chore(deps-dev): bump the php-dev-tools group with 5 updates by dependabot[bot] · Pull Request #6986 · EC-CUBE/ec-cube

dependabot · 2026-07-29T07:25:42Z

Bumps the php-dev-tools group with 5 updates:

Package	From	To
phpstan/phpstan	`2.1.44`	`2.2.5`
phpstan/phpstan-doctrine	`2.0.20`	`2.0.28`
rector/rector	`2.3.9`	`2.5.7`
codeception/lib-innerbrowser	`4.1.0`	`4.1.1`
symfony/polyfill-iconv	`1.33.0`	`1.37.0`

Updates phpstan/phpstan from 2.1.44 to 2.2.5

Commits

See full diff in compare view

Updates phpstan/phpstan-doctrine from 2.0.20 to 2.0.28

Release notes

Sourced from phpstan/phpstan-doctrine's releases.

2.0.28

b462395 - Support query inference with multiple entity managers (#756)

da187ce - Update actions/cache action to v6 (#775)

9660770 - Fix build on PHPStan 2.2.3 (#773)

c17f92d - Update github-actions to v3.0.1 (#771)

65a399f - Update github-actions to v7 (#772)

2.0.27

39b4ca4 - Fix incorrect stub change of criteria arg (#768)

2.0.26

edea68b - Update github-actions (#765)

22cd60b - Sync ObjectRepository stub types with Doctrine (#767)

cff83bf - Fix one more test

78df87c - Update more tests

efa7cca - Adjust test for more precise decimal-int-string type

2.0.25

e20e8bf - Fix duplicate registration of RepositoryMethodCallRule (#764)

2.0.24

5485522 - Check field names of orderBy parameter in findBy and findOneBy

2.0.23

4821d67 - Replace deprecated actions/create-release with softprops/action-gh-release

c6c0ee2 - Bump GitHub Actions across major versions

7728233 - Bump GitHub Actions within their current majors

20bd086 - Update test for phpstan 2.2 (#759)

5e4d0b2 - Support Doctrine NumberType (#754)

a19c4b2 - Fix doctrine CI (#758)

c3a182e - Update github-actions

d022f3f - latest infection does not support PHP 8.2 (#752)

4af7048 - Update release-toot.yml (#751)

d417606 - CI: move name-collision job into build.yml (#750)

2.0.22

e87516b - Remove Reflector from StubFilesExtensionLoader (#747)

414ca85 - Add collision-detector.json to export-ignore in .gitattributes (#746)

8af50e2 - name-collision-detector (#745)

fb8f874 - Rely on same template name than doctrine (#744)

983c304 - Fix return type on EntityRepository::matching() generics (#743)

2.0.21

81dac0e - Add literal string types for prepare method (#734)

1650f18 - Cleanup EntityRepositoryClassReflectionExtension (#740)

Commits

b462395 Support query inference with multiple entity managers (#756)
da187ce Update actions/cache action to v6 (#775)
9660770 Fix build on PHPStan 2.2.3 (#773)
c17f92d Update github-actions to v3.0.1 (#771)
65a399f Update github-actions to v7 (#772)
39b4ca4 Fix incorrect stub change of criteria arg (#768)
edea68b Update github-actions (#765)
22cd60b Sync ObjectRepository stub types with Doctrine (#767)
cff83bf Fix one more test
78df87c Update more tests
Additional commits viewable in compare view

Updates rector/rector from 2.3.9 to 2.5.7

Release notes

Sourced from rector/rector's releases.

Released Rector 2.5.7

This release sharpens the PHPUnit code-quality sets, adds a focused narrow asserts set, deprecates two blurry Symfony web-test rules, and fixes a handful of docblock false-positives in dead-code removal.

New Features 🎉

PHPUnit: PHPUNIT_NARROW_ASSERTS set

A new set focused on narrowing broad asserts to their specific, more descriptive method — e.g. assertTrue(isset($a['b'])) → assertArrayHasKey('b', $a). ([rector-phpunit #716])
use Rector\PHPUnit\Set\PHPUnitSetList;
return RectorConfig::configure()
->withSets([PHPUnitSetList::PHPUNIT_NARROW_ASSERTS]);
withPreparedSets() gains phpunitNarrowAsserts + phpunitMockToStub

The 2 PHPUnit sets are now toggleable like any other prepared set. (#8178)
return RectorConfig::configure()
    ->withPreparedSets(
        phpunitNarrowAsserts: true,
        phpunitMockToStub: true,
    );
PHPUnit: flip with($this->callback(...)) on void methods to willReturnCallback()

VoidMethodWithCallbackToWillReturnCallbackRector (renamed + refocused) drops the pointless return value and types the closure as void, matching the mocked void method. ([rector-phpunit #724])
 $this->createMock(SomeClass::class)
     ->method('run')
-    ->with($this->callback(function ($arg) {
-        echo $arg;
-
-        return true;
-    }));
+    ->willReturnCallback(function ($arg): void {
+        echo $arg;
+    });

... (truncated)

Commits

ba22f8c Rector 2.5.7
1109537 Updated Rector to commit 653ec233fa55057fb11a6c133ed5c8d57dec9ff2
e363554 Updated Rector to commit 3c481b689cd746323dfad98782cd7939f28035e4
fb62051 Updated Rector to commit 3c481b689cd746323dfad98782cd7939f28035e4
561c81c Updated Rector to commit 51d61737c5fbaed10c5f711bbc8074720452417e
9f3ea3a Updated Rector to commit e713102f40682bc65311d3a50e5490e6acc452f3
78b5c28 Updated Rector to commit 306b852af3e4d0045034a6865bffe311ccdf38c9
4bb232c Updated Rector to commit 0e269a0d17470ec8331efb518efcfd5fa6e7162d
eab289b Updated Rector to commit cc1a748e25adb989f2cf42f0329792810d79d216
4ebe4bc Updated Rector to commit ed944a11e6e3a83bac0f9e1f4a413bcc7153fca7
Additional commits viewable in compare view

Updates codeception/lib-innerbrowser from 4.1.0 to 4.1.1

Release notes

Sourced from codeception/lib-innerbrowser's releases.

4.1.1

What's Changed

Fix moveBack() history pointer + add symmetric moveForward() by @TavoNiievez in Codeception/lib-innerbrowser#87

Full Changelog: Codeception/lib-innerbrowser@4.1.0...4.1.1

Commits

0fa80de Fix moveBack() history pointer + add symmetric moveForward() (#87)
See full diff in compare view

Updates symfony/polyfill-iconv from 1.33.0 to 1.37.0

Release notes

Sourced from symfony/polyfill-iconv's releases.

v1.37.0

Changelog (symfony/polyfill-iconv@v1.36.0...v1.37.0)

no significant changes

v1.36.0

Changelog (symfony/polyfill-iconv@v1.35.0...v1.36.0)

no significant changes

v1.35.0

Changelog (symfony/polyfill-iconv@v1.34.0...v1.35.0)

no significant changes

v1.34.0

Changelog (symfony/polyfill-iconv@v1.33.0...v1.34.0)

no significant changes

Commits

2c5729f CS fixes
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the php-dev-tools group with 5 updates: | Package | From | To | | --- | --- | --- | | [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) | `2.1.44` | `2.2.5` | | [phpstan/phpstan-doctrine](https://github.com/phpstan/phpstan-doctrine) | `2.0.20` | `2.0.28` | | [rector/rector](https://github.com/rectorphp/rector) | `2.3.9` | `2.5.7` | | [codeception/lib-innerbrowser](https://github.com/Codeception/lib-innerbrowser) | `4.1.0` | `4.1.1` | | [symfony/polyfill-iconv](https://github.com/symfony/polyfill-iconv) | `1.33.0` | `1.37.0` | Updates `phpstan/phpstan` from 2.1.44 to 2.2.5 - [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits) Updates `phpstan/phpstan-doctrine` from 2.0.20 to 2.0.28 - [Release notes](https://github.com/phpstan/phpstan-doctrine/releases) - [Commits](phpstan/phpstan-doctrine@2.0.20...2.0.28) Updates `rector/rector` from 2.3.9 to 2.5.7 - [Release notes](https://github.com/rectorphp/rector/releases) - [Commits](rectorphp/rector@2.3.9...2.5.7) Updates `codeception/lib-innerbrowser` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/Codeception/lib-innerbrowser/releases) - [Commits](Codeception/lib-innerbrowser@4.1.0...4.1.1) Updates `symfony/polyfill-iconv` from 1.33.0 to 1.37.0 - [Release notes](https://github.com/symfony/polyfill-iconv/releases) - [Commits](symfony/polyfill-iconv@v1.33.0...v1.37.0) --- updated-dependencies: - dependency-name: phpstan/phpstan dependency-version: 2.2.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: php-dev-tools - dependency-name: phpstan/phpstan-doctrine dependency-version: 2.0.28 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: php-dev-tools - dependency-name: rector/rector dependency-version: 2.5.7 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: php-dev-tools - dependency-name: codeception/lib-innerbrowser dependency-version: 4.1.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: php-dev-tools - dependency-name: symfony/polyfill-iconv dependency-version: 1.37.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: php-dev-tools ... Signed-off-by: dependabot[bot] <support@github.com>

rector 2.5.7 は phpstan 2.2 で削除された `PHPStan\Parser\RichParser` の private プロパティ `$container` を PrivatesAccessor 経由で参照するため, DI コンテナ構築時に MissingPrivatePropertyException で fatal error になり Rector ジョブが失敗していた. composer の制約上は矛盾がない (rector 2.5.7 の要求は phpstan ^2.2.2) ため dependabot が壊れた組み合わせの lock を生成していた. rector 2.5.8 (rectorphp/rector-src#8208 "Bump to PHPStan ^2.2.6 and Fix its Container compatibility in RichParser") で `$nodeVisitors` を参照する実装に修正されているため 2.5.8 へ更新する. rector 2.3.9 への据え置きは phpstan を ^2.1.40 に固定する意味になり本 PR の phpstan 2.2 更新と両立しない. あわせて 2.3.9 → 2.5.8 で追加された新ルールの指摘に追従する. RemoveDefaultValueFromAssignedPropertyRector は以下の理由でスキップする. - Entity (Order::$delivery_fee_total, Customer::$buy_times 等) の初期化子は `#[ORM\Column(options: ['default' => 0])]` と対になる初期値の表明である - LoggerFacade / TranslatorFacade の static プロパティは init() 前にも参照され得るため, 初期化子を消すと nullable 型なのに未初期化アクセスの Error になる TwigInitializeListener では `@var Page $Page` の削除により `$Page->getPageLayouts()` の native 型が解決されるようになり, 不正確な `@var PageLayout[]` が PHPStan で検出されたため削除した (`Page::getPageLayouts()` は `@return Collection<int, PageLayout>` を持つ). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…php-dev-tools-b148682b6d

upstream/4.4 のマージで取り込んだ RefundRequestControllerTest の `setUp(){parent::setUp();}` を RemoveParentDelegatingClassMethodRector の指摘どおり削除する。 CI は PR のマージ ref (base との合成) を解析するため, base 4.4 にしか存在しないファイルの指摘はブランチ側のローカル実行では再現しなかった。upstream/4.4 をマージした状態で rector を実行し, CI と同一の 1 件を再現・解消している。 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

nanasess · 2026-07-30T05:40:28Z

dependabot の lock 更新だけでは Rector ジョブが fatal error で落ちるため、手動で追加修正しました。追加した内容と判断理由を残します。

1. なぜ追加修正が必要だったか

rector/rector 2.5.7 と phpstan/phpstan 2.2.x の組み合わせが壊れており、Rector ジョブが fatal error になっていました。

PHP Fatal error:  Uncaught Rector\Exception\Reflection\MissingPrivatePropertyException:
Property "$container" was not found in "PHPStan\Parser\RichParser"
  in vendor/rector/rector/src/Util/Reflection/PrivatesAccessor.php:82

Rector は PrivatesAccessor で PHPStan の internal クラスの private プロパティを直接書き換えています（src/DependencyInjection/PHPStan/PHPStanContainerMemento.php が RichParser の node visitor を間引く実装）。PHPStan 2.2 でこの $container が ExtensionsCollection $nodeVisitors に置き換わったため、Rector の DI コンテナ構築時に即死します。対象ファイルに関係なく vendor/bin/rector --version すら通りません。

composer の制約上は矛盾がない（Rector 2.5.7 の要求は phpstan/phpstan: ^2.2.2）ため、dependabot は valid な組み合わせとして lock を生成していました。

2. `rector/rector` を 2.5.8 へ更新（`composer.lock`）

Rector 2.5.8 の rectorphp/rector-src#8208 「Bump to PHPStan ^2.2.6 and Fix its Container compatibility in RichParser」がこのバグの修正です。

Rector を据え置く回避は成立しませんでした。各版が要求する PHPStan は次の通りで、2.3.9 に据え置くと PHPStan を ^2.1.40 に固定することになり、本 PR の PHPStan 2.2 更新と両立しません。

rector/rector	要求する phpstan/phpstan
2.3.9（更新前）	`^2.1.40`
2.4.0 〜 2.5.7	`^2.2.2` ← 壊れている範囲
2.5.8	`^2.2.6`

3. Rector 2.3.9 → 2.5.8 で追加された新ルールの指摘に追従

fatal が解消すると新ルールの指摘が出るため、適用しました。発火したルールと適用ファイル数:

ルール	適用ファイル数
`RemoveUselessVarTagRector`	34
`RemoveDuplicatedReturnSelfDocblockRector`	21
`RemoveParentDelegatingClassMethodRector`	13
`RemoveNullNamedArgOnNullDefaultParamRector`	5
`RemoveUselessTernaryRector`	4
`CommandConfigureToAttributeRector`	4
`TernaryToNullCoalescingRector`	3
`RemoveUselessUnionReturnDocblockRector`	3
`RemoveUselessReturnTagRector`	1
`RemoveDoubleSelfAssignRector`	1

差分の大半は docblock と未使用 import の削除です。実行時挙動に関わる変更は全件確認しており、いずれも意味的に等価です。

? true : false の除去 5 箇所。うち PluginService::enable() の $plugin->setEnabled($enable ? true : false) は enable(Plugin $plugin, bool $enable = true) と bool 型宣言なのでキャスト効果がなく安全
is_null($x) ? $x : $y → ?? 4 箇所
空の #[\Override] configure(): void {} の削除 2 箇所（親 Command::configure() が空実装）
setUp(){parent::setUp();} 8 箇所 / tearDown(){parent::tearDown();} 7 箇所の削除（13 ファイル、すべて tests/ 配下）
$Order = $Order = $this->getLastOrder(); の二重代入除去

4. `RemoveDefaultValueFromAssignedPropertyRector` は `rector.php` で skip

2.5.8 の新ルールですが、次の 2 点で不都合が出るため理由コメント付きで skip しました。

エンティティ: Order::$delivery_fee_total = '0' / Customer::$buy_times = '0' / $buy_total = '0' の初期化子を削除する提案でした。コンストラクタで setDeliveryFeeTotal('0') 等を呼ぶため new 経路の実害はありませんが、#[ORM\Column(..., options: ['default' => 0])] と対になる初期値の表明を崩します
static Facade: LoggerFacade / TranslatorFacade の private static ?ContainerInterface $Container = null; から初期化子を消すと、nullable 型なのに未初期化状態になります。getLoggerBy() は self::$Container->get() を無条件に参照するため、init() 前アクセスが未初期化アクセスの Error に変わります

5. `TwigInitializeListener` の `@var PageLayout[]` を削除

Rector が /** @var Page $Page */ を削除した結果、PHPStan が $Page->getPageLayouts() の native 型 Collection を解決できるようになり、次行の /** @var PageLayout[] $PageLayouts */ が矛盾として検出されました。

PHPDoc tag @var with type array<Eccube\Entity\PageLayout> is not subtype of
native type Doctrine\Common\Collections\Collection.  (varTag.nativeType)

PHPStan 2.2 の新チェックによるものか Rector 由来かを切り分けるため、該当ファイルのみ変更前に戻して PHPStan を再実行し No errors を確認しています（= Rector 由来）。Page::getPageLayouts() は既に @return Collection<int, PageLayout> を持っているため、不正確な @var を削除して解決しました（@phpstan-ignore やベースラインは使っていません）。

6. `upstream/4.4` をマージ

CI は PR のマージ ref（base との合成）を解析するため、base 4.4 にしか存在しないファイルの指摘がブランチ側のローカル実行では再現しません。本ブランチは base から 87 コミット遅れており、tests/Eccube/Tests/Web/Admin/Order/RefundRequestControllerTest.php（b9934b1e30 で追加）の指摘が CI でのみ残っていました。

upstream/4.4 をマージ（コンフリクトなし）した状態で Rector を実行し、CI と同一の 1 件を再現・解消しています。

検証

ローカルで CI と同じゲートを実行しています（PHP 8.5 / SQLite）。

ゲート	結果
`rector process --dry-run --config=rector.php`	`[OK] Rector is done!`（exit 0）
`php-cs-fixer fix --dry-run`	`Found 0 of 1229 files that can be fixed`
`phpstan analyze src/`（level 6）	`[OK] No errors`
`phpunit`（CI と同じ 4 グループ除外）	`Tests: 3041, Assertions: 6736` 失敗・エラー 0

CI では Rector / PHPStan / PHP CS Fixer / dockerbuild（8.2–8.5）/ installer E2E が pass しています。

申し送り

手動 push したため dependabot の自動更新（rebase）は停止しています。 以降 lock を再生成させる場合は @dependabot rebase が必要です
rector.php の DoctrineSetList::DOCTRINE_DBAL_30 が deprecated 警告を出しています（withComposerBased() 推奨）。fatal とは無関係で本 PR では触っていません。別途対応が必要です

dependabot · 2026-07-30T06:59:00Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update Php code labels Jul 29, 2026

ttokoro20240902 mentioned this pull request Jul 30, 2026

chore(dependabot): symfony/* の major を ignore しグループ漏れを解消 #7006

Merged

15 tasks

nanasess and others added 3 commits July 30, 2026 14:12

Merge remote-tracking branch 'upstream/4.4' into dependabot/composer/…

be196c5

…php-dev-tools-b148682b6d

nanasess requested review from dotani1111 and ttokoro20240902 July 30, 2026 05:43

nanasess added this to the 4.4.0 milestone Jul 30, 2026

dependabot Bot closed this Jul 30, 2026

dependabot Bot deleted the dependabot/composer/php-dev-tools-b148682b6d branch July 30, 2026 06:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps-dev): bump the php-dev-tools group with 5 updates - #6986

chore(deps-dev): bump the php-dev-tools group with 5 updates#6986
dependabot[bot] wants to merge 4 commits into
4.4from
dependabot/composer/php-dev-tools-b148682b6d

dependabot Bot commented on behalf of github Jul 29, 2026 •

edited

Loading

Uh oh!

nanasess commented Jul 30, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2.0.28

2.0.27

2.0.26

2.0.25

2.0.24

2.0.23

2.0.22

2.0.21

Released Rector 2.5.7

New Features 🎉

PHPUnit: PHPUNIT_NARROW_ASSERTS set

withPreparedSets() gains phpunitNarrowAsserts + phpunitMockToStub

PHPUnit: flip with($this->callback(...)) on void methods to willReturnCallback()

4.1.1

What's Changed

v1.37.0

v1.36.0

v1.35.0

v1.34.0

Uh oh!

nanasess commented Jul 30, 2026

1. なぜ追加修正が必要だったか

2. rector/rector を 2.5.8 へ更新（composer.lock）

3. Rector 2.3.9 → 2.5.8 で追加された新ルールの指摘に追従

4. RemoveDefaultValueFromAssignedPropertyRector は rector.php で skip

5. TwigInitializeListener の @var PageLayout[] を削除

6. upstream/4.4 をマージ

検証

申し送り

Uh oh!

dependabot Bot commented on behalf of github Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 29, 2026 •

edited

Loading

PHPUnit: `PHPUNIT_NARROW_ASSERTS` set

`withPreparedSets()` gains `phpunitNarrowAsserts` + `phpunitMockToStub`

PHPUnit: flip `with($this->callback(...))` on void methods to `willReturnCallback()`

2. `rector/rector` を 2.5.8 へ更新（`composer.lock`）

4. `RemoveDefaultValueFromAssignedPropertyRector` は `rector.php` で skip

5. `TwigInitializeListener` の `@var PageLayout[]` を削除

6. `upstream/4.4` をマージ