Psalm 7.0.0-rc24 has been released: https://github.com/vimeo/psalm/releases/tag/7.0.0-rc24 #psalm

Psalm 7.0.0-rc25 has been released: https://github.com/vimeo/psalm/releases/tag/7.0.0-rc25 #psalm

Psalm 7.0.0-rc26 has been released: https://github.com/vimeo/psalm/releases/tag/7.0.0-rc26 #psalm

Psalm 7.0.0-rc27 has been released: https://github.com/vimeo/psalm/releases/tag/7.0.0-rc27 #psalm

Psalm 6.20.5 has been released: https://github.com/vimeo/psalm/releases/tag/6.20.5 #psalm

Psalm 6.20.6 has been released: https://github.com/vimeo/psalm/releases/tag/6.20.6 #psalm

Psalm 7.0.0-rc28 has been released: https://github.com/vimeo/psalm/releases/tag/7.0.0-rc28 #psalm

Security analysis is on by default: types, taints and dead code in one pass, on a rewritten, 10x faster taint engine.

New: NoSQL, LLM prompt and URL injection, php://input and upload names as sources, taint through closures and generators.

Try it: https://psalm.dev/r/7631291cc5

Hack-style purity: declare which side effects code may have (io, time, write-props...) and catch the "pure" function that reads the clock or edits its input.

Purity templates make array_map() and your interfaces as pure as what you pass them.

Try it: https://psalm.dev/r/be7eb39420

Dead code detection on a reference graph: if nothing reachable uses it, Psalm finds it. Classes that only call each other, cycles included, and exceptions you create but never throw.

Try it: https://psalm.dev/r/31c62c069b

Template defaults for classes, functions and methods: Result<int> now means Result<int, RuntimeException>.

Libraries can add a template without breaking the types their users already wrote.

Try it: https://psalm.dev/r/4e21eb262e

PHP 8.6 pipelines with partial application, fully typed:

$slug = $title |> trim(...) |> str_replace(' ', '-', ?);
// string

$title |> explode(' ', ?) |> strtolower(...);
// InvalidArgument: strtolower expects string, non-empty-list<string> given

Try it: https://psalm.dev/r/3c08a570e0

Framework plugins in the box: PHPUnit, Mockery, Symfony, Laravel and sabre/event plugins switch on by themselves when your composer.json uses the library. Zero setup.

Daily releases from now on: features and fixes reach you the day they land. And the team grew: Alies Lapatsin joined the maintainers.

Upgrading is a dependency bump away: https://psalm.dev/docs/running_psalm/upgrading_to_psalm_7/

Psalm 6.20.7 has been released: https://github.com/vimeo/psalm/releases/tag/6.20.7 #psalm

Psalm 7.0.1 has been released: https://github.com/vimeo/psalm/releases/tag/7.0.1 #psalm

Psalm 7.0.2 has been released: https://github.com/vimeo/psalm/releases/tag/7.0.2 #psalm

Psalm 6.20.8 has been released: https://github.com/vimeo/psalm/releases/tag/6.20.8 #psalm

Psalm 7.0.3 has been released: https://github.com/vimeo/psalm/releases/tag/7.0.3 #psalm