[dependabot]

Bumps vimeo/psalm from 5.26.1 to 7.0.1.

Release notes

Sourced from vimeo/psalm's releases.

7.0.1

What's Changed

Fixes

• Report each property write in a restricted purity context once by @​danog in vimeo/psalm#13067
• [7.x] Cut peak memory 22 to 25% (4.6 to 3.6 GB on Laravel) by stopping workers before unpacking their results by @​jarstelfox in vimeo/psalm#12573
• Fix: code used only from __destruct and other magic methods is reported unused by @​alies-dev in vimeo/psalm#13069
• Don't report strtolower() of a Stringable object as redundant by @​jirkace in vimeo/psalm#12598
• Fix: __callStatic and the code it uses reported unused by @​alies-dev in vimeo/psalm#13073
• Don't crash on a constant dividing by a zero constant of another class (#12066) by @​jirkace in vimeo/psalm#12761
• fix(readonly): promoted properties of a readonly class are readonly by @​jirkace in vimeo/psalm#12909
• fix(var-docblock): a @​var line without a name does not take the name of the previous line by @​jirkace in vimeo/psalm#12670
• fix(messages): say that the (unset) cast was removed in PHP 8.0 by @​jirkace in vimeo/psalm#12824
• fix(messages): explain impossible negated checks and calls without effect by @​jirkace in vimeo/psalm#13006
• fix(types): array intersected with iterable is an array of the iterable's types by @​jirkace in vimeo/psalm#13004
• fix(messages): do not tell to install a polyfill that may not ship the symbol by @​jirkace in vimeo/psalm#12813

Docs

• Document that taint analysis runs by default by @​roxblnfk in vimeo/psalm#13072

Internal changes

• Add regression tests for 92 issues already fixed in Psalm 7 by @​alies-dev in vimeo/psalm#13063
• Let a Psalm process of the end-to-end tests run for 300 seconds by @​jirkace in vimeo/psalm#12613
• Push the files composer build regenerates instead of failing by @​danog in vimeo/psalm#13138

New Contributors

• @​roxblnfk made their first contribution in vimeo/psalm#13072

Full Changelog: vimeo/psalm@7.0.0...7.0.1

Psalm 7

Announcing the release of Psalm 7!

Featuring a simply enormous number of new features and bug fixes, such as:

• security analysis on by default: fully refactored for 10x+ performance and much greater coverage, in the same run as type checking and dead code detection;
• much deeper security analysis taint tracking: NoSQL, LLM prompt and URL injection, new sources like php://input and uploaded file names, flows through closures, generators, traits and by-reference parameters, and ready-made stubs for Guzzle, PSR-7, Monolog, MongoDB and more.
• a new purity model based on Hack's capabilities: declare exactly which side effects a function may have (io, time, write-props...), with purity templates for classes, closures and automatically inferred annotations;
• graph-based dead code detection: If nothing reachable uses a class, function, method, constant, variable, etc, Psalm finds it, now properly handling unused cycles as well.
• Template defaults (@template TError of Throwable = RuntimeException) for classes, functions and methods: Result<int> just works, and libraries can add templates without breaking their users.
• PHP 8.5 and 8.6 support: Full support for Partial Function Application, the pipe operator, and much more!
• Daily releases. Features and fixes reach you the day they land, no more waiting on dev-master.
• Framework plugins in the box. The PHPUnit, Symfony, Laravel, Mockery and sabre/event plugins ship with Psalm and switch on by themselves. Zero setup.
• a bigger Psalm maintainer team: @​alies-dev has joined the Psalm maintainer team, contributing many new useful features and bugfixes!
• An official Discord community!
• And so, so many other new features and bugfixes!

Psalm 7 runs on 64-bit PHP 8.2 to 8.6. Upgrading is simple for most projects: see Upgrading below.

Security analysis: faster, always on, in a single run

... (truncated)

Commits

• c390923 Update the files composer build generates
• 6a88f99 Merge pull request #13138 from danog/auto-push-composer-build
• 356d3a8 Check composer build patches with a copy of the checker and parse-mode tokens
• 8b3bfa2 Only push composer build patches that change generated data files
• b0f46ed Push the files composer build regenerates instead of failing
• 6a8c211 Merge pull request #12813 from jirkace/fix-12234
• 5bb65c1 Merge pull request #13004 from jirkace/fix/11183-array-implements-iterable-do...
• eacc973 Merge pull request #13006 from jirkace/fix/11053-clearer-impossible-and-unuse...
• f520ba7 Merge pull request #12824 from jirkace/fix-11639
• 9f1ed18 Merge pull request #12670 from jirkace/fix/8461-var-docblock-var-id-carryover
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Quality Report — ConductionNL/launchpad @ 055c782

Check	PHP	Vue	Security	License	Tests
lint	❌
phpcs	❌
phpmd	❌
psalm	❌
phpstan	❌
phpmetrics	❌
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
format		❌
check-schema-l10n		✅
composer			❌	❌
npm			❌	✅ 636/636
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					❌
Newman					❌
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-11-05 12:57 UTC

Download the full PDF report from the workflow artifacts.