Bump vimeo/psalm from 3.10.1 to 3.12.1

[dependabot-preview[bot]]

Bumps vimeo/psalm from 3.10.1 to 3.12.1.

Release notes

Sourced from vimeo/psalm's releases.

Improve taint analysis a little

Taint analysis

• $_REQUEST is now treated as a source, and taints now flow through trim and similar funcs
• @psalm-taint-specialize now works in static methods

Also @TysonAndre added a --debug-emitted-issues command line flag to help debug the route of a Psalm issue.

Bugfixes

• preg_replace_callback now supports arrays properly even when the closure is not well-documented (#3639)

Add --taint-analysis command

This will be the officially-supported taint analysis command going forward.

Add more taint analysis features

Features

• various taint analysis improvements
• added an <extraFiles> tag to tell Psalm about directories it should scan, but not analyse (#3618)

Bugfixes

• add better support for complex switch (true) case statements (#3603)
• allow lists to have their types refined in @psalm-assert calls (#3605)
• treat (Foo\Bar::class)::baz() as Foo\Bar::baz() (#3609)
• @andrei-petre improved error message casing for undefined methods (#3615)
• @iluuu1994 allowed strings with leading backslashes e.g. '\Foo\Bar::baz' to be treated as callables (#3607)
• prevent a crash when analysing an assertion on a class constant where the class doesn’t exist (#3607)

Improve diff behaviour & bugfixes

Improved --diff behaviour

@bendavies pointed out an issue (#3367) in Psalm's behaviour when running --diff, where the caching would only take effect the third time you ran Psalm, not the second. This is now fixed.

Pathological-case switch statement speedups

switch statements with 100 case statements in a row like

switch ($i) {
  case 0:
  case 1:
  ...
  case 99:
    return;
}

Used to have polynomial complexity, but now they're evaluated in linear time.

Commits

• 9b86021 Fix #3639 - allow coerced types to count when picking callmap options
• 1f86afe Revert "Fix #3631 - apply assertions to RHS of equality in conditional"
• fc8212e Fix static call specialisation via annotation
• bee10a2 Add a --debug-emitted-issues flag (#3637)
• e8be2c5 Support taint flows in more functions
• 7f05b3c Add $_REQUEST as a taint source
• f2f5606 Document other supported --report file names (#3633)
• 9c17795 Fix #3631 - apply assertions to RHS of equality in conditional
• 29eb830 Remove taint annotation as it could confuse
• d462830 Add --taint-analysis to command line help
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

If all status checks pass Dependabot will automatically merge this pull request.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired)

[dependabot-preview[bot]]

One of your CI runs failed on this pull request, so Dependabot won't merge it.

• continuous-integration/travis-ci/pr

Dependabot will still automatically merge this pull request if you amend it and your tests pass.

[dependabot-preview[bot]]

Superseded by #77.