Skip to content
This repository was archived by the owner on Aug 23, 2026. It is now read-only.

docs(quality): record rector/phpstan version coupling in the gate (AID-528) - #187

Merged
abkrim merged 1 commit into
mainfrom
abdelkarim/aid-528-rector-version-coupling-note
Jul 17, 2026
Merged

abkrim merged 1 commit into
mainfrom
abdelkarim/aid-528-rector-version-coupling-note

Conversation

@abkrim

@abkrim abkrim commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Documentation-only follow-up to #186. No behaviour change.

Why

rector/rector 2.5.7 hard-requires phpstan/phpstan ^2.2.2:

larastan/larastan v3.10.0  requires  phpstan/phpstan (^2.2.0)
rector/rector     2.5.7    requires  phpstan/phpstan (^2.2.2)
composer/pcre     3.4.0    conflicts phpstan/phpstan (<2.2.2)

So rector, larastan and phpstan move as one unit. A rector minor can drag phpstan forward and silently change the @phpstan gate inside the same PR — and Renovate is now active on this repo (#185), so that bump arrives unattended.

The note goes in rector.php because that is what a reviewer opens when Renovate proposes a rector bump.

Scope check

Adopting rector in #186 did not move anything — verified against the lock diff of ea42fd6:

Package before after
phpstan/phpstan 2.2.5 2.2.5 ✓
larastan/larastan v3.10.0 v3.10.0 ✓

Only rector/rector 2.5.7 and driftingly/rector-laravel 2.5.0 were added. The risk is the next upgrade, not the adoption.

Learned from openmizan AID-526, which hit this while hardening the same gate.

Verification

composer check-full → exit 0, 1442 passed / 16 skipped, coverage 89.8%. refactor:dry still exits 0.

…D-528)

rector/rector hard-requires phpstan/phpstan (^2.2.2 as of 2.5.7), so
rector, larastan and phpstan move as one unit. A rector minor can drag
phpstan forward and silently change the @phpstan gate inside the same
PR. Renovate is active on this repo, so that bump arrives unattended and
the reviewer needs the warning where they will actually read it.

Adopting rector did not move anything: phpstan stayed at 2.2.5 and
larastan at v3.10.0 (verified against the lock diff of ea42fd6). The
risk is the next upgrade, not the adoption.

Learned from openmizan AID-526, which hit this while hardening the same
gate. Documentation only — no behaviour change, refactor:dry still
exits 0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@abkrim
abkrim merged commit fa91e0e into main Jul 17, 2026
2 checks passed
@abkrim
abkrim deleted the abdelkarim/aid-528-rector-version-coupling-note branch July 17, 2026 12:54
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant