Skip to content

chore(deps): update composer dev dependencies#48

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/composer-dev
Open

chore(deps): update composer dev dependencies#48
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/composer-dev

Conversation

@renovate

@renovate renovate Bot commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
carthage-software/mago 1.29.01.43.0 age confidence
phpunit/phpunit (source) 10.5.6310.5.64 age confidence
rector/rector (source) 2.4.52.5.5 age confidence
symfony/config (source) 7.4.107.4.14 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

carthage-software/mago (carthage-software/mago)

v1.43.0: Mago 1.43.0

Compare Source

Mago 1.43.0

A fix-focused release clearing false positives across the analyzer, codex, linter, and formatter. is_callable narrowing, strict in_array, type-alias recursion, ::class array keys, no-dead-store, and member-access chains. Plus sqlsrv stubs and internal HIR groundwork for the upcoming rule-based checker.

✨ Features

Prelude
  • sqlsrv extension: added function and constant stubs for the sqlsrv extension. (#​2045, e8f1ed3)

🐛 Bug Fixes

Analyzer
  • is_callable narrowing: no more false invalid-callable after narrowing to a callable type. (#​2037, 938a511)
  • Strict in_array: keeps the value's type on a negative result instead of wrongly excluding it. (#​2048, 3a69d09)
  • redundant-logical-operation: suppressed during loop pre-condition analysis. (#​2054, 4b4a7d4)
Codex
  • Enum generic narrowing: preserves generic type parameters when narrowing with enum type arguments. (#​2035, 0c5fdad)
  • Type-alias recursion: rejects aliases shadowing symbols and handles self-references, fixing a stack overflow. (#​2050, cde8037)
  • ::class array keys: no false invalid-array-index for literal class-string keys. (#​2056, e0dc158)
Prelude
  • Named arguments: dropped @no-named-arguments from native functions that accept them. (#​2043, 3e77dff)
Linter
Formatter
  • Member-access chains: formatting is idempotent with both preserve options. (#​2032, 840cca4)
  • Array-base parentheses: avoids redundant parens around a parenthesized array base. (#​2038, da54dd7)
Syntax
  • Heredoc interpolation: preserves token order for lossless reconstruction. (2a87bf6)
  • Abstract methods: allows a ?><?php tag-pair terminator after an abstract method. (e5f81cb)
PHPDoc Syntax
  • Docblock close marker: treats consecutive * before / as one marker, fixing a lost intersection type. (#​2055, 8749c2b)

📖 Documentation

🏗️ Internal

  • HIR groundwork: flat Node/NodeKind view and PHP surface syntax carried through the IR for the upcoming rule-based checker. (11349fd, 94927e7)
  • Composite strings: unified composite/shell strings into one node with spans and heredoc/nowdoc kinds. (732ad8f, 6c880a8)
  • Analyzer performance: removed duplicate hashing and redundant allocations. (5ae5198, 072933f, f71b732)
  • Crate cleanup: removed the unused mago-docblock and mago-type-syntax crates. (5deb957)
  • Toolchain: pinned nightly bumped through nightly-2026-07-05. (#​2059)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.42.0...1.43.0

v1.42.0: Mago 1.42.0

Compare Source

Mago 1.42.0

A small release adding a prefer-early-return linter rule, fixing Windows self-update, and clearing analyzer and PHPDoc false positives around is_a(), nullable destructuring, and @param on promoted properties.

✨ Features

Linter
  • prefer-early-return: new rule suggesting early returns to reduce nesting in functions. (#​2031, e523ab1)

🐛 Bug Fixes

Analyzer
  • is_a() with allow_string: a string subject no longer triggers a false impossible-type-comparison. (db64917)
  • Nullable destructuring: destructuring T|null keeps element types (plus null) instead of widening to mixed. (643a037)
PHPDoc Syntax
  • @param on promoted properties: @param T with no variable is allowed and types the property like @var. (8b9af32)
CLI
  • Windows self-update: extracts the .exe-suffixed binary from the archive, fixing "file not found". (805a1c3)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

Full Changelog: carthage-software/mago@1.41.0...1.42.0

v1.41.0: Mago 1.41.0

Compare Source

Mago 1.41.0

A feature release adding call-site generic variance and a new no-duplicate-match-arm linter rule, alongside analyzer, codex, and PHPDoc fixes for implicit Stringable, do-while narrowing, @return nullability, and enum match exhaustiveness.

✨ Features

Linter
  • no-duplicate-match-arm: new rule flags a match arm whose result duplicates an earlier arm. (#​2027, a9b3775)
Type System
  • Call-site generic variance: covariant/contravariant/* type-argument modifiers parse and drive assignability. (#​2025, c7ff981)

🐛 Bug Fixes

Analyzer
  • @return narrowing: a docblock @return int over native ?int narrows the return instead of re-adding null. (#​2020, dd8a54f)
  • do-while conditions: the loop body is narrowed by its condition on re-entry, like while. (#​2029, 496cd0a)
  • Enum match exhaustiveness: a self-typed enum is treated as enumerable, fixing a false non-exhaustive report. (#​2019, 6c72db0)
Codex
  • Implicit Stringable: a class declaring or inheriting __toString() now implicitly implements Stringable. (#​2026, 7a81571)
PHPDoc Syntax
  • Inline code spans: an inline `code` span may cross continuation lines without an "unclosed code" error. (#​2024, af95abc)

🏗️ Internal

  • Dependencies: refreshed third-party dependencies. (14ac380)
  • Toolchain: pinned nightly bumped to nightly-2026-06-27. (#​2010, 9680310)

🙏 Thank You

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.40.2...1.41.0

v1.40.2: Mago 1.40.2

Compare Source

Mago 1.40.2

A patch release fixing analyzer false positives around property narrowing across calls and match subjects, two PHPDoc inline-code and conditional-type parsing fixes, plus new diagnostics for unsetting readonly/hooked properties and invalid trait as modifiers.

✨ Features

Analyzer
  • Invalid unset: unsetting a readonly or hooked property is now reported. (#​2018, a24eb10)
Semantics
  • Trait as modifiers: a non-visibility modifier in a trait as adaptation (e.g. as final) is now rejected. (e3d9437)

🐛 Bug Fixes

Analyzer
  • match after impure call: a property used as a match subject no longer widens to mixed. (#​2014, c9e5cc9)
  • Narrowing across calls: passing $obj->prop no longer drops narrowings on sibling properties. (#​2015, 2e9a529)
  • Readonly writes: outside writes to a readonly property report a readonly violation, not a visibility one. (5eb7068)
PHPDoc Syntax
  • Inline code spans: // and quotes inside backticks are literal, not an "unclosed code" error. (95b393d)
  • Parenthesized conditionals: ($x is Y ? A : B) return types parse correctly again. (3a8d627)

🙏 Thank You

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.40.1...1.40.2

v1.40.1: Mago 1.40.1

Compare Source

Mago 1.40.1

A small patch release fixing array_key_exists() narrowing under strict-array-index-existence and a PHPDoc parsing regression where a @return description beginning with is was mistaken for a conditional type.

🐛 Bug Fixes

Analyzer
  • array_key_exists(): narrows a non-literal key like isset() under strict-array-index-existence. (#​2012, 246b1eb)
PHPDoc Syntax
  • Conditional types: is only starts a conditional type when a target ? follows, so prose like @return bool is true when … stays a description. (8d615a8)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.40.0...1.40.1

v1.40.0: Mago 1.40.0

Compare Source

Mago 1.40.0

A big release driven by community reports: three new formatter settings, a new suspicious-explode-arguments linter rule and a final-controller auto-fix, an inspect-baseline CLI command, a Composer-shipped editor schema, and a long list of analyzer, codex, prelude, and PHP-parity syntax fixes. Under the hood, the 2.0 groundwork landed on main: a new high-level IR, a unified mago-phpdoc-syntax, and new mago-allocator/mago-flags crates.

✨ Features

Analyzer
  • array_filter truthiness: a callback-less array_filter() narrows values to their truthy form. (#​1990, bc9bede)
Formatter
  • Breaking binary expressions: preserve_breaking_binary_expression keeps author line breaks in such chains. (#​1853, 5aacc7d)
  • Sort uses by length: optional sorting of use statements by length. (#​1942, 0688859)
  • Tag + declare: optionally combine the opening tag and declare(strict_types=1) onto one line. (#​1959, 2ff4cf5)
Linter
  • suspicious-explode-arguments: warns when explode's short literal looks swapped into the string position. (#​1998, 577d40a)
  • final-controller fix: offers an auto-fix that inserts final before any modifier. (#​2006, 82017a0)
  • sensitive-parameter: skips boolean-like parameters. (#​1949, 2333626)
Type System
  • empty types: empty and empty-scalar are supported in type-syntax and codex. (#​1968, e94cfdd)
CLI
  • inspect-baseline: new command to visualise the distribution of baselined issues. (#​1900, efd07bd)
Composer
  • Editor schema: ships a version-matched schema.json under vendor/carthage-software/mago/. (#​1899, 38b78d0)
Nix
  • Default package: packages.<system>.default now provides bin/mago. (#​1970, 13d7071)

🐛 Bug Fixes

Analyzer
  • Named args + optional params: too-few-arguments fires when a named arg fills only an optional param. (#​2004, c5ec4ef)
  • Conditional array shapes: double-quoted array-access keys reconcile like single-quoted ones. (#​2005, 095badf)
  • Shadowed overrides: no false incompatible-return-type against an ancestor hidden by an intermediate override. (#​1996, 431ff97)
  • $this calls: a property keeps its declared type instead of widening to mixed. (#​1994, 5eef024)
  • Readonly narrowing: readonly property narrowings survive a call passing an object argument. (#​1993, 5cbbe91)
  • foreach over unions: corrected always-entered inference, fixing a false impossible-condition. (#​1986, 22951bd)
  • Compound conditions: avoid duplicate diagnostics in compound conditions. (#​1961, 1ea5ba2)
  • @property traits: trait property conflicts are no longer reported against @property tags. (#​1964, a5f3823)
Codex
  • Self-cased display: self/static/parent resolve to the original-cased class name in diagnostics. (#​1995, b544222)
  • Closure instanceof: closures are treated as instances of Closure. (#​1956, 6fe1bbd)
  • Callable variance: null is no longer ignored in contravariant callable parameter checks. (#​1966, 3f94734)
Linter
  • String-concat chains: a whole chain collapses into one no-redundant-string-concat issue and fix. (#​2003, f8a31f8)
  • no-dead-store: flags stores overwritten across a conditional branch. (#​1999, a315465)
  • no-boolean-flag: only flags boolean parameters actually used as flags. (#​1988, 50cdd11)
  • prefer-early-continue: the auto-fix preserves comments and indentation. (#​1946, 495f639)
Syntax
  • Operator precedence: corrected clone/cast/unary precedence and bound print/yield above and/xor/or. (1ac37b0, 4d01d2d)
  • String interpolation: distinguishes ${label}/${ expr } and $a[offset] forms in the lexer. (b56a704, f3198c8)
  • Reference operands: relational stays above equality when a reference assignment is an operand. (ea6cbce)
  • Unicode escapes: \u{...} decodes to UTF-8 bytes to match Zend. (b19386c)
HIR
  • Integer literals: lowered with PHP long semantics, overflowing to float. (9014c33, 79a7600)
  • Anonymous classes: anonymous-class modifiers are now lowered. (797358f)
Docblock
  • static return: parses a static return type after the static method modifier. (#​1963, d5fb015)
Prelude

📖 Documentation

  • GitHub Actions: improved setup guide and refreshed action versions. (#​1953, b852388)

🏗️ Internal

Architecture
  • High-level IR: new mago-hir crate lowering the CST to a high-level IR (2.0 groundwork). (ca15f9d, e32d0d8, afefad6)
  • PHPDoc unification: codex/analyzer/linter scan docblocks via mago-phpdoc-syntax, retiring two crates. (#​1932, #​1972, 70179ec)
  • New crates: mago-allocator (+ CopyInto) and mago-flags. (#​1957, 0adfdc0, 9a4cd06)
  • Lexer heredoc: heredoc/nowdoc resolved in the lexer with indentation as trivia. (0e4c0e6)
  • astcst: renamed AST to CST across the workspace. (#​1933, b7d64b6)
Dependencies
  • Slimmer deps: serde is now optional/off-by-default; dropped cruet, ustr, shell-words. (1751bae, 184c493, ec8e092)
CI / Tooling

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.30.0...1.40.0

v1.30.0: Mago 1.30.0

Compare Source

Mago 1.30.0

A release focused on generics and robustness: intersection types of generic parameters are now computed, generic reflection (ReflectionClass<T>) threads T into method-return inference, and a new fuzzing + Miri CI hardened the lexer and parsers against crashes, leaks, and quadratic blowups on malformed input. Also: vendor type patches, an object&callable type, and the usual analyzer, codex, formatter, linter, and CLI fixes.

✨ Features

Analyzer
  • Generic reflection: ReflectionClass<T>/ReflectionMethod<T> thread T into getName()/invoke() return types. (c44dc8f)
  • object&callable type: invokable classes are accepted via has-method<__invoke>. (#​1902, 7efac3c)
Codex
  • Vendor type patches: a patches source overrides third-party types without editing vendor code. (#​1873, dcfd38b)
Database
  • Explicit extensionless files: files named without an extension are loaded when listed explicitly. (#​1916, 639f481)

🐛 Bug Fixes

Analyzer
  • Generic intersections: A&B of unions/iterables computed, e.g. (int|bool)&(int|float)int. (#​1945, 353ed77, 7dd3d61)
  • do/while null-narrowing: the loop condition now narrows the body on re-entry. (#​1947, db10237)
  • Undocumented __call return: inferred from __call's declared return instead of mixed. (131537a)
Codex
  • public-properties-of: resolves inherited props, @type aliases, and generic-parameter selectors. (#​1928, #​1929, ce5eea6)
  • Transitive @mixin: methods resolve across mixin chains. (#​1915, e6d9304)
  • Nested templates: params inside class-string and $this in @extends/@implements now resolve. (#​1924, f2fff71, 5eda2e0)
  • Patched method signatures: abstract/concrete mismatches in method patches no longer flagged. (#​1940, c370be3)
Formatter
  • null last in unions: ordered last by default per PER CS 3. (#​1835, 3e5d38c)
  • Comment before method chain: kept on its own line. (#​1854, 1db1fa5)
  • Property-receiver chains: first method stays on the same line under same-line chain style. (#​1193, 5ff2133)
Linter
  • FQ refs in namespace-less files: fully-qualified global class/function/constant references are flagged. (#​1846, 53626d0)
  • global/static rebinds: no false no-parameter-shadowing/no-dead-store. (#​1910, #​1911, 4ccc4f5)
Syntax
  • Class-name keyword casing: resource/integer no longer collide with type keywords. (#​1898, 899cbf3)
  • Identifier::last_segment: returns the last segment, not the first. (#​1919, cadea52)
  • Interpolation perf & leaks: brace-interpolation scan is linear and string-aware; token-kind leak fixed. (#​1914, 478aa81, a80e557)
Type Syntax
  • Malformed-input hardening: type parser is depth-guarded; invalid float tokens like .1E are no longer emitted. (5179f3f, 6baf0b1)
Twig Syntax
  • Malformed-input hardening: expression/statement parsing is depth-guarded and an arena leak is fixed. (f338622, 3972674)
CLI
  • Versioned docs URL: the generated mago.toml links to a versioned, non-404 docs page. (#​1939, b120e6b)
  • Baseline on scoped runs: no false out-of-sync warning on filtered runs. (#​1904, fdffae9)
Prelude
  • DateTime types: precise constant types and format() return type. (#​1917, 70e6094)
Database
  • Vendor watcher: stops adding vendor-path files as host files. (#​1912, f1eaf73)

🏗️ Internal

Language Server
  • Experimental language server removed from the distribution, it is now available on the feat/language-server branch. (131b34c)
CI / Tooling
  • Fuzzing & Miri: scheduled fuzz action and Miri job; fuzzers built for the gnu target so ASan links. (48a3cf1, b0dbd5f, 3b7f34b)
  • Stacked Borrows UB: word interner reads interned bytes via the raw entry pointer. (e9bd270)
  • Toolchain: workspace builds on Rust 1.96.0; routine nightly pins. (35e53c2, #​1925)
  • MAGO_THREADS tests: no longer fail when the env var is set. (#​1895, e2a9d31)
  • Dependencies: bump tar to 0.4.46. (#​1920, b220deb)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.29.0...1.30.0

sebastianbergmann/phpunit (phpunit/phpunit)

v10.5.64: PHPUnit 10.5.64

Compare Source

Changed
  • #​6797: Adapt code generated for test double of interface with constructor for PHP 8.6

Learn how to install or update PHPUnit 10.5 in the documentation.

Keep up to date with PHPUnit:
rectorphp/rector (rector/rector)

v2.5.5

Compare Source

v2.5.4: Released Rector 2.5.4

Compare Source

New Features 🥳

  • [TypeDeclaration] Add ReturnTypeFromGetRepositoryDocblockRector (#​8146)

Bugfixes 🐛

  • [DeadCode] Keep generic @​ var/@​ return self<...> narrowing annotations (#​8147)
  • [TypeDeclaration] Handle getRepository() return via local variable in ReturnTypeFromGetRepositoryDocblockRector (#​8148)

v2.5.3: Released Rector 2.5.3

Compare Source

New Features 🥳

withTypeGuardedClasses()

Are you an open-source project or package used by others? Do you want to make type changes, but keep BC?

Guard the listed classes and their non-final descendants against method signature changes - e.g. adding a return type or a param type — that would break child classes (#​8135)

return RectorConfig::configure()
    ->withTypeGuardedClasses([SomeContract::class]);

New Rules 🎉

NegatedAndsToPositiveOrsRector

(CodeQuality) — simplify a negated "and" to "or" via de Morgan (#​8082)

 $a = 5;
 $b = 10;
-$result = !($a > 20 && $b <= 50);
+$result = $a <= 20 || $b > 50;

ExplicitAttributeNamedArgsRector

(CodeQuality) — positional attribute args → named args (#​8079), Thanks @​DaveLiddament!

-#[SomeAttribute(SomeClass::class, null, ['home'])]
+#[SomeAttribute(value: SomeClass::class, only: null, except: ['home'])]
 class SomeClass
 {
 }

SwitchTrueToMatchRector

(CodeQuality) — switch (true) of returning cases → match (true), replaces deprecated SwitchTrueToIfRector (#​8113)

-        switch (true) {
-            case $value === 0:
-                return 'no';
-            case $value === 1:
-                return 'yes';
-            default:
-                return 'maybe';
-        }
+        return match (true) {
+            $value === 0 => 'no',
+            $value === 1 => 'yes',
+            default => 'maybe',
+        };

RemoveDuplicatedReturnSelfDocblockRector

(DeadCode) — drop @return duplicating native self/static (#​8087)

 final class SomeClass
 {
-    /**
-     * @&#8203;return $this
-     */
     public function some(): self
     {
         return $this;
     }
 }

RemoveMixedDocblockOverruledByNativeTypeRector

(DeadCode) — drop @param mixed / @return mixed overruled by native type (#​8089)

-    /**
-     * @&#8203;param mixed $value
-     * @&#8203;return mixed
-     */
     public function run(int $value): string
     {
     }

RemoveUselessUnionReturnDocblockRector

(DeadCode) — drop @return union broader than a specific native type (#​8126)

-    /**
-     * @&#8203;return bool|mixed|string
-     */
     public function run(): false|string
     {
     }

ClosureReturnTypeFromAssertInstanceOfRector

(TypeDeclaration) — add closure return type narrowed by assertInstanceOf() (#​8115)

-        $callback = function (object $object) {
+        $callback = function (object $object): SomeType {
             $this->assertInsta

> ✂ **Note**
> 
> PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/castor-labs/php-lib-ledgering).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDkuNCIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

@renovate renovate Bot force-pushed the renovate/composer-dev branch from 8497d8c to e33f569 Compare June 17, 2026 19:09
@renovate renovate Bot changed the title chore(deps): update composer dev dependencies to v1.30.0 chore(deps): update composer dev dependencies Jun 17, 2026
@renovate renovate Bot force-pushed the renovate/composer-dev branch 8 times, most recently from a395b5a to a7ec7d9 Compare June 27, 2026 12:47
@renovate renovate Bot force-pushed the renovate/composer-dev branch 3 times, most recently from ed09689 to 4af49d1 Compare July 6, 2026 15:00
@renovate renovate Bot force-pushed the renovate/composer-dev branch from 4af49d1 to b6a7562 Compare July 9, 2026 10:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants