Sourced from vimeo/psalm's releases.

Bugfixes

Change in behaviour

• accessing a not-previously-specified key of an object-like array is now a bug (#2787)
• any args passed to an unknown method must now be defined beforehand (#2909)

Other bugfixes

• @Daeroni improved some builtin GD functions (#2851)
• @JaredCDN prevented a TypeError when generating xml reports (#2856)
• Psalter: fix MissingParamType replacement when for parameters passed by-reference (#2857)
• Prevent DuplicateArrayKey warning when unpacking multiple arrays without known key types (#2852)
• Allow comparison between different templated object-like arrays (#2849)
• Allow casting templated types (#2848)
• Allow class constants to contain array offset references for other class constants (#2844)
• Forbid passing in mutatable class to a mutation-free context (#2805)
• Allow "5.0" where numeric is expected (#2827)
• Only warn about deprecated classes where they're used explicitly (#2721)
• Warn when an immutable class depends on a mutable parent (#2242)
• Detect error when asserting on result of function call (#1684)
• Break apart a scalar type into constituent parts where necessary (#1311)
• Treat echo as impure (#2867)
• Prevent use of impure __toString (#2866)
• Prevent keyed arrays from being interpreted as callable (#2871)
• @ArSn fixed setting memory_limit artificially low when running Psalter (#2873)
• Allow @method as(string $s) (#2881)
• Handle templated intersections more equally (#2875)
• @pilif added a config skipChecksOnUnresolvableIncludes that you can disable to make Psalm more strict when it encounters includes for unknown files (#2817)
• @jdreesen improved the return type of range(...)
• Keep track of which argument a given template param was inferred from, to avoid overwriting the inference (#2900)
• Don't care about method case in the PhpStorm meta scanner (#2890)
• Rename stubs to prevent issues in PHPStorm (#2879)
• Trim carriage returns where necessary (#2859)
• Prevent ternaries from being considered a valid reference (#2910)
• @leightonthomas supported trailing commas in type aliases (#1799)
• Prevent contradiction with templated object equality (#2918)
• Don't emit MissingPropertyType where the property is defined in a third-party lib (#2388)

• 352bd3f Remove redundant condition
• 766effb Improve accuracy of diff generation
• f3d7ed6 Remove var_dump
• 7f9e6b8 Increase processor consumption
• dc74f2b Add specific cast
• 10b807b Fix reference generation from methods in --diff mode
• a2a5071 Fix #2923 - remove hack to fix a template issue
• 51bfc7c Only emit mixed issues for MissingClassPropertyType
• 7ea06c7 Only emit PossiblyUndefinedVariable issue on variables
• 75a3412 Downgrade error when using unknown variable in mixed method
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the .dependabot/config.yml file in this repo:

• Update frequency
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)