Skip to content

chore(deps): update dependency vimeo/psalm to v7 (main)#5270

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/main-vimeo-psalm-7.x
Open

chore(deps): update dependency vimeo/psalm to v7 (main)#5270
renovate[bot] wants to merge 1 commit intomainfrom
renovate/main-vimeo-psalm-7.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 21, 2026

This PR contains the following updates:

Package Change Age Confidence
vimeo/psalm ^6.16.1^7.0.0-beta19 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

vimeo/psalm (vimeo/psalm)

v7.0.0-beta19

Compare Source

What's Changed

Fixes
  • Final improvements for reduced scanning by @​danog in #​11809
  • Allow enums to have impure methods by @​danog
  • Switch void/never params to use ParadoxicalCondition issue by @​danog

Full Changelog: vimeo/psalm@7.0.0-beta18...7.0.0-beta19

v7.0.0-beta18

Compare Source

What's Changed

Features
Fixes
Docs
Internal changes
Other changes

Full Changelog: vimeo/psalm@7.0.0-beta17...7.0.0-beta18

v7.0.0-beta17

Compare Source

What's Changed

Features
Fixes
Internal changes

New Contributors

Full Changelog: vimeo/psalm@7.0.0-beta16...7.0.0-beta17

v7.0.0-beta16

Compare Source

This release allows using @psalm-pure on classes, which will mark all methods as pure, and ban property declarations.

What's Changed

Features
Fixes

Full Changelog: vimeo/psalm@7.0.0-beta15...7.0.0-beta16

v7.0.0-beta15

Compare Source

This release features a major refactoring of Psalm's mutability inference system.

This release will likely be followed by a stable release.

The new automated mutability (pure, mutation free, externally mutation free, impure) attribute fixes that will be proposed by Psalm, when applied, will improve Psalm's type inference and especially security analysis, as pure functions are automatically specialized by Psalm, killing false positives during security analysis.

Now, Psalm will always analyze and emit MissingPureAnnotation and MissingImmutableAnnotation issues for all functions, methods and classes that can be marked with one of the following attributes (which can be automatically added by running Psalm with --alter --issues=MissingPureAnnotation,MissingImmutableAnnotation).

For functions and methods, MissingPureAnnotation will be emitted, automatically adding the following annotations:

  • @psalm-pure » - Indicates that the function or method is pure, one whose output is just a function of its input (no mutations or even read property accesses allowed).
  • @psalm-mutation-free » - Used to annotate a class method that does not mutate state, either internally or externally of the class's scope (only internal property reads on $this are allowed for methods)
  • @psalm-external-mutation-free » - Used to annotate a class method that does not mutate state externally of the class's scope (internal property reads and writes on $this and self are allowed for methods)
  • @psalm-impure » - A new annotation, equivalent to the default mutability level of functions and methods (all mutations allowed): Psalm will require the explicit annotation of only abstract methods with this or any of the above annotations through a separate, non-autofixable MissingAbstractPureAnnotation issue, to improve mutability inference for implementors of an interface (though it can be used on all functions and methods as well).

For classes, MissingImmutableAnnotation will be emitted, automatically adding the following annotations:

  • @psalm-immutable » - Used to annotate a class where every property is treated by consumers as @psalm-readonly and every instance method is treated as @psalm-mutation-free.
  • @psalm-external-mutation-free » - Used to annotate a class where every instance method is treated as @psalm-external-mutation-free.
  • @psalm-mutable » - A new annotation, used to annotate a class where at least one property is mutable: this is the default behavior, but it can be explicitly marked for clarity: Psalm will require the explicit annotation of only interfaces with this or any of the above annotations through a separate, non-autofixable MissingInterfaceImmutableAnnotation issue, to improve mutability inference for implementors of an interface (though it can be used on all classes and interfaces as well).

New types

For situations where the callable or Closure needs to be pure, mutation-free or externally mutation-free, the following subtypes are available:

  • Pure (no mutations or even read property accesses allowed), equivalent to marking functions or methods with @psalm-pure
    • pure-callable
    • pure-Closure
  • Mutation-free (only internal property reads on $this are allowed for methods), equivalent to marking functions or methods with @psalm-mutation-free
    • self-accessing-callable
    • self-accessing-Closure
  • Externally mutation-free (internal property reads and writes on $this and self are allowed for methods), equivalent to marking functions or methods with @psalm-external-mutation-free
    • self-mutating-callable
    • self-mutating-Closure
  • Impure (the default behavior, all mutations allowed); functions or methods can also be explicitly marked as impure with @psalm-impure
    • impure-callable (an alias to callable)
    • impure-Closure (an alias to Closure)

This can be useful when the callable is used in a function marked with @psalm-pure or @psalm-mutation-free or @psalm-external-mutation-free.

What's Changed

Features
  • Mutation refactoring, always emit MissingPureAnnotation and MissingImmutableAnnotation issues by @​danog in #​11630
  • Global variables are impure like static variables by @​kkmuffme in #​11659
Fixes

Full Changelog: vimeo/psalm@6.15.1...7.0.0-beta15

v7.0.0-beta14

Compare Source

What's Changed

Features
Fixes
Docs
Other changes

Full Changelog: vimeo/psalm@6.14.3...7.0.0-beta14

v7.0.0-beta13

Compare Source

What's Changed

Features

Full Changelog: vimeo/psalm@7.0.0-beta12...7.0.0-beta13

v7.0.0-beta12

Compare Source

What's Changed

Features
Fixes
Internal changes
  • Improve performance by avoiding repeated scanning of files included/required only once by @​mmcev106 in #​11478
Other changes

New Contributors

Full Changelog: vimeo/psalm@7.0.0-beta11...7.0.0-beta12

v7.0.0-beta11

Compare Source

What's Changed

Features
  • ✨ Full support for iterables for iterator_to_array by @​andrew-demb in #​11430
  • Add an arrayCache configuration key that can be used to disable the newly introduced array cache: this will slightly slow down execution times while reducing RAM usage, avoiding OOM issues on bigger codebases by @​danog

Full Changelog: vimeo/psalm@7.0.0-beta10...7.0.0-beta11

v7.0.0-beta10

Compare Source

What's Changed

Fixes

Full Changelog: vimeo/psalm@7.0.0-beta9...7.0.0-beta10

v7.0.0-beta9

Compare Source

Fixes:

  • Normalize order of taint flow graph issues

Full Changelog: vimeo/psalm@7.0.0-beta8...7.0.0-beta9

v7.0.0-beta8

Compare Source

This release syncs up the 7.x branch with the 6.x branch.

What's Changed

Features
Fixes
Docs
Other changes

New Contributors

Full Changelog: vimeo/psalm@7.0.0-beta7...7.0.0-beta8

v7.0.0-beta7

Compare Source

What's Changed

Fixes
Other changes

New Contributors

Full Changelog: vimeo/psalm@7.0.0-beta6...7.0.0-beta7

v7.0.0-beta6

Compare Source

What's Changed

Features
  • Enable taint analysis by default.
Fixes
Other changes

Full Changelog: vimeo/psalm@7.0.0-beta5...7.0.0-beta6

v7.0.0-beta5: Combined analysis!

Compare Source

This beta release adds a major new feature to Psalm v7: combined analysis!

Combined analysis allows running normal analysis, security analysis and dead code analysis all at the same time, within a single run, greatly reducing overall runtimes!

Future beta releases will also enable taint analysis by default, given that now it can be run alongside normal analysis.

What's Changed

Features

Full Changelog: vimeo/psalm@7.0.0-beta4...7.0.0-beta5

v7.0.0-beta4

Compare Source

Join the new official Psalm news channel and the Psalm community!

The news channel will be used to share inside exclusive news about upcoming Psalm features (including property hook support, coming within the next few releases!), and the community group can be used to discuss and share the way you use Psalm!

What's Changed

Features

Full Changelog: vimeo/psalm@7.0.0-beta3...7.0.0-beta4

v7.0.0-beta3

Compare Source

Add git and composer to the docker image by @​danog.

Full Changelog: vimeo/psalm@7.0.0-beta2...7.0.0-beta3

v7.0.0-beta2

Compare Source

What's Changed

Features
Fixes
Internal changes

Full Changelog: vimeo/psalm@7.0.0-beta1...7.0.0-beta2

v7.0.0-beta1: First Psalm v7 beta!

Compare Source

Announcing the first public beta of Psalm v7!

Psalm v7 brings huge performance improvements to security analysis, up to 10x thanks to a full refactoring of both the internal representation of taints, and optimization of the graph resolution logic.

It also brings performance improvements to dead code analysis, and fixes for list types.

Even more performance improvements and new features will be released soon!

What's Changed

Breaking changes

See here for the full list of breaking changes between v6 and v7.

Features
Fixes
Other changes

Full Changelog: vimeo/psalm@6.9.0...7.0.0-beta1


Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • "before 5am on tuesday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 21, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3. to review Waiting for reviews dependencies

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants