All pull requests

Pull requests

• [7.x] Report every taint flow into a sink: one sink node per call site

  #11986·danog opened Sep 23, 2026Collaborator·

  ·
  6

• Capability-based purity and purity templates (Hack coeffects for Psalm)

  release:feature
  #11984·danog opened Sep 22, 2026Collaborator·

  ·
  13

• Report native symbols used below the PHP version that introduced them

  #11974·danog opened Sep 17, 2026Collaborator·

  ·

• Resolve class-template type variables at read sites; fix deferred-model regressions

  release:fix
  #11966·danog opened Sep 16, 2026Collaborator·

  ·

• [7.x] Report every taint flow into a sink, not just the first to arrive

  release:fix
  #11961·alies-dev opened Sep 15, 2026Contributor·

  ·
  1

• [6.x] Report InvalidDocblock instead of crashing on unparseable @self-out / @if-this-is types

  #11960·alies-dev opened Sep 15, 2026Contributor·

  ·
  1

  1

• Detect unused free functions; simplify dead-code roots

  #11955·danog opened Sep 15, 2026Collaborator·

  ·
  9

• Keep the type of variables assigned in only some branches

  #11925·GromNaN opened Aug 27, 2026Contributor·

  ·
  1

• fix: shallow-scan extraFiles also for language server

  #11919·susnux opened Aug 11, 2026·

  ·
  1

• Docs: mention MegaLinter as a way to run Psalm in CI

  #11918·nvuillam opened Aug 8, 2026·

  ·

• [6.x] Memoise vendor statements instead of re-parsing them on every request

  #11917·alies-dev opened Aug 7, 2026Contributor·

  ·

• [6.x] Fix Cache::getHash() reading the payload file instead of the hash

  #11915·alies-dev opened Aug 7, 2026Contributor·

  ·

• Throw TypeParseTreeException instead of crashing on a bare TemplateIsTree

  #11914·Eljees opened Aug 6, 2026Contributor·

  ·
  2

  2

• Fix inherited static return type on parent:: and static:: calls

  #11908·eyupcanakman opened Jul 14, 2026Contributor·

  ·

• Bump mheap/github-action-required-labels from 5.5.2 to 5.6.0

  dependenciesgithub_actions
  #11907·dependabot[bot] opened Jul 13, 2026Bot·

  ·

• Fix invalid SARIF region for issues reported at line 0

  #11903·eyupcanakman opened Jul 6, 2026Contributor·

  ·
  1

• Bump docker/setup-buildx-action from 4.1.0 to 4.2.0

  dependenciesgithub_actions
  #11902·dependabot[bot] opened Jul 6, 2026Bot·

  ·

• Bump actions/cache from 5.0.5 to 6.1.0

  dependenciesgithub_actions
  #11896·dependabot[bot] opened Jun 29, 2026Bot·

  ·

• [6.x] Support PHP 8.5 clone-with-properties

  #11893·alies-dev opened Jun 23, 2026Contributor·

  ·
  3

• [6.x] Allow #[\Override] on properties (PHP 8.5)

  #11891·alies-dev opened Jun 23, 2026Contributor·

  ·
  1

  1

• Bump actions/checkout from 6.0.2 to 7.0.0

  dependenciesgithub_actions
  #11886·dependabot[bot] opened Jun 22, 2026Bot·

  ·

• Add generic return type for the PHP 8.5 clone() function

  #11884·delolmo opened Jun 18, 2026Contributor·

  ·
  4

• Add generic type signatures for array_first, array_last, array_any and array_all

  #11883·delolmo opened Jun 18, 2026Contributor·

  ·
  4

• Bump shivammathur/setup-php from 2.37.1 to 2.37.2

  dependenciesgithub_actions
  #11882·dependabot[bot] opened Jun 15, 2026Bot·

  ·

• Fix crash when a property assertion targets a non-variable argument

  #11879·eyupcanakman opened Jun 12, 2026Contributor·

  ·
  1