[dependabot]

Bumps phpstan/phpstan from 2.1.45 to 2.2.16.

Commits

• See full diff in compare view

[s2x]

Left open (gamma, Dependabot run): lint fails in the Rector step. PHPStan 2.2.16 removed the private $container property of PHPStan\Parser\RichParser that rector/rector 2.3.9 reads (MissingPrivatePropertyException). This needs a newer Rector (or holding PHPStan back), not a change in this PR.

[s2x]

@dependabot rebase

[s2x]

Triage note (not a merge). I rebased this PR (it was BEHIND) and re-ran CI; it is still red. Leaving it open — the blocker is a version pin in composer.json, not something a Dependabot phpstan bump can carry.

CI state after the rebase: run 37104509394, 2026-10-03. lint FAILURE, ci-ok FAILURE, Failed: rector. Everything else green: build-piper-glibc, build-piper-musl, test-integration, unit (php 8.2/8.3/8.4/8.5), changes, docs. mergeStateStatus is now BLOCKED rather than BEHIND.

Root cause: rector/rector 2.3.9 cannot run against phpstan 2.2.16

- Downloading phpstan/phpstan (2.2.16)
- Downloading rector/rector (2.3.9)

==> phpstan
 [OK] No errors
==> rector
PHP Fatal error:  Uncaught Rector\Exception\Reflection\MissingPrivatePropertyException:
  Property "$container" was not found in "PHPStan\Parser\RichParser" class
  in .../vendor/rector/rector/src/Util/Reflection/PrivatesAccessor.php:82
#0 .../src/Util/Reflection/PrivatesAccessor.php(45): ...->resolvePropertyReflection()
#1 .../src/DependencyInjection/PHPStan/PHPStanContainerMemento.php(24): ...->getPrivateProperty()
#2 .../src/PhpParser/Parser/RectorParser.php(32): ...PHPStanContainerMemento::removeRichVisitors()
Failed: rector

PHPStan itself is happy on 2.2.16 ([OK] No errors, level from phpstan.neon). The crash is entirely Rector 2.3.9 reaching into a PHPStan private property that no longer exists in 2.2.x.

composer.json pins the exact version "rector/rector": "2.3.9", so Dependabot will not move it as part of a phpstan-only PR.

The fix is available upstream — this is no longer a dead end

standard-followups.md says to wait for Rector to ship a fix. It has shipped:

• Rector 2.5.8 (2026-07-27) — "Bump to PHPStan ^2.2.6 and Fix its Container compatibility in RichParser" (rector-src#8208). First fixed release.
• Rector 2.5.9 (2026-07-30) — "Wire RichParser node visitors via DI factory instead of private property hack" (rector-src#8215). Removes PrivatesAccessor from this code path.
• Rector 2.6.5 (2026-08-30) — "Support PHPStan 2.2.10 scope changes" (rector-src#8420).
• Rector 2.6.7 (2026-09-13, current) — "Bump PHPStan to ^2.2.14" (rector-src#8491).

Proof that Rector 2.6.7 runs cleanly against phpstan 2.2.16: crazy-goat/fdb-php #134, run 37048347861 — the job locked phpstan/phpstan (2.2.16) + rector/rector (2.6.7), Rector completed with no exception, and phpstan reported [OK] No errors. The green master run 37016064255 does the same with Rector 2.6.3.

Why I am not unblocking it here

Moving "rector/rector": "2.3.9" to a 2.5.8+ line is a source change with its own review, and I am explicitly not to pin or downgrade tool versions as a workaround. The same pin also affects crazy-goat/rabbit-stream #573 ("rector/rector": "~2.4.0"), so both are one root cause.

To unblock: bump rector/rector in composer.json to ^2.6.7 (or at minimum >=2.5.8), rebase, and this PR should go green on its own. Note that fdb-php needs one extra fix first — Rector 2.6.4 introduced IfToNullCoalescingAssignRector, which reports one file in fdb-php's tests (fdb-php #135) — but piper-php's Rector set may not trigger it, so that needs checking on the actual bump.

[s2x]

Addendum to the above — I checked the Rector config, so here is a concrete warning about the bump.

rector.php on master has no ->withSkip() at all, and it analyses four paths: src, examples, bin, tests, with the DEAD_CODE, CODE_QUALITY, TYPE_DECLARATION, PRIVATIZATION and EARLY_RETURN sets:

->withPaths([
    __DIR__ . '/src',
    __DIR__ . '/examples',
    __DIR__ . '/bin',
    __DIR__ . '/tests',
])

Rector 2.3.9 → 2.6.7 is 19 patch releases across a minor bump, and the new sets/rules added along the way (including IfToNullCoalescingAssignRector, added in 2.6.4) will be applied to all four paths with no skips. So expect rector process --dry-run to report more than one file, not just the ??= case seen in fdb-php. Whoever takes this should budget for a composer lint:fix-equivalent pass plus a review of the resulting diff, not a version-line edit.

Also worth knowing: bin/lint.sh:18 runs vendor/bin/rector process --no-progress-bar || true — the fix mode swallows Rector's exit code. Line 26 (step "rector" vendor/bin/rector process --dry-run) is the one that gates CI. That asymmetry is intentional for autofix but worth keeping in mind when reading local output.

[s2x]

Closing this in favour of a merged pull request: the same bump is already on master.

phpstan/phpstan 2.1.45 -> 2.2.16 could not land on its own. composer.json pins rector/rector
at 2.3.9, and that Rector reads the private $container property of PHPStan\Parser\RichParser,
which no longer exists from PHPStan 2.2.6 on. So the lint job died with:

PHP Fatal error:  Uncaught Rector\Exception\Reflection\MissingPrivatePropertyException:
Property "$container" was not found in "PHPStan\Parser\RichParser" class
  in vendor/rector/rector/src/Util/Reflection/PrivatesAccessor.php:82
#1 .../PHPStanContainerMemento.php(24)->getPrivateProperty()
#2 .../PhpParser/Parser/RectorParser.php(32)->removeRichVisitors()

and took ci-ok down with it.

Worth noting for the next occurrence: Composer does not catch this. rector/rector 2.3.9
requires phpstan/phpstan ^2.1.40, and a caret on 2.1 means >=2.1.40 <3.0.0, which includes
2.2.16, so the resolver locks the pair happily. The break is purely at runtime.

Superseded by #24, merged as 1b72027171a68ea7f6da1c9824f66e3a422f6dfb
(chore(deps): bump rector/rector 2.3.9 to 2.6.7 and phpstan/phpstan 2.1.45 to 2.2.16, closes #23):

• phpstan/phpstan 2.1.45 -> 2.2.16 — the same bump as here.
• rector/rector 2.3.9 -> 2.6.7, the first line that supports PHPStan 2.2.x
  (2.5.8 fixes the private-property access; 2.6.7 requires phpstan/phpstan ^2.2.14).

composer.lock is regenerated, bin/lint.sh and the unit suite pass locally, and ci-ok is
green on #24 with build-piper-glibc, build-piper-musl and test-integration included.

Per .team/deps.md, a Dependabot pull request is only closed when the same bump is on the default
branch. That is now the case.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.