nowo-tech/phpstan-frankenphp

Release v1.1.2: composer audit CI

Changelog

Security

• CI: run composer audit --locked after dependency install (REQ-SEC / P3).

Commits

• Release v1.1.2: composer audit CI (36e5590)
• ci(security): add composer audit --locked after install (4e204bb)

Security

• CI: run composer audit --locked after dependency install (REQ-SEC / P3).

Release v1.1.1: Symfony 8 demos and Hot Reload 1.4.

Changelog

Changed

• Demos: pin nowo-tech/hot-reload-bundle to ^1.4 with FrankenPHP Mercure/hot_reload (dev/test only).

Commits

• Release v1.1.1: Symfony 8 demos and Hot Reload 1.4. (4412284)
• Bump demo HotReloadBundle to ^1.4 and enable FrankenPHP hot reload. (46549e5)

Changed

• Demos: pin nowo-tech/hot-reload-bundle to ^1.4 with FrankenPHP Mercure/hot_reload (dev/test only).

Release v1.1.0 - Worker process-state rules and pcntl signal hardening

Changelog

Added

• Worker rules for process-wide state that survives FrankenPHP worker requests:
  • NoChdirRule (frankenphp.worker.noChdir)
  • NoSetLocaleRule (frankenphp.worker.noSetLocale) — queries via setlocale($category, 0|"0") allowed
  • NoLocaleSetDefaultRule (frankenphp.worker.noLocaleSetDefault) — locale_set_default() / Locale::setDefault()
  • NoDateDefaultTimezoneSetRule (frankenphp.worker.noDateDefaultTimezoneSet)
  • NoMbEncodingMutationRule (frankenphp.worker.noMbEncodingMutation) — mb_internal_encoding / mb_regex_encoding / mb_http_output / mb_language with an argument; no-arg reads allowed
  • NoErrorReportingMutationRule (frankenphp.worker.noErrorReportingMutation)
  • NoUmaskRule (frankenphp.worker.noUmask)
• Hardening rule: NoPcntlSignalRule (frankenphp.hardening.noPcntlSignal) — pcntl_signal, pcntl_async_signals, pcntl_signal_dispatch, pcntl_signal_get_handler, pcntl_sigprocmask, pcntl_sigwaitinfo, pcntl_sigtimedwait, pcntl_alarm
• Fixture demos, Symfony 8 anti-patterns, RuleTestCase coverage, and catalog updates in RULES.md
• ROADMAP.md for planned expansions and explicit non-goals

Notes

• Consumer action required if you already enable ruleset-worker.neon and/or ruleset-hardening.neon: re-run PHPStan and fix or baseline the new identifiers. See UPGRADING.md.
• Continue requiring nowo-tech/phpstan-frankenphp: ^1.0 (1.1.0 is a compatible minor).

Commits

• Release v1.1.0: worker process-state rules and pcntl signal hardening. (37c1e75)

Added

• Worker rules for process-wide state that survives FrankenPHP worker requests:
  • NoChdirRule (frankenphp.worker.noChdir)
  • NoSetLocaleRule (frankenphp.worker.noSetLocale) — queries via setlocale($category, 0|"0") allowed
  • NoLocaleSetDefaultRule (frankenphp.worker.noLocaleSetDefault) — locale_set_default() / Locale::setDefault()
  • NoDateDefaultTimezoneSetRule (frankenphp.worker.noDateDefaultTimezoneSet)
  • NoMbEncodingMutationRule (frankenphp.worker.noMbEncodingMutation) — mb_internal_encoding / mb_regex_encoding / mb_http_output / mb_language with an argument; no-arg reads allowed
  • NoErrorReportingMutationRule (frankenphp.worker.noErrorReportingMutation)
  • NoUmaskRule (frankenphp.worker.noUmask)
• Hardening rule: NoPcntlSignalRule (frankenphp.hardening.noPcntlSignal) — pcntl_signal, pcntl_async_signals, pcntl_signal_dispatch, pcntl_signal_get_handler, pcntl_sigprocmask, pcntl_sigwaitinfo, pcntl_sigtimedwait, pcntl_alarm
• Fixture demos, Symfony 8 anti-patterns, RuleTestCase coverage, and catalog updates in RULES.md
• ROADMAP.md for planned expansions and explicit non-goals

Notes

• Consumer action required if you already enable ruleset-worker.neon and/or ruleset-hardening.neon: re-run PHPStan and fix or baseline the new identifiers. See UPGRADING.md.
• Continue requiring nowo-tech/phpstan-frankenphp: ^1.0 (1.1.0 is a compatible minor).

Release v1.0.3 - Spec Kit deep baseline and Cursor Agent scaffold

Changelog

Added

• GitHub Spec Kit Cursor Agent scaffold under .specify/ (constitution, templates, workflows)
• .github/copilot-instructions.md for maintainer/agent conventions

Changed

• Deep Spec Kit baseline: specs/001-baseline/spec.md with semantic FR-* requirements and user scenarios; code-inventory.md maps 20/20 production PHP files under src/ (REQ-SPECKIT-003)
• CI: bump actions/stale from v10 to v11
• Internal Rector/CS cleanups (exclusive type checks); skip ReduceAlwaysFalseIfOrRector so processNode instanceof guards stay for early-return coverage; no public API or reported-error changes

Notes

• No rule behaviour changes and no consumer action required. Continue requiring nowo-tech/phpstan-frankenphp: ^1.0.

Commits

• Release v1.0.3: Spec Kit deep baseline and Cursor Agent scaffold. (17f99e7)
• Merge pull request #1 from nowo-tech/dependabot/github_actions/actions/stale-11 (e63dfb3)
• chore(ci): bump actions/stale from 10 to 11 (34780ee)
• docs: update README structure and documentation links (8922260)

Added

• GitHub Spec Kit Cursor Agent scaffold under .specify/ (constitution, templates, workflows)
• .github/copilot-instructions.md for maintainer/agent conventions

Changed

• Deep Spec Kit baseline: specs/001-baseline/spec.md with semantic FR-* requirements and user scenarios; code-inventory.md maps 20/20 production PHP files under src/ (REQ-SPECKIT-003)
• CI: bump actions/stale from v10 to v11
• Internal Rector/CS cleanups (exclusive type checks); skip ReduceAlwaysFalseIfOrRector so processNode instanceof guards stay for early-return coverage; no public API or reported-error changes

Notes

• No rule behaviour changes and no consumer action required. Continue requiring nowo-tech/phpstan-frankenphp: ^1.0.

Release v1.0.2 - FrankenPHP banner, Make demos/smoke, security checklist

Changelog

Added

• FrankenPHP-friendly banner in README (docs/images/frankenphp-friendly.png)
• Make targets: check-open-prs, demo-smoke; Compose V2→V1 detection (REQ-MAKE-010)
• Demo Symfony 8: DebugBundle + Twig Inspector; update-bundle; SYMFONY_DEPRECATIONS_HELPER=max[direct]=0
• Explicit ignoreErrors: [] in phpstan.neon.dist; release security checklist (12.4.1) in docs/SECURITY.md

Changed

• GitHub About / Packagist description shortened for clarity

Commits

• chore(release): prepare 1.0.2 (8edcc44)

Added

• FrankenPHP-friendly banner in README (docs/images/frankenphp-friendly.png)
• Make targets: check-open-prs, demo-smoke; Compose V2→V1 detection (REQ-MAKE-010)
• Demo Symfony 8: DebugBundle + Twig Inspector; update-bundle; SYMFONY_DEPRECATIONS_HELPER=max[direct]=0
• Explicit ignoreErrors: [] in phpstan.neon.dist; release security checklist (12.4.1) in docs/SECURITY.md

Changed

• GitHub About / Packagist description shortened for clarity

Release v1.0.1

Documentation: remediations remain PHP-FPM compatible.

Changelog

Documentation

• Clarified that rule remediations remain PHP-FPM compatible: they harden the app for FrankenPHP classic/worker without requiring FrankenPHP-only APIs, and remain valid under FPM (MIGRATION.md, RULES.md, USAGE.md, README).

Commits

• Release v1.0.1: document FPM-compatible remediations. (c27fbbe)

Documentation

• Clarified that rule remediations remain PHP-FPM compatible: they harden the app for FrankenPHP classic/worker without requiring FrankenPHP-only APIs, and remain valid under FPM (MIGRATION.md, RULES.md, USAGE.md, README).

Release v1.0.0

First stable release of nowo-tech/phpstan-frankenphp:
classic, worker, worker-strict, and hardening PHPStan rulesets,
fixture demos, Symfony 8 FrankenPHP demo, 100% coverage gate.

Changelog

• 2026-07-22

First stable release of nowo-tech/phpstan-frankenphp: PHPStan rules to migrate from PHP-FPM to FrankenPHP classic, then worker mode.

Added

• PHPStan extension (type: phpstan-extension) with extension.neon (schema/defaults only; rules are not auto-enabled).
• Level 1 — classic (ruleset-classic.neon): exit/die, fastcgi_finish_request, putenv, ignore_user_abort, unlimited I/O timeouts.
• Level 2 — worker (ruleset-worker.neon): mutable statics, static locals, globals, $_ENV/$_SESSION, native session API, persistent ini_set, singletons, register_shutdown_function, set_error_handler / set_exception_handler.
• Level 2b — worker-strict (ruleset-worker-strict.neon) and parameter frankenphp.flagRequestSuperglobals (default false) to also flag $_GET/$_POST/….
• Level 3 — hardening (ruleset-hardening.neon): set_time_limit(0), memory_limit -1, pcntl_fork, blocking sleep, register_tick_function.
• Aggregate ruleset rules.neon (classic + worker + hardening).
• Fixture demos under demo/{classic,worker,hardening}/{bad,good} with Composer/Make targets (demo-*, demo-*-good).
• Symfony 8 + FrankenPHP demo (demo/symfony8) with FRANKENPHP_MODE=worker by default, anti-patterns, and leveled PHPStan configs.
• Documentation: RULES, MIGRATION, INSTALLATION, CONFIGURATION, USAGE, DEMO-FRANKENPHP, RELEASE, Spec Kit baseline (specs/001-baseline/).
• QA: PHPUnit RuleTestCase + unit/integration suites, 100% line coverage on src/, coverage-check / test-coverage-100, CI matrix PHP 8.2–8.5, release-check + release-check-demos.

Changed

• NoSuperglobalAccessRule defaults to $_ENV + $_SESSION only (aligned with FrankenPHP worker reset behaviour); request superglobals are opt-in via worker-strict / flagRequestSuperglobals.
• Mutable static guidance no longer recommends invalid readonly static properties.