November 20, 2020
    • Fixes a regression when interpreting if (is_string($foo) === false) and if (is_string($foo) !== true) (#4637)
    • 🛠 Fix crash when scanning codebases that use a lot of class aliasing (#4636)

  • v4.2.0 Changes

    November 20, 2020

    🔒 Security analysis

    👌 Support for sending analysis GitHub Security

    Thanks to @LukasReschke, Psalm can now output its results in a format compatible with GitHub's Code Scanning feature (#4582)

    🔒 More specific output for security issues

    📄 Psalm now separates out different security issues it finds, with code snippets that reproduce the issue e.g. TaintedHtml and TaintedUnserialize

    🛠 Bugfixes

    Inheritance for docblock return and param types

    This ticket – #4537 – revealed a slight issue with Psalm's automatic inheritance of docblock param and return types.

    Psalm will now only inherit docblock parameter and return types from a single docblock, which means you can't define param types in one parent class method and return types in another. It's a relatively minor change, but it might break some code.

    🛠 Other bugfixes

    • 🔒 Security Analysis: @LukasReschke made a lot of improvements to Psalm's taint analysis (#4554, #4572, #4576, #4592, #4604, #4630)
    • @pilif improved the mb_strtolower return type (#4469)
    • 👍 perform better inference for literal int division (#2132)
    • 🛠 fix bugs caused by around ReflectionProperty stub not implementing Reflector (#4481)
    • 👍 better error message for PossiblyInvalidArrayOffset (#4479)
    • 👌 support assertions in new calls (#4491)
    • 🛠 fix type inference when unpacking typed iterables (#4487)
    • @orklah added some undocumented properties to SoapFault (#4510)
    • 👍 @wouterj added support for reflecting builtin PHP union types (#4505)
    • autoloaded constants set in define are now inferred as mixed (#4509)
    • prevent crash with empty match expression (#4519)
    • treat exit expressions as the empty type (#4516)
    • track type contradiction issues in match expressions (#4517)
    • remember assignments when descending into property use (#4522)
    • 👍 @adrienlucas added support for proxying functions for taint analysis (#4495)
    • 👌 improve template param inference (#4485, #4524, #4545)
    • fix property initialisation checks when parent::__construct refers to grandparent class (#4540)
    • 👍 allow better get_class inference inside match expressions (#4544)
    • mark closure uses as UnusedVariable where possible (#4547)
    • ⚠ prevent false-positive warning about calling unset on array with key (#4529)
    • @orklah added a check for accessing an array with a negative int offset (#4552)
    • 🛠 @thomasvargiu fixed a bug intersecting with templated types (#4560)
    • 👍 @duskwuff added support for passing named arguments to functions that use variadic params (#4575)
    • ➕ added a more specific return type for substr in PHP 8 (#4580)
    • @BenMorel improved mysqli property types and a DateTimeInterface signature (#4577, #4579)
    • @mstilkerich added a more accurate stub for preg_filter (#4587)
    • 👌 improved a lot of tainting (#4599, #4605)
    • prevent negative line numbers in output (#4600)
    • prevent string literals from carrying taints (#4620)
    • improve inference of array_key_exists when the first arg is a variable (#4626)
    • ⚡️ @orklah improved return type updating when returning $this or static (#4632)

  • v4.1.1 Changes

    November 02, 2020

    🔋 Features

    More attribute checks

    Psalm now checks that you're using attributes correctly (by verifying attribute targets).

    int-mask and int-mask-of

    🚀 This release also brings support for representing bitmasks concisely with the introduction of a new type int-mask.

    int-mask<1, 2, 4> is automatically converted to 1|2|3|4|5|6|7.

    Another new type, int-mask-of, allows you to represent masks of multiple values from a single source query

    Given

    class FileFlag {
    public const OPEN = 1;
    public const MODIFIED = 2;
    public const NEW = 4;
}

    int-mask-of<FileFlag::*> is equivalent to int-mask<FileFlag::OPEN, FileFlag::MODIFIED, FileFlag::NEW>

    🛠 Bugfixes

    • 👍 Psalm now supports multiline @extends and @implements docblock tags (#4453)
    • 📦 Psalm’s cache now gets busted in more situations when using a self-packaged Phar
    • Only treat two variables as the same if they were set in the same place (#4467)
    • 👍 Psalm now performs better inference after if (!class_exists($foo, false)) { return; } (#4466)

  • v4.1.0 Changes

    October 30, 2020

    🔋 Features

    👍 This adds basic support for PHP 8 attributes (#4367). Psalm checks attribute arguments, and also emits a UndefinedAttributeClass issue if the attribute cannot be found.

    This version of Psalm can also be installed when using PHP 8.

    🛠 Bugfixes

    • class getIterator calls are used inside loops (#3625)
    • 👍 allow Psalm to understand more assignments when evaluating implicit else (#4374)
    • promoted properties are always used in the constructor (#4386)
    • arraylike-object should be Countable too (#4398)
    • signature types (return & param types) weren't being invalidated when their use changed, now they are
    • 👍 allow multiple @psalm-assert-if-true on a single variable (#4414)
    • 👉 uses better path normalisation when resolveFromConfig="true" so that existing baselines need only small adjustments (#4410)
    • @BenMorel improved some ext-ds stubs (#4415)
    • 👍 allow implicit null->offsetGet() inside an isset call (#4397)
    • 🛠 fix try analysis on assigned vars when they're typed to mixed (#4418)
    • any class with a __toString method in PHP 8 is assumed to implement Stringable (#4429)
    • fix crash when encountering no-argument str_replace, DOMNode::appendChild, crypt, get_class_methods, iterator_to_array, get_object_vars calls
    • prevent unused variable false-positive when (bool) or (float) casts are used (#4435)
    • @enumag improved ext-ds stubs with immutable data structures (#4425)

  • v4.0.1 Changes

    October 20, 2020

    🛠 This adds a fix for treatment of finally blocks, and fixes a bug in unused variable detection in short closures (#4372)

  • v4.0.0 Changes

    October 20, 2020

    🚀 This release supports PHP 8 and its new features.

    It bumps the minimum requirement to PHP 7.3.

    👍 It includes better unused variable detection.

    It includes these breaking changes for v4:

    👉 User-facing

    • ✂ remove issues MisplacedRequiredParam, TypeCoercion, MixedTypeCoercion
    • ✂ remove support for @template-typeof
    • 0️⃣ default to not disabling checks with UnresolvableInclude (#2818)
    • ✂ Remove requireVoidReturnType, useAssertForType config flags, both now permanently true
    • 🔄 Change default on resolveFromConfigFile to "true". This means if your Psalm config is not in the same directory that you run Psalm from, and you want to keep all the paths correct, you'll need to add resolveFromConfigFile="false" to maintain existing path resolution

    🔌 Internals (for plugin developers)

    • class constants should live in their own storage object
    • 📇 rename TFn to TClosure, ObjectLike to TKeyedArray, GetClassT to TDependentGetClass, GetTypeT to TDependentGetType
    • ✂ Remove return type manipulation from AfterFunctionCallAnalysisInterface – use the MethodReturnTypeProviderInterface and FunctionReturnTypeProviderInterface hooks instead
    • ➕ Added return and param types to plugin hooks

  • v4.0.0-beta3

    October 19, 2020

  • v4.0.0-beta1 Changes

    October 19, 2020

    🚀 This release supports PHP 8 and its new features.

    It bumps the minimum requirement to PHP 7.3.

    👍 It includes better unused variable detection.

    It includes these breaking changes for v4:

    👉 User-facing

    • ✂ remove issues MisplacedRequiredParam, TypeCoercion, MixedTypeCoercion
    • ✂ remove support for @template-typeof
    • 0️⃣ default to not disabling checks with UnresolvableInclude (#2818)
    • ✂ Remove requireVoidReturnType, useAssertForType config flags, both now permanently true
    • 🔄 Change default on resolveFromConfigFile to "true". This means if your Psalm config is not in the same directory that you run Psalm from, and you want to keep all the paths correct, you'll need to add resolveFromConfigFile="false" to maintain existing path resolution

    🔌 Internals (for plugin developers)

    • class constants should live in their own storage object
    • 📇 rename TFn to TClosure, ObjectLike to TKeyedArray, GetClassT to TDependentGetClass, GetTypeT to TDependentGetType
    • ✂ Remove return type manipulation from AfterFunctionCallAnalysisInterface – use the MethodReturnTypeProviderInterface and FunctionReturnTypeProviderInterface hooks instead
    • ➕ Added return and param types to plugin hooks