Bump vimeo/psalm from 4.1.1 to 4.2.1

[dependabot-preview[bot]]

Bumps vimeo/psalm from 4.1.1 to 4.2.1.

Release notes

Sourced from vimeo/psalm's releases.

Fix regression in conditional interpretation

• Fixes a regression when interpreting if (is_string($foo) === false) and if (is_string($foo) !== true) (#4637)
• Fix crash when scanning codebases that use a lot of class aliasing (#4636)

Add support for Github Security analysis

Security analysis

Support for sending analysis GitHub Security

Thanks to @LukasReschke, Psalm can now output its results in a format compatible with GitHub's Code Scanning feature (#4582)

More specific output for security issues

Psalm now separates out different security issues it finds, with code snippets that reproduce the issue e.g. TaintedHtml and TaintedUnserialize

Bugfixes

Inheritance for docblock return and param types

This ticket – #4537 – revealed a slight issue with Psalm's automatic inheritance of docblock param and return types.

Psalm will now only inherit docblock parameter and return types from a single docblock, which means you can't define param types in one parent class method and return types in another. It's a relatively minor change, but it might break some code.

Other bugfixes

• Security Analysis: @LukasReschke made a lot of improvements to Psalm's taint analysis (#4554, #4572, #4576, #4592, #4604, #4630)
• @pilif improved the mb_strtolower return type (#4469)
• perform better inference for literal int division (#2132)
• fix bugs caused by around ReflectionProperty stub not implementing Reflector (#4481)
• better error message for PossiblyInvalidArrayOffset (#4479)
• support assertions in new calls (#4491)
• fix type inference when unpacking typed iterables (#4487)
• @orklah added some undocumented properties to SoapFault (#4510)
• @wouterj added support for reflecting builtin PHP union types (#4505)
• autoloaded constants set in define are now inferred as mixed (#4509)
• prevent crash with empty match expression (#4519)
• treat exit expressions as the empty type (#4516)
• track type contradiction issues in match expressions (#4517)
• remember assignments when descending into property use (#4522)
• @adrienlucas added support for proxying functions for taint analysis (#4495)
• improve template param inference (#4485, #4524, #4545)
• fix property initialisation checks when parent::__construct refers to grandparent class (#4540)
• allow better get_class inference inside match expressions (#4544)
• mark closure uses as UnusedVariable where possible (#4547)
• prevent false-positive warning about calling unset on array with key (#4529)
• @orklah added a check for accessing an array with a negative int offset (#4552)
• @thomasvargiu fixed a bug intersecting with templated types (#4560)
• @duskwuff added support for passing named arguments to functions that use variadic params (#4575)
• added a more specific return type for substr in PHP 8 (#4580)
• @BenMorel improved mysqli property types and a DateTimeInterface signature (#4577, #4579)

Commits

• ea9cb72 First creation_function param isnÆt really a sink
• 1cead18 Fix #4637 - prevent regression when negating function call with === false
• da632ca feature: allow plugin manager to work without config file (#4639)
• ce89382 Fix #4636 - prevent crashes on aliased classes
• ccf6e28 Grammar
• 7c62b0c Make Readme more punchy
• acb4bb4 documented type in InternalTaintSinkMap (#4627)
• c562e1d Don’t taint foreach keys with array-fetch
• e04f219 return static instead of self when static context detected (#4632)
• 78d644d Change TaintedText to TaintedCallable
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired)