vimeo/psalm
Stars: 5299
Forks: 637
Pull Requests: 2997
Issues: 7064
Watchers: 65
Last Updated: 2023-09-16 18:05:06
A static analysis tool for finding errors in PHP applications
License: MIT License
Languages: PHP, Shell
Psalm
Psalm is a static analysis tool for finding errors in PHP applications.
Installation
To get started, check out the installation guide.
Live Demo
You can play around with Psalm on its website.
Documentation
Documentation is available on Psalm’s website, generated from the docs folder.
Interested in contributing?
Have a look at CONTRIBUTING.md.
Who made this
Built by Matt Brown (@muglug).
Maintained by Orklah (@orklah), Daniil Gentili (@danog), and Bruce Weirdan (@weirdan).
The engineering team at Vimeo have provided a lot encouragement, especially @nbeliard, @erunion and @nickyr.
OPEN ISSUES
See all- Function/method overloading by @weirdan
- Rebound `$this` by @weirdan
- Feature request: New psalter options by @ADmad
- request for type detection w/ array_filter, string filters, also with ARRAY_FILTER_USE_KEY by @ghost
- Add an option to warn about undeclared global functions regardless of Psalm's signature map. by @TysonAndre
- Annotation is not recognized on a global declaration by @Rarst
- Warn about docblock union of two different object-like arrays by @muglug
- Bitwise assignment doesn't change type by @bugreportuser
- Add support to psalter to fix UndefinedThisProperty{Assignment, Fetch} errors by @souravchandra
- Allow limiting who can inherit/implement a class by @muglug
- Greater than or less than comparison when types are different or one is an object should report issue by @still-dreaming-1
- Prevent intersections between impossible interface methods by @bdsl
- Add checks similar to TypeDoesNotContainType for loose equality (==, !=) conditions? by @TysonAndre
- Intersection with object shape type by @sserbin
- Various testing improvments by @bdsl
- Suppress ImplicitToStringCast for some objects by @kassner
- @psalm-type gives more specific errors than @var by @SignpostMarv
- Add a way to specify that the scan phase should be single threaded? by @TysonAndre
- Don't emit MissingParamType when param-out is provided? by @TysonAndre
- annoyance with templated key-of & MixedArgumentTypeCoercion by @SignpostMarv
- @param-out doesn't work with interface or abstract methods by @Shira-3749
- Improve messaging when callable param/return types don’t match up by @muglug
- Merging of objects with defined properties should yield objects with union of properties by @Ocramius
- Psalm should infer that result of multiplication is never an array. by @TysonAndre
- No String cannot be used as a class for a constant by @vudaltsov
- NoInterfaceProperties triggers when checking if property exists on an object by @pamil
- Using stub causes PropertyNotSetInConstructor by @weirdan
- Error when error suppresions are configured which dont suppres a actual error by @staabm
- Add error when unpacking an array of arguments with string keys by @vudaltsov
- Feature request: public-method-string<O> by @lstrojny
- Throws types validation by @dbalabka
- Psalter: generate more portable types by @staabm
- Allow in_array check to constrain type of array by @bdsl
- Support seal-methods/seal-properties as shorthand for psalm-seal-methods by @TysonAndre
- Support no-seal-properties/no-seal-methods on classes to avoid emitting UndefinedMagicMethod by @TysonAndre
- query re: non-built-in extension functions by @SignpostMarv
- Feature Request: Add check for placeholder count vs arguments count mismatch for sprintf() by @ADmad
- psalm should detect syntax errors in regex-patterns by @staabm
- Bash/zsh completion files, for psalm's CLI options? by @TysonAndre
- Add a progress indicator while scanning files? by @TysonAndre
- Detect which method is available in php version? by @roukmoute
- Check $this in static functions by @vudaltsov
- Error while reading baseline: Baseline file does not contain <files> by @leighman
- tidyNode properties’ types are inaccurate by @chloekek
- array_keys() issue only with phar version by @Rarst
- Calls to `__get` through property access seem to always infer `string` as parameter type, even when `class-string` is given by @Ocramius
- Plug-ins not compatible with PHAR by @jtojnar
- Idea: `@psalm-never-throw`, alike to `@psalm-pure`, but promises to not throw/warn by @Ocramius
- Prevent direct call to __construct by @DaveLiddament
- Consider failing analysis with an error when baseline contains non-applicable exclusion by @localheinz
- array_multisort and InvalidPassByReference by @kkmuffme
- Allow value-of in assertions? by @vaceletm
- Pseudo-types for referencing class properties and methods? by @Ocramius
- Bound closures should maintain return type. by @gmazzap
- Clear cache after composer.lock change by @greg0ire
- Non-existent arguments should probably give an error by @vudaltsov
- Check serializable contract by @staabm
- Suggest adding config flag when `@property` tag is given but no magic getter used by @muglug
- Auto-generate config based on existing config from other tools by @muglug
- Excessive `static` in types by @SCIF
- Discussion: psalm-immutable built-in classes by @zerkms
- Have to run psalm twice to fix all the issues by @kamrandotpk
- Dont UnresolvableInclude when wrapped in file_exists by @kkmuffme
- Suggest to remove unmatched issueHandlers by @williamdes
- Default value for parameters with callable type can only be NULL by @vudaltsov
- [Enhancement] Plugins added via plugin command are not formatted properly by @mr-feek
- [Question] how to annotate "array merge" operation by @joehoyle
- False positive MixedReturnTypeCoercion? by @gharlan
- DateInterval::format() considered "possibly-mutating" by @sebastianbergmann
- Different variable type in the default case and after the switch block by @vudaltsov
- DX: improve error messages by @staabm
- [enhancement] Migrate psalm to use symfony console command? by @mr-feek
- @psalm-trace result of the statement beneath without a variable by @vudaltsov
- Invalid read from CallMap when methods are in inheritance by @simPod
- Broken parsing of '@template of I' followed by a simple comment by @githoober
- PropertyNotSetInConstructor is issued although ignored by @JoshuaBehrens
- Psalm can't infer argument type of nested closure by @EvgeniiR
- Nonsensical error messages such as "expects empty, int(0) provided." when appending to empty template by @ostrolucky
- @var doblock collapses object{} and class notation by @joehoyle
- Support read only function or method parameters by @githoober
- Subtype error when parent class includes class-string and callable params by @kevinsmith
- Using constants as array key for object like array by @dmolineus
- Incorrectly resolved $this return of PHPDoc defined method in mixin context by @SCIF
- Support key-mapped templated arrays by @muglug
- Conditional type 'func_num_args()' not properly inheriting by @tvdijen
- Define param-out type in hook by @hectorj
- UndefinedDocblockClass when using intersection type in @throws by @marcusirgens
- Add @mixin documentation by @githoober
- Infer class type based upon result of is_a() function call by @mr-feek
- Add taint flows for remaining built-in pure functions such as utf8_decode, max($strings), etc by @TysonAndre
- ImpureStaticProperty in immutable context when static property is @readonly by @asgrim
- Cover the PHP taint extension's sinks and taint flows by @muglug
- Aliasing same method from different traits uses method from first trait by @GrandLTU
- Dump more detailed exception frames when a worker crashes? by @TysonAndre
- Taint detection for $_SERVER? by @TysonAndre
- Incorrect file and line for `include` sink with multiple complex expressions by @TysonAndre
- Idea: Treat $var() as a taint sink? by @TysonAndre
- Taint detection does not work for closure use references or reference params by @TysonAndre
- TaintAnalysis does not support dynamic properties of cloned objects (low priority) by @TysonAndre
- @var MyTrait $mockForTrait causes UndefinedDocblockClass by @caugner
- Type inference from is_* functions does not work for constants by @gmazzap
- Warn about stubs that duplicate classes/functions from other stubs in internal stubs? by @TysonAndre
- Idea: Allow adding descriptions to psalm-taint-source by @TysonAndre
- Run psalm config with relative path if resolveFromConfigFile enabled by @Patrick-Remy
- How to add taint source for objects? by @thbley
- Idea: Add option to mark other filesystem functions as taint sinks by @TysonAndre
- Psalm doesn't recognize aliased trait constructor by @remorhaz
- New annotation: psalm-no-alias by @olleharstedt
- Psalm stops checking for taint detection after call to eval() by @TysonAndre
- Custom taint sinks added programmaticaly by @adrienlucas
- UndefinedDocblockClass on applying type to static variable in a class method by @UrsusArctosUa
- Are stub files required to list out every method? by @mr-feek
- Support to load extraFiles from PHAR by @filips123
- Would expect `MethodSignatureMismatch` by @leighman
- [Question] Stubs prioity, MethodReturnTypeProviderInterface for documented magic methods by @zlodes
- Support additional ways to mark parameters as unused that other tools can use? by @TysonAndre
RELEASES
See all- Hello World! by @muglug
- Emit more issues on incorrect array access by @muglug
- Bump version by @muglug
- by @muglug
- Show code snippets for errors by @muglug
- Add parser support for PHP 7.1 by @muglug
- Fix return type warnings on docblockless-functions by @muglug
- PHP 7.1 Support by @muglug
- Add support for gettype checks by @muglug
- Fix for oldstyle constructors by @muglug
- Add TypeDoesNotContainType issue by @muglug
- Fix trait protected/private method visibility by @muglug
- Add windows support by @muglug
- Support windows by @muglug
- Various small fixes by @muglug
- Downgrade DateTimeInterface to DateTime by @muglug
- Fix checking method mutations by @muglug
- 4.29.0 by @orklah
- 4.28.0 by @orklah
- 4.27.0 by @orklah
- 4.26.0 by @orklah
- 4.25.0 by @orklah
- 4.24.0 by @orklah
- 4.23.0 by @muglug
- 5.0.0-beta1 by @orklah
- 4.22.0 by @orklah
- 4.21.0 by @weirdan
- 4.20.0 by @orklah
- 5.0.0-alpha1 by @weirdan
- 4.19.0 by @orklah
- 4.18.1 by @weirdan
- 4.18 by @weirdan
- 4.17.0 by @orklah
- 4.16.1 by @weirdan
- 4.16.0 by @weirdan
- v4.15.0 by @orklah
- 4.14.0 by @orklah
- Fixed crash during config parsing by @weirdan
- 4.13.0 by @weirdan
- 4.12.0 by @weirdan
- 4.11.2 by @weirdan
- 4.11.1 by @weirdan
- 4.11.0 by @weirdan
- Better infinite loop inference, some PHP 8.1 support and a bunch of fixes by @weirdan
- Just a bunch of fixes + callmap tests by @weirdan
- Improve preloading and fix template bounds checks by @muglug
- Fixed TIntRange bounds types by @weirdan
- First community release by @weirdan
- Fix baseline functionality by @muglug
- Detect more unused code by @muglug
- Bugfixes galore by @muglug
- Fix potential templated static issue by @muglug
- Better tracking of mixed issues by @muglug
- Fix small API regression by @muglug
- Mostly bugfixes by @muglug
- More bugfixes by @muglug
- Fix autocompletion in PHP 7.3 by @muglug
- Improve autocompletion for functions by @muglug
- Fix PHP 7.1-7.2 builds by @muglug
- Bugfixes by @muglug
- Even more bugfixes by @muglug
- Fix regression in conditional interpretation by @muglug
- Add support for Github Security analysis by @muglug
- More attribute checks by @muglug
- Support PHP 8 Attributes by @muglug
- Couple of bugfixes by @muglug
- Improve treatment of finally blocks by @muglug
- Psalm 4.0.0 by @muglug
- Psalm 4.0.0 Beta Release 3 by @muglug
- 4.0.0 Beta Release 1 by @muglug
- Fix two regressions by @muglug
- Fix preg_split by @muglug
- A bunch of bugfixes by @muglug
- A smattering of things by @muglug
- Automatically add pure/immutable annotations by @muglug
- Fix another regression by @muglug
- Fix regression by @muglug
- Flag named argument discrepancies by @muglug
- Minor bugfixes by @muglug
- Allow MissingPropertyType to be fixed automatically by @muglug
- Improve taint analysis a little by @muglug
- Add --taint-analysis command by @muglug
- Add more taint analysis features by @muglug
- Improve diff behaviour & bugfixes by @muglug
- Fix loop unset crash introduced by 3.11.3 by @muglug
- Add more comprehensive support for conditional types by @muglug
- Prevent crash when analysing some isset conditions by @muglug
- Conditional types & faster --diff mode by @muglug
- Fix astract method call false positive by @muglug
- Improve help messages by @muglug
- Adjust config flag behaviour for mixed issues by @muglug
- Fix a few incompatibilities introduced in 3.9.0 by @muglug
- Allow totallyTyped config flag to work again by @muglug
- Improve initialisation by @muglug
- Build a Phar release by @muglug
- Improve template handling between different templated functions by @muglug
- Improve type inference by @muglug
- Show issues that can be fixed with Psalter by @muglug
- Misc fixes by @muglug
- Support PHP 7.4 by @muglug
- Improve try/catch handling by @muglug
- 5.1.0 by @weirdan
- Psalm 5 by @muglug
- 5.0.0-rc1 by @orklah
- 4.30.0 by @orklah
- 5.2.0 by @weirdan
- 5.15.0 by @weirdan
- 5.14.1 by @weirdan
- 5.14.0 by @weirdan
- 5.13.1 by @orklah
- 5.13.0 by @orklah
- 5.12.0 by @orklah
- 5.11.0 by @orklah
- 5.10.0 by @orklah
- 5.9.0 by @orklah
- 5.8.0 by @weirdan
- 5.7.7 by @weirdan
- 5.7.6 by @weirdan
- 5.7.5 by @weirdan
- 5.7.4 by @weirdan
- 5.7.3 by @weirdan
- 5.7.2 by @weirdan
- 5.7.1 by @weirdan
- 5.7.0 by @weirdan
- 5.6.0 by @weirdan
- 5.5.0 by @orklah
- 5.4.0 by @orklah
- 5.3.0 by @orklah