[dependabot]

Updates the requirements on phpstan/phpstan, phpstan/phpstan-strict-rules, phpstan/phpstan-nette, nepada/phpstan-nette-tester and spaze/phpstan-disallowed-calls to permit the latest version.
Updates phpstan/phpstan to 2.2.16

Commits

• See full diff in compare view

Updates phpstan/phpstan-strict-rules to 2.0.12

Release notes

Sourced from phpstan/phpstan-strict-rules's releases.

2.0.12

• 2bc5ae1 - Allow GMP and BCMath\Number in arithmetic operations (#311)
• 70e3081 - Update github-actions (#324)
• 07a17dd - Update github-actions to v7 (#325)
• de9bdda - Update github-actions (#322)
• 80870ec - Replace deprecated actions/create-release with softprops/action-gh-release
• 109c14f - Bump GitHub Actions across major versions
• ebf31ff - Bump GitHub Actions within their current majors
• 727c193 - Update github-actions
• cc56619 - Update github-actions
• 1e72841 - Update release-toot.yml (#319)
• ada7e60 - CI: move name-collision job into build.yml (#318)
• 470946d - Add missing export-ignore entries to .gitattributes (#315)
• 8b14a8e - name-collision-detector (#314)

Commits

• 2bc5ae1 Allow GMP and BCMath\Number in arithmetic operations (#311)
• 70e3081 Update github-actions (#324)
• 07a17dd Update github-actions to v7 (#325)
• de9bdda Update github-actions (#322)
• 80870ec Replace deprecated actions/create-release with softprops/action-gh-release
• 109c14f Bump GitHub Actions across major versions
• ebf31ff Bump GitHub Actions within their current majors
• 727c193 Update github-actions
• cc56619 Update github-actions
• 1e72841 Update release-toot.yml (#319)
• Additional commits viewable in compare view

Updates phpstan/phpstan-nette to 2.0.12

Release notes

Sourced from phpstan/phpstan-nette's releases.

2.0.12

• 2c104f1 - Fix "False positive staticMethod.alreadyNarrowedType for Strings::length() inside numeric comparison" (#210)
• 038d6e7 - Remove accidental committed file (#208)

Commits

• 2c104f1 Fix "False positive staticMethod.alreadyNarrowedType for Strings::length() in...
• 038d6e7 Remove accidental committed file (#208)
• See full diff in compare view

Updates nepada/phpstan-nette-tester to 2.1.0

Release notes

Sourced from nepada/phpstan-nette-tester's releases.

2.1.0

• Drop support for PHP 7
• Fix handling of unpacked arguments
• Ignore calls with unresolved named arguments
• Add support for Assert::hasKey() and Assert::hasNotKey()

Commits

• 2ef57b4 Add support for Assert::hasKey() and Assert::hasNotKey()
• 469630f Ignore calls with unresolved named arguments
• 702977d Fix handling of unpacked arguments
• 71ea892 Fix code style with PHP 8.0 as the minimum version
• d71bda9 Drop support for PHP 7
• c71cb3c Open 2.1-dev
• dcf3dc1 Update spaze/phpstan-disallowed-calls requirement in the phpstan group (#109)
• 14422e5 Bump the phpstan group across 1 directory with 3 updates (#108)
• 34a685e Bump actions/checkout from 6 to 7 (#106)
• a37bd4b Bump the phpstan group across 1 directory with 2 updates (#105)
• Additional commits viewable in compare view

Updates spaze/phpstan-disallowed-calls to 4.14.0

Release notes

Sourced from spaze/phpstan-disallowed-calls's releases.

Bundled config for functions that are not timing-safe

New bundled configuration file disallowed-non-timing-safe-calls.neon for code that works with keys, tokens, and other secrets: it disallows hex2bin(), bin2hex(), base64_decode(), and base64_encode(), because their runtime depends on the processed bytes and can leak information about them, and recommends the sodium_* functions instead, or ParagonIE\ConstantTime\* when ext-sodium is not available (#433, #434)

includes:
    - vendor/spaze/phpstan-disallowed-calls/disallowed-non-timing-safe-calls.neon

Note: comparing secrets, digests, hashes is the other half - use hash_equals(), not ===, which is an operator, so no rule here can catch it.

Commits

• 90210a8 Tidy up after the non-timing-safe calls config (#434)
• 679d2ad Reword the disallowed-non-timing-safe-calls.neon docs paragraph
• 6368446 Rename NonTimingSafeCallsConfigTest to NonTimingSafeConfigFunctionCallsTest
• 2278723 Explain why disallowed-non-timing-safe-calls.neon is not self-applied
• 821edd4 Add a bundled config file for encoding functions that are not timing-safe (#433)
• 18d1308 Add a bundled config file for encoding functions that are not timing-safe
• 94bd445 Allow directives fall through to the next one when they don't match (#430)
• be678df Document that setting multiple aliases of one directive uses just one of them
• edef780 Allow directives fall through to the next one when they don't match
• 46cd043 Match attributes on methods and functions with allowInMethods and `allowInFun...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.