chore(deps): update composer dev dependencies by renovate[bot] · Pull Request #48 · castor-labs/php-lib-ledgering

renovate · 2026-06-04T18:37:57Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
carthage-software/mago	`1.29.0` → `1.45.0`
phpunit/phpunit (source)	`10.5.63` → `10.5.64`
rector/rector (source)	`2.4.5` → `2.5.9`
symfony/config (source)	`7.4.10` → `7.4.15`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

carthage-software/mago (carthage-software/mago)

`v1.45.0`: Mago 1.45.0

Compare Source

Mago 1.45.0

This release teaches the analyzer to build keyed array shapes from get_object_vars(), adds @param-closure-this support and an auto-fix for overly-wide return types, introduces a linter rule preferring DateTimeImmutable::createFromTimestamp(), fixes a batch of analyzer false positives, and makes empty reports valid SARIF/JSON documents for CI.

✨ Features

Analyzer

get_object_vars() shapes: returns keyed array shapes built from the object's visible properties. (#2110, a729ce1)
@param-closure-this: supports the docblock tag for typing a closure parameter's $this. (#2131, 6000d41)
Overly-wide return types: adds an auto-fix that narrows the declared return type. (#2068, #2120, 9e4d186)

Linter

prefer-datetimeimmutable-create-from-timestamp: suggests the factory over new DateTimeImmutable('@...'). (#2118, 38b6152)

🐛 Bug Fixes

Analyzer

Readonly promotion: detects reinitialization of promoted readonly properties in parent constructors. (#2127, 490452e)
Escaping breaks: preserves breaks that escape nested loops in reachability analysis. (#2124, 635eeab)
Guarded members: tracks method_exists guards on descendant members. (#2125, d1b6e9c)
PSL analysis: eliminates false positives when analyzing PSL-based code. (6527f24)
array_map shapes: preserves array shapes for untyped closures. (#2122, 816578a)
Catch variables: refines definedness for precise conditions in try/catch. (#2119, aa469b9)
Hooked properties: tracks property-hook writes against the read type. (#2112, bd95ea5)
Split property types: supports distinct @property-read and @property-write types. (#2079, #2108, b54a881)
@property visibility: resolves tags according to call-site visibility. (#2106, a4b077d)

Codex

Enum case literals: infers literal values from class constants, tightening integer conditions. (#2111, 237465e)

Prelude

array_diff: relaxes value parameters to string-castable types. (#2116, f290239)

Reporting

Empty reports: emits valid SARIF, JSON, GitLab, and Checkstyle documents when there are no issues. (#2128, 003ff32)

Playground

Analyzer settings: forwards playground settings so they take effect. (#2121, 4184888)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

@dotdash: #2106, #2108, #2112, #2120, #2122, #2123, #2131

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.44.0...1.45.0

`v1.44.0`: Mago 1.44.0

Compare Source

Mago 1.44.0

A faster release with stronger dependent-type analysis, richer guard and linter configuration, and fixes across the CLI, formatter, analyzer, and semantics.

✨ Features

Analyzer

Override return types: reports overriding methods that omit a declared return type. (#2100, 90c04c0)

Linter

no-missing-format-argument: detects missing format arguments. (#2062, 38857dd)
missing-docs exclusions: supports configurable exclusions. (#2102, 4488055)
Disallowed symbol levels: configures levels for functions and type instantiations. (#2101, 34ed400)

Guard

@final validation: supports the annotation during structure validation. (#2065, 78cbbf0)
Restrictions: supports dependency restrictions and public-method allowlists. (#2074, 8d6d359)

CLI

-y self-update: adds a shorthand for --no-confirm. (#2011, d231964)

🐛 Bug Fixes

Analyzer

Dependent types: resolve them across calls, partials, unpacks, and intersections. (a629700, a231709, 81be763)
Integer conditions: preserve ranges for correct impossible and redundant-condition reports. (#2085, #2087, 2037b9a, 6d71045)
Loop conditions: stabilize types and avoid false diagnostics in do-while iterations. (#2078, 0205e49, 7afc4eb)
isset flow: retains unsafe access and try/catch uncertainty after failed checks. (#2076, #2096, b70350c, 23203e5)
Readonly initialization: accepts deferred initialization of readonly properties. (#2095, ad495bd)
Magic methods: resolves @method calls backed by inherited methods. (#2089, fda90f8)
Mixin receiver types: binds $this and static to mixin receivers. (#2086, 07086c5)
Property overrides: reports incomparable override types. (#2103, 80dbbfe)
Dynamic property names: reports $property, not $$property. (#2066, 5d2116d)
PHPDoc returns: permits void in nullable docblock return types. (#2081, #2082, cdfd166)
Optional shapes: recognises optional string-keyed shapes as lists. (#2073, b15f9e1)

Codex

Enum case identity: distinguishes cases during type identity checks. (#2071, 683220c, 2637cf8)
Backed enum values: preserves literal values from known ->value access. (#2064, 45ad41b)
Trait bounds: accepts exact @require-extends classes when validating traits. (#2069, 84c0766)

Semantics

Enum magic methods: permits __call, __callStatic, and __invoke. (#2075, d0487f2)

Linter

Namespaced imports: prevents overlapping fixes in global function imports. (#2072, 9b40611)

Formatter

Binary continuations: preserves indentation and match-arm docblocks. (#2060, #2063, 3057c15)
Multiline chains: keeps short chains attached after receiver arguments wrap. (#1711, #2030, bc0090e)
Aligned assignments: respects print width and indents continuations. (#2093, #2094, 035d956, 2923585)

Guard

@self: scopes permits to the active rule namespace. (#2084, 6a2a317)

CLI

Piped output: restores SIGPIPE handling, avoiding a panic with head. (#2090, #2097, 9e504a6)

Distribution

Composer package: excludes the repository-only tests suite. (#2098, 722e39b)

🏗️ Internal

Performance

Formatter: reduces printer and pipeline overhead. (f6520a2, ed94713)
Linter: reduces traversal and allocation overhead. (d818460)
Project analysis: speeds up end-to-end analysis and word interning. (d473383, c0d27c6)

Toolchain

Rust: bumps the minimum Rust version to 1.97.0 and removes the nightly pin. (8c8262e, a43077b)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

@Norbytus: #2065
@mvanhorn: #2030, #2097
@dotdash: #2066, #2075, #2086, #2088, #2089, #2098, #2100, #2103
@xHeaven: #2082
@maximal: #2011
@adam-ja: #2101, #2102

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.43.0...1.44.0

`v1.43.0`: Mago 1.43.0

Compare Source

Mago 1.43.0

A fix-focused release clearing false positives across the analyzer, codex, linter, and formatter. is_callable narrowing, strict in_array, type-alias recursion, ::class array keys, no-dead-store, and member-access chains. Plus sqlsrv stubs and internal HIR groundwork for the upcoming rule-based checker.

✨ Features

Prelude

sqlsrv extension: added function and constant stubs for the sqlsrv extension. (#2045, e8f1ed3)

🐛 Bug Fixes

Analyzer

is_callable narrowing: no more false invalid-callable after narrowing to a callable type. (#2037, 938a511)
Strict in_array: keeps the value's type on a negative result instead of wrongly excluding it. (#2048, 3a69d09)
redundant-logical-operation: suppressed during loop pre-condition analysis. (#2054, 4b4a7d4)

Codex

Enum generic narrowing: preserves generic type parameters when narrowing with enum type arguments. (#2035, 0c5fdad)
Type-alias recursion: rejects aliases shadowing symbols and handles self-references, fixing a stack overflow. (#2050, cde8037)
::class array keys: no false invalid-array-index for literal class-string keys. (#2056, e0dc158)

Prelude

Named arguments: dropped @no-named-arguments from native functions that accept them. (#2043, 3e77dff)

Linter

no-dead-store: handles terminators and loop exits, clearing false positives. (#2052, #2053, 9f2eb74)

Formatter

Member-access chains: formatting is idempotent with both preserve options. (#2032, 840cca4)
Array-base parentheses: avoids redundant parens around a parenthesized array base. (#2038, da54dd7)

Syntax

Heredoc interpolation: preserves token order for lossless reconstruction. (2a87bf6)
Abstract methods: allows a ?><?php tag-pair terminator after an abstract method. (e5f81cb)

PHPDoc Syntax

Docblock close marker: treats consecutive * before / as one marker, fixing a lost intersection type. (#2055, 8749c2b)

📖 Documentation

AST → CST: updated stale AST references to CST. (#2034, 73a9ade)
Helix formatter: fixed the Helix formatter setup docs. (#2058, 15336f4)

🏗️ Internal

HIR groundwork: flat Node/NodeKind view and PHP surface syntax carried through the IR for the upcoming rule-based checker. (11349fd, 94927e7)
Composite strings: unified composite/shell strings into one node with spans and heredoc/nowdoc kinds. (732ad8f, 6c880a8)
Analyzer performance: removed duplicate hashing and redundant allocations. (5ae5198, 072933f, f71b732)
Crate cleanup: removed the unused mago-docblock and mago-type-syntax crates. (5deb957)
Toolchain: pinned nightly bumped through nightly-2026-07-05. (#2059)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.42.0...1.43.0

`v1.42.0`: Mago 1.42.0

Compare Source

Mago 1.42.0

A small release adding a prefer-early-return linter rule, fixing Windows self-update, and clearing analyzer and PHPDoc false positives around is_a(), nullable destructuring, and @param on promoted properties.

✨ Features

Linter

prefer-early-return: new rule suggesting early returns to reduce nesting in functions. (#2031, e523ab1)

🐛 Bug Fixes

Analyzer

is_a() with allow_string: a string subject no longer triggers a false impossible-type-comparison. (db64917)
Nullable destructuring: destructuring T|null keeps element types (plus null) instead of widening to mixed. (643a037)

PHPDoc Syntax

@param on promoted properties: @param T with no variable is allowed and types the property like @var. (8b9af32)

CLI

Windows self-update: extracts the .exe-suffixed binary from the archive, fixing "file not found". (805a1c3)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

@Bleksak: #2031

Full Changelog: carthage-software/mago@1.41.0...1.42.0

`v1.41.0`: Mago 1.41.0

Compare Source

Mago 1.41.0

A feature release adding call-site generic variance and a new no-duplicate-match-arm linter rule, alongside analyzer, codex, and PHPDoc fixes for implicit Stringable, do-while narrowing, @return nullability, and enum match exhaustiveness.

✨ Features

Linter

no-duplicate-match-arm: new rule flags a match arm whose result duplicates an earlier arm. (#2027, a9b3775)

Type System

Call-site generic variance: covariant/contravariant/* type-argument modifiers parse and drive assignability. (#2025, c7ff981)

🐛 Bug Fixes

Analyzer

@return narrowing: a docblock @return int over native ?int narrows the return instead of re-adding null. (#2020, dd8a54f)
do-while conditions: the loop body is narrowed by its condition on re-entry, like while. (#2029, 496cd0a)
Enum match exhaustiveness: a self-typed enum is treated as enumerable, fixing a false non-exhaustive report. (#2019, 6c72db0)

Codex

Implicit Stringable: a class declaring or inheriting __toString() now implicitly implements Stringable. (#2026, 7a81571)

PHPDoc Syntax

Inline code spans: an inline `code` span may cross continuation lines without an "unclosed code" error. (#2024, af95abc)

🏗️ Internal

Dependencies: refreshed third-party dependencies. (14ac380)
Toolchain: pinned nightly bumped to nightly-2026-06-27. (#2010, 9680310)

🙏 Thank You

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.40.2...1.41.0

`v1.40.2`: Mago 1.40.2

Compare Source

Mago 1.40.2

A patch release fixing analyzer false positives around property narrowing across calls and match subjects, two PHPDoc inline-code and conditional-type parsing fixes, plus new diagnostics for unsetting readonly/hooked properties and invalid trait as modifiers.

✨ Features

Analyzer

Invalid unset: unsetting a readonly or hooked property is now reported. (#2018, a24eb10)

Semantics

Trait as modifiers: a non-visibility modifier in a trait as adaptation (e.g. as final) is now rejected. (e3d9437)

🐛 Bug Fixes

Analyzer

match after impure call: a property used as a match subject no longer widens to mixed. (#2014, c9e5cc9)
Narrowing across calls: passing $obj->prop no longer drops narrowings on sibling properties. (#2015, 2e9a529)
Readonly writes: outside writes to a readonly property report a readonly violation, not a visibility one. (5eb7068)

PHPDoc Syntax

Inline code spans: // and quotes inside backticks are literal, not an "unclosed code" error. (95b393d)
Parenthesized conditionals: ($x is Y ? A : B) return types parse correctly again. (3a8d627)

🙏 Thank You

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.40.1...1.40.2

`v1.40.1`: Mago 1.40.1

Compare Source

Mago 1.40.1

A small patch release fixing array_key_exists() narrowing under strict-array-index-existence and a PHPDoc parsing regression where a @return description beginning with is was mistaken for a conditional type.

🐛 Bug Fixes

Analyzer

array_key_exists(): narrows a non-literal key like isset() under strict-array-index-existence. (#2012, 246b1eb)

PHPDoc Syntax

Conditional types: is only starts a conditional type when a target ? follows, so prose like @return bool is true when … stays a description. (8d615a8)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

@Soean: #2012

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

@ddanielou: #2008

Full Changelog: carthage-software/mago@1.40.0...1.40.1

`v1.40.0`: Mago 1.40.0

Compare Source

Mago 1.40.0

A big release driven by community reports: three new formatter settings, a new suspicious-explode-arguments linter rule and a final-controller auto-fix, an inspect-baseline CLI command, a Composer-shipped editor schema, and a long list of analyzer, codex, prelude, and PHP-parity syntax fixes. Under the hood, the 2.0 groundwork landed on main: a new high-level IR, a unified mago-phpdoc-syntax, and new mago-allocator/mago-flags crates.

✨ Features

Analyzer

array_filter truthiness: a callback-less array_filter() narrows values to their truthy form. (#1990, bc9bede)

Formatter

Breaking binary expressions: preserve_breaking_binary_expression keeps author line breaks in such chains. (#1853, 5aacc7d)
Sort uses by length: optional sorting of use statements by length. (#1942, 0688859)
Tag + declare: optionally combine the opening tag and declare(strict_types=1) onto one line. (#1959, 2ff4cf5)

Linter

suspicious-explode-arguments: warns when explode's short literal looks swapped into the string position. (#1998, 577d40a)
final-controller fix: offers an auto-fix that inserts final before any modifier. (#2006, 82017a0)
sensitive-parameter: skips boolean-like parameters. (#1949, 2333626)

Type System

empty types: empty and empty-scalar are supported in type-syntax and codex. (#1968, e94cfdd)

CLI

inspect-baseline: new command to visualise the distribution of baselined issues. (#1900, efd07bd)

Composer

Editor schema: ships a version-matched schema.json under vendor/carthage-software/mago/. (#1899, 38b78d0)

Nix

Default package: packages.<system>.default now provides bin/mago. (#1970, 13d7071)

🐛 Bug Fixes

Analyzer

Named args + optional params: too-few-arguments fires when a named arg fills only an optional param. (#2004, c5ec4ef)
Conditional array shapes: double-quoted array-access keys reconcile like single-quoted ones. (#2005, 095badf)
Shadowed overrides: no false incompatible-return-type against an ancestor hidden by an intermediate override. (#1996, 431ff97)
$this calls: a property keeps its declared type instead of widening to mixed. (#1994, 5eef024)
Readonly narrowing: readonly property narrowings survive a call passing an object argument. (#1993, 5cbbe91)
foreach over unions: corrected always-entered inference, fixing a false impossible-condition. (#1986, 22951bd)
Compound conditions: avoid duplicate diagnostics in compound conditions. (#1961, 1ea5ba2)
@property traits: trait property conflicts are no longer reported against @property tags. (#1964, a5f3823)

Codex

Self-cased display: self/static/parent resolve to the original-cased class name in diagnostics. (#1995, b544222)
Closure instanceof: closures are treated as instances of Closure. (#1956, 6fe1bbd)
Callable variance: null is no longer ignored in contravariant callable parameter checks. (#1966, 3f94734)

Linter

String-concat chains: a whole chain collapses into one no-redundant-string-concat issue and fix. (#2003, f8a31f8)
no-dead-store: flags stores overwritten across a conditional branch. (#1999, a315465)
no-boolean-flag: only flags boolean parameters actually used as flags. (#1988, 50cdd11)
prefer-early-continue: the auto-fix preserves comments and indentation. (#1946, 495f639)

Syntax

Operator precedence: corrected clone/cast/unary precedence and bound print/yield above and/xor/or. (1ac37b0, 4d01d2d)
String interpolation: distinguishes ${label}/${ expr } and $a[offset] forms in the lexer. (b56a704, f3198c8)
Reference operands: relational stays above equality when a reference assignment is an operand. (ea6cbce)
Unicode escapes: \u{...} decodes to UTF-8 bytes to match Zend. (b19386c)

HIR

Integer literals: lowered with PHP long semantics, overflowing to float. (9014c33, 79a7600)
Anonymous classes: anonymous-class modifiers are now lowered. (797358f)

Docblock

static return: parses a static return type after the static method modifier. (#1963, d5fb015)

Prelude

phpversion(): $extension is optional. (#1950, 5aed5bf)
array_splice: preserves the element type in its return. (#1982, af4e647)
PCRE/mbstring stubs: corrected preg_match_all/preg_replace_callback_array and mb_ord stubs. (#1980, 958a4b7; #1981, dd0b80c)
Default values: added to ZipArchive::addEmptyDir, xml_parser_create, ini_get_all, and more. (#1967, 6c640d9; #1969, 054651d)
Precise types: base64_encode returns non-empty-string; tighter stdlib types. (#1974, c2c37f5; #1975, c7e595f)
Falsable returns: mb_chr/mb_ord and ReflectionClass::getReflectionConstant. (578e427, 327778a)

📖 Documentation

GitHub Actions: improved setup guide and refreshed action versions. (#1953, b852388)

🏗️ Internal

Architecture

High-level IR: new mago-hir crate lowering the CST to a high-level IR (2.0 groundwork). (ca15f9d, e32d0d8, afefad6)
PHPDoc unification: codex/analyzer/linter scan docblocks via mago-phpdoc-syntax, retiring two crates. (#1932, #1972, 70179ec)
New crates: mago-allocator (+ CopyInto) and mago-flags. (#1957, 0adfdc0, 9a4cd06)
Lexer heredoc: heredoc/nowdoc resolved in the lexer with indentation as trivia. (0e4c0e6)
ast → cst: renamed AST to CST across the workspace. (#1933, b7d64b6)

Dependencies

Slimmer deps: serde is now optional/off-by-default; dropped cruet, ustr, shell-words. (1751bae, 184c493, ec8e092)

CI / Tooling

Toolchain: routine pinned-nightly bumps. (#2002, #2000, #1997)
Miri & fuzzing: skip deep-nesting overflow tests under Miri; fix fuzz-target Arena import. (676e1a4, #1984, 92d29cd)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

@Soean: #1951, #1967, #1969, #1980, #1981, #1983, #1984, #1987
@mvanhorn: #1962, #1977
@dotdash: #1961, #1964
@SpectralFlame: #1955
@nhedger: #1953
@Zuruuh: [#1974](https:/

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/composer-dev branch from 8497d8c to e33f569 Compare June 17, 2026 19:09

renovate Bot changed the title ~~chore(deps): update composer dev dependencies to v1.30.0~~ chore(deps): update composer dev dependencies Jun 17, 2026

renovate Bot force-pushed the renovate/composer-dev branch 8 times, most recently from a395b5a to a7ec7d9 Compare June 27, 2026 12:47

renovate Bot force-pushed the renovate/composer-dev branch 4 times, most recently from 4af49d1 to b6a7562 Compare July 9, 2026 10:26

renovate Bot force-pushed the renovate/composer-dev branch 3 times, most recently from 5c429a7 to 2df86e7 Compare July 19, 2026 02:37

renovate Bot force-pushed the renovate/composer-dev branch 3 times, most recently from 86500bb to 30359b7 Compare July 29, 2026 14:51

chore(deps): update composer dev dependencies

0b40846

renovate Bot force-pushed the renovate/composer-dev branch from 30359b7 to 0b40846 Compare July 31, 2026 01:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update composer dev dependencies - #48

chore(deps): update composer dev dependencies#48
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/composer-dev

renovate Bot commented Jun 4, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.45.0: Mago 1.45.0

Mago 1.45.0

✨ Features

Analyzer

Linter

🐛 Bug Fixes

Analyzer

Codex

Prelude

Reporting

Playground

🙏 Thank You

Contributors

Issue Reporters

v1.44.0: Mago 1.44.0

Mago 1.44.0

✨ Features

Analyzer

Linter

Guard

CLI

🐛 Bug Fixes

Analyzer

Codex

Semantics

Linter

Formatter

Guard

CLI

Distribution

🏗️ Internal

Performance

Toolchain

🙏 Thank You

Contributors

Issue Reporters

v1.43.0: Mago 1.43.0

Mago 1.43.0

✨ Features

Prelude

🐛 Bug Fixes

Analyzer

Codex

Prelude

Linter

Formatter

Syntax

PHPDoc Syntax

📖 Documentation

🏗️ Internal

🙏 Thank You

Contributors

Issue Reporters

v1.42.0: Mago 1.42.0

Mago 1.42.0

✨ Features

Linter

🐛 Bug Fixes

Analyzer

PHPDoc Syntax

CLI

🙏 Thank You

Contributors

v1.41.0: Mago 1.41.0

Mago 1.41.0

✨ Features

Linter

Type System

🐛 Bug Fixes

Analyzer

Codex

PHPDoc Syntax

🏗️ Internal

🙏 Thank You

Issue Reporters

renovate Bot commented Jun 4, 2026 •

edited

Loading

`v1.45.0`: Mago 1.45.0

`v1.44.0`: Mago 1.44.0

`v1.43.0`: Mago 1.43.0

`v1.42.0`: Mago 1.42.0

`v1.41.0`: Mago 1.41.0

`v1.40.2`: Mago 1.40.2

`v1.40.1`: Mago 1.40.1

`v1.40.0`: Mago 1.40.0