[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
boundwize/structarmed	^0.18.10 → ^0.20.0
psalm/plugin-phpunit	^0.19.5 → ^0.21.0

---

Release Notes

boundwize/structarmed

v0.20.0: Released: StructArmed 0.20.0

Compare Source

StructArmed 0.20.0 introduces a new Stability preset, modular architecture configuration, and an option to run analysis without persistent caching.

This release introduces:

• the new Preset::STABILITY() for protecting public APIs from internal implementation details;
• isApi and isInternal properties on ClassNode for custom rule development;
• Architecture::import() for splitting architecture configuration across multiple files;
• --no-cache for running analysis without persistent caching;
• improved PSR-4 validation and cache cleanup safety.

New Stability Preset

StructArmed introduces a new preset for enforcing API stability:

Preset::STABILITY()

The preset includes two new rules:

• ApiMayNotBeInternalRule — prevents declarations from being marked with both @api and @internal.
• ApiMayNotExtendInternalRule — prevents @api classes and interfaces from extending @internal declarations, directly or through inheritance.

For example:

/** @internal */
class InternalService
{
}

/** @api */
class PublicService extends InternalService
{
}

The Stability preset reports an architecture violation because a public API extends an internal implementation.

Enable the preset with:

use Boundwize\StructArmed\Preset\Preset;

->withPreset(Preset::STABILITY())

Or initialize a new configuration:

vendor/bin/structarmed init --preset=stability

API and Internal Detection on ClassNode

ClassNode now exposes two new boolean properties:

• $classNode->isApi — indicates whether the declaration has an @api PHPDoc tag.
• $classNode->isInternal — indicates whether the declaration has an @internal PHPDoc tag.

These properties are available to custom architecture rules, making it easier to enforce project-specific API stability and visibility conventions.

For example:

public function appliesTo(ClassNode $classNode): bool
{
    return $classNode->isApi && ! $classNode->isInternal;
}

The properties are populated automatically during analysis for scanned class-like declarations, including classes, interfaces, traits, and enums.

Import Architecture Configuration

StructArmed now supports organizing architecture configuration across multiple files using Architecture::import().

For example:

use Boundwize\StructArmed\Architecture;

return Architecture::define()
    ->import(__DIR__ . '/module/Foo/structarmed.php')
    ->import(__DIR__ . '/module/Bar/structarmed.php');

Each imported file returns a callable that receives the root Architecture instance:

use Boundwize\StructArmed\Architecture;

return static function (Architecture $architecture): void {
    $architecture->layer('Foo', 'module/Foo/src/');
};

This allows architecture rules and layers to be organized by module while sharing the same configuration.

Imported configurations support:

• nested imports with circular import protection;
• paths resolved relative to the project root;
• automatic analysis cache invalidation when imported files change.

This makes StructArmed easier to configure and maintain in modular applications and larger projects.

New --no-cache Option

StructArmed introduces a new CLI option:

vendor/bin/structarmed analyse --no-cache

This option runs analysis without reading from or writing to the persistent analysis cache.

It is useful for debugging, validating uncached analysis, and environments where persistent caching is not desired.

The option supports both sequential and parallel analysis.

--no-cache cannot be combined with --clear-cache.

Bug Fixes and Internal Improvements

• Fix PSR-4 validation for .class.php files.
• Report files that map to invalid PSR-4 class names.
• Improve temporary cache directory cleanup after parallel --no-cache analysis.
• Prevent cache directory removal races between concurrent runs.
• Update documentation and test coverage.

What's Changed

• Add --no-cache option in #​507.
• Add the new Stability preset, API rules, and ClassNode API/internal detection in #​510.
• Clean up temporary cache directories after parallel --no-cache analysis in #​513.
• Fix PSR-4 validation for .class.php files in #​516.
• Report invalid PSR-4 class names in #​517.
• Add modular architecture configuration imports in #​522.
• Fix concurrent cache directory cleanup in #​523.

Full Changelog: boundwize/structarmed@0.19.10...0.20.0

v0.19.10: Released: StructArmed 0.19.10

Compare Source

What's Changed

• perf: Wait for parallel workers with stream_select() when progress is disabled by @​samsonasik in #​520

Full Changelog: boundwize/structarmed@0.19.9...0.19.10

v0.19.9: Released: StructArmed 0.19.9

Compare Source

What's Changed

• perf: Speed up violation sorting and function usage marking by @​samsonasik in #​515
• fix: Recognize class references in static callable strings by @​samsonasik in #​518

Full Changelog: boundwize/structarmed@0.19.8...0.19.9

v0.19.8: Released: StructArmed 0.19.8

Compare Source

What's Changed

• fix: Avoid treating function and constant names as class references by @​samsonasik in #​514

Full Changelog: boundwize/structarmed@0.19.7...0.19.8

v0.19.7: Released: StructArmed 0.19.7

Compare Source

What's Changed

• fix: Sort violations by file and line so reports and baselines are stable across runs by @​samsonasik in #​512

Full Changelog: boundwize/structarmed@0.19.6...0.19.7

v0.19.6: Released: StructArmed 0.19.6

Compare Source

What's Changed

• [docs] Add more example on withPresets() by @​samsonasik in #​509
• fix: Count duplicate baseline violations so new duplicates are reported by @​samsonasik in #​511

Full Changelog: boundwize/structarmed@0.19.5...0.19.6

v0.19.5: Released: StructArmed 0.19.5

Compare Source

What's Changed

• perf: Optimize violation fixing by skipping non-fixable rules and avoiding array shifts by @​samsonasik in #​503
• fix: Make AnalysisResultCache::clear() keep files it did not create by @​samsonasik in #​506

Full Changelog: boundwize/structarmed@0.19.4...0.19.5

v0.19.4: Released: StructArmed 0.19.4

Compare Source

What's Changed

• fix: File rules honour the user defined Source layer when a preset has no source paths by @​samsonasik in #​502

Full Changelog: boundwize/structarmed@0.19.3...0.19.4

v0.19.3: Released: StructArmed 0.19.3

Compare Source

What's Changed

• perf: Cluster large files into one worker and write node cache incrementally by @​samsonasik in #​501

Full Changelog: boundwize/structarmed@0.19.2...0.19.3

v0.19.2: Released: StructArmed 0.19.2

Compare Source

What's Changed

• perf: Store only the content hash in per-file cache payload metadata by @​samsonasik in #​498
• refactor: Skip collecting file-analysis facts when not needed by @​samsonasik in #​499
• perf: Skip recursive parent and function fallback resolution when only ruleset defined by @​samsonasik in #​500

Full Changelog: boundwize/structarmed@0.19.1...0.19.2

v0.19.1: Released: StructArmed 0.19.1

Compare Source

What's Changed

• perf: Halve coordinator memory by adding __unserialize() to analysis nodes by @​samsonasik in #​497

Full Changelog: boundwize/structarmed@0.19.0...0.19.1

v0.19.0: Released: StructArmed 0.19.0

Compare Source

StructArmed 0.19.0 introduces configurable project base paths and a new architecture rule for restricting constant usage.

This release introduces:

• --basepath and its -d alias for analysing projects from a separate working directory;
• the new MayNotUseConstantRule for restricting constant usage within architecture layers;
• additional DDD preset restrictions for STDIN, STDOUT, and STDERR;
• dependency update and internal cleanup.

Configurable Project Base Path

StructArmed now supports specifying the project root through --basepath or its short alias -d.

This is useful when StructArmed is installed in a separate tools directory instead of the project's root directory.

For example:

composer.json
src/
tests/
tools/
└── structarmed/
    ├── composer.json
    ├── structarmed.php
    └── vendor/

From tools/structarmed, run:

vendor/bin/structarmed analyse --basepath=../../

Or use the shorter form:

vendor/bin/structarmed analyse -d ../../

The specified base path is used for resolving:

• architecture layer paths;
• scan paths;
• the project's composer.json and PSR-4 mappings;
• cache directories;
• baseline paths.

Configuration discovery checks the current working directory first, followed by the specified base path. An explicit --config remains relative to the current working directory.

The option also works with cache clearing:

vendor/bin/structarmed --basepath=../../ --clear-cache

CLI options may be specified before or after the command.

This makes StructArmed easier to integrate into projects that keep development tools and their dependencies separate from the application.

New MayNotUseConstantRule

StructArmed introduces:

MayNotUseConstantRule

This rule prevents classes, traits, and enums in a specified architecture layer from using a forbidden constant.

For example:

use Boundwize\StructArmed\Rule\Rules\Usage\MayNotUseConstantRule;

->rule(
    'domain_no_php_eol',
    new MayNotUseConstantRule(
        layer: 'Domain',
        constant: 'PHP_EOL',
    ),
)

The rule supports global and namespaced constants:

new MayNotUseConstantRule(
    layer: 'Domain',
    constant: 'Vendor\\Config\\DEBUG',
)

Constant names are matched case-sensitively, while namespace names are matched case-insensitively.

The rule also handles PHP's runtime fallback behavior for unqualified constants inside namespaces.

DDD Preset Improvements

The DDD preset now prevents the Domain layer from directly using these constants:

• STDIN
• STDOUT
• STDERR

These restrictions are enabled automatically through:

Preset::DDD()

This helps keep domain logic independent of direct console input and output.

Internal Improvements

• Remove unused RuleViolationCollection::forLayer() and toJson() methods.
• Update fidry/cpu-core-counter dependency to ^1.4.
• Update the analysis cache format to accommodate constant usage information.
• Temporarily exclude PHP 8.5 on macOS from CI due to runner setup issues.

What's Changed

• Add MayNotUseConstantRule and DDD preset restrictions in #​495.
• Add configurable project base paths using --basepath and -d in #​496.
• Improve configuration discovery across working and project directories in #​496.
• Remove unused RuleViolationCollection::forLayer() and toJson() methods in #​476.
• Update fidry/cpu-core-counter to ^1.4 in #​490.

Full Changelog: boundwize/structarmed@0.18.11...0.19.0

psalm/psalm-plugin-phpunit (psalm/plugin-phpunit)

v0.21.1

Compare Source

What's Changed

• Rewrite README: what the plugin does and why to use it by @​alies-dev in #​161
• Bump actions/cache from 5 to 6 by @​dependabot[bot] in #​163
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​162
• Bump symfony/yaml from 6.4.18 to 6.4.48 in /tools/behat by @​dependabot[bot] in #​159
• Annotate test fixtures instead of suppressing purity issues by @​danog in #​166

Full Changelog: psalm/psalm-plugin-phpunit@0.21.0...0.21.1

v0.21.0

Compare Source

Supports Psalm 7 and psalm/psalm-plugin-api ^0.4.

v0.20.4

Compare Source

Bump plugin API to include ^0.3.

Full Changelog: psalm/psalm-plugin-phpunit@0.20.3...0.20.4

v0.20.3

Compare Source

Bumps the plugin api to include ^0.2.

Full Changelog: psalm/psalm-plugin-phpunit@0.20.2...0.20.3

v0.20.2

Compare Source

What's Changed

• Fix #[Test] attribute detection for inherited and fully-qualified attributes by @​alies-dev in #​160

New Contributors

• @​alies-dev made their first contribution in #​160

Full Changelog: psalm/psalm-plugin-phpunit@0.20.1...0.20.2

v0.20.1

Compare Source

v0.20.0

Compare Source

What's Changed

• Switch to psalm/psalm-plugin-api 0.1.0 (targeting Psalm v7 beta)
• Bump actions/cache from 3 to 4 by @​dependabot[bot] in #​153
• Bump actions/checkout from 3 to 4 by @​dependabot[bot] in #​152
• Bump actions/cache from 4 to 5 by @​dependabot[bot] in #​157
• Bump actions/checkout from 4 to 6 by @​dependabot[bot] in #​156

Full Changelog: psalm/psalm-plugin-phpunit@0.19.5...0.20.0

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

Read more information about the use of Renovate Bot within Laminas.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires psalm/plugin-phpunit ^0.21.0 -> satisfiable by psalm/plugin-phpunit[0.21.1].
    - vimeo/psalm is locked to version 6.20.1 and an update of this package was not requested.
    - psalm/plugin-phpunit 0.21.1 requires psalm/psalm-plugin-api ^0.4 -> satisfiable by psalm/psalm-plugin-api[0.4.0, 0.4.1].
    - psalm/psalm-plugin-api[0.4.0, ..., 0.4.1] conflict with vimeo/psalm <7.0.0-rc3.

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.