chore(deps): update composer dev tooling dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
php-cs-fixer/shim	^3.95.10 → ^3.95.12
phpstan/phpstan	^2.2.2 → ^2.2.5
phpstan/phpstan-phpunit	^2.0.16 → ^2.0.18
rector/rector (source)	^2.4.6 → ^2.5.5

---

Release Notes

PHP-CS-Fixer/shim (php-cs-fixer/shim)

v3.95.12

Compare Source

v3.95.11

Compare Source

phpstan/phpstan-phar-composer-source (phpstan/phpstan)

v2.2.5

Compare Source

v2.2.4

Compare Source

v2.2.3

Compare Source

phpstan/phpstan-phpunit (phpstan/phpstan-phpunit)

v2.0.18

Compare Source

• f5dc20f - Fix #[RequiresPhpunit] version requirement being evaluated against PHP version (#​313)
• 1e573d3 - AttributeVersionRequirementHelper: add defaults to bool parameters (#​312)

v2.0.17

Compare Source

• c2f9775 - Update actions/cache action to v6 (#​311)
• 933f682 - Update actions/cache action to v5.1.0 (#​310)
• 8ec191f - Check #[RequiresPhpunit] in the same way we check #[RequiresPhp] (#​308)
• d138088 - Implement ClassAttributeRequiresPhpVersionRule (#​305)
• caada62 - Update github-actions to v7 (#​307)
• 611a216 - Update github-actions to v3.0.1 (#​306)
• 2312495 - Extract AttributeVersionRequirementHelper (#​304)
• 952d0ee - Warn about incomplete versions in #[RequiresPhp] (#​303)
• bf910b5 - Sanity check #[RequiresPhp] value and range (#​269)
• d309858 - Update github-actions to f3e473d (#​301)
• 4a8e26f - Update github-actions (#​300)
• 2c07f22 - Replace deprecated actions/create-release with softprops/action-gh-release
• 67c9d57 - Bump GitHub Actions across major versions
• a7baf3b - Bump GitHub Actions within their current majors
• 3ea20e6 - Update github-actions
• 53357ab - Update github-actions
• 6760e77 - latest infection does not support PHP 8.2 (#​296)
• ecfa568 - Update release-toot.yml (#​295)
• 21ea2e9 - name-collision-detector (#​294)
• 6851172 - Update test assertions
• e2c6207 - Fix build (#​287)
• db27c1f - Delete .github/workflows/claude-react-on-comment.yml
• 1c9e1df - Refactor build workflow to use GITHUB_BASE_REF
• 53c1301 - Lint workflows
• fca9e3a - [StepSecurity] ci: Harden GitHub Actions
• bfdcb62 - Remove PHPSTAN_BOT_TOKEN from checkout step
• bb6479c - React on issues opened and fall back to issue body
• 10e8509 - Add CLAUDE.md to export-ignore in .gitattributes
• 2202890 - Add CLAUDE.md with project documentation for AI assistants
• ffd7013 - Add Claude React on Comment workflow

rectorphp/rector (rector/rector)

v2.5.5: Released Rector 2.5.5

Compare Source

New Features 🥳

• [CodingStyle] Add AlternativeIfToBracketRector (#​8158)
• [TypeDeclaration] Add PrivateMethodReturnTypeFromStrictNewArrayRector, split private methods out (#​8153)
• [CodeQuality] Decopule array and object variants from ExplicitBoolCompareRector (#​8162)

Bugfixes 🐛

• [TypeDeclaration] Fix AddClosureParamTypeForArrayMapRector to type closure params from array values, not keys (#​8163)
• [Php56] Add missing parentheses for lower-precedence operands in PowToExpRector (#​8161)
• [Php80] Keep trailing doc comment after annotation in AnnotationToAttributeRector (#​8160)
• [CodeQuality] Skip same boolean in both branches in SimplifyIfReturnBoolRector (#​8159)
• [CodeQuality] Skip alternative syntax (if/endif) in ShortenElseIfRector (#​8157)
• [EarlyReturn] Split nested && operand into its own early return in ReturnBinaryOrToEarlyReturnRector (#​8156)
• [CodeQuality] Preserve parentheses around low-precedence operands in LogicalToBooleanRector (#​8155)
• [CodeQuality] Skip inner function referenced as string callable in InnerFunctionToPrivateMethodRector (#​8154)
• [CodeQuality] Preserve parentheses around right-side assign in LogicalToBooleanRector (#​8152)
• [CodeQuality] Wrap assign on right side of binary op in parentheses in LogicalToBooleanRector (#​8151)
• [DeadCode] Keep generic static union docblock in RemoveDuplicatedReturnSelfDocblockRector (#​8150)

v2.5.4: Released Rector 2.5.4

Compare Source

New Features 🥳

• [TypeDeclaration] Add ReturnTypeFromGetRepositoryDocblockRector (#​8146)

Bugfixes 🐛

• [DeadCode] Keep generic @​ var/@​ return self<...> narrowing annotations (#​8147)
• [TypeDeclaration] Handle getRepository() return via local variable in ReturnTypeFromGetRepositoryDocblockRector (#​8148)

v2.5.3: Released Rector 2.5.3

Compare Source

New Features 🥳

withTypeGuardedClasses()

Are you an open-source project or package used by others? Do you want to make type changes, but keep BC?

Guard the listed classes and their non-final descendants against method signature changes - e.g. adding a return type or a param type — that would break child classes (#​8135)

return RectorConfig::configure()
    ->withTypeGuardedClasses([SomeContract::class]);

New Rules 🎉

NegatedAndsToPositiveOrsRector

(CodeQuality) — simplify a negated "and" to "or" via de Morgan (#​8082)

 $a = 5;
 $b = 10;
-$result = !($a > 20 && $b <= 50);
+$result = $a <= 20 || $b > 50;

ExplicitAttributeNamedArgsRector

(CodeQuality) — positional attribute args → named args (#​8079), Thanks @​DaveLiddament!

-#[SomeAttribute(SomeClass::class, null, ['home'])]
+#[SomeAttribute(value: SomeClass::class, only: null, except: ['home'])]
 class SomeClass
 {
 }

SwitchTrueToMatchRector

(CodeQuality) — switch (true) of returning cases → match (true), replaces deprecated SwitchTrueToIfRector (#​8113)

-        switch (true) {
-            case $value === 0:
-                return 'no';
-            case $value === 1:
-                return 'yes';
-            default:
-                return 'maybe';
-        }
+        return match (true) {
+            $value === 0 => 'no',
+            $value === 1 => 'yes',
+            default => 'maybe',
+        };

RemoveDuplicatedReturnSelfDocblockRector

(DeadCode) — drop @return duplicating native self/static (#​8087)

 final class SomeClass
 {
-    /**
-     * @​return $this
-     */
     public function some(): self
     {
         return $this;
     }
 }

RemoveMixedDocblockOverruledByNativeTypeRector

(DeadCode) — drop @param mixed / @return mixed overruled by native type (#​8089)

-    /**
-     * @​param mixed $value
-     * @​return mixed
-     */
     public function run(int $value): string
     {
     }

RemoveUselessUnionReturnDocblockRector

(DeadCode) — drop @return union broader than a specific native type (#​8126)

-    /**
-     * @​return bool|mixed|string
-     */
     public function run(): false|string
     {
     }

ClosureReturnTypeFromAssertInstanceOfRector

(TypeDeclaration) — add closure return type narrowed by assertInstanceOf() (#​8115)

-        $callback = function (object $object) {
+        $callback = function (object $object): SomeType {
             $this->assertInstanceOf(SomeType::class, $object);

     return $object;
 };

TypedPropertyFromContainerGetSetUpRector

(TypeDeclaration) — type property from @var when assigned via container get() in setUp() (#​8120)

-    /**
-     * @​var SomeService
-     */
-    private $someService;
+    private SomeService $someService;

     protected function setUp(): void
     {
         $this->someService = static::getContainer()->get(SomeService::class);
     }

TypedPropertyFromGetRepositorySetUpRector

(TypeDeclaration) — same, for getRepository() assignment in setUp() (#​8124)

-    /**
-     * @​var SomeEntityRepository
-     */
-    private $someEntityRepository;
+    private SomeEntityRepository $someEntityRepository;

protected function setUp(): void
{
$this->someEntityRepository = $this->em->getRepository(SomeEntity::class);
}

NarrowBoolDocblockReturnTypeRector

(TypeDeclaration) — narrow @return bool to false/true per native type (#​8127)

     /**
-     * @​return bool|string[]
+     * @​return false|string[]
      */
     public function run(): false|array

NarrowArrayCollectionUnionReturnDocblockRector

(TypeDeclarationDocblocks) — Type[]|ArrayCollection → generic ArrayCollection<int, Type> (#​8136)

     /**
-     * @​return LeadEventLog[]|ArrayCollection
+     * @&#8203;return ArrayCollection<int, LeadEventLog>
      */
     public function getSuccessful(): ArrayCollection

AddClosureParamTypeFromVariableCallRector

(TypeDeclaration) — add closure param type from how the closure variable is called (#​8142)

-$printItem = function ($item) {
+$printItem = function (Item $item) {
     echo $item->name;
 };

$printItem(new Item());

rectorphp/rector-symfony 🎵

EventSubscriberMethodReturnVoidRector

(CodeQuality) — subscribed event methods must return void (event is by-reference) (#​949)

-    public function onEvent(Event $event): Event
+    public function onEvent(Event $event): void
     {
-        return $event->setSomething('value');
+        $event->setSomething('value');
     }

rectorphp/rector-phpunit 🟢

PHPUnit 12 cluster — typing createMock() / createStub() properties as intersections after the MockObject → Stub split.

ChangeMockObjectReturnUnionToIntersectionRector

(CodeQuality) — MockObject @return union → intersection (#​703)

     /**
-     * @​return Event|\PHPUnit\Framework\MockObject\MockObject
+     * @​return Event&\PHPUnit\Framework\MockObject\MockObject
      */
     private function createEvent(): \PHPUnit\Framework\MockObject\MockObject

AddIntersectionVarToMockObjectPropertyRector

(CodeQuality) — add MockObject intersection @var to a native MockObject property (#​697)

+    /**
+     * @​var \PHPUnit\Framework\MockObject\MockObject&\SomeService
+     */
     private \PHPUnit\Framework\MockObject\MockObject $someServiceMock;

AddStubIntersectionVarToStubPropertyRector

(CodeQuality) — add Stub intersection @var to a native Stub property (#​700)

+    /**
+     * @​var \PHPUnit\Framework\MockObject\Stub&\SomeService
+     */
     private \PHPUnit\Framework\MockObject\Stub $someServiceStub;

MockObjectVarToStubRector

(PHPUnit120) — on a property retyped to Stub, update @var from MockObject to Stub (#​689)

 /**
- * @​var FieldModel|MockObject
+ * @​var FieldModel|\PHPUnit\Framework\MockObject\Stub
  */
 private \PHPUnit\Framework\MockObject\Stub $leadFieldModel;

BareVarToStubIntersectionRector

(PHPUnit120) — add &Stub to a bare single-class @var of a Stub property (#​690)

 /**
- * @​var FormBuilderInterface
+ * @​var FormBuilderInterface&Stub
  */
 private \PHPUnit\Framework\MockObject\Stub $formBuilder;

PreferTestsWithCamelCaseRector

(CodeQuality) — rename PHPUnit test methods to camelCase (#​668), Thanks @​Xammie!

-    public function test_something()
+    public function testSomething()
     {
     }

PreferTestsWithSnakeCaseRector

(CodeQuality) — rename PHPUnit test methods to snake_case, the opposite convention (#​668), Thanks @​Xammie!

-    public function testSomething()
+    public function test_something()
     {
     }

Bugfixes 🐛

• --only / --only-suffix runs now cache under a rule-scoped key (#​8075), Thanks @​SanderMuller!
• Fix double clear-cache (#​8096)
• ParamTypeByMethodCallTypeRector split into Object / Scalar / Array rules (#​8134)

Deprecations & Removals 💀

Migrate away - these will be removed in a future release:

• SwitchTrueToIfRector → use new SwitchTrueToMatchRector (#​8109)
• StrictStringParamConcatRector — too many false positives (#​8090)
• StaticClosureRector + StaticArrowFunctionRector (#​8092)
• StaticCallOnNonStaticToInstanceCallRector — risky change (#​8093)
• EnumCaseToPascalCaseRector — risky change (#​8095)
• JoinStringConcatRector (#​8107)
• RemoveTypedPropertyNonMockDocblockRector — no real value (#​8119)
• Removed: long-deprecated rules (5+ months old) (#​8094)

rectorphp/rector-symfony

• ParameterBagToAutowireAttributeRector (#​954)
• AddRouteAnnotationRector (#​952)

rectorphp/rector-phpunit

• BehatPHPUnitAssertToWebmozartRector — too narrow (#​686)

v2.5.2: Released Rector 2.5.2

Compare Source

Bugfixes 🐛

• Match class + path in unused-skip reporting — fix combined class => [paths] skips being wrongly flagged as unused (#​8073)
• Mark skip used only when rule would change the file — a class/path skip counts as "used" only if the rule would actually touch that file, killing false "used" hits (#​8076)
• Improve unused-skip resolver methods — cleaner resolution internals (#​8072)
• Track used skips as class => [paths] map — richer per-path skip tracking backing the report (#​8074)

v2.5.1: Released Rector 2.5.1

Compare Source

Bugfixes 🐛

• Skip unused-skip reporting on narrowed runs - no more false "unused skip" noise when running Rector on a subset of paths (#​8069)
• Display skips only on uncached run - skip report shows on real runs, not when results come from cache (#​8071)
• RemoveAlwaysTrueIfConditionRector — avoid scanning whole new statements on dynamic variable checks; moved logic to ExprAnalyzer and bail early on defined variables (#​8057)

v2.5.0: Released Rector 2.5

Compare Source

New Features 🥳 🎉 🎉 🎉

This release has 3 interesting new features. Let's look at them:

[dx] Report skips that never matched (#​8058)

• What? - like PHPStan's reportUnusedIgnores, but for Rector ->withSkip(). Flags skip entries that never matched anything during the run, so you can delete stale skips.

• Why? - skips rot. You skip a path/rule to dodge a problem, later the file moves or the rule stops firing there — the skip lingers forever,
  silently masking nothing. This surfaces dead skips so config stays honest.

// rector.php
return RectorConfig::configure()
    ->withSkip([
        SimplifyUselessVariableRector::class => [
            '*/src/Legacy/*',          // still matches — fine
            '*/NonexistentUnused/*',   // matches nothing — stale
        ],
    ])
    ->reportUnusedSkips();

Run output:

 [OK] Rector is done!
  
 [WARNING] This skip is unused, it never matched any element.
           You can remove it from "->withSkip()"

 * Rector\CodeQuality\Rector\FunctionLike\SimplifyUselessVariableRector => */NonexistentUnused/*

---

[dx] Removing unused imports by default (#​8047)

You can update your rector.php config:

 return RectorConfig::configure()
-    ->withImportNames(removeUnusedImports: true);
+    ->withImportNames();

In case it's not for you, turn it off:

 return RectorConfig::configure()
-    ->withImportNames();
+    ->withImportNames(removeUnusedImports: false);

---

[dx] Introducing Drupal composer-based sets (#​8041), Thanks @​bbrala!

If you're using Drupal Rector, you can now enable it's per-version sets via:

 return RectorConfig::configure()
+    ->withComposerBased(drupal: true);

To learn more about composer-based-sets, checkout the documentation.

New Rules 🎉

• [php 8.4] [type-declaration] Add AddArrayAnyAllClosureParamTypeRector and NarrowArrayAnyAllNullableParamTypeRector (#​8049)
• [code-quality] Add MoveInnerFunctionToTopLevelRector (#​8042)
• [code-quality] Add NewArrayItemConcatAssignToAssignRector (#​8045)
• [code-quality] Add FixClassCaseSensitivityVarDocblockRector (#​8046)
• [polyfills] add missing polyfill to PHP 8.4 array functions (#​8052)
• [rector] Add AddParamTypeToRefactorMethodRector if missing (#​8061)

Bugfixes 🐛

• [internal] Streamline use imports management to FileNode (#​8040)
• [PostRector] Do not keep an unused import matched only by a partial docblock name's tail (#​8043), Thanks @​ruudk!
• [CodeQuality] Skip native function on MoveInnerFunctionToTopLevelRector (#​8044)
• Fix --only runs caching files as unchanged, hiding pending changes from full runs (#​8029), Thanks @​SanderMuller!
• [fix] Fix RemoveUnusedPrivateMethodRector for NeverType (#​8050)
• [dead-code] Fix RemoveUnusedVariableAssignRector, allow for SplFileInfo as cleanup on purpose for gc (#​8054)
• [fixes] Couple ClassPropertyAssignToConstructorPromotionRector, RemoveAlwaysTrueIfConditionRector and RemoveUnusedVariableAssignRector fixes (#​8055)
• [TypeDeclaration][DeadCode] Skip class with Doctrine static function mapping (loadMetadata) in TypedPropertyFromAssignsRector and RemoveUnusedPrivatePropertyRector (#​8059)
• [TypeDeclaration] Skip class with Doctrine static function mapping (loadMetadata) in TypedPropertyFromStrictConstructorRector (#​8060)

rectorphp/rector-doctrine 🟠

• [NodeAnalyzer] Detect Doctrine static function mapping (loadMetadata) entity in DoctrineEntityDetector (736bf61)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.