[dependabot]

Bumps nowo-tech/phpstan-frankenphp from 1.2.3 to 1.3.0.

Release notes

Sourced from nowo-tech/phpstan-frankenphp's releases.

Release v1.3.0: rules catch all static/global write forms and ini_alter; narrower node types.

Changelog

Fixed

• NoMutableStaticPropertyRule reports every property of a multi-property declaration (private static $a, $b; only reported $a) and detects compound assignments (.=, +=, ??=, …), reference assignments (=&) and ++ / -- on static properties, not only =.
• NoGlobalStateWriteRule detects compound assignments ($GLOBALS['x'] .= …, ??=), reference assignments and ++ / -- on $GLOBALS.
• NoPersistentIniSetRule also flags the ini_alter() alias (messages name the function actually called).

Changed

• NoLocaleSetDefaultRule, NoSingletonGetInstanceRule and NoUnlimitedIoTimeoutRule now register for PhpParser\Node\Expr\CallLike instead of every Node (same detection, fewer callbacks). NoMutableStaticPropertyRule and NoGlobalStateWriteRule keep Node because they inspect both statements and expressions.
• PHP-CS-Fixer no longer formats tests/Fixtures (it rewrote the constructs under test).

Commits

• Release v1.3.0: rules catch all static/global write forms and ini_alter; narrower node types. (8ad8c62)
• fix(rules): catch all static/global write forms and ini_alter, narrow call rules (20645b8)
• test: cover NoPcntlForkRule non-FuncCall guard to restore 100% line coverage (75a8f63)
• chore(demo): refresh generated config reference for Symfony 8.1.8 (87156af)

Changelog

Sourced from nowo-tech/phpstan-frankenphp's changelog.

[1.3.0] - 2026-10-13

Fixed

• NoMutableStaticPropertyRule reports every property of a multi-property declaration (private static $a, $b; only reported $a) and detects compound assignments (.=, +=, ??=, …), reference assignments (=&) and ++ / -- on static properties, not only =.
• NoGlobalStateWriteRule detects compound assignments ($GLOBALS['x'] .= …, ??=), reference assignments and ++ / -- on $GLOBALS.
• NoPersistentIniSetRule also flags the ini_alter() alias (messages name the function actually called).

Changed

• NoLocaleSetDefaultRule, NoSingletonGetInstanceRule and NoUnlimitedIoTimeoutRule now register for PhpParser\Node\Expr\CallLike instead of every Node (same detection, fewer callbacks). NoMutableStaticPropertyRule and NoGlobalStateWriteRule keep Node because they inspect both statements and expressions.
• PHP-CS-Fixer no longer formats tests/Fixtures (it rewrote the constructs under test).

Commits

• 8ad8c62 Release v1.3.0: rules catch all static/global write forms and ini_alter; narr...
• 20645b8 fix(rules): catch all static/global write forms and ini_alter, narrow call rules
• 75a8f63 test: cover NoPcntlForkRule non-FuncCall guard to restore 100% line coverage
• 87156af chore(demo): refresh generated config reference for Symfony 8.1.8
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, php. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

@coderabbitai review

[HecFranco]

Reviewed: Dependabot bump within the expected range; required CI checks green (Scrutinizer is external/non-blocking).