fix(psalm): the findings Psalm 7 reports under PHP 8.5 #6

Merged

dawid merged 1 commit from fix/psalm-7-findings into main 2026-11-10 17:55:53 +00:00

Conversation 0 Commits 1 Files changed 5 +23 -25

dawid commented 2026-11-10 12:52:21 +00:00

Owner

• Copy link
• Copy Markdown

main's standards job fails since #4 (Psalm 7): Renovate re-created #4's branch before it was merged and dropped the baseline update, and Psalm 7 on the CI image's PHP 8.5 reports 5 findings at new places and 7 baseline entries as unused.

This fixes the five instead of baselining them (CliProcess's closed pipes, a redundant is_array in Schema, a float cast in Numerics) and suppresses TaintedShell for CliProcess, whose proc_open gets an argv array and so no shell. --update-baseline then dropped the unused entries and added none.

Checked in composer:2 (PHP 8.5.12, Psalm 7.0.5, as CI): Psalm 0 errors, php-cs-fixer clean, PHPUnit 249 tests OK.

main's `standards` job fails since #4 (Psalm 7): Renovate re-created #4's branch before it was merged and dropped the baseline update, and Psalm 7 on the CI image's PHP 8.5 reports 5 findings at new places and 7 baseline entries as unused. This fixes the five instead of baselining them (CliProcess's closed pipes, a redundant is_array in Schema, a float cast in Numerics) and suppresses TaintedShell for CliProcess, whose proc_open gets an argv array and so no shell. `--update-baseline` then dropped the unused entries and added none. Checked in `composer:2` (PHP 8.5.12, Psalm 7.0.5, as CI): Psalm 0 errors, php-cs-fixer clean, PHPUnit 249 tests OK.

dawid added 1 commit 2026-11-10 12:52:21 +00:00

fix(psalm): the findings Psalm 7 reports under PHP 8.5 ... f926628e1c

Psalm 7 on the CI image's PHP 8.5 reports what the baseline kept under the
old runtime at other places, so main's standards job failed:

- CliProcess takes a pipe out of $pipes before closing it, so the property
  never holds a closed resource.
- Schema::check returns early for a value that is not an array instead of
  testing is_array twice.
- Numerics casts array_sum's result to float, as the matrix holds floats.
- TaintedShell is suppressed for CliProcess: proc_open gets an argv array,
  which PHP runs without a shell.

The baseline loses the entries these fixes made unused; it gains none.

dawid merged commit 87e0c76b81 into main 2026-11-10 17:55:53 +00:00

dawid deleted branch fix/psalm-7-findings 2026-11-10 17:55:53 +00:00

dawid referenced this pull request from a commit 2026-11-10 17:55:55 +00:00

fix(psalm): the findings Psalm 7 reports under PHP 8.5 (#6)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

ansible

Ansible collections and roles

  

ci

CI: the workflows' actions and images

  

dependencies

Renovate: an update of dependencies

  

digest

A pinned version or a new digest of the same version

  

docker

Container images

  

fix

Ships with the app: fix(deps), so the release bot makes a patch release

  

go

Go modules

  

javascript

npm packages

  

major

A new major version: may break, read its release notes

  

minor

A new minor version: new features, should not break

  

patch

A new patch version: fixes only

  

php

Composer packages

  

python

Python packages

  

released

Release bot: in a tagged release (the changelog names it)

  

security

Fixes a known vulnerability (OSV): merge soon

No labels

ansible

ci

dependencies

digest

docker

fix

go

javascript

major

minor

patch

php

python

released

security

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

dawid/nextcloud-talk-ai!6

No description provided.