phpro/grumphp

What's Changed

• Bump actions/cache from 5 to 6 by @dependabot[bot] in #1226
• Read files from the worktree git dir instead of the shared repository by @veewee in #1227
• Bump composer/composer from 2.9.8 to 2.10.2 by @dependabot[bot] in #1228
• Bump actions/checkout from 6 to 7 by @dependabot[bot] in #1225

Full Changelog: v2.22.0...v2.23.0

Say hi to Mago 🦊

GrumPHP just made a new friend. Starting this release, you can run Mago straight from your hooks.

Mago is a PHP toolchain written in Rust. The name means "wizard," which fits: it does the work of four tools at once. A formatter, a linter, a static analyzer, and an architectural guard, all in a single fast binary. It's already showing up in places like Drupal.

We didn't bolt it on as one big task. Each part gets its own, so you turn on only what you want and configure them separately:

• mago_format keeps your code style consistent
• mago_lint catches style slips, smells, and likely bugs
• mago_analyze does the deeper work: types, control flow, logic errors
• mago_guard enforces your architecture and layer rules

Format, lint, and analyze run read-only by default. When one fails, GrumPHP offers to re-run it with fixes applied, so you stay in control. Guard only reports, because you can't auto-fix an architecture problem (Mago won't pretend otherwise).

Add it to your project like any other tool:

composer require --dev carthage-software/mago
vendor/bin/mago init

Then point your grumphp.yml at whichever tasks you want. Full setup and options live in the Mago task docs.

The grump approves. Welcome to the family, Mago. 🧙‍🦊

What's Changed

• Add cache CLI options for eslint by @rodrigoaguilera in #1223
• Support git autosquash amend! prefix in commit message task by @reynkonig in #1224
• Add Mago as task by @johnatas-x in #1216

New Contributors

• @rodrigoaguilera made their first contribution in #1223
• @reynkonig made their first contribution in #1224
• @johnatas-x made their first contribution in #1216

Full Changelog: v2.21.0...v2.22.0

What's Changed

• Bump actions/dependency-review-action from 4 to 5 by @dependabot[bot] in #1217
• Fix raw Console markup rendered by ConsoleSectionOutput::overwrite() by @mitrpaka in #1221
• Fix CI by @veewee in #1222

New Contributors

• @mitrpaka made their first contribution in #1221

Full Changelog: v2.20.0...v2.21.0

What's Changed

• Cover more of Drupal's custom file extensions by @damienmckenna in #1203
• Add support for doctrine/collections 3.x by @a-treschilov in #1212
• Upgrade composer CVE + lock dependencies by @veewee in #1214

New Contributors

• @damienmckenna made their first contribution in #1203
• @a-treschilov made their first contribution in #1212

Full Changelog: v2.19.0...v2.20.0

What's Changed

• Bump actions/cache from 4 to 5 by @dependabot[bot] in #1201
• Require --raw diffs for gitlib by @veewee in #1207

Upgrading

❗ Requires re-initialization from git hooks

In the new version of our dependency gitlib, you need to pass the --raw option to the git diff that is being parsed by the pre-commit hooks. This means you'll need to change your git hook after upgrading:

./vendor/bin/grumphp git:init

If you are using a custom hook, make sure to add the --raw parameter to git diff first:

Example:
https://github.com/veewee/grumphp/blob/81a6f9ae3bc0aa96eeb842545ed0b86eb8cd2a1c/resources/hooks/local/pre-commit#L9

DIFF=$(git -c diff.mnemonicprefix=false -c diff.noprefix=false --no-pager diff --raw -r -p -m -M --full-index --no-color --staged | cat)

Full Changelog: v2.18.0...v2.19.0

What's Changed

• Fix installation link for deptrac by @codisart in #1190
• Add support for Symfony 8.0 by @Jibbarth in #1194
• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #1195
• Improve SF 8.0 support by @veewee in #1199

New Contributors

• @codisart made their first contribution in #1190

Full Changelog: v2.17.0...v2.18.0

What's Changed

• Php 85 upgrade by @veewee in #1189

Full Changelog: v2.16.0...2.17.0

What's Changed

• Php 85 upgrade by @veewee in #1189

Full Changelog: v2.16.0...v2.17.0

What's Changed

• Add composer_validate_autoload task by @TravisCarden in #1186
• Update services.yml to remove suffixes for windows added by default from symfony/process by @apohutenumera in #1188

New Contributors

• @apohutenumera made their first contribution in #1188

Full Changelog: v2.15.0...v2.16.0

What's Changed

• Fix Security Checker Enlightn Allow List by @youwe-petervanderwal in #1180
• Bump actions/checkout from 4 to 5 by @dependabot[bot] in #1182
• Update phpcs.md by @pmysiak in #1183

New Contributors

• @youwe-petervanderwal made their first contribution in #1180
• @pmysiak made their first contribution in #1183

Full Changelog: v2.14.0...v2.15.0

What's Changed

• Mark 1.x as unsupported in SECURITY.md by @marcwrobel in #1176
• Change the task compiler logic to allow resolving of environment variables. by @veewee in #1177

New Contributors

• @marcwrobel made their first contribution in #1176

Full Changelog: v2.13.0...v2.14.0

This tag was signed with the committer’s verified signature .

veewee Toon Verwerft

GPG key ID: BB5F005D6FFDD89E

Verified Learn about vigilant mode .