[dependabot]

Updates the requirements on infection/infection, phpstan/phpstan, phpstan/phpstan-deprecation-rules, rector/rector and rector/type-perfect to permit the latest version.
Updates infection/infection to 0.34.2

Release notes

Sourced from infection/infection's releases.

0.34.2

Fixed:

• Use recordTestRunHistory instead of cacheResult on PHPUnit 13.3 by @​lazerg in infection/infection#3447
• Escape GitHub annotation workflow commands by @​theofidry in infection/infection#3441

Internal:

• Suggest minimizing blast radius of any change + specific guidance for AI by @​sanmai in infection/infection#3426
• Replace deprecated MutantBuilder::materialize(), simplify the builder by @​sanmai in infection/infection#3432
• Record PHPUnit version and CPU steal in performance metrics by @​sanmai in infection/infection#3417
• Refactor GitHub annotation command formatting by @​theofidry in infection/infection#3442
• Fix Rector warning by @​theofidry in infection/infection#3443
• Revert TurboNodeTraverser return type in Analyser by @​sanmai in infection/infection#3434

New Contributors

• @​lazerg made their first contribution in infection/infection#3447

Full Changelog: infection/infection@0.34.1...0.34.2

Commits

• 18d9bef fix(phpunit): Use recordTestRunHistory instead of cacheResult on PHPUnit 13.3...
• 9505953 [Conductor] Update shipmonk/dead-code-detector to 1.3.3 (#3446)
• aa66f5f chore: Fix Rector warning (#3443)
• 2dd27a7 refactor(reporter): Refactor GitHub annotation command formatting (#3442)
• b669894 fix(reporter): Escape GitHub annotation workflow commands (#3441)
• 57605a4 build(deps): bump zizmorcore/zizmor from 1.27.0 to 1.28.0 in the dependencies...
• 6758404 [Conductor] Update carthage-software/mago to 1.46.0 (#3439)
• 9233b25 [Conductor] Update rector/rector to 2.6.1 (#3438)
• 65f79f3 [Conductor] Update all of phpstan (#3437)
• d779f90 feat(test-framework): Add debug test framework and static analysis adapters (...
• Additional commits viewable in compare view

Updates phpstan/phpstan to 2.2.8

Commits

• See full diff in compare view

Updates phpstan/phpstan-deprecation-rules to 2.0.5

Release notes

Sourced from phpstan/phpstan-deprecation-rules's releases.

2.0.5

• 67bedd6 - Update github-actions (#197)
• 6be8bd3 - Update actions/cache action to v6 (#198)
• 0b310ec - Update github-actions to v3.0.1 (#195)
• 782d848 - Update github-actions to v7 (#196)
• 85fff9d - Update github-actions to f3e473d (#194)
• 54db580 - Update github-actions (#193)
• 99aff1a - Replace deprecated actions/create-release with softprops/action-gh-release
• 971f8e1 - Bump GitHub Actions across major versions
• 89fef35 - Bump GitHub Actions within their current majors
• 0652358 - Update github-actions
• 02119cc - Update github-actions
• 389c78c - latest infection does not support PHP 8.2 (#189)
• 899202d - Update release-toot.yml (#188)
• 016d677 - name-collision-detector (#187)
• 945df12 - Delete .github/workflows/claude-react-on-comment.yml
• a70b8b1 - Remove default branch determination from workflow
• 1faeb2e - Lint workflows
• 534891e - [StepSecurity] ci: Harden GitHub Actions
• 3acc664 - Remove PHPSTAN_BOT_TOKEN from checkout step
• 49efeb2 - React on issues opened and fall back to issue body
• 319c3f6 - Add PHP 8.5 to CI matrix for lint, tests, and static analysis
• 73feeba - Add missing export-ignore entries to .gitattributes
• c6d73e5 - Add CLAUDE.md with project documentation
• f9f68eb - Add Claude React on Comment workflow

Commits

• 67bedd6 Update github-actions (#197)
• 6be8bd3 Update actions/cache action to v6 (#198)
• 0b310ec Update github-actions to v3.0.1 (#195)
• 782d848 Update github-actions to v7 (#196)
• 85fff9d Update github-actions to f3e473d (#194)
• 54db580 Update github-actions (#193)
• 99aff1a Replace deprecated actions/create-release with softprops/action-gh-release
• 971f8e1 Bump GitHub Actions across major versions
• 89fef35 Bump GitHub Actions within their current majors
• 0652358 Update github-actions
• Additional commits viewable in compare view

Updates rector/rector to 2.6.2

Release notes

Sourced from rector/rector's releases.

Released Rector 2.6.2

The 2.6.0 release introduced composer-based sets. This release finishes the job: every extension package now ships a single composer-based set, and the per-version set providers behind the old guessing game are gone.

use Rector\Config\RectorConfig;
return RectorConfig::configure()
->withComposerBased(
doctrine: true,
phpunit: true,
twig: true,
);

Each rule inside checks composer.json/installed.json on its own and runs only if the installed package version matches its constraint. No SymfonySetList::SYMFONY_63, no picking a PHPUnit version by hand. We're working hard to bring Drupal and Laravel community packages to the same system.

Run only the PHP rules (#8322)

A new --php option on the process command runs only rules bound to a minimal PHP version — those implementing MinPhpVersionInterface. Useful to split a PHP upgrade from the rest, without a second config:

vendor/bin/rector process src --php --dry-run

New features 🥳

• [Process] Add --php option to run only PHP version rules (#8322)
• [Configuration] Resolve the composer-based set of extension packages in withComposerBased() (#8332), load Doctrine and Twig composer-based sets (#8313)
• [Configuration] Report explicit error when the --only rule exists but is not registered in rector.php (#8300)
• [DX] Warn on skipped classes that are not Rector rules (#8323), include the skipped class name in the message (#8325)
• [DX] Show previous exceptions during bootstrap (#8287)

 [WARNING] This skipped class is not a Rector rule, so it can never be skipped.
           Only classes that implement "Rector\Contract\Rector\RectorInterface"
           can be used in "->withSkip()"

New rules 🎉

rector-src

• [DeadCode] RemoveRedundantTypeCheckRector (#8307)

... (truncated)

Commits

• 03cd615 Rector 2.6.2
• 112412c Updated Rector to commit d39693f97e95e5dfb160f6d3529b740ac1c24b38
• db9eb19 Updated Rector to commit 29928dd034534323ebf603bd1602b4f20ecd3ac6
• 722336e Updated Rector to commit 09ee9549d7e20c168004ec0111ba165f91350541
• 3654819 Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• f42c503 Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• f7bbc4f Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• 08865fb Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• b00041d Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• 032c857 Updated Rector to commit 768539a46a08410a7e25a643fe3777ab9c17b116
• Additional commits viewable in compare view

Updates rector/type-perfect to 2.2.0

Release notes

Sourced from rector/type-perfect's releases.

Type Perfect 2.2.0 - Deprecated & merged into tomasvotruba/type-coverage

This package is deprecated

Keeping 2 very close packages up-to-date is daunting work and keep both behind. T Both focus with custom PHPStan rule on better type coverage and more precise and narrow types if available.

To improve support, the Type Perfect rules have been merged into tomasvotruba/type-coverage as of its 2.3.0 release. This is the final release of rector/type-perfect — it is marked abandoned in composer.json and Composer will now point you at the replacement on every install.

How to switch

1. Swap the package

 "require-dev": {
-    "rector/type-perfect": "^2.1"
+    "tomasvotruba/type-coverage": "^2.3"
 }

composer remove rector/type-perfect --dev
composer require tomasvotruba/type-coverage --dev

If you already use tomasvotruba/type-coverage, only remove rector/type-perfect — keeping both loads every rule twice.

Type Coverage requires PHP ^8.4; Type Perfect required ^8.2.

2. Keep your ignoreErrors as they are

The rules keep the Rector\TypePerfect\ namespace inside Type Coverage, so existing ignore patterns and PHPStan baselines still match. The extension is registered by phpstan/extension-installer, so no includes change is needed either.

3. Enable the rules that used to be on by default

NoParamTypeRemovalRule, NoIssetOnObjectRule and NoEmptyOnObjectRule reported right after install here. In Type Coverage they are opt-in like the rest of the set, one parameter each:

 parameters:
     type_perfect:
         narrow_param: true
         narrow_return: true
         no_mixed_property: true
         no_mixed_caller: true
         null_over_false: true
</tr></table> 

... (truncated)

Commits

• 33d189f Deprecate package in favor of tomasvotruba/type-coverage (#78)
• 255b323 NoArrayAccessOnObjectRule: Skip Symfony DomCrawler AbstractUriElement and chi...
• bf9bd55 Prepare push repository logic to anywherephp/type-perfect (#75)
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
composer/infection/infection	>= 0.34.2, < 0.35.0	Unknown	Unknown
composer/phpstan/phpstan	>= 2.2.8, < 3.0.0	Unknown	Unknown
composer/phpstan/phpstan-deprecation-rules	>= 2.0.5, < 3.0.0	Unknown	Unknown
composer/rector/rector	>= 2.6.2, < 3.0.0	Unknown	Unknown
composer/rector/type-perfect	>= 2.2.0, < 3.0.0	Unknown	Unknown

Scanned Files

• composer.json

[github-advanced-security]

PHPStan found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.00%. Comparing base (b70840d) to head (2e85200).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##             master     #436   +/-   ##
=========================================
  Coverage     98.00%   98.00%           
  Complexity       20       20           
=========================================
  Files             1        1           
  Lines            50       50           
=========================================
  Hits             49       49           
  Misses            1        1           

Flag	Coverage Δ
php-8.3	98.00% <100.00%> (ø)
phpunit	98.00% <100.00%> (ø)
ubuntu-latest	98.00% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/CallbackFilterHandler.php	98.00% <100.00%> (ø)