chore: upgrade PHPStan to 2.2.6 - #2240
Closed
SanderMuller wants to merge 1 commit into
Closed
Conversation
Bumps phpstan/phpstan from 2.1.40 to 2.2.6. Composer resolves it as a single-package upgrade; none of the PHPStan extensions need a version change. 2.2 surfaces nine findings that 2.1.40 did not. None are 2.2 bugs: - Removed three now-stale ignores that 2.2 no longer needs (2.2 narrows method_exists() and sees `new $class()` can throw ArgumentCountError): Option::displayValue and BootDiscovery::resolveDiscovery(). - Dropped provably dead code flagged by the sharper analysis: the redundant count($method) === 2 in GenericContainer::invoke(), the dead ?? null and the === true checks in Cookie::createFromString(). - Ignored two false positives with a reason: the intentionally-unused sign() call in a test that expects an exception, and a stateful seek() comparison in TempestViewLexer that is not actually constant.
SanderMuller
requested review from
aidan-casey,
brendt and
innocenzi
as code owners
July 27, 2026 11:53
Member
|
Awesome! We just merged #2234 though :D Nonetheless, I appreciate the effort! |
Contributor
Author
Whoops totally missed that one, awesome! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrades
phpstan/phpstanfrom 2.1.40 to 2.2.6.Why
Mainly speed. On this codebase (full
src,packagesandtests, level 5, single process, cold cache), 2.2.6 uses about 14% less CPU than 2.1.40, 63.9s against 74.6s as the min of three runs, and a little less peak memory (895 MB against 964 MB). CI runs in parallel, so in practice that is a shorter run and more room under the 1G limit.Composer resolves it as a single-package upgrade. None of the PHPStan extensions here (phpat, disallowed-calls, deprecation-rules) need a version change.
Findings addressed
2.2 reports nine things 2.1.40 did not. None are 2.2 bugs. Three kinds:
Stale ignores that 2.2 made unnecessary by fixing the false positives they suppressed, removed:
Option::displayValue: two@phpstan-ignore-next-lineon themethod_exists()guard and thetoString()call. 2.2 narrowsmethod_exists(), so neither is needed.BootDiscovery::resolveDiscovery():@phpstan-ignore catch.neverThrown. 2.2 seesnew $discoveryClass()can throwArgumentCountError, so the catch is reachable.Dead code, removed (behavior unchanged):
GenericContainer::invoke(): onceis_array($method)narrows thecallableto its two-element array form,count($method) === 2is always true.Cookie::createFromString():'value'is always set, so?? nullnever fired;secureandhttponlyare only ever set totrue, soisset(...) && ... === trueis justisset(...).False positives, ignored with a reason:
SignerTest::test_no_signing_key(): thesign()call is there to trigger the expected exception, so its result is unused on purpose.TempestViewLexer::lexTag():seek()is stateful, andconsume()moved the cursor past=earlier in the branch, so the=== "'"check is not actually always false. 2.2 does not track the mutation across the two calls.Checks
composer phpstangreen on 2.2.6, no baseline changes.composer lint(mago) and formatting clean.