🥇Release of PHPStan 1.0, a static analyzer for PHP code

After six years of development, the first stable release of the PHP static analyzer PHPStan 1.0 has been launched. It allows for the detection of errors in PHP code without execution and the use of unit tests. The project code is written in PHP and is distributed under the MIT license.

The analyzer offers 10 levels of checks, with each subsequent level expanding the capabilities of the previous one and providing stricter validations:

Basic checks for unknown classes, functions, and methods ($this), undefined variables, as well as incorrect argument counts.

Detection of likely undefined variables, unknown magic methods, and class properties with __call and __get.

Detection of unknown methods in all expressions, not limited to calls through $this. PHPDocs checks.

Validation of return types and type assignments to properties.

Basic detection of 'dead' (never called) code. Identification of instanceof calls that always return false, 'else' blocks that never execute, and code following a return statement.

Checks on argument types passed to methods and functions.

Warnings about missing annotations with type information.

Warnings about incorrect union types defining collections of two or more types.

Warnings about method calls and property accesses with 'nullable' types.

Checks for the use of the 'mixed' type.

Examples of basic issues detected:

Existence of classes used in instanceof, catch, typehints, and other language constructs.
Existence and accessibility of called methods and functions, along with the number of arguments passed.
Verification that a method returns data of the same type as defined in the return expression.
Existence and visibility of properties being accessed, as well as checks on declared and actual data types used in properties.
Correctness of the number of parameters passed to sprintf/printf in the string formatting block.
Existence of variables considering blocks created by branching operators and loops.
Useless type casts (e.g., '(string) 'foo'') and strict checks ('===' and '!==') for data with different types and operands that always return false.

Key innovations in PHPStan 1.0:

The implementation includes validation level "9", which performs checks on the usage of the type "mixed", intended for accepting parameters of different types. This ninth level identifies unsafe uses of "mixed", such as passing values of type "mixed" to another type, calling methods with type "mixed", and accessing its properties, as they may not exist.
Management of identity checks for return values of identical function calls using the annotations @phpstan-pure and @phpstan-impure.
Type analysis in try-catch-finally constructs using the @throws annotations.
Identification of certain but unused internal (private) properties, methods, and constants.
Passing incompatible callback calls in array handling functions, such as array_map and usort.
Inspection of types for missing type hint annotations.
Compatibility of type descriptions with PHPDocs has been ensured, allowing types from error messages to be used in PHPDocs.

Source: opennet.ru

Release of PHPStan 1.0, a static code analyzer for PHP.