chore(deps): update composer dev dependencies by renovate[bot] · Pull Request #48 · castor-labs/php-lib-ledgering

renovate · 2026-06-04T18:37:57Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
carthage-software/mago	`1.29.0` → `1.47.6`
phpunit/phpunit (source)	`10.5.63` → `10.5.64`
rector/rector (source)	`2.4.5` → `2.6.6`
symfony/config (source)	`7.4.10` → `7.4.17`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

carthage-software/mago (carthage-software/mago)

`v1.47.6`: Mago 1.47.6

Compare Source

Mago 1.47.6

Mago 1.47.6 strengthens property and control-flow narrowing, preserves collection precision, and fixes formatter comment and string handling.

🐛 Bug Fixes

Analyzer

Nested isset: marks roots defined after guarded nested offset checks. (#2303, 1da40ab)
Nullsafe booleans: narrows nullable receivers after boolean property comparisons. (#2315, e3aefe1)
Nullsafe instanceof: narrows receivers and properties after nullsafe type checks. (#2308, ea927d0)
String-length guards: narrows strings from strlen() comparisons. (#2307, fff0817)
Integer reconciliation: preserves literal unions through bitwise guards. (#2309, 801fc7f)
Keyed writes: retains non-empty arrays after writes from non-empty loops. (#2305, ed44977)
Boolean aliases: preserves guard narrowing across elseif and match. (#2312, 2a248f1)
Compound assignments: retains right-operand types in the expression index. (#2311, ce98d0d)
Immutable chains: keeps deep property narrowing across unrelated calls. (#2304, 414c4e0)
Trait requirements: excludes requirement-only generics from inheritance paths. (#2317, 007de69)
Property assertions: maps parameter-property assertions onto call arguments. (#2318, 696def4)

Prelude

Reflection names: types ReflectionClass<T>::getName() as class-string<T>. (#2314, f38df5b)

Formatter

Parenthesized comments: keeps comments attached inside grouping parentheses. (#2300, 88d062f)
Dollar strings: preserves single quotes around strings containing dollar signs. (#2316, 6aa441c)

🏗️ Internal

Performance

Analyzer allocations: removes redundant clones from hot analysis paths. (16335f4)

Maintenance

Version updater: reduces release versioning complexity. (5113670)
Nightly Clippy: removes a redundant watcher path clone. (64f3e9f)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

@adamaveray: #2300

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

@MichaelOwenDyer: #2304, #2305, #2307, #2308, #2312, #2315, #2318
@kamil-tekiela: #2303
@shadowhand: #2314
@gsteel: #2309
@SanderMuller: #2311
@Vyygir: #2316
@bendavies: #2317

Full Changelog: carthage-software/mago@1.47.5...1.47.6

`v1.47.5`: Mago 1.47.5

Compare Source

Mago 1.47.5

Mago 1.47.5 improves conditional and nullsafe narrowing, class-string handling, constructor analysis, and wide-shape performance.

🐛 Bug Fixes

Analyzer

Suppressed guards: narrows types through error-suppressed conditions. (#2268, f13467c)
Root callable strings: resolves callables with a leading namespace separator. (#2274, #2283, da58581)
Closure array checks: preserves closure types through negated array checks. (#2282, 2d316d5)
Elseif reassignment: discards stale clauses after assignments in conditions. (#2277, aefba3d)
Nullsafe receivers: preserves receiver narrowing through nullsafe property access. (#2261, edb7082)
Parent constructors: resolves inherited declarations and cross-file initialization. (#2271, #2273, 95d6cd6, 62a418d)
Exact assertions: preserves true and false one-way narrowing. (#2263, #2278, 1b7741e)
Nullsafe assertions: applies multi-target assertions to nullsafe arguments. (#2287, 4bf8961)
Union properties: reconciles union roots before nested property assertions. (#2295, 637b850)
Foreach arrays: preserves sanitized array types through loops. (#2294, 8d063e9)
Static properties: preserves declared types across logical AND. (#2293, de61ef7)
Match assertions: applies conditional assertions in boolean match arms. (#2262, 63b663f)
Negated unions: applies union assertions conjunctively. (#2251, c9fd26e)
Null coalescing: continues analysis after an unreachable terminating RHS. (#2270, 850ad19)

Codex

Class-string validation: rejects non-class scalars where class-string is required. (#2285, ad348fc)
List inference: combines empty arrays with lists without losing list shape. (#2281, 7568d72)

Prelude

Class probes: accepts strings, models $allow_string, and tests dynamic classes. (#2284, #2286, 6b73f42, a7a055c)

Formatter

Unary comments: preserves spacing between unary-prefixed comments and operands. (#2301, 25140c4)

🏗️ Internal

Performance

Wide array shapes: avoids rebuilding key unions for literal access. (#2289, f112ef2, 1c5e349)

Maintenance

Nightly Clippy: simplifies guard clauses for current linting. (#2269, 7ba104a)
Pull request template: adds affected-area guidance. (#2272, 5ead238)
Release versioning: automates patch and minor version bumps. (3ac6783)
Rust dependencies: refreshes workspace dependencies. (d961fb7)
Sponsors: refreshes the sponsor list. (cca4229)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

@dotdash: #2268, #2269, #2283, #2284, #2285, #2286
@adamaveray: #2270, #2271, #2272, #2273, #2301

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

@MichaelOwenDyer: #2251, #2261, #2262, #2263
@bendavies: #2274, #2277, #2281, #2282, #2289
@mathroc: #2278, #2287
@kamil-tekiela: #2293, #2294, #2295

Full Changelog: carthage-software/mago@1.47.4...1.47.5

`v1.47.4`: Mago 1.47.4

Compare Source

Mago 1.47.4

Mago 1.47.4 improves numeric-string analysis, instanceof narrowing, formatter stability, and array-inference performance.

🐛 Bug Fixes

Analyzer

Instanceof with coalesce: narrows values guarded by ($value ?? null) instanceof T. (#2249, 889e259)
Nullsafe instanceof: narrows nullable receivers after nullsafe property checks. (#2250, b17a46f)
Loose numeric comparisons: models PHP integer-string coercion. (#2254, 0b424e8)
Readonly diagnostics: names readonly violations instead of visibility errors. (#2241, 7b103aa)
Integer-string keys: normalizes canonical strings to integer array keys. (#2259, 39b9577)

Codex

Array inference: prevents inferred array types from exploding in size. (#2256, 89a45de)

Linter

Subtraction from zero: suggests negating the right operand. (#2240, b302702)
Anonymous constructors: records variables passed to anonymous class constructors as used. (#2239, 8ff624e)

Formatter

Preserved conditions: keeps binary-condition indentation idempotent. (#2255, 3435bf3)
Method-chain semicolons: preserves spacing before else and elseif. (#2150, #2237, 03d9726)
Tiny print widths: prevents table-style layout underflow. (#2242, 098540e)
Numeric concatenation: avoids redundant operand parentheses. (#2246, c581aa7)

Prelude

array_sum: returns int|float for numeric-string arrays. (#2258, 4000b2f)

🏗️ Internal

Analyzer

Write visibility: centralizes effective write-visibility resolution. (#2238, e67a00e)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

@bastnic: #2237, #2242, #2246
@dotdash: #2238, #2241

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

@diegobanos: #2150
@vkunz: #2239, #2240
@MichaelOwenDyer: #2249, #2250
@devin-ai-integration[bot]: #2255
@kamil-tekiela: #2254, #2256, #2258, #2259

Full Changelog: carthage-software/mago@1.47.3...1.47.4

`v1.47.3`: Mago 1.47.3

Compare Source

Mago 1.47.3

Mago 1.47.3 improves pipe expressions, numeric inference, match narrowing, readonly offsets, nullsafe chains, and loop control.

✨ Features

Analyzer

Integer ranges: infers ranges when bounded float arithmetic is cast to int. (#2232, 506066a)

Formatter

Pipe formatting: adds preserve-breaking-pipe-expression to retain existing line breaks. (#2141, 0cfc8ec)

🐛 Bug Fixes

Analyzer

Nullsafe chains: narrows receivers after a nullsafe chain is proven non-null. (#2226, 4e678b8)
Readonly offsets: allows offset writes through readonly properties holding ArrayAccess objects. (#2227, af3c576)
Pipe expressions: preserves generic return types through pipe partial applications. (#2141, 0cfc8ec)
Numeric-string unary ops: models signs, increments, and decrements as PHP does. (#2229, 9316487)
Boolean match arms: narrows the original subject for instanceof conditions. (#2231, d6cdf19)
Switch loop levels: resolves numeric break and continue levels across switch. (#2233, c5eff01)

🏗️ Internal

Performance

Match allocations: avoids allocating synthetic variable names during match analysis. (4c2581f)

🙏 Thank You

Contributors

No external pull requests were merged for this release.

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.47.2...1.47.3

`v1.47.2`: Mago 1.47.2

Compare Source

Mago 1.47.2

Mago 1.47.2 prevents invalid UTF-8 reporting crashes, preserves formatter semantics, and fixes several analyzer false positives.

🐛 Bug Fixes

Analyzer

Static class-string calls: preserves generics returned by static factories. (#2220, 0766957)
Array assignments: reports undefined target variables once. (#2219, 1705475)
Promoted property hooks: analyzes hook bodies and records method usage. (#2218, 0936c30)

Formatter

Invoked constructs: preserves required parentheses around invoked require expressions. (#2221, 38f9e2a)

Reporting

Invalid UTF-8: preserves source offsets and prevents rich-reporting panics. (#2222, e91cc71)

🏗️ Internal

Maintenance

Shared internals: deduplicates closure typing, call analysis, and linter utilities. (1668678)
Analyzer linting: cleans up Clippy findings after the shared refactor. (782d2cc)

🙏 Thank You

Contributors

No external pull requests were merged for this release.

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

Full Changelog: carthage-software/mago@1.47.1...1.47.2

`v1.47.1`: Mago 1.47.1

Compare Source

Mago 1.47.1

This patch release has no user-facing changes. It fixes the release pipeline so every supported target and crate can be published successfully.

🏗️ Internal

Release Pipeline

PHP SDK tests: skips integration tests when PHP or Composer dependencies are unavailable. (7f9e4ff)
Extension crate: adds mago-extension to the crate publishing order. (68c0818)

Full Changelog: carthage-software/mago@1.47.0...1.47.1

`v1.47.0`: Mago 1.47.0

Compare Source

Mago 1.47.0

Extensions in any language, Sponsored by CHECK24

Thanks to CHECK24 (@check24-opensource) for sponsoring Mago's new Extension API and PHP SDK.

✨ Features

Extensions

Extension API: adds language-neutral workers, a PHP SDK, custom lint rules, analyzer plugins, and CLI tooling. (#2192)

See the extension documentation to get started.

Analyzer

--skip-ignores: disables configured analyzer ignores for a run. (#2191, f05c849)
Array key narrowing: narrows a key after a successful array_key_exists check. (#2199, c58e48b, 7cc1739)

🐛 Bug Fixes

Analyzer

Logical assignments: merges assignments made by short-circuited right-hand expressions. (#2176, a53bc78)
Magic properties: treats magic properties as possibly undefined. (#2177, cea8d53)
Nullable inference: preserves null when inferring into a mixed parameter. (#2175, 97988bb)
Scalar narrowing: prevents scalar intersections from collapsing incorrectly to never. (#2179, #2206, 8d34248, c8bd837)
Flow structures: returns Flow's concrete StructureType from type_structure(). (#2186, ccde5ae)
Diagnostic casing: preserves method-name casing in unused-method diagnostics. (#2187, 13090af)
Required interfaces: keeps requirement metadata without inheriting interface members. (#2189, e5a949e, 874ffac)
Match subjects: evaluates method-call subjects once for exhaustive matching. (#2190, #2208, 7a7faa1)
Private trait methods: stops inheriting private trait methods into child classes. (#2188, 8a8958a)
Switch entry flow: keeps independently selected cases reachable after a terminating case. (#2185, efe7526)
Method assertions: invalidates cached nested call results after mutating calls. (#2180, 353233b)
Bool templates: recognizes bool-constrained templates in comparisons. (#2172, b84241a)
Omitted generics: treats missing generic arguments as erased wildcards. (#2178, f1e029b)
Docblock symbols: reports undefined types in class-level member and mixin tags. (#2193, 2c59ad3)
Compound conditions: removes order-dependent impossible-comparison diagnostics. (#2195, 7ca65e2)
Nullable object shapes: preserves object-shape fields in nullable docblock unions. (#2200, 5029124)
Global annotations: honors @var docblocks on global statements. (#2181, #2202, a7023c7)
Callable class strings: recognizes invokable classes in callable class-string bounds. (#2207, f77c965)
Closure identity: recognizes every closure as an instance of Closure. (#2203, d54d88e)
Symbol references: preserves source files for references returned to extensions. (#2211, aabe675)
Unresolved dependencies: analyzes class bodies and exposes missing dependencies to extensions. (#2212, 24c9304, f1558d4)
Class constants: canonicalizes class names when recording constant references. (#2213, b59529d)
Missing property types: checks declarations without default values. (#2201, 2e4260f)

Codex

@api metadata: preserves @api on properties, methods, and constants. (#2214, 37450cd)

Linter

Language constructs: excludes clone, exit, and die from ambiguous function calls. (#2196, 828cc42)

PHPDoc Syntax

Trailing hyphens: prevents a hyphen from consuming the next byte in docblocks. (#2194, #2198, d46b35f)

Prelude

Imagick classes: adds missing Imagick class stubs, including ImagickPixel. (#2210, 5e9b671)

Extensions

Windows startup: prevents an authentication race when extension workers connect. (111413a)

WASM

Telemetry: excludes unavailable extension orchestrator telemetry from WASM builds. (9e8b752)

📖 Documentation

Extensions

Extension guide: documents the architecture, PHP SDK, analyzer plugins, and custom rules. (7d67272)
Starter template: recommends the extension template as the quickest starting point. (bb98a97)

Website

Version order: lists documentation versions newest first. (#2204, ffd725e)
Rule reference: refreshes the generated linter rule documentation. (3597d38)

🏗️ Internal

Maintenance

Codex types: removes dead APIs and deduplicates type and comparator machinery. (3a28052, 3d301af, acd2d56)
Analyzer internals: removes dead code and deduplicates reconciler and resolver logic. (02b352e)
Formatter internals: simplifies presets, comments, alignment, and printer machinery. (e07980f, e595c13)
Shared cleanup: deduplicates extension, codex, analyzer, and linter internals. (4b68329)
Clippy policy: updates lint allowances for module roots and rest-pattern maintenance. (82b7522, 2053081, 332368a)
Sponsors: refreshes the generated sponsor list. (8cec88c)

🙏 Thank You

Special thanks to CHECK24 for fully funding the Extension API's full-time development.

Contributors

A huge thank you to everyone who contributed code to this release:

@dotdash: #2184, #2191, #2193, #2200, #2202
@norberttech: #2186
@hdimer: #2198
@maximal: #2204
@chrisvasz: #2201

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

@james2doyle: #39
@bendavies: #443, #1385
@swayok: #887
@SanderMuller: #2164, #2211, #2212, #2213, #2214
@mathroc: #2172, #2199
@edsrzf: #2175
@BafS: #2176, #2177, #2195
@yoannblot: #2178
@gsteel: #2179, #2180, #2196
@Skyript: #2185
@maximal: #2187
@conghuyn: #2188
@mytskine: #2189
@dragosprotung: #2190
@kryyova: #2194
@iainhallam: #2181
@dantleech: #2203
@ddanielou: #2206, #2207, #2208
@Double-Ramzi: #2210

Full Changelog: carthage-software/mago@1.46.0...1.47.0

`v1.46.0`: Mago 1.46.0

Compare Source

Mago 1.46.0

This release fixes a workflow-command injection in the GitHub reporting format (GHSA-f256-xqf4-x8pr), adds a redundant-static linter rule and a --stats shorthand, corrects a batch of generic-narrowing and late-static-binding false positives across the analyzer and codex, and speeds up the PHP parser.

🔒 Security

Reporting

Workflow-command injection: escapes untrusted values written to workflow commands and log records. (GHSA-f256-xqf4-x8pr, cc8d5e4)

Reported by Liyi Zhou, Ziyue, Strick, Maurice, and Chenchen of the University of Sydney.

✨ Features

Linter

redundant-static: reports static in a final class where self is equivalent. (#2154, ef06262)

CLI

--stats: adds a shorthand for count output. (#2130, db4a2cb)

Prelude

json_validate: asserts non-empty-string when the call succeeds. (#2155, 198f2b4)

🐛 Bug Fixes

Analyzer

Array entry narrowing: narrows possibly-absent entries on the parent shape, independent of conjunct order. (#2132, 2af1cbc, 784b93b)
Attribute arguments: validates the types of attribute constructor arguments. (#2161, ebf2f8d)
Switch labels: detects duplicate and unreachable case labels. (#2162, 4119141)
Mutation-free calls: narrows repeated calls to mutation-free methods. (#2138, b6e97ee)
Identical arrays: folds comparisons between identical arrays. (#2149, c2c7bb4)
Late-static returns: preserves late-static types in generic return positions. (#2151, fe272b8)
void conditionals: stops demanding a return from conditionals in void functions. (#2160, bd85d70)
self in attributes: resolves self in attributes applied to class-likes. (#2168, 7f88255)
Specialized generics: accepts class-strings of specialized generic classes. (#2171, b0b0b91)
Narrowing leaks: prevents method-call narrowing from leaking across scopes. (42cfd1f)

Codex

Bounded templates: allows instanceof narrowing of generics parameterised by a bounded template. (#2135, a45ffec, 8b2edf6)
Template defaults: populates default template arguments when the generic argument is omitted. (#2140, aff9ce8)
Static return types: preserves generic parameters in static return types. (#2145, 327ca0a)
void with never: keeps void when combined with never. (#2159, 864d0f7)
Late-static rebinding: guards exact late-static type rebinding. (fcd42ec)

Linter

Naming suggestions: suppresses invalid suggestions for constants starting with a number. (#2158, 7c54906)
missing-docs: renames the exclusion config field. (#2134, a5eab2d)

Syntax

Method return types: parses grouped static method return types in docblocks. (#2152, 06871ea)
String interpolation: limits recursion when parsing interpolated strings. (3610502)

Prelude

Attribute: adds the missing TARGET_CONSTANT constant. (9bef302)

Composer

Availability markers: unbreaks self-analysis of the availability markers. (#2169, 209f980)

📖 Documentation

Reporting

--sort: clarifies that the flag is a no-op for some formats. (#2173, #2174, 654b3f4)

🏗️ Internal

Performance

Parser: streamlines the PHP parser hot paths. (1ec8868)

Analyzer

Unused templates: uses loop labels for the unused-template checks. (#2133, b4aa9ad)
Tests: removes invalid attribute stubs. (4d9c611)

🙏 Thank You

Contributors

A huge thank you to everyone who contributed code to this release:

@dotdash: #2133, #2159, #2160, #2168, #2169, #2171, #2174
@gsteel: #2155
@adam-ja: #2134
@epic-64: #2130

Issue Reporters

Thank you to everyone who reported issues that shaped this release:

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/composer-dev branch from 8497d8c to e33f569 Compare June 17, 2026 19:09

renovate Bot changed the title ~~chore(deps): update composer dev dependencies to v1.30.0~~ chore(deps): update composer dev dependencies Jun 17, 2026

renovate Bot force-pushed the renovate/composer-dev branch 8 times, most recently from a395b5a to a7ec7d9 Compare June 27, 2026 12:47

renovate Bot force-pushed the renovate/composer-dev branch 4 times, most recently from 4af49d1 to b6a7562 Compare July 9, 2026 10:26

renovate Bot force-pushed the renovate/composer-dev branch 3 times, most recently from 5c429a7 to 2df86e7 Compare July 19, 2026 02:37

renovate Bot force-pushed the renovate/composer-dev branch 4 times, most recently from 30359b7 to 0b40846 Compare July 31, 2026 01:00

renovate Bot force-pushed the renovate/composer-dev branch 4 times, most recently from 3204b4f to 528bcda Compare August 7, 2026 22:39

renovate Bot force-pushed the renovate/composer-dev branch 4 times, most recently from 27d5b33 to d0ae62d Compare August 18, 2026 22:39

renovate Bot force-pushed the renovate/composer-dev branch from d0ae62d to 79b2241 Compare August 19, 2026 22:48

renovate Bot force-pushed the renovate/composer-dev branch 4 times, most recently from 4ff6168 to 9c597a3 Compare August 27, 2026 12:16

renovate Bot force-pushed the renovate/composer-dev branch 9 times, most recently from 6d46ff2 to 48a2ea8 Compare September 4, 2026 04:41

chore(deps): update composer dev dependencies

d462317

renovate Bot force-pushed the renovate/composer-dev branch from 48a2ea8 to d462317 Compare September 4, 2026 18:36

Navigation Menu

Uh oh!

chore(deps): update composer dev dependencies - #48

chore(deps): update composer dev dependencies#48
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/composer-dev

renovate Bot commented Jun 4, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.47.6: Mago 1.47.6

Mago 1.47.6

🐛 Bug Fixes

Analyzer

Prelude

Formatter

🏗️ Internal

Performance

Maintenance

🙏 Thank You

Contributors

Issue Reporters

v1.47.5: Mago 1.47.5

Mago 1.47.5

🐛 Bug Fixes

Analyzer

Codex

Prelude

Formatter

🏗️ Internal

Performance

Maintenance

🙏 Thank You

Contributors

Issue Reporters

v1.47.4: Mago 1.47.4

Mago 1.47.4

🐛 Bug Fixes

Analyzer

Codex

Linter

Formatter

Prelude

🏗️ Internal

Analyzer

🙏 Thank You

Contributors

Issue Reporters

v1.47.3: Mago 1.47.3

Mago 1.47.3

✨ Features

Analyzer

Formatter

🐛 Bug Fixes

Analyzer

🏗️ Internal

Performance

🙏 Thank You

Contributors

Issue Reporters

v1.47.2: Mago 1.47.2

Mago 1.47.2

🐛 Bug Fixes

Analyzer

Formatter

Reporting

🏗️ Internal

Maintenance

🙏 Thank You

Contributors

Issue Reporters

v1.47.1: Mago 1.47.1

Mago 1.47.1

🏗️ Internal

Release Pipeline

v1.47.0: Mago 1.47.0

Mago 1.47.0

Extensions in any language, Sponsored by CHECK24

✨ Features

Extensions

Analyzer

🐛 Bug Fixes

Analyzer

Codex

Linter

renovate Bot commented Jun 4, 2026 •

edited

Loading

`v1.47.6`: Mago 1.47.6

`v1.47.5`: Mago 1.47.5

`v1.47.4`: Mago 1.47.4

`v1.47.3`: Mago 1.47.3

`v1.47.2`: Mago 1.47.2

`v1.47.1`: Mago 1.47.1

`v1.47.0`: Mago 1.47.0

`v1.46.0`: Mago 1.46.0