chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/starlight (source)	0.41.2 → 0.41.3
phpstan/phpstan	2.2.2 → 2.2.4
phpstan/phpstan-symfony	2.0.19 → 2.0.20
phpunit/phpunit (source)	13.1.14 → 13.2.2
rector/rector (source)	2.4.5 → 2.5.2

---

Release Notes

withastro/starlight (@​astrojs/starlight)

v0.41.3

Compare Source

Patch Changes

• #​3911 1686ecc Thanks @​timothyjordan! - Keeps keyboard focus inside the mobile menu while it is open, preventing focus moving to hidden interactive elements in page content.

phpstan/phpstan-phar-composer-source (phpstan/phpstan)

v2.2.4

Compare Source

v2.2.3

Compare Source

phpstan/phpstan-symfony (phpstan/phpstan-symfony)

v2.0.20

Compare Source

sebastianbergmann/phpunit (phpunit/phpunit)

v13.2.2: PHPUnit 13.2.2

Compare Source

Fixed

• #​6768: Negative priorities for hook methods are rejected by static analysis
• #​6778: Deprecation triggered outside of tests cannot be ignored

---

Learn how to install or update PHPUnit 13.2 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v13.2.1: PHPUnit 13.2.1

Compare Source

Fixed

• #​6741: Test is not run when --filter matches the name of a data set but not the name of the test method
• #​6743: Improve error message for invalid version constraint in attribute
• #​6744: Environment variable attributes reject empty-string values since PHPUnit 13.2.0

---

Learn how to install or update PHPUnit 13.2 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

v13.2.0: PHPUnit 13.2.0

Compare Source

Added

• #​3387: Specify a list of tests to run
• #​4201: Handle interrupts and display current test results
• #​4501: Option to mark test as risky when it does not contribute to code coverage
• #​5757: Add assertions for ignoring whitespace differences in strings
• #​5810: Do not dump arrays and objects in failure messages of IsTrue, IsFalse, IsNull, IsFinite, IsInfinite, and IsNan constraints
• #​5838: Inherit #[RunTestsInSeparateProcesses] from parent test classes
• #​5922: assertContainsEquals() should use sebastian/comparator for element comparison
• #​6000: Report PHPT test as risky when --SKIPIF-- does not have standard-output side effect
• #​6075: Support test execution order sorted by descending duration
• #​6346: Emit warning when conflicting CLI options are used
• #​6534: Make $_dataName available to #[TestDoxFormatter] callbacks
• #​6559: Improved API for exception message expectations
• #​6565: Optional $skipWhenEmpty parameter for #[DataProvider] and #[DataProviderExternal]
• #​6566: Allow --stop-on-defect, --stop-on-error, etc. to accept an optional threshold
• #​6567: Make diff context lines configurable
• #​6574: Improve willReturnMap() with constraint support and strict matching
• #​6575: --list-test-ids CLI option and enhance --filter CLI option to support test ID syntax
• #​6577: --run-test-id <test-id> CLI option that accepts a single test ID for exact matching
• #​6579: Properly handle issues triggered outside of tests
• #​6597: Compact output (activated through --compact CLI option and PHPUNIT_COMPACT_OUTPUT=1 environment variable)
• #​6598: --disable-coverage-targeting CLI option
• #​6602: Separate configuration for branch coverage from path coverage
• #​6606: Support for partially ordered parameter sets in mock object expectations
• #​6611: Add CPU time to telemetry
• #​6681: Comment-aware variants of XML comparison assertions
• The executionOrder attribute in the XML configuration file now accepts defects combined with any main order, as well as three-way combinations of depends/no-depends, defects, and a main order (for example, depends,defects,duration-ascending)
• --validate-configuration CLI option to validate an XML configuration file for PHPUnit
• Report TestDox information in Open Test Reporting XML
• Report per-test and per-test-suite resource usage (time, memory usage, peak memory usage) in Open Test Reporting XML
• Report number of assertions performed for each test in Open Test Reporting XML
• Report structured comparison failure details (expected, actual, diff) in Open Test Reporting XML
• Report random order seed in Open Test Reporting XML when test execution order is randomised

Changed

• #​5873: Chain previously registered error handler instead of silently disabling PHPUnit's error handling
• #​6535: Use sebastian/file-filter in SourceFilter::includes() for issue trigger identification
• #​6581: Allow #[IgnoreDeprecations] to be repeated
• #​6609: Skip data providers whose method cannot match --filter
• #​6685: Generate failure messages for inverse assertions by authoring negations, not by rewriting strings
• Only errors and failures are now considered for "defect first" test reordering (tests that triggered deprecations, notices, or warnings as well as incomplete, risky, and skipped tests were previous also considered)
• A warning is now emitted when closures are compared for equality using the IsEqual, IsEqualCanonicalizing, IsEqualIgnoringCase, IsEqualWithDelta, and TraversableContainsEqual constraints or the assertEquals(), assertEqualsCanonicalizing(), assertEqualsIgnoringCase(), assertEqualsWithDelta(), and assertContainsEquals() assertions

Deprecated

• #​6075: --order-by duration CLI option, use --order-by duration-ascending instead
• #​6075: --order-by size CLI option, use --order-by size-ascending instead
• #​6075: executionOrder="duration" XML configuration attribute value, use executionOrder="duration-ascending" instead
• #​6075: executionOrder="size" XML configuration attribute value, use executionOrder="size-ascending" instead
• #​6560: Soft-deprecate expectExceptionMessage(), use expectExceptionMessageIsOrContains() instead

Fixed

• #​5845: Error handlers registered before PHPUnit (e.g. via auto_prepend_file) cause false "risky test" warnings
• #​5851: Output buffer manipulation in tests causes incorrect capture, hangs, and silent failures
• #​6582: TestSuiteSorter::cmpSize() does not handle TestSuite objects for TestCase classes

---

Learn how to install or update PHPUnit 13.2 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

rectorphp/rector (rector/rector)

v2.5.2: Released Rector 2.5.2

Compare Source

Bugfixes 🐛

• Match class + path in unused-skip reporting — fix combined class => [paths] skips being wrongly flagged as unused (#​8073)
• Mark skip used only when rule would change the file — a class/path skip counts as "used" only if the rule would actually touch that file, killing false "used" hits (#​8076)
• Improve unused-skip resolver methods — cleaner resolution internals (#​8072)
• Track used skips as class => [paths] map — richer per-path skip tracking backing the report (#​8074)

v2.5.1: Released Rector 2.5.1

Compare Source

Bugfixes 🐛

• Skip unused-skip reporting on narrowed runs - no more false "unused skip" noise when running Rector on a subset of paths (#​8069)
• Display skips only on uncached run - skip report shows on real runs, not when results come from cache (#​8071)
• RemoveAlwaysTrueIfConditionRector — avoid scanning whole new statements on dynamic variable checks; moved logic to ExprAnalyzer and bail early on defined variables (#​8057)

v2.5.0: Released Rector 2.5

Compare Source

New Features 🥳 🎉 🎉 🎉

This release has 3 interesting new features. Let's look at them:

[dx] Report skips that never matched (#​8058)

• What? - like PHPStan's reportUnusedIgnores, but for Rector ->withSkip(). Flags skip entries that never matched anything during the run, so you can delete stale skips.

• Why? - skips rot. You skip a path/rule to dodge a problem, later the file moves or the rule stops firing there — the skip lingers forever,
  silently masking nothing. This surfaces dead skips so config stays honest.

// rector.php
return RectorConfig::configure()
    ->withSkip([
        SimplifyUselessVariableRector::class => [
            '*/src/Legacy/*',          // still matches — fine
            '*/NonexistentUnused/*',   // matches nothing — stale
        ],
    ])
    ->reportUnusedSkips();

Run output:

 [OK] Rector is done!
  
 [WARNING] This skip is unused, it never matched any element.
           You can remove it from "->withSkip()"

 * Rector\CodeQuality\Rector\FunctionLike\SimplifyUselessVariableRector => */NonexistentUnused/*

---

[dx] Removing unused imports by default (#​8047)

You can update your rector.php config:

 return RectorConfig::configure()
-    ->withImportNames(removeUnusedImports: true);
+    ->withImportNames();

In case it's not for you, turn it off:

 return RectorConfig::configure()
-    ->withImportNames();
+    ->withImportNames(removeUnusedImports: false);

---

[dx] Introducing Drupal composer-based sets (#​8041), Thanks @​bbrala!

If you're using Drupal Rector, you can now enable it's per-version sets via:

 return RectorConfig::configure()
+    ->withComposerBased(drupal: true);

To learn more about composer-based-sets, checkout the documentation.

New Rules 🎉

• [php 8.4] [type-declaration] Add AddArrayAnyAllClosureParamTypeRector and NarrowArrayAnyAllNullableParamTypeRector (#​8049)
• [code-quality] Add MoveInnerFunctionToTopLevelRector (#​8042)
• [code-quality] Add NewArrayItemConcatAssignToAssignRector (#​8045)
• [code-quality] Add FixClassCaseSensitivityVarDocblockRector (#​8046)
• [polyfills] add missing polyfill to PHP 8.4 array functions (#​8052)
• [rector] Add AddParamTypeToRefactorMethodRector if missing (#​8061)

Bugfixes 🐛

• [internal] Streamline use imports management to FileNode (#​8040)
• [PostRector] Do not keep an unused import matched only by a partial docblock name's tail (#​8043), Thanks @​ruudk!
• [CodeQuality] Skip native function on MoveInnerFunctionToTopLevelRector (#​8044)
• Fix --only runs caching files as unchanged, hiding pending changes from full runs (#​8029), Thanks @​SanderMuller!
• [fix] Fix RemoveUnusedPrivateMethodRector for NeverType (#​8050)
• [dead-code] Fix RemoveUnusedVariableAssignRector, allow for SplFileInfo as cleanup on purpose for gc (#​8054)
• [fixes] Couple ClassPropertyAssignToConstructorPromotionRector, RemoveAlwaysTrueIfConditionRector and RemoveUnusedVariableAssignRector fixes (#​8055)
• [TypeDeclaration][DeadCode] Skip class with Doctrine static function mapping (loadMetadata) in TypedPropertyFromAssignsRector and RemoveUnusedPrivatePropertyRector (#​8059)
• [TypeDeclaration] Skip class with Doctrine static function mapping (loadMetadata) in TypedPropertyFromStrictConstructorRector (#​8060)

rectorphp/rector-doctrine 🟠

• [NodeAnalyzer] Detect Doctrine static function mapping (loadMetadata) entity in DoctrineEntityDetector (736bf61)

v2.4.6: Released Rector 2.4.6

Compare Source

New Features 🥳

• [deprecation] Add RenameDeprecatedMethodCallRector inferring rename from @​deprecated docblock (#​8015)
• [sets] kick of named args set (#​8013)

# rector.php
return (RectorConfig::configure())
    ->withPreparedSets(namedArgs: true);

• Add Symfony 8 to the set provider collector (#​8019), Thanks @​mbabker!

Bugfixes 🐛

• [BetterPhpDocParser] Keep import referenced by @​see/@​uses tag with a trailing description (#​8039), Thanks @​ruudk!
• [internals] skip and finalize beforeTraverse() and afterTraverse() as never used, use refactor() instead (#​7765)
• [DeadCode] Skip (void) cast with #[NoDiscard] on target method call on RemoveDeadStmtRector (#​8038)
• Bump composer/pcre to ^3.4.0 and phpstan/phpstan to ^2.2.2 (#​8037)
• [CodeQuality] Handle crash on custom exception not autoloaded on ThrowWithPreviousExceptionRector (#​8036)
• refactor: extract AutoloadFileParameterResolver from bin, add tests (#​8035), Thanks @​SanderMuller!
• Fix cached results surviving a change of --autoload-file (#​8034), Thanks @​SanderMuller!
• [CodingStyle] Remove AstResolver usage on ArrowFunctionAndClosureFirstClassCallableGuard (#​8031)
• [DeadCode] Remove AstResolver on RemoveParentCallWithoutParentRector (#​8032)
• [DeadCode] Skip with use of func_num_args() on RemoveNullArgOnNullDefaultParamRector (#​8030)
• [Php70] Skip rewriting to $this on static method or static closure on StaticCallOnNonStaticToInstanceCallRector (#​8026)
• [ci] add compat test (#​8025)
• Fix ReplaceArgumentDefaultValueRector generating invalid self:: constant in unrelated classes (#​8023)
• Fix RemoveDeadIfBlockRector dropping else block when merging empty if with elseif (#​8022)
• Fix RemoveParentCallWithoutParentRector removing valid call when ancestor hierarchy is unresolvable (#​8018)
• split of RemoveNullNamedArgOnNullDefaultParamRector to handle only named args (#​8014)
• Add failing tests (#​8012), Thanks @​u01jmg3!
• Update rector/swiss-knife version to ^2.4.1 (#​8011)

rectorphp/rector-symfony 🎶

• [Symfony81] Add new rule for deprecated validator test usages (#​948), Thanks @​florianhofsaessC24!
• fix: only convert Twig extensions fully reducible to AsTwig attributes (#​947)
• [Symfony73] Sort optional parameters last in InvokableCommandInputAttributeRector (#​945)
• Add PHPStan rule requiring nested set configs to be imported in parent set config (#​943)
• [Symfony81] Add new rule for Security component (#​942), Thanks @​MrYamous!
• Remove unused imports (#​941), Thanks @​MrYamous!
• [Symfony81] Add new rule for Filesystem (#​940), Thanks @​MrYamous!

rectorphp/rector-phpunit 🟢

• [PHPUnit12] Handle crash on property not exists on PropertyCreateMockToCreateStubRector (#​681)
• [AnnotationsToAttributes] Convert external @​depends ClassName::method to #[DependsExternal] (#​679)
• [PHPUnit12] Drop ConstraintValidatorTestCase from AllowMockObjectsWhereParentClassRector triggers (#​678)

rectorphp/rector-downgrade-php ⬇️

• Add DowngradeDomNodeChildNodesForeachRector for null $childNodes before PHP 8.0 (#​379)
• Update boundwize/structarmed version to ^0.9 (#​378)
• Fix use of existing PhpAttributeAnalyzer service on AddReturnTypeWillChangeAttributeRector (#​377)
• Remove no longer exists '--ansi' flag from swiss-knife (#​376)
• [DowngradePhp81] Add AddReturnTypeWillChangeAttributeRector (#​372), Thanks @​jquiaios!

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer update phpstan/phpstan:2.2.4 phpstan/phpstan-symfony:2.0.20 phpunit/phpunit:13.2.2 rector/rector:2.5.2 --with-dependencies --ignore-platform-req=ext-* --ignore-platform-req=lib-* --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires phpunit/phpunit ^13.0 -> satisfiable by phpunit/phpunit[13.2.2].
    - phpunit/phpunit 13.2.2 requires sebastian/diff ^9.0 -> found sebastian/diff[9.0.0] but these were not loaded, likely because it conflicts with another require.

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.