chore(deps): update composer dev tooling dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
php-cs-fixer/shim	^3.95.17 → ^3.95.18
phpstan/phpstan	^2.2.5 → ^2.2.7
phpstan/phpstan-deprecation-rules	^2.0.4 → ^2.0.5
phpunit/phpunit (source)	^13.2.5 → ^13.2.6
rector/rector (source)	^2.5.7 → ^2.6.1

---

Release Notes

PHP-CS-Fixer/shim (php-cs-fixer/shim)

v3.95.18

Compare Source

phpstan/phpstan-phar-composer-source (phpstan/phpstan)

v2.2.7

Compare Source

v2.2.6

Compare Source

phpstan/phpstan-deprecation-rules (phpstan/phpstan-deprecation-rules)

v2.0.5

Compare Source

• 67bedd6 - Update github-actions (#​197)
• 6be8bd3 - Update actions/cache action to v6 (#​198)
• 0b310ec - Update github-actions to v3.0.1 (#​195)
• 782d848 - Update github-actions to v7 (#​196)
• 85fff9d - Update github-actions to f3e473d (#​194)
• 54db580 - Update github-actions (#​193)
• 99aff1a - Replace deprecated actions/create-release with softprops/action-gh-release
• 971f8e1 - Bump GitHub Actions across major versions
• 89fef35 - Bump GitHub Actions within their current majors
• 0652358 - Update github-actions
• 02119cc - Update github-actions
• 389c78c - latest infection does not support PHP 8.2 (#​189)
• 899202d - Update release-toot.yml (#​188)
• 016d677 - name-collision-detector (#​187)
• 945df12 - Delete .github/workflows/claude-react-on-comment.yml
• a70b8b1 - Remove default branch determination from workflow
• 1faeb2e - Lint workflows
• 534891e - [StepSecurity] ci: Harden GitHub Actions
• 3acc664 - Remove PHPSTAN_BOT_TOKEN from checkout step
• 49efeb2 - React on issues opened and fall back to issue body
• 319c3f6 - Add PHP 8.5 to CI matrix for lint, tests, and static analysis
• 73feeba - Add missing export-ignore entries to .gitattributes
• c6d73e5 - Add CLAUDE.md with project documentation
• f9f68eb - Add Claude React on Comment workflow

sebastianbergmann/phpunit (phpunit/phpunit)

v13.2.6: PHPUnit 13.2.6

Compare Source

Fixed

• #​6861: Hook methods run twice when a template method is marked with its corresponding attribute
• Regression that stopped test methods from being sorted by source code location

---

Learn how to install or update PHPUnit 13.2 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

rectorphp/rector (rector/rector)

v2.6.1: Released Rector 2.6.1

Compare Source

Bugfix 🐛

• [composer-based] Fix fatal error in the composer-based command on a lazy-initialized property, e.g. PHPStan UnionType::$normalized (#​8280)

PHP Fatal error:  Uncaught Error: Typed property PHPStan\Type\UnionType::$normalized
must not be accessed before initialization in src/Console/Command/ComposerBasedCommand.php:205

---

Composer-based sets keep growing: Twig, nette/utils and the rest of Symfony 📦

Follow-up release to 2.6.0. The composer-based rollout continues - Twig and nette/utils join, and every remaining Symfony rule now declares the package version its target API was added in.

use Rector\Config\RectorConfig;

return RectorConfig::configure()
    ->withComposerBased(
        doctrine: true,
        netteUtils: true,
        phpunit: true,
        symfony: true,
        twig: true,
    );

The new Twig composer-based set replaces the twig112 → twig127 → ... → twig30 chain with a single set, where every rule checks the installed twig/twig version:

 final class SomeTwigUse
 {
-    public function run(Twig_Environment $twigEnvironment)
+    public function run(\Twig\Environment $twigEnvironment)
     {
-        return new Twig_SimpleFilter('some_filter', 'strlen');
+        return new \Twig\TwigFilter('some_filter', 'strlen');
     }
 }

Package bonding (composer-based rollout) 📦

• [NetteUtils] Bind nette/utils rules to the installed package version; nette-utils4.php becomes composer-based.php and is loaded as a single set (#​8275)
• [rector-symfony] Add Twig composer-based set (#​996)
• [rector-symfony] Bond the remaining 48 Symfony rules to their composer package version (#​994)
• [rector-symfony] Register LoadValidatorMetadataToAttributeRector in the composer-based set - the last interface-bonded rule left outside it (#​997)
• [rector-symfony] Bond ContainerInterfaceServiceToServiceContainerRector to symfony/dependency-injection >=6.0 (#​999)
• [rector-doctrine] Bond AddGetReferenceTypeRector to doctrine/data-fixtures >=1.6 and the annotation-to-attribute sets to their package constraints (#​497)
• [rector-doctrine] Bond version-specific rules and configuration to composer package constraints (#​495) *
• [rector-phpunit] Bond RemoveExpectAnyFromMockRector to PHPUnit 11+ (#​756) *

_{* landed in 2.6.0, missing from its release notes}

The per-version sets are not touched - every rule stays registered where it was.

Set changes 📈

• [CodingStyle] Remove ConsistentImplodeRector from the coding style level - the swapped implode($array, $glue) signature was removed in PHP 8.0, so the rule belongs to the php80 set only, where it already is (#​8273)
• [rector-doctrine] Add DoctrineSetList::COMPOSER_BASED constant, remove the empty DOCTRINE_BUNDLE_210 set (#​499)

Bugfixes 🐛

• [TypeDeclarationDocblocks] Skip docblock reprint when nothing changed in AddParamArrayDocblockFromAssignsParamToParamReferenceRector (#​8271)
• [rector-symfony] [Symfony44] Fix duplicated return in ConsoleExecuteReturnIntRector on a trailing comment (#​992), plus a fixture for a block comment with a commented-out return (#​993)
• [rector-symfony] [Symfony44] Skip redundant (int) cast on a match return in ConsoleExecuteReturnIntRector - a match of int constants is a UnionType, so the instanceof IntegerType check missed it (#​998)

 public function execute(InputInterface $input, OutputInterface $output): int
 {
-    return (int) match ($input->getArgument('type')) {
+    return match ($input->getArgument('type')) {
         'a' => 0,
         default => 1,
     };
 }

Deprecations 💀

Deprecated rules still run, but print a warning and will be removed in a future major release.
These are coding standard preferences or opinionated rewrites - a coding standard tool is the better place for them.

rector-src

• WrapEncapsedVariableInCurlyBracesRector - also removed from the coding style level (#​8272)

 function run($world)
 {
-    echo "Hello $world!";
+    echo "Hello {$world}!";
 }

The actual PHP 8.2 deprecation, ${var}, is covered by VariableInStringInterpolationFixerRector in the php82 set.

• CountArrayToEmptyArrayComparisonRector - also removed from the coding style level (#​8274)

-count($array) === 0;
-count($array) > 0;
+$array === [];
+$array !== [];

• ArraySpreadInsteadOfArrayMergeRector - the spread result is harder to read, and ... mid-array looks dangerous in review (#​8277)

-$values = array_merge($firstValues, $secondValues);
+$values = [...$firstValues, ...$secondValues];

• UnusedForeachValueToArrayKeysRector - also removed from the code quality level (#​8278)

-foreach ($values as $key => $value) {
+foreach (array_keys($values) as $key) {
     $items[$key] = null;
 }

rector-doctrine

• GetRepositoryServiceLocatorToRepositoryServiceInjectionRector - it resolved the repository class by running a regular expression over the entity file contents (#​498)

Renames 🔄

• [rector-symfony] ReplaceServiceArgumentRector → ContainerInterfaceServiceToServiceContainerRector, no longer configurable (#​999)

Both sets configured it with the same 2 values, for a single Symfony 6.0 BC break - the Psr\Container\ContainerInterface and Symfony\...\DependencyInjection\ContainerInterface aliases of the service_container service were removed. Now hardcoded, and the ReplaceServiceArgument value object is gone.

 use function Symfony\Component\DependencyInjection\Loader\Configurator\service;

-return service(ContainerInterface::class);
+return service('service_container');

v2.6.0: Released Rector 2.6.0

Compare Source

Composer-based sets - let Rector handle upgrade from composer.json 🥳

The main theme of this release: rules that turn themselves on based on the package versions you actually have installed.

Instead of picking a Symfony or PHPUnit set by version number and guessing what applies, register the composer-based set once. Every rule inside checks composer.json/installed.json and only runs if the installed package version matches its constraint.

use Rector\Config\RectorConfig;

return RectorConfig::configure()
    ->withComposerBased(
        doctrine: true,
        phpunit: true,
        symfony: true,
        twig: true,
    );

We're working on full coverage. At the moment, PHPUnit and Symfony rules are already migrated to this approach. Not only rules, but also rule configuration can be bound to a package version:

$rectorConfig->ruleWithConfigurationComposerVersionBound(
    SomeRector::class,
    [...],
    'phpunit/phpunit',
    '>=11.0'
);

To see what is active and why, there is a new command:

vendor/bin/rector composer-based

 Composer package bound rules
 ------------------------------- ----------------- ---------- ----------- --------
  Rule                            Package           Requires   Installed   Active
 ------------------------------- ----------------- ---------- ----------- --------
  RemoveExpectAnyFromMockRector   phpunit/phpunit   >=11.0     11.5.2      yes
  RedirectToRouteRector           symfony/...       >=2.6      7.2.1       yes
 ------------------------------- ----------------- ---------- ----------- --------

 ! [NOTE] 2 of 2 composer package bound items are active

And to run only those rules in a single process:

vendor/bin/rector process --composer-based

New features 🥳

• [Config] Add ruleWithConfigurationComposerVersionBound() (#​8244)
• [composer-based] Add composer-based command (#​8246)
• [composer-based] Report rule configuration bound to installed package version (#​8247)
• [composer-based] Register each rule only once, add --composer-based process filter (#​8248)
• [Configuration] Load single composer-based PHPUnit set in withComposerBased() (#​8255)
• [Configuration] Load single composer-based Symfony set in withComposerBased() (#​8259)
• [Console] Print composer-based rule configuration on separate full-width line (#​8256)
• [Testing] Allow a test case to resolve package versions from a standalone composer.json (#​8264)

New rules 🎉

rector-src

• [DeadCode] RemoveTestsOverriddenPrivateMethodParameterRector (#​8254)

rector-phpunit

• [CodeQuality] AddIntersectionParamToMockObjectParamRector (#​755)
• [PHPUnit 11.0] ExpectsParamToMockObjectRector — for private test method params (#​753)
• [PHPUnit 11.0] MockObjectArgCreateStubToCreateMockRector (#​741)
• [PHPUnit 11.5] AssertContainsOnlyMethodCallRector (#​738)

rector-symfony

• [CodeQuality] LoadValidatorMetadataToAttributeRector (#​988)

Bugfixes 🐛

• [DeadCode] Skip RecastingRemovalRector on array dim fetch value (#​8262)
• [DeadCode] Skip RemoveDefaultValueFromAssignedPropertyRector on early return in constructor-called method (#​8261)
• [DeadCode] Skip static property in RemoveDefaultValueFromAssignedPropertyRector (#​8240)
• [DeadCode] Remove whole assign statement on unused createStub() in tests (#​8257)
• [NodeAnalyzer] Detect always terminated stmts with statements before the return (#​8260)
• [Configuration] Resolve --only rule name with shell-eaten backslashes (#​8267)
• [rector-symfony] Add try/catch fixtures with statements before the return (#​986)

# before: quotes were needed to match rule
vendor/bin/rector p --only="\Rector\CodeQuality\Rector\FuncCall\ChangeArrayPushToArrayAssignRector"

# after: simple class name works as well
vendor/bin/rector p --only \Rector\CodeQuality\Rector\FuncCall\ChangeArrayPushToArrayAssignRector

• [Composer] Prefer composer.json constraint over outdated installed.json version (#​8242)
• Fix InstalledPackageResolver cwd fallback lost by promoted property (#​8237)
• [rector-phpunit] Fix swapped preCondition and postCondition attribute mapping (#​746)
• [rector-phpunit] Handle test traits in DataProviderAnnotationToAttributeRector (#​751, #​752)

Set changes 📈

• [Config] Move 3 rules from coding style set to their proper sets — ExplicitPublicClassMethodRector to PHP 5.3, plus one each to code quality and dead code (#​8266)
• [CodingStyle] Remove MinMaxToClampRector from coding style level (#​8270)
• [rector-symfony] Add SymfonySetList::COMPOSER_BASED (#​982)
• [rector-phpunit] Register composer-based set in PHPUnitSetProvider (#​748)

Deprecations 💀

Deprecated rules still run, but print a w and will be removed in a future major release.
These were deprecated as not part of any set, risky, opinionated or excluded by most users. Goal is to make Rector useful more to masses and every day user by having valuable and reliable rules.

rector-src

• EncapsedStringsToSprintfRector (#​8265)
• SimplifyRegexPatternRector (#​8263)
• BinaryOpStandaloneAssignsToDirectRector (#​8269)
• NullableCompareToNullRector (#​8268)
• NestedTernaryToMatchRector (#​8241)
• AddReturnDocblockFromMethodCallDocblockRector (#​8239)
• Gmagick to Imagick set (#​8252)
• withPhp53Sets() ... withPhp74Sets() — use withPhpLevel() instead (#​8253)
• cacheMetaExtension() — reports a warning when used (#​8251)

rector-doctrine

• YamlToAttributeDoctrineMappingRector (#​492)
• DoctrineSetList::YAML_TO_ANNOTATIONS set (#​493)

rector-symfony

• TemplateAnnotationToThisRenderRector (#​989)
• ReturnDirectJsonResponseRector (#​987)
• AutowireAttributeRector (#​981)

rector-phpunit

• WillReturnCallbackFallbackToThrowRector (#​740)
• ReplaceTestFunctionPrefixWithAttributeRector (#​739)

Removals 💀

• [depre] Remove strict-booleans set, deprecated since 2025-10 (#​8243)
• [ChangesReporting] Remove junit output format (#​8250)
• [rector-doctrine] Remove DoctrineDocBlockResolver, deprecated since 2025-05 (#​491)
• [rector-symfony] Remove StringExtensionToConfigBuilderRector, deprecated since 2025-10 (#​978)
• [rector-phpunit] Remove 4 rules deprecated since 2025-10 (#​743)
• [rector-phpunit] Remove deprecated AssertPropertyExistsRector (#​742)

Package bonding (composer-based rollout)

• [rector-symfony] Bond version-specific rules to composer package constraints (#​979), include all configured rules in the composer-based set (#​980), bond AddViolationToBuildViolationRector to symfony/validator 2.5 (#​983), add AuthorizationCheckerIsGrantedExtractorRector to the composer-based set (#​985), bond RedirectToRouteRector to symfony/framework-bundle 2.6 (#​991)
• [rector-phpunit] Bond version-specific rules to composer package constraints (#​754), bond stub and mock rules to phpunit/phpunit >=11.0 (#​750), bond annotation-to-attribute rules to phpunit/phpunit >=10.0 (#​744, #​745), move composer version bound rules to composer-based set (#​747)

v2.5.9: Released Rector 2.5.9

Compare Source

Bugfixes 🐛

• [DeadCode] Remove unreachable class-like checks in Class_-only rules (#​8217)
• [CodingStyle] Use native php-parser node API over class reflection (#​8218)
• [Php80] Remove AstResolver usage on AddParamBasedOnParentClassMethodRector (#​8196)
• Wire RichParser node visitors via DI factory instead of private property hack (#​8215)
• [Php80] Skip promoting a property the parent declares without a native type in ClassPropertyAssignToConstructorPromotionRector (#​8232)
• [DeadCode] Keep empty __construct() in anonymous class that extends parent on RemoveEmptyClassMethodRector (#​8219)
• [DeadCode] Skip negative zero on RemoveDeadZeroAndOneOperationRector (#​8213)
• [DeadCode] Skip protected property on non-final class on RemoveDefaultValueFromAssignedPropertyRector (#​8214)
• [DeadCode] Skip array dim fetch assign on RemoveDefaultValueFromAssignedPropertyRector (#​8212)
• [DeadCode] Skip if/else in loop on RemoveDefaultValueFromAssignedPropertyRector (#​8211)
• [DeadCode] Skip early return in constructor on RemoveDefaultValueFromAssignedPropertyRector (#​8209)

Set changes 🗑️

NullToStrictStringFuncCallArgRector out of the PHP 8.1 set (#​8234)

The rule and all its fixtures stay, so it can still be opted into:

->withRules([NullToStrictStringFuncCallArgRector::class])

Deprecations 💀

TypeDeclarationDocblocks: 3 data provider docblock rules (#​8235)

Data provider docblock typing is not relevant to code quality — it increases maintenance cost and decreases readability of the test class.

Deprecated rules:

• AddReturnArrayDocblockFromDataProviderParamRector
• AddReturnDocblockDataProviderRector
• AddParamArrayDocblockFromDataProviderRector

rectorphp/rector-symfony 🎵

• [Symfony72] Match push() to its own RequestStack variable in PushRequestToRequestStackConstructorRector (#​971)
• [Symfony44] Skip custom isGranted() service calls in controllers in AuthorizationCheckerIsGrantedExtractorRector (#​973)
• [Symfony42] Update Cookie fixture after NewToStaticCallRector config removal (#​974)
• Drop rector/type-perfect, its rules ship in tomasvotruba/type-coverage 2.3 now (#​972)
• Bump dev dependencies, PHPUnit 13 (#​976)
• [deps] Bump symfony/config to ^8.1 (#​977)

Deprecated: SimplifyFormRenderingRector (#​975)

The rule removed the explicit ->createView() call when a form was passed to render():

Symfony supports passing the FormInterface directly, but the shorthand is ambiguous and breaks dynamic forms: forms modified in PRE_SET_DATA/POST_SUBMIT listeners and submitted over AJAX end up with a 422 response and no clear error. Keeping the explicit ->createView() call is the reliable form. See symfony/symfony#50542.

rectorphp/rector-phpunit 🧪

• [PHPUnit 13] Fix class in expectExceptionMessage() rename to TestCase (#​735)

rectorphp/rector-downgrade-php ⬇️

• [DowngradePhp81] Reference MHASH_* constants by name in DowngradeHashAlgorithmXxHashRector to fix PHP 8.5 deprecation (#​386)

v2.5.8: Released Rector 2.5.8

Compare Source

New Features 🥳

• [dx] Add "if" set with if/else/ternary rules (#​8199)
• [DeadCode] Add RemoveDeadInstanceOfAssertRector (#​8202)
• [DeadCode] Add RemoveDoubleSelfAssignRector (#​8203)
• [DeadCode] Add RemoveParentDelegatingClassMethodRector (#​8204)
• [DeadCode] Add RemoveDefaultValueFromAssignedPropertyRector (#​8207)
• [TypeDeclaration] Fix incomplete type on yield variable + yield from in AddParamTypeBasedOnPHPUnitDataProviderRector (#​8206)

Bugfixes 🐛

• Fix LogicalToBooleanRector: parenthesize assignments nested under unary/binary operators (#​8184)
• [TypeDeclaration] Skip trait methods on ParamTypeByMethodCallType rules (#​8189)
• [Php80] Skip promotion when property type is wider than constructor param on ClassPropertyAssignToConstructorPromotionRector (#​8170), Thanks @​ximki-vinki!
• [Php85] Skip outer spread on NestedFuncCallsToPipeOperatorRector (#​8191)
• [DeadCode] Fix crash on float version arg in ConditionResolver (#​8192)
• Make NestedFuncCallsToPipeOperatorRector minimum depth configurable (#​8193)
• Fix codeception data provider detection (#​8194), Thanks @​d-mitrofanov-v!
• Make PHPStan DI-Container available in bootstrap files (#​8190), Thanks @​staabm!
• [Privatization] Skip Symfony Command protected static property in PrivatizeFinalClassPropertyRector (#​8201)
• Bump to PHPStan ^2.2.6 and Fix its Container compatibility in RichParser (#​8208)

Removed 💀

• skip @​ return this on RemoveReturnTagIncompatibleWithNativeTypeRector on Traits (#​8185)
• [DeadCode] Skip string scalar sub type on RemoveReturnTagIncompatibleWithNativeTypeRector (#​8186)

rectorphp/rector-symfony 🎵

• [Symfony73] Remove empty configure() method in CommandHelpToAttributeRector (#​969)
• [Symfony73] Keep AbstractExtension when Twig extension overrides a built-in function/filter (#​968)
• [Symfony73] Wrap scalar groups option in array in ConstraintOptionsToNamedArgumentsRector (#​967)
• [Symfony61] Remove empty configure() method even with empty body (#​966)
• [Symfony61] Remove now empty configure() method in CommandConfigureToAttributeRector (#​965)
• [CodeQuality] Respect typeGuardedClasses and skip closure-only returns in ResponseReturnTypeControllerActionRector (#​964)
• [Symfony44] Return 1 instead of (int) false in ConsoleExecuteReturnIntRector (#​963)
• [CodeQuality] Add union and method call return type support to ResponseReturnTypeControllerActionRector (#​961)
• [Twig30] Add new set for Twig 30 (#​960), Thanks @​MrYamous

rectorphp/rector-doctrine 🟠

• [DataFixtures 17] add new set for doctrine data-fixtures 17 (#​487), Thanks @​MrYamous

rectorphp/rector-phpunit 🟢

• [PHPUnit 13] Add PHPUnit 13 config set (#​733)
• [CodeQuality] Skip super global variables on AssertIssetToSpecificMethodRector (#​732)
• [CodeQuality] Skip anonymous classes in AssertClassToThisAssertRector (#​729)
• [CodeQuality] Move AssertClassToThisAssertRector hook from Class_ to ClassMethod (#​728)
• AssertEqualsToSameRector: skip arrays whose actual value key order is not provably identical (#​727)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.