Add PHPStan level 1 configuration and fix static analysis errors

[Copilot]

Adds PHPStan static analysis at level 1, addressing 7 errors across the codebase.

Configuration

• Created phpstan.neon.dist with level 1 analysis
• Scans src/ and package-command.php
• Ignores WP_CLI_VERSION constant (defined at runtime by wp-cli core)

Fixes

Deprecated API usage:

• Replace BasePackage::$stabilities → BasePackage::STABILITIES constant
• Replace PlatformRepository::PLATFORM_PACKAGE_REGEX → isPlatformPackage() method

Undefined variables:

• Initialize $default_fields before conditional assignment in show_packages()
• Initialize $childrenClean before conditional assignment in JsonManipulator::removeSubNode()

Type safety:

• Remove conditional Composer v2 check when constructing ComposerRepository (package requires ^2.2.25)
• Remove unused $name parameter from closure in JsonManipulator::addSubNode()

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: /usr/bin/php /usr/bin/php /home/REDACTED/work/package-command/package-command/vendor/wp-cli/wp-cli/bin/../php/boot-fs.php core install --url=REDACTED --title=WP CLI Site --admin_user=admin --admin_email=admin@example.com --admin_password=password1 --skip-email (dns block)
• github.com (HTTP Only)
  • Triggering command: /usr/bin/ssh /usr/bin/ssh -o SendEnv=GIT_PROTOCOL git@github.com git-upload-pack 'non-existent-git-user-asdfasdf/non-existent-git-repo-asdfasdf.git' --quiet --verify d/package-command/vendor/bin/sh n vendor/wp-cli/wp-- ndor/bin/git sh wp-c�� package is-installed od xt (packet block)
  • Triggering command: /usr/bin/ssh /usr/bin/ssh -o SendEnv=GIT_PROTOCOL git@github.com git-upload-pack 'wp-cli-test/private-repository.git' yHigh=170M (packet block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>PHPStan configuration</issue_title>
<issue_description>Would be nice if we could use PHPStan here too.

We can start with level 1 and work our way up. Most basic phpstan.neon.dist file:

parameters:
  level: 1
  paths:
    - src
    - package-command.php
  scanDirectories:
    - vendor/wp-cli/wp-cli/php
  scanFiles:
    - vendor/php-stubs/wordpress-stubs/wordpress-stubs.php
  treatPhpDocTypesAsCertain: false

This yields:

------ ---------------------------------------------------------------------------------------------------
  Line   src/Package_Command.php
 ------ ---------------------------------------------------------------------------------------------------
  744    Class Composer\Repository\ComposerRepository constructor invoked with 3 parameters, 4-5 required.
  779    Variable $default_fields might not be defined.
  1002   Constant WP_CLI_VERSION not found.
         💡 Learn more at https://phpstan.org/user-guide/discovering-symbols
  1077   Access to deprecated static property $stabilities of class Composer\Package\BasePackage.
 ------ ---------------------------------------------------------------------------------------------------

 ------ ------------------------------------------------------------------------------------------------------------
  Line   src/WP_CLI/JsonManipulator.php
 ------ ------------------------------------------------------------------------------------------------------------
  131    Fetching deprecated class constant PLATFORM_PACKAGE_REGEX of class Composer\Repository\PlatformRepository:
         use PlatformRepository::isPlatformPackage(string $name) instead
  251    Anonymous function has an unused use $name.
  387    Variable $childrenClean might not be defined.
  407    Variable $childrenClean might not be defined.
 ------ ------------------------------------------------------------------------------------------------------------
```</issue_description>

## Comments on the Issue (you are @copilot in this section)

<comments>
</comments>

• Fixes PHPStan configuration #215

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[codecov]

Codecov Report

❌ Patch coverage is 42.85714% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/Package_Command.php	0.00%	4 Missing ⚠️

📢 Thoughts on this report? Let us know!