Bump the upgrade-batch group with 4 updates

[dependabot]

Bumps the upgrade-batch group with 4 updates: symplify/easy-coding-standard, rector/rector, phpstan/phpstan and spaze/phpstan-disallowed-calls.

Updates symplify/easy-coding-standard from 13.2.17 to 13.2.19

Release notes

Sourced from symplify/easy-coding-standard's releases.

Released ECS 13.2.19

What's new

🐛 Fix fatal error when configuring a PHP-CS-Fixer fixer

ECS replaces symfony/console, so Symfony\Component\Console\Application is never installed. Configuring a php-cs-fixer fixer with a deprecated option ran ConfigurableFixerTrait::configure(), which calls PhpCsFixer\Console\Application::getMajorVersion() — a class that extends the missing Symfony Application, so PHP fatalled resolving the parent:

PHP Fatal error: Uncaught Error: Class "Symfony\Component\Console\Application" not found

Now a declaration-only stub ships in /stubs (prefixed by php-scoper in the release build), so the run proceeds instead of fatalling:

-<?php $x=1;+<?php++$x = 1;

A Configured Fixer CI reproducer guards against regressions.

Commits

• a2af21c ECS 13.2.19
• 80d411e Updated ECS to commit 3aee0ac6f5d46c8abba78c28013c9310e01326d1
• 1444973 ECS 13.2.18
• a78d69a Updated ECS to commit 34ddfedc54d060bc4a9944ae40f860a69f60cb66
• d21172a Updated ECS to commit 84e77b87fe08f3ac278b28f49fb3cca220d5cf6c
• See full diff in compare view

Updates rector/rector from 2.5.8 to 2.6.4

Release notes

Sourced from rector/rector's releases.

Released Rector 2.6.4

A tooling release under the hood: Rector's dependency-injection container moves off illuminate/container onto entropy/entropy, and composer-based sets now target the lowest declared version of a library instead of guessing the current one.

New rules 🎉

rector-src

• [Php7.4] IfToNullCoalescingAssignRector — convert an if null-guard into ??= (#8356)
• [Php7.3] ArrayKeysToArrayKeyFirstLastRector — array_keys($a)[0] → array_key_first($a) (#8238)

rector-symfony

• [Web Link] WebLinkStringRelationsToConstantsRector (#1058)

Engine 🔧

• Switch the DI container from illuminate/container to entropy/entropy (#8362) — lighter container, order-independent service collections via autodiscover()
• [VersionBonding] Allow a rule to require multiple composer package constraints at once (#8355)
• [Composer] Target the lowest declared version for libraries in composer-based sets; only a project package type is treated as an application (#8359, #8363)
• [Configuration] Skip deprecated rules pulled in from an active set — warn only instead of crashing (#8358)
• [DI] Register PHPStan PhpVersionFactory as a public service so third-party rules can autowire it (#8365)
• [PhpParser] Merge decorating node visitors from 14 to 8 for faster traversal (#8380)

Bugfixes 🐛

rector-src

• [TypeDeclarationDocblocks] Skip ClassMethodArrayDocblockParamFromLocalCallsRector on methods overriding a parent/interface (#8357)
• [TypeDeclarationDocblocks] Skip a contradicting @param array when the local call type conflicts with the default value (#8381)
• [Naming] Skip a valid singular name with an ous suffix in RenameForeachValueVariableToMatchExprVariableRector (#8382)

rector-symfony

• [Symfony 6.1] Skip CommandConfigureToAttributeRector on non-constant configure() values (#1057)
• [Symfony 3.4] Skip ContainerGetNameToTypeInTestsRector when the named service has no matching FQCN service (#1051)
• [Symfony 3.0] Skip OptionNameRector when no option name changes (#1044)

rector-phpunit

• [CodeQuality] Fix AddInstanceofAssertForNullableArgumentRector duplicating assertInstanceOf inside traits (#773)
• [CodeQuality] Fix MatchAssertSameExpectedTypeRector rewriting a passing assert into a failing one (#771)

... (truncated)

Commits

• 6ff0084 Rector 2.6.4
• 4f200ea Updated Rector to commit a50ce054c4868521b16622e296192d8daf6d6ed6
• c6e94a2 Updated Rector to commit c236c3a4da7ea763e69cbed799e5d6401c9c2652
• bf687a8 Updated Rector to commit c236c3a4da7ea763e69cbed799e5d6401c9c2652
• fd60822 Updated Rector to commit b0924425a745f88b50be43c4af0abb879690bac3
• b2adc66 Updated Rector to commit 53a764b165b2e18c221229919d4051a82960245f
• 215f7cf Updated Rector to commit 53a764b165b2e18c221229919d4051a82960245f
• 420570f Updated Rector to commit 53a764b165b2e18c221229919d4051a82960245f
• 578c863 Updated Rector to commit 22353e27b3db321a03c66b55d233ec413c4820e9
• 57ae283 Updated Rector to commit 22353e27b3db321a03c66b55d233ec413c4820e9
• Additional commits viewable in compare view

Updates phpstan/phpstan from 2.2.7 to 2.2.12

Commits

• See full diff in compare view

Updates spaze/phpstan-disallowed-calls from 4.13.0 to 4.14.0

Release notes

Sourced from spaze/phpstan-disallowed-calls's releases.

Bundled config for functions that are not timing-safe

New bundled configuration file disallowed-non-timing-safe-calls.neon for code that works with keys, tokens, and other secrets: it disallows hex2bin(), bin2hex(), base64_decode(), and base64_encode(), because their runtime depends on the processed bytes and can leak information about them, and recommends the sodium_* functions instead, or ParagonIE\ConstantTime\* when ext-sodium is not available (#433, #434)

includes:- vendor/spaze/phpstan-disallowed-calls/disallowed-non-timing-safe-calls.neon

Note: comparing secrets, digests, hashes is the other half - use hash_equals(), not ===, which is an operator, so no rule here can catch it.

Commits

• 90210a8 Tidy up after the non-timing-safe calls config (#434)
• 679d2ad Reword the disallowed-non-timing-safe-calls.neon docs paragraph
• 6368446 Rename NonTimingSafeCallsConfigTest to NonTimingSafeConfigFunctionCallsTest
• 2278723 Explain why disallowed-non-timing-safe-calls.neon is not self-applied
• 821edd4 Add a bundled config file for encoding functions that are not timing-safe (#433)
• 18d1308 Add a bundled config file for encoding functions that are not timing-safe
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions