markus staab | @[email protected]

open-source lover, creator of staabm/phpstan-dba, extensive freetime @phpstan, @rectorphp and #phpunit contributor

#sabredav, #amphp, #redaxo

[markus staab | @[email protected] @markusstaab]

Do you need help with #PHPStan in some form?

I have plenty of experience in contributing changes to PHPStan core, or implementing custom extensions.

https://t.co/h9OiAGlHIF

plz RT

[markus staab | @[email protected] @markusstaab]

@matthieunapoli I understood your post as “I throw my prod data into AI” - which is not allowed in europe without user consent

[Rector @rectorphp]

When was the last time you've updated your dev deps?
Give it a go to save time...

Rector got 6x faster compared to December 2025 🚀🚀🚀

[markus staab | @[email protected] @markusstaab]

Had a few hours left this morning, so I looked into #php #codesniffer performance.

Suggested 2 changes which make it 20-25% faster when running it on phpstan-src.
Fingers crossed we can get these into the next release.

[Daniel Lockyer @DanielLockyer]

oh great, ssh on musl linux (alpine etc) accepts any password longer than 256 characters

updating to openssh 10.6p2 fixes it

and/or disable PasswordAuthentication

[Node.js @nodejs]

Security release pre-alert:

We will release new versions of Node.js 22, 24, and 26 release lines on or shortly, after 2026-11-11 in order to address security vulnerabilities.

The highest severity issue fixed in this release is HIGH.
https://t.co/6PdxXwHLE6

[markus staab | @[email protected] @markusstaab]

@nicksdot My feeling is we will not go back into regular dev mode for the upcoming months.

[Ondřej Mirtes @OndrejMirtes]

👀 PHPStan will soon be able to remove unmatched ignoreErrors automatically by running with --fix

[Ondřej Mirtes @OndrejMirtes]

PHPStan ❤️ Twig! Analyse your templates same way you analyse your PHP code with TwigStan 👇

[Dev_NIX @_DevNIX]

Good news, looks like @OndrejMirtes is going to maintain TwigStan! Future is bright certanly 🤩

[markus staab | @[email protected] @markusstaab]

#phpstan recently started erroring about assertEmpty() and assertNotEmpty() #PHPUnit assertions, when phpstan-strict-rules are enabled (because these forbidd empty()).

Just released autofixers for phpstan-phpunit for the most common cases.

[markus staab | @[email protected] @markusstaab]

@calebdw Might be worth opening a issue and describing your needs/use-case

[markus staab | @[email protected] @markusstaab]

Since #phpstan 2.3.0 a single rule can subscribe to multiple node types.

Using MultipleNodeTypesRule interface some rules can be implemented more efficiently.

[Ondřej Mirtes @OndrejMirtes]

PHPStan Turbo’s README now explains how it works and where the 60% time savings come from: https://t.co/NExS6madXp

[markus staab | @[email protected] @markusstaab]

meanwhile we have ~1030 separate #githubactions CI jobs running on every commit in a pull request of #phpstan. ~29 minutes to run everything.

we have all the fancy stuff.. a separate build step, tests, static analysis, mutation testing, compiling a native extension.

QA is key

[markus staab | @[email protected] @markusstaab]

You might know depending on configuration #xDebug beeing loaded can considerably slow down things

Therefore popular tools auto-restart themselves

Recently we learned #pcov can have similar impact.
Todays #phpstan release therefore also disarms it

[Ondřej Mirtes @OndrejMirtes]

PHPStan Turbo now also makes Rector faster! Rector 2.8 ships with Turbo enabled, taking 50% less time to finish.

[markus staab | @[email protected] @markusstaab]

You might know depending on configuration #xDebug beeing loaded can considerably slow down things

Therefore popular tools auto-restart themselves

Recently we learned #pcov can have similar impact.
Todays #phpstan release therefore also disarms it

[markus staab | @[email protected] @markusstaab]

@nicksdot You could try phpstorm light

https://t.co/EEsuLc7asE

[markus staab | @[email protected] @markusstaab]

@OndrejMirtes @Rvanlaak committing dependencies is useful when you need stable deployments and some random person decides to delete its package/repo