« Changelog History


Psalm v4.2.0 Release Notes

Release Date: 2020-11-20 // over 3 years ago

  • 🔒 Security analysis

    👌 Support for sending analysis GitHub Security

    Thanks to @LukasReschke, Psalm can now output its results in a format compatible with GitHub's Code Scanning feature (#4582)

    🔒 More specific output for security issues

    📄 Psalm now separates out different security issues it finds, with code snippets that reproduce the issue e.g. TaintedHtml and TaintedUnserialize

    🛠 Bugfixes

    Inheritance for docblock return and param types

    This ticket – #4537 – revealed a slight issue with Psalm's automatic inheritance of docblock param and return types.

    Psalm will now only inherit docblock parameter and return types from a single docblock, which means you can't define param types in one parent class method and return types in another. It's a relatively minor change, but it might break some code.

    🛠 Other bugfixes

    • 🔒 Security Analysis: @LukasReschke made a lot of improvements to Psalm's taint analysis (#4554, #4572, #4576, #4592, #4604, #4630)
    • @pilif improved the mb_strtolower return type (#4469)
    • 👍 perform better inference for literal int division (#2132)
    • 🛠 fix bugs caused by around ReflectionProperty stub not implementing Reflector (#4481)
    • 👍 better error message for PossiblyInvalidArrayOffset (#4479)
    • 👌 support assertions in new calls (#4491)
    • 🛠 fix type inference when unpacking typed iterables (#4487)
    • @orklah added some undocumented properties to SoapFault (#4510)
    • 👍 @wouterj added support for reflecting builtin PHP union types (#4505)
    • autoloaded constants set in define are now inferred as mixed (#4509)
    • prevent crash with empty match expression (#4519)
    • treat exit expressions as the empty type (#4516)
    • track type contradiction issues in match expressions (#4517)
    • remember assignments when descending into property use (#4522)
    • 👍 @adrienlucas added support for proxying functions for taint analysis (#4495)
    • 👌 improve template param inference (#4485, #4524, #4545)
    • fix property initialisation checks when parent::__construct refers to grandparent class (#4540)
    • 👍 allow better get_class inference inside match expressions (#4544)
    • mark closure uses as UnusedVariable where possible (#4547)
    • ⚠ prevent false-positive warning about calling unset on array with key (#4529)
    • @orklah added a check for accessing an array with a negative int offset (#4552)
    • 🛠 @thomasvargiu fixed a bug intersecting with templated types (#4560)
    • 👍 @duskwuff added support for passing named arguments to functions that use variadic params (#4575)
    • ➕ added a more specific return type for substr in PHP 8 (#4580)
    • @BenMorel improved mysqli property types and a DateTimeInterface signature (#4577, #4579)
    • @mstilkerich added a more accurate stub for preg_filter (#4587)
    • 👌 improved a lot of tainting (#4599, #4605)
    • prevent negative line numbers in output (#4600)
    • prevent string literals from carrying taints (#4620)
    • improve inference of array_key_exists when the first arg is a variable (#4626)
    • ⚡️ @orklah improved return type updating when returning $this or static (#4632)