All pull requests

Reset $_SESSION after session_unset()
#12087TheNetherWatcher opened Oct 2, 2026
Taint the entries of $_SERVER and $_FILES the client sends
#12086danog opened Oct 2, 2026Collaborator
Docs: mention that findUnusedCode is on by default in v6
#12085TheNetherWatcher opened Oct 2, 2026
Make taints flow through the builtins that return data from their arguments
#12084danog opened Oct 2, 2026Collaborator
Specialize the classes extending a class with @psalm-taint-specialize
#12083danog opened Oct 2, 2026Collaborator
Report the taint flows a plugin connects to a sink from a node without location
#12082danog opened Oct 2, 2026Collaborator
Declare the taint sinks of more builtins, including those declared by stubs
#12081danog opened Oct 2, 2026Collaborator
Fix LSP lookup of functions declared in included files
#12080M393 opened Oct 2, 2026Contributor
Remove the taints a function's native return type cannot hold
#12079danog opened Oct 2, 2026Collaborator
Resolve specialized calls with summaries, fixing taint false negatives when flows converge
#12078danog opened Oct 2, 2026Collaborator
[6.x] Infer types for array_first, array_last, array_any and array_all, and sharpen array_pop/array_shift
#12067alies-dev opened Sep 30, 2026Contributor
[6.x] Fix crashes on NAN, INF and out of range float literals on PHP 8.5
#12065alies-dev opened Sep 30, 2026Contributor
3
[6.x] Model nullsafe short-circuiting across the whole chain
#12064alies-dev opened Sep 29, 2026Contributor
[6.x] Fix type variables bounded by another type variable (backport)
#12059alies-dev opened Sep 29, 2026Contributor
[6.x] Fix crash when a closure unsets a by-reference captured variable (backport)
#12058alies-dev opened Sep 29, 2026Contributor
[6.x] Fix InvalidPropertyFetch on type variable receivers (backport)
#12056alies-dev opened Sep 29, 2026Contributor
[6.x] Preserve set visibility when reflecting properties
#12052jturbide opened Sep 29, 2026
Stop MissingAbstractPureAnnotation on class-annotated abstract methods; Hack conformance for abstract purity
#12050danog opened Sep 29, 2026Collaborator
Check $object::$prop as a static fetch on the object's class
#12046HenkPoley opened Sep 29, 2026Contributor
[7.x] Fix: don't report plugin-appended class suppressions as unused
#12033alies-dev opened Sep 28, 2026Contributor
Add the _ purity to the closure parameters a function-like calls with --alter
#12019danog opened Sep 28, 2026Collaborator
9
[6.x] Keep polymorphic array callables typed and guard template inference (follow-up to #11815)
#12012alies-dev opened Sep 28, 2026Contributor
[6.x] static from class finality, not method finality
#12001alies-dev opened Sep 27, 2026Contributor
[6.x] Support PHP 8.5 pipe operator
#12000alies-dev opened Sep 27, 2026Contributor
[6.x] Fix crash when destructuring into offsets of an undefined variable
#11996alies-dev opened Sep 27, 2026Contributor

Navigation Menu

All pull requests

Reset $_SESSION after session_unset()

Taint the entries of $_SERVER and $_FILES the client sends

Docs: mention that findUnusedCode is on by default in v6

Make taints flow through the builtins that return data from their arguments

Specialize the classes extending a class with @psalm-taint-specialize

Report the taint flows a plugin connects to a sink from a node without location

Declare the taint sinks of more builtins, including those declared by stubs

Fix LSP lookup of functions declared in included files

Remove the taints a function's native return type cannot hold

Resolve specialized calls with summaries, fixing taint false negatives when flows converge

[6.x] Infer types for array_first, array_last, array_any and array_all, and sharpen array_pop/array_shift

[6.x] Fix crashes on NAN, INF and out of range float literals on PHP 8.5

[6.x] Model nullsafe short-circuiting across the whole chain

[6.x] Fix type variables bounded by another type variable (backport)

[6.x] Fix crash when a closure unsets a by-reference captured variable (backport)

[6.x] Fix InvalidPropertyFetch on type variable receivers (backport)

[6.x] Preserve set visibility when reflecting properties

Stop MissingAbstractPureAnnotation on class-annotated abstract methods; Hack conformance for abstract purity

Check `$object::$prop` as a static fetch on the object's class

[7.x] Fix: don't report plugin-appended class suppressions as unused

Add the `_` purity to the closure parameters a function-like calls with --alter

[6.x] Keep polymorphic array callables typed and guard template inference (follow-up to #11815)

[6.x] `static` from class finality, not method finality

[6.x] Support PHP 8.5 pipe operator

[6.x] Fix crash when destructuring into offsets of an undefined variable

Pull requests