chore(deps): bump psalm/phar from ^5.26.1 to v7 (main) by renovate[bot] · Pull Request #13243 · nextcloud/mail

renovate · 2026-07-06T22:16:03Z

This PR contains the following updates:

Package	Change	Age	Confidence
psalm/phar	`^5.26.1` → `^7.0.0-rc10`

Release Notes

psalm/phar

Configuration

📅 Schedule: (in timezone Europe/Vienna)

Branch creation
- "before 5am on wednesday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

ChristophWurst · 2026-10-23T14:01:14Z

Blocked by feat(deps): require PHP 8.2, drop NC32 support #13931

Assisted-by: Claude:claude-sonnet-5

Checked out the open Psalm v7 bump (#13243) and read its CI output to find issues Psalm v7 catches that are real, version-independent bugs rather than the new unused-code/purity detectors v7 turns on by default (those make up the bulk of the new report and aren't addressed here). Fixes: - HordeSyncTokenParser: base64_decode() can return false in strict mode, which was then passed into explode() unguarded. - ProxyController: file_get_contents() on the bundled blocked-image asset can return false; return a 500 instead of constructing a response with a false body. - MessageMapper (Db): mb_convert_encoding()/preg_replace() can return false/null during preview-text cleanup; fall back to the pre-transform value, matching the existing pattern in Html.php. - MessageMapper (IMAP): Horde_Mime_Part's own docblocks say setDispositionParameter()/setContentTypeParameter() take a string, but the implementation explicitly supports and relies on null to remove the parameter. Suppressed with a reference to the actual behavior. - IMAPMessage: same mb_convert_encoding() false-return gap, in keyword display-name normalization. - ContactsIntegration: newContact() already returns null when contacts integration is disabled; extended that to the case where the user has no address book at all, instead of calling the contacts API with a null address-book key. - The four FeatureExtraction classes and ImportanceClassifier: a message's sender can have a null email ("This should not happen" case in extract()), which doesn't actually corrupt the computed ratios since it would just miss the stats map as a non-matching key; suppressed instead of hardening with a guard. Also switched a debug json_encode() call to JSON_THROW_ON_ERROR, matching the pattern used everywhere else in the codebase. This should shrink the diff of the eventual Psalm v7 bump itself, following the pattern from #11224/#13542/#13340. The remaining Psalm v7 findings in Html.php, AutoConfig/IspDb.php, and a handful of zero-baseline files are left for a follow-up. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Christoph Wurst <1374172+ChristophWurst@users.noreply.github.com> Signed-off-by: Daniel Kesselberg <3902676+kesselb@users.noreply.github.com>

Follow-up to #13932 and #13933: re-ran the open Psalm v7 bump (#13243) after both of those merged to see what was left. Two things slipped through the first two batches. - The three FeatureExtraction classes each had a second array access (flaggedMessages/readMessages/repliedMessages) using the same possibly-null $email key as the one already suppressed; only the first access per file got a suppression comment. - MessageMapper (Db) had a second, different possibly-null argument: $recipient->getLabel() passed into mb_strcut() when building recipient rows. Address's own fromRaw() already treats "no label" as "fall back to the email", so this does the same instead of suppressing. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Christoph Wurst <1374172+ChristophWurst@users.noreply.github.com>

@returns

Second batch from the open Psalm v7 bump (nextcloud#13243), same approach as the previous one (nextcloud#13932): real, version-independent issues only, not the new unused-code/purity detectors v7 enables by default. - IspDb::getUrls() had a doc typo, @returns instead of @return, so Psalm never saw its string[] return type and had to infer a much looser one, which caused a possibly-invalid-cast complaint two methods away. Fixing the typo fixes the root cause. - Html::convertLinks()/parseMailBody(): mb_convert_encoding() and preg_split() can return false, unguarded. - JmapMailboxConnector, JmapMessageAdapter, AiIntegrationsService, ItineraryService: json_encode()/preg_replace() calls missing the JSON_THROW_ON_ERROR flag or a null-coalescing fallback, matching the pattern already used elsewhere in each of these files. - ConvertAddresses: Horde_Mail_Rfc822_List::current() is typed to possibly return null, which foreach can't actually hit once valid() has confirmed there's an item; suppressed like the similar Horde docblock gap fixed in nextcloud#13932. - SubmitContentJob: simplified a nullsafe call and its fallback that Psalm proved is unreachable (the foreach it's in always runs at least once). - DelegationForbiddenException: missing #[\Override] on an overridden method. - AiIntegrations/Cache::getBackoffTtl(): suppressed rather than fixed - the obvious cast-earlier fix changes behavior for large $attempt values (2 ** $attempt overflows to a huge float before min() clamps it back down), which broke an existing test, so the possibly-float operand is intentional here. - GravatarSource: stream_get_contents() can return false, which the existing null/empty guard didn't account for. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Christoph Wurst <1374172+ChristophWurst@users.noreply.github.com>

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Psalm v7 turns on unused-code and purity/security detectors by default (MissingPureAnnotation, PossiblyUnusedMethod, UnusedClass, MissingImmutableAnnotation, and friends), which together make up the overwhelming majority of what this bump newly flags (~1500 of the original ~1800 errors after #13932/#13933/#14014 already handled the ordinary type-safety findings). Hand-annotating purity/usage across that many methods isn't realistic for this bump, so this follows the same approach as the Psalm v6 upgrade (#11224): regenerate the baseline wholesale via `psalm --set-baseline`, accepting the new detectors' findings as known rather than fixed. Verified this baseline is actually clean across all four CI matrix legs (nextcloud/ocp dev-master, dev-stable33, dev-stable34, dev-stable35), not just one of them. One finding couldn't be baselined at all: Migration/addMailboxKey() is flagged as MissingPureAnnotation only under the stable33/34 OCP stubs, not master/stable35, because a baseline entry errors as "unused" on whichever legs don't reproduce it. Suppressed inline instead, which doesn't have that problem either way. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Christoph Wurst <1374172+ChristophWurst@users.noreply.github.com>

ChristophWurst · 2026-11-03T08:39:26Z

Closing so Renovate can recreate this cleanly. Assisted-by: Claude:claude-sonnet-5

renovate · 2026-11-03T08:40:52Z

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 7.x releases. But if you manually upgrade to 7.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

renovate Bot requested a review from ChristophWurst as a code owner July 6, 2026 22:16

renovate Bot added 3. to review dependencies labels Jul 6, 2026

renovate Bot requested review from GretaD and kesselb as code owners July 6, 2026 22:16

renovate Bot force-pushed the renovate/main-psalm-phar-7.x branch from 432e5c5 to 756fa92 Compare July 12, 2026 15:13

renovate Bot force-pushed the renovate/main-psalm-phar-7.x branch from 756fa92 to e88847b Compare July 20, 2026 23:34

renovate Bot force-pushed the renovate/main-psalm-phar-7.x branch 2 times, most recently from 196a358 to e33811b Compare August 11, 2026 14:44

renovate Bot force-pushed the renovate/main-psalm-phar-7.x branch from e33811b to 5cd68c2 Compare August 26, 2026 11:46

renovate Bot force-pushed the renovate/main-psalm-phar-7.x branch from 5cd68c2 to a772665 Compare September 7, 2026 20:13

renovate Bot force-pushed the renovate/main-psalm-phar-7.x branch 4 times, most recently from 112af6c to a031f69 Compare September 21, 2026 11:00

renovate Bot force-pushed the renovate/main-psalm-phar-7.x branch 3 times, most recently from e24acd4 to fe0506d Compare September 28, 2026 12:13

renovate Bot force-pushed the renovate/main-psalm-phar-7.x branch from fe0506d to 662fa0c Compare September 30, 2026 19:48

renovate Bot force-pushed the renovate/main-psalm-phar-7.x branch 3 times, most recently from 354731e to 040874a Compare October 16, 2026 16:53

renovate Bot force-pushed the renovate/main-psalm-phar-7.x branch 2 times, most recently from 015eeb6 to c1e8957 Compare October 23, 2026 15:04

This was referenced Oct 23, 2026

fix(psalm): resolve type issues flagged by Psalm 7 #13932

Merged

fix(psalm): resolve more type issues flagged by Psalm 7 #13933

Merged

renovate Bot force-pushed the renovate/main-psalm-phar-7.x branch 2 times, most recently from d168e96 to 42e24c5 Compare October 27, 2026 14:22

renovate Bot force-pushed the renovate/main-psalm-phar-7.x branch 2 times, most recently from 53050cc to a87ae4e Compare November 2, 2026 15:35

ChristophWurst mentioned this pull request Nov 2, 2026

fix(psalm): resolve remaining type issues flagged by Psalm 7 #14014

Merged

renovate Bot force-pushed the renovate/main-psalm-phar-7.x branch from a87ae4e to 3974622 Compare November 2, 2026 19:09

chore(deps): bump psalm/phar from ^5.26.1 to v7

25c6511

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot force-pushed the renovate/main-psalm-phar-7.x branch from 3974622 to 25c6511 Compare November 3, 2026 07:44

nextcloud-command added the AI assisted This PR contains AI-assisted commits label Nov 3, 2026

ChristophWurst closed this Nov 3, 2026

ChristophWurst deleted the renovate/main-psalm-phar-7.x branch November 3, 2026 08:39

Navigation Menu

Repository navigation

chore(deps): bump psalm/phar from ^5.26.1 to v7 (main) - #13243

chore(deps): bump psalm/phar from ^5.26.1 to v7 (main)#13243
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/main-psalm-phar-7.x

renovate Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

ChristophWurst commented Oct 23, 2026 •

edited

Loading

Uh oh!

ChristophWurst commented Nov 3, 2026

Uh oh!

renovate Bot commented Nov 3, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

renovate Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Configuration

Uh oh!

ChristophWurst commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ChristophWurst commented Nov 3, 2026

Uh oh!

renovate Bot commented Nov 3, 2026

Renovate Ignore Notification

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

renovate Bot commented Jul 6, 2026 •

edited

Loading

ChristophWurst commented Oct 23, 2026 •

edited

Loading