Search results

Taint source on __get is lost when the property is read via ?? or behind isset()

Status: Open.

#11909 In vimeo/psalm;

· alies-dev opened on Jul 23, 2026

StatementsAnalyzer emits dynamic-property warnings on dev-master

Status: Open.

#11906 In vimeo/psalm;

· zonuexe opened on Jul 9, 2026

array_is_list() reported as impossible for array{key?: T}

Status: Open.

#11905 In vimeo/psalm;

· zonuexe opened on Jul 9, 2026

Calling public methods declared by an interface of internally-annotated implementations

Status: Open.

#11904 In vimeo/psalm;

· zerkms opened on Jul 7, 2026

[regression] StatementsAnalyzer::$depth dynamic-property deprecation crash on PHP 8.2+ (master)

Status: Open.

#11899 In vimeo/psalm;

· alies-dev opened on Jul 2, 2026

psalm.dev/check emits php warnings as html

Status: Open.

#11898 In vimeo/psalm;

· M393 opened on Jun 30, 2026

Language Server sends null for optional LSP fields that must be absent

Status: Open.

#11895 In vimeo/psalm;

· kimabrandt opened on Jun 28, 2026

False positive InvalidAttribute: #[\Override] on properties is valid in PHP 8.5

Status: Open.

#11890 In vimeo/psalm;

· alies-dev opened on Jun 23, 2026

SARIF: taint rules lack security-severity, so Code Scanning shows them as "Other / Error" not "Security / Critical"

Status: Open.

#11885 In vimeo/psalm;

· alies-dev opened on Jun 21, 2026

Psalm silently aborts (exit 0, zero output) when an analyzed file class_exists()-guards a require_once of an autoloadable file that has a top-level exit

Status: Open.

#11881 In vimeo/psalm;

· dknauss opened on Jun 13, 2026

@mixin-host method providers not consulted for mixin-forwarded methods

Status: Open.

#11880 In vimeo/psalm;

· alies-dev opened on Jun 13, 2026

MoreSpecificReturnType/LessSpecificReturnStatement with narrowed @method annotations in inheritance chains

Status: Open.

#11877 In vimeo/psalm;

· jabrandes-bscm opened on Jun 12, 2026