diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon
index d9535d4dd24..7655a096bcc 100644
--- a/phpstan-baseline.neon
+++ b/phpstan-baseline.neon
@@ -6,12 +6,138 @@ parameters:
 			count: 1
 			path: wcfsetup/install/files/acp/update_com.woltlab.wcf_6.1_spider_step1.php
 
+		-
+			message: '#^Property wcf\\acp\\form\\AbstractCategoryAddForm\:\:\$categoryNodeTree \(wcf\\data\\category\\UncachedCategoryNodeTree\) does not accept wcf\\data\\category\\CategoryNodeTree\.$#'
+			identifier: assign.propertyType
+			count: 1
+			path: wcfsetup/install/files/lib/acp/form/AbstractCategoryEditForm.class.php
+
+		-
+			message: '#^Property wcf\\acp\\form\\LanguageImportForm\:\:\$language \(wcf\\data\\language\\Language\) does not accept wcf\\data\\language\\LanguageEditor\.$#'
+			identifier: assign.propertyType
+			count: 1
+			path: wcfsetup/install/files/lib/acp/form/LanguageImportForm.class.php
+
+		-
+			message: '#^Property wcf\\acp\\page\\DevtoolsNotificationTestPage\:\:\$events \(array\<array\<wcf\\system\\user\\notification\\event\\ITestableUserNotificationEvent\>\>\) does not accept array\<array\<wcf\\system\\user\\notification\\event\\IUserNotificationEvent\>\>\.$#'
+			identifier: assign.propertyType
+			count: 3
+			path: wcfsetup/install/files/lib/acp/page/DevtoolsNotificationTestPage.class.php
+
+		-
+			message: '#^Property wcf\\acp\\page\\DevtoolsNotificationTestPage\:\:\$events \(array\<array\<wcf\\system\\user\\notification\\event\\ITestableUserNotificationEvent\>\>\) does not accept array\<list\<wcf\\system\\user\\notification\\event\\IUserNotificationEvent\>\>\.$#'
+			identifier: assign.propertyType
+			count: 1
+			path: wcfsetup/install/files/lib/acp/page/DevtoolsNotificationTestPage.class.php
+
+		-
+			message: '#^Method wcf\\data\\article\\ArticleAction\:\:delete\(\) should return int but returns array\<string, array\<int\>\|string\>\.$#'
+			identifier: return.type
+			count: 1
+			path: wcfsetup/install/files/lib/data/article/ArticleAction.class.php
+
 		-
 			message: '#^Constructor of class wcf\\data\\clipboard\\item\\ClipboardItemAction has an unused parameter \$objects\.$#'
 			identifier: constructor.unusedParameter
 			count: 1
 			path: wcfsetup/install/files/lib/data/clipboard/item/ClipboardItemAction.class.php
 
+		-
+			message: '#^Property wcf\\data\\comment\\CommentAction\:\:\$comment \(wcf\\data\\comment\\Comment\) does not accept wcf\\data\\comment\\CommentEditor\.$#'
+			identifier: assign.propertyType
+			count: 2
+			path: wcfsetup/install/files/lib/data/comment/CommentAction.class.php
+
+		-
+			message: '#^Property wcf\\data\\comment\\response\\CommentResponseAction\:\:\$response \(wcf\\data\\comment\\response\\CommentResponse\) does not accept wcf\\data\\comment\\response\\CommentResponseEditor\.$#'
+			identifier: assign.propertyType
+			count: 1
+			path: wcfsetup/install/files/lib/data/comment/response/CommentResponseAction.class.php
+
+		-
+			message: '#^Property wcf\\data\\style\\StyleAction\:\:\$style \(wcf\\data\\style\\Style\) does not accept wcf\\data\\style\\StyleEditor\.$#'
+			identifier: assign.propertyType
+			count: 1
+			path: wcfsetup/install/files/lib/data/style/StyleAction.class.php
+
+		-
+			message: '#^Access to an undefined property Zend\\Console\\Getopt\:\:\$exitOnFail\.$#'
+			identifier: property.notFound
+			count: 4
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
+		-
+			message: '#^Access to an undefined property Zend\\Console\\Getopt\:\:\$help\.$#'
+			identifier: property.notFound
+			count: 1
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
+		-
+			message: '#^Access to an undefined property Zend\\Console\\Getopt\:\:\$language\.$#'
+			identifier: property.notFound
+			count: 1
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
+		-
+			message: '#^Access to an undefined property Zend\\Console\\Getopt\:\:\$q\.$#'
+			identifier: property.notFound
+			count: 1
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
+		-
+			message: '#^Access to an undefined property Zend\\Console\\Getopt\:\:\$v\.$#'
+			identifier: property.notFound
+			count: 1
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
+		-
+			message: '#^Access to an undefined property Zend\\Console\\Getopt\:\:\$version\.$#'
+			identifier: property.notFound
+			count: 1
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
+		-
+			message: '#^Call to method getTerminal\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
+			identifier: class.notFound
+			count: 1
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
+		-
+			message: '#^Call to method getWidth\(\) on an unknown class phpline\\Terminal\.$#'
+			identifier: class.notFound
+			count: 1
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
+		-
+			message: '#^Call to method println\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
+			identifier: class.notFound
+			count: 5
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
+		-
+			message: '#^Call to method readLine\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
+			identifier: class.notFound
+			count: 3
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
+		-
+			message: '#^Call to method setExpandEvents\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
+			identifier: class.notFound
+			count: 1
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
+		-
+			message: '#^Call to method setHistory\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
+			identifier: class.notFound
+			count: 1
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
+		-
+			message: '#^Call to method setHistoryEnabled\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
+			identifier: class.notFound
+			count: 3
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
 		-
 			message: '#^Call to static method error\(\) on an unknown class phpline\\internal\\Log\.$#'
 			identifier: class.notFound
@@ -48,6 +174,24 @@ parameters:
 			count: 1
 			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
 
+		-
+			message: '#^Method wcf\\system\\CLIWCF\:\:getReader\(\) has invalid return type phpline\\console\\ConsoleReader\.$#'
+			identifier: class.notFound
+			count: 1
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
+		-
+			message: '#^Method wcf\\system\\CLIWCF\:\:getTerminal\(\) has invalid return type phpline\\Terminal\.$#'
+			identifier: class.notFound
+			count: 1
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
+		-
+			message: '#^Property wcf\\system\\CLIWCF\:\:\$consoleReader has unknown class phpline\\console\\ConsoleReader as its type\.$#'
+			identifier: class.notFound
+			count: 1
+			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+
 		-
 			message: '#^Constant INSTALL_SCRIPT not found\.$#'
 			identifier: constant.notFound
@@ -79,46 +223,22 @@ parameters:
 			path: wcfsetup/install/files/lib/system/cli/command/CLICommandHandler.class.php
 
 		-
-			message: '#^Call to static method debug\(\) on an unknown class phpline\\internal\\Log\.$#'
+			message: '#^Call to method println\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
 			identifier: class.notFound
-			count: 1
-			path: wcfsetup/install/files/lib/system/cli/command/WorkerCLICommand.class.php
+			count: 31
+			path: wcfsetup/install/files/lib/system/cli/command/ImportCLICommand.class.php
 
 		-
-			message: '#^Call to static method info\(\) on an unknown class phpline\\internal\\Log\.$#'
+			message: '#^Call to method readLine\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
 			identifier: class.notFound
-			count: 2
-			path: wcfsetup/install/files/lib/system/cli/command/WorkerCLICommand.class.php
-
-		-
-			message: '#^Constructor of class wcf\\system\\exception\\ErrorException has an unused parameter \$filename\.$#'
-			identifier: constructor.unusedParameter
-			count: 1
-			path: wcfsetup/install/files/lib/system/exception/ErrorException.class.php
-
-		-
-			message: '#^Constructor of class wcf\\system\\exception\\ErrorException has an unused parameter \$lineno\.$#'
-			identifier: constructor.unusedParameter
-			count: 1
-			path: wcfsetup/install/files/lib/system/exception/ErrorException.class.php
-
-		-
-			message: '#^Call to an undefined method wcf\\system\\form\\builder\\container\\wysiwyg\\WysiwygFormContainer\:\:addValidationError\(\)\.$#'
-			identifier: method.notFound
-			count: 2
-			path: wcfsetup/install/files/lib/system/form/builder/container/wysiwyg/WysiwygFormContainer.class.php
-
-		-
-			message: '#^Method wcf\\system\\package\\plugin\\LanguagePackageInstallationPlugin\:\:getEmptyXml\(\) invoked with 0 parameters, 1 required\.$#'
-			identifier: arguments.count
-			count: 1
-			path: wcfsetup/install/files/lib/system/package/plugin/LanguagePackageInstallationPlugin.class.php
+			count: 11
+			path: wcfsetup/install/files/lib/system/cli/command/ImportCLICommand.class.php
 
 		-
-			message: '#^Call to static method stripAnsi\(\) on an unknown class phpline\\internal\\AnsiUtil\.$#'
+			message: '#^Call to method setHistoryEnabled\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
 			identifier: class.notFound
 			count: 3
-			path: wcfsetup/install/files/lib/util/CLIUtil.class.php
+			path: wcfsetup/install/files/lib/system/cli/command/ImportCLICommand.class.php
 
 		-
 			message: '#^Access to an undefined property Zend\\Console\\Getopt\:\:\$list\.$#'
@@ -151,115 +271,181 @@ parameters:
 			path: wcfsetup/install/files/lib/system/cli/command/WorkerCLICommand.class.php
 
 		-
-			message: '#^Call to method println\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
+			message: '#^Call to static method debug\(\) on an unknown class phpline\\internal\\Log\.$#'
 			identifier: class.notFound
-			count: 31
-			path: wcfsetup/install/files/lib/system/cli/command/ImportCLICommand.class.php
+			count: 1
+			path: wcfsetup/install/files/lib/system/cli/command/WorkerCLICommand.class.php
 
 		-
-			message: '#^Call to method readLine\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
+			message: '#^Call to static method info\(\) on an unknown class phpline\\internal\\Log\.$#'
 			identifier: class.notFound
-			count: 11
-			path: wcfsetup/install/files/lib/system/cli/command/ImportCLICommand.class.php
+			count: 2
+			path: wcfsetup/install/files/lib/system/cli/command/WorkerCLICommand.class.php
 
 		-
-			message: '#^Call to method setHistoryEnabled\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
-			identifier: class.notFound
-			count: 3
-			path: wcfsetup/install/files/lib/system/cli/command/ImportCLICommand.class.php
+			message: '#^Method wcf\\system\\condition\\AbstractCheckboxCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
+			count: 1
+			path: wcfsetup/install/files/lib/system/condition/AbstractCheckboxCondition.class.php
 
 		-
-			message: '#^Access to an undefined property Zend\\Console\\Getopt\:\:\$exitOnFail\.$#'
-			identifier: property.notFound
-			count: 4
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			message: '#^Method wcf\\system\\condition\\AbstractIntegerCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
+			count: 1
+			path: wcfsetup/install/files/lib/system/condition/AbstractIntegerCondition.class.php
 
 		-
-			message: '#^Access to an undefined property Zend\\Console\\Getopt\:\:\$help\.$#'
-			identifier: property.notFound
+			message: '#^Method wcf\\system\\condition\\AbstractMultiSelectCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
 			count: 1
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			path: wcfsetup/install/files/lib/system/condition/AbstractMultiSelectCondition.class.php
 
 		-
-			message: '#^Access to an undefined property Zend\\Console\\Getopt\:\:\$language\.$#'
-			identifier: property.notFound
+			message: '#^PHPDoc type array of property wcf\\system\\condition\\AbstractMultiSelectCondition\:\:\$fieldValue is not covariant with PHPDoc type string of overridden property wcf\\system\\condition\\AbstractSelectCondition\:\:\$fieldValue\.$#'
+			identifier: property.phpDocType
 			count: 1
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			path: wcfsetup/install/files/lib/system/condition/AbstractMultiSelectCondition.class.php
 
 		-
-			message: '#^Access to an undefined property Zend\\Console\\Getopt\:\:\$q\.$#'
-			identifier: property.notFound
+			message: '#^Method wcf\\system\\condition\\AbstractSelectCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
 			count: 1
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			path: wcfsetup/install/files/lib/system/condition/AbstractSelectCondition.class.php
 
 		-
-			message: '#^Access to an undefined property Zend\\Console\\Getopt\:\:\$v\.$#'
-			identifier: property.notFound
+			message: '#^Method wcf\\system\\condition\\AbstractTextCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
 			count: 1
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			path: wcfsetup/install/files/lib/system/condition/AbstractTextCondition.class.php
 
 		-
-			message: '#^Access to an undefined property Zend\\Console\\Getopt\:\:\$version\.$#'
-			identifier: property.notFound
+			message: '#^Method wcf\\system\\condition\\AbstractTimestampCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
 			count: 1
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			path: wcfsetup/install/files/lib/system/condition/AbstractTimestampCondition.class.php
 
 		-
-			message: '#^Call to method getTerminal\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
-			identifier: class.notFound
+			message: '#^Method wcf\\system\\condition\\TimeCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
 			count: 1
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			path: wcfsetup/install/files/lib/system/condition/TimeCondition.class.php
 
 		-
-			message: '#^Call to method getWidth\(\) on an unknown class phpline\\Terminal\.$#'
-			identifier: class.notFound
+			message: '#^Method wcf\\system\\condition\\UserBirthdayCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
 			count: 1
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			path: wcfsetup/install/files/lib/system/condition/UserBirthdayCondition.class.php
 
 		-
-			message: '#^Call to method println\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
-			identifier: class.notFound
-			count: 5
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			message: '#^Method wcf\\system\\condition\\UserGroupCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
+			count: 1
+			path: wcfsetup/install/files/lib/system/condition/UserGroupCondition.class.php
 
 		-
-			message: '#^Call to method readLine\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
-			identifier: class.notFound
-			count: 3
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			message: '#^Method wcf\\system\\condition\\UserLanguageCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
+			count: 1
+			path: wcfsetup/install/files/lib/system/condition/UserLanguageCondition.class.php
 
 		-
-			message: '#^Call to method setExpandEvents\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
-			identifier: class.notFound
+			message: '#^Method wcf\\system\\condition\\UserMobileBrowserCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
 			count: 1
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			path: wcfsetup/install/files/lib/system/condition/UserMobileBrowserCondition.class.php
 
 		-
-			message: '#^Call to method setHistory\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
-			identifier: class.notFound
+			message: '#^Method wcf\\system\\condition\\UserMultifactorCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
 			count: 1
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			path: wcfsetup/install/files/lib/system/condition/UserMultifactorCondition.class.php
 
 		-
-			message: '#^Call to method setHistoryEnabled\(\) on an unknown class phpline\\console\\ConsoleReader\.$#'
-			identifier: class.notFound
-			count: 3
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			message: '#^Method wcf\\system\\condition\\UserOptionsCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
+			count: 1
+			path: wcfsetup/install/files/lib/system/condition/UserOptionsCondition.class.php
 
 		-
-			message: '#^Method wcf\\system\\CLIWCF\:\:getReader\(\) has invalid return type phpline\\console\\ConsoleReader\.$#'
-			identifier: class.notFound
+			message: '#^Method wcf\\system\\condition\\UserRegistrationDateCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
 			count: 1
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			path: wcfsetup/install/files/lib/system/condition/UserRegistrationDateCondition.class.php
 
 		-
-			message: '#^Method wcf\\system\\CLIWCF\:\:getTerminal\(\) has invalid return type phpline\\Terminal\.$#'
-			identifier: class.notFound
+			message: '#^Method wcf\\system\\condition\\UserStateCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
 			count: 1
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
+			path: wcfsetup/install/files/lib/system/condition/UserStateCondition.class.php
 
 		-
-			message: '#^Property wcf\\system\\CLIWCF\:\:\$consoleReader has unknown class phpline\\console\\ConsoleReader as its type\.$#'
+			message: '#^Method wcf\\system\\condition\\UserTrophyCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
+			count: 1
+			path: wcfsetup/install/files/lib/system/condition/UserTrophyCondition.class.php
+
+		-
+			message: '#^Method wcf\\system\\condition\\UserUserIDCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
+			count: 1
+			path: wcfsetup/install/files/lib/system/condition/UserUserIDCondition.class.php
+
+		-
+			message: '#^Method wcf\\system\\condition\\page\\MultiPageCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
+			count: 1
+			path: wcfsetup/install/files/lib/system/condition/page/MultiPageCondition.class.php
+
+		-
+			message: '#^Method wcf\\system\\condition\\user\\UserLastActivityTimeIntervalDaysCondition\:\:getData\(\) should return array\<mixed\> but returns null\.$#'
+			identifier: return.type
+			count: 1
+			path: wcfsetup/install/files/lib/system/condition/user/UserLastActivityTimeIntervalDaysCondition.class.php
+
+		-
+			message: '#^Argument of an invalid type wcf\\data\\comment\\Comment supplied for foreach, only iterables are supported\.$#'
+			identifier: foreach.nonIterable
+			count: 1
+			path: wcfsetup/install/files/lib/system/endpoint/controller/core/comments/RenderComment.class.php
+
+		-
+			message: '#^Constructor of class wcf\\system\\exception\\ErrorException has an unused parameter \$filename\.$#'
+			identifier: constructor.unusedParameter
+			count: 1
+			path: wcfsetup/install/files/lib/system/exception/ErrorException.class.php
+
+		-
+			message: '#^Constructor of class wcf\\system\\exception\\ErrorException has an unused parameter \$lineno\.$#'
+			identifier: constructor.unusedParameter
+			count: 1
+			path: wcfsetup/install/files/lib/system/exception/ErrorException.class.php
+
+		-
+			message: '#^Call to an undefined method wcf\\system\\form\\builder\\container\\wysiwyg\\WysiwygFormContainer\:\:addValidationError\(\)\.$#'
+			identifier: method.notFound
+			count: 2
+			path: wcfsetup/install/files/lib/system/form/builder/container/wysiwyg/WysiwygFormContainer.class.php
+
+		-
+			message: '#^Property wcf\\system\\form\\element\\AbstractNamedFormElement\:\:\$value \(string\) does not accept array\<string\>\.$#'
+			identifier: assign.propertyType
+			count: 1
+			path: wcfsetup/install/files/lib/system/form/element/MultipleSelectionFormElement.class.php
+
+		-
+			message: '#^Method wcf\\system\\package\\plugin\\LanguagePackageInstallationPlugin\:\:getEmptyXml\(\) invoked with 0 parameters, 1 required\.$#'
+			identifier: arguments.count
+			count: 1
+			path: wcfsetup/install/files/lib/system/package/plugin/LanguagePackageInstallationPlugin.class.php
+
+		-
+			message: '#^Call to static method stripAnsi\(\) on an unknown class phpline\\internal\\AnsiUtil\.$#'
 			identifier: class.notFound
+			count: 3
+			path: wcfsetup/install/files/lib/util/CLIUtil.class.php
+
+		-
+			message: '#^Property wcf\\util\\DirectoryUtil\:\:\$fileObjects \(array\<DirectoryIterator\>\) does not accept array\<SplFileInfo\>\.$#'
+			identifier: assign.propertyType
 			count: 1
-			path: wcfsetup/install/files/lib/system/CLIWCF.class.php
\ No newline at end of file
+			path: wcfsetup/install/files/lib/util/DirectoryUtil.class.php
\ No newline at end of file
diff --git a/phpstan.neon b/phpstan.neon
index 642e9cfdaa6..1ba5cd018c1 100644
--- a/phpstan.neon
+++ b/phpstan.neon
@@ -2,7 +2,7 @@ includes:
     - phpstan-baseline.neon
 
 parameters:
-    level: 2
+    level: 3
     paths:
         - wcfsetup/install/files
     excludePaths:
diff --git a/wcfsetup/install/files/lib/acp/form/AbstractCustomOptionForm.class.php b/wcfsetup/install/files/lib/acp/form/AbstractCustomOptionForm.class.php
index 9e38bdf4492..7edccad7ccd 100644
--- a/wcfsetup/install/files/lib/acp/form/AbstractCustomOptionForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/AbstractCustomOptionForm.class.php
@@ -38,7 +38,7 @@ abstract class AbstractCustomOptionForm extends AbstractAcpForm
 
     /**
      * option default value
-     * @var string
+     * @var string|int|float
      */
     public $defaultValue = '';
 
@@ -56,7 +56,7 @@ abstract class AbstractCustomOptionForm extends AbstractAcpForm
 
     /**
      * field is required
-     * @var bool
+     * @var int
      */
     public $required = 0;
 
@@ -68,7 +68,7 @@ abstract class AbstractCustomOptionForm extends AbstractAcpForm
 
     /**
      * 1 if the option is disabled
-     * @var bool
+     * @var int
      * @since   5.2
      */
     public $isDisabled = 0;
diff --git a/wcfsetup/install/files/lib/acp/form/AdAddForm.class.php b/wcfsetup/install/files/lib/acp/form/AdAddForm.class.php
index aa620f6b0be..d0a71f9713c 100644
--- a/wcfsetup/install/files/lib/acp/form/AdAddForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/AdAddForm.class.php
@@ -70,7 +70,7 @@ class AdAddForm extends AbstractForm
 
     /**
      * list of available locations
-     * @var string[]
+     * @var array<string, array<int, string>>
      */
     public $locations = [];
 
diff --git a/wcfsetup/install/files/lib/acp/form/ArticleAddForm.class.php b/wcfsetup/install/files/lib/acp/form/ArticleAddForm.class.php
index 2705a8cfb73..b4449e2387f 100644
--- a/wcfsetup/install/files/lib/acp/form/ArticleAddForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/ArticleAddForm.class.php
@@ -59,7 +59,7 @@ class ArticleAddForm extends AbstractForm
 
     /**
      * true if created article is multi-lingual
-     * @var bool
+     * @var int
      */
     public $isMultilingual = 0;
 
@@ -113,7 +113,7 @@ class ArticleAddForm extends AbstractForm
 
     /**
      * enables the comment function
-     * @var bool
+     * @var int
      */
     public $enableComments = ARTICLE_ENABLE_COMMENTS_DEFAULT_VALUE;
 
@@ -587,7 +587,7 @@ public function save()
         $this->categoryID = 0;
         $this->publicationStatus = Article::PUBLISHED;
         $this->enableComments = ARTICLE_ENABLE_COMMENTS_DEFAULT_VALUE;
-        $this->title = $this->teaser = $this->content = $this->images = $this->imageID = $this->teaserImages = $this->teaserImageID == $this->tags = [];
+        $this->title = $this->teaser = $this->content = $this->images = $this->imageID = $this->teaserImages = $this->teaserImageID = $this->tags = [];
         $this->metaTitle = $this->metaDescription = [];
 
         // Reload attachment handler to reset the uploaded attachments.
diff --git a/wcfsetup/install/files/lib/acp/form/BBCodeEditForm.class.php b/wcfsetup/install/files/lib/acp/form/BBCodeEditForm.class.php
index bf376193e30..46957132e18 100644
--- a/wcfsetup/install/files/lib/acp/form/BBCodeEditForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/BBCodeEditForm.class.php
@@ -183,10 +183,10 @@ public function readData()
             $this->bbcodeTag = $this->bbcode->bbcodeTag;
             $this->htmlOpen = $this->bbcode->htmlOpen;
             $this->htmlClose = $this->bbcode->htmlClose;
-            $this->isBlockElement = $this->bbcode->isBlockElement;
-            $this->isSourceCode = $this->bbcode->isSourceCode;
+            $this->isBlockElement = !!$this->bbcode->isBlockElement;
+            $this->isSourceCode = !!$this->bbcode->isSourceCode;
             $this->className = $this->bbcode->className;
-            $this->showButton = $this->bbcode->showButton;
+            $this->showButton = !!$this->bbcode->showButton;
             $this->wysiwygIcon = $this->bbcode->wysiwygIcon;
         }
     }
diff --git a/wcfsetup/install/files/lib/acp/form/BoxAddForm.class.php b/wcfsetup/install/files/lib/acp/form/BoxAddForm.class.php
index ecfcc01485a..aa9caf0eb1f 100644
--- a/wcfsetup/install/files/lib/acp/form/BoxAddForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/BoxAddForm.class.php
@@ -53,7 +53,7 @@ class BoxAddForm extends AbstractForm
 
     /**
      * true if created box is multi-lingual
-     * @var bool
+     * @var int
      */
     public $isMultilingual = 0;
 
@@ -77,7 +77,7 @@ class BoxAddForm extends AbstractForm
 
     /**
      * true if created box is visible everywhere
-     * @var bool
+     * @var int
      */
     public $visibleEverywhere = 1;
 
@@ -89,7 +89,7 @@ class BoxAddForm extends AbstractForm
 
     /**
      * true if box header is visible
-     * @var bool
+     * @var int
      */
     public $showHeader = 1;
 
@@ -137,7 +137,7 @@ class BoxAddForm extends AbstractForm
 
     /**
      * selected box controller object type
-     * @var ObjectType
+     * @var ?ObjectType
      */
     public $boxController;
 
@@ -200,7 +200,7 @@ class BoxAddForm extends AbstractForm
     public $availableBoxPositions = [];
 
     /**
-     * @var bool
+     * @var int
      * @since   5.2
      */
     public $isDisabled = 0;
@@ -218,7 +218,7 @@ class BoxAddForm extends AbstractForm
     public $presetBox;
 
     /**
-     * @var bool
+     * @var int
      * @since   5.4
      */
     public $invertPermissions;
@@ -480,13 +480,13 @@ public function validate()
                 }
             }
         } elseif ($this->boxType !== 'system' && $this->linkType == 'external') {
-            $this->linkPageID = $this->linkPageObjectID = null;
+            $this->linkPageID = $this->linkPageObjectID = 0;
 
             if (empty($this->externalURL)) {
                 throw new UserInputException('externalURL');
             }
         } else {
-            $this->linkPageID = $this->linkPageObjectID = null;
+            $this->linkPageID = $this->linkPageObjectID = 0;
             $this->externalURL = '';
         }
 
diff --git a/wcfsetup/install/files/lib/acp/form/ContactRecipientAddForm.class.php b/wcfsetup/install/files/lib/acp/form/ContactRecipientAddForm.class.php
index 873b3bb81fb..576f5a922f1 100644
--- a/wcfsetup/install/files/lib/acp/form/ContactRecipientAddForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/ContactRecipientAddForm.class.php
@@ -175,7 +175,7 @@ public function save()
         ]);
 
         // reset values
-        $this->email = $this->name = 0;
+        $this->email = $this->name = '';
         $this->isDisabled = $this->showOrder = 0;
 
         I18nHandler::getInstance()->reset();
diff --git a/wcfsetup/install/files/lib/acp/form/NotificationPresetSettingsForm.class.php b/wcfsetup/install/files/lib/acp/form/NotificationPresetSettingsForm.class.php
index 76afa72d430..8b6707740d9 100644
--- a/wcfsetup/install/files/lib/acp/form/NotificationPresetSettingsForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/NotificationPresetSettingsForm.class.php
@@ -45,7 +45,7 @@ class NotificationPresetSettingsForm extends AbstractForm
 
     /**
      * true to apply change to existing users
-     * @var bool
+     * @var int
      */
     public $applyChangesToExistingUsers = 0;
 
diff --git a/wcfsetup/install/files/lib/acp/form/PackageStartInstallForm.class.php b/wcfsetup/install/files/lib/acp/form/PackageStartInstallForm.class.php
index 5d9fd0f0eea..77b7cb601a5 100755
--- a/wcfsetup/install/files/lib/acp/form/PackageStartInstallForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/PackageStartInstallForm.class.php
@@ -42,7 +42,7 @@ class PackageStartInstallForm extends AbstractForm
      * data of the uploaded package
      * @var string[]
      */
-    public $uploadPackage = '';
+    public $uploadPackage = [];
 
     /**
      * archive of the installation/update package
diff --git a/wcfsetup/install/files/lib/acp/form/PageAddForm.class.php b/wcfsetup/install/files/lib/acp/form/PageAddForm.class.php
index 4689936b000..070ea570041 100644
--- a/wcfsetup/install/files/lib/acp/form/PageAddForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/PageAddForm.class.php
@@ -55,7 +55,7 @@ class PageAddForm extends AbstractForm
 
     /**
      * true if created page is multi-lingual
-     * @var bool
+     * @var int
      */
     public $isMultilingual = 0;
 
@@ -79,7 +79,7 @@ class PageAddForm extends AbstractForm
 
     /**
      * true if page is disabled
-     * @var bool
+     * @var int
      */
     public $isDisabled = 0;
 
@@ -156,25 +156,25 @@ class PageAddForm extends AbstractForm
 
     /**
      * true if the page is available during offline mode
-     * @var bool
+     * @var int
      */
     public $availableDuringOfflineMode = 0;
 
     /**
      * true if the page is accessible for search spiders
-     * @var bool
+     * @var int
      */
     public $allowSpidersToIndex = 1;
 
     /**
      * true if page should be added to the main menu
-     * @var bool
+     * @var int
      */
     public $addPageToMainMenu = 0;
 
     /**
      * parent menu item id
-     * @var int
+     * @var ?int
      */
     public $parentMenuItemID;
 
@@ -185,7 +185,7 @@ class PageAddForm extends AbstractForm
     public $menuItems;
 
     /**
-     * @var bool
+     * @var int
      * @since   5.2
      */
     public $enableShareButtons = 0;
@@ -203,7 +203,7 @@ class PageAddForm extends AbstractForm
     public $presetPage;
 
     /**
-     * @var bool
+     * @var int
      * @since   5.4
      */
     public $invertPermissions = 0;
diff --git a/wcfsetup/install/files/lib/acp/form/PageEditForm.class.php b/wcfsetup/install/files/lib/acp/form/PageEditForm.class.php
index 0bd26e01fdb..b491580327d 100644
--- a/wcfsetup/install/files/lib/acp/form/PageEditForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/PageEditForm.class.php
@@ -30,7 +30,7 @@ class PageEditForm extends PageAddForm
     public $activeMenuItem = 'wcf.acp.menu.link.cms.page.list';
 
     /**
-     * @var int
+     * @var ?int
      */
     public $overrideApplicationPackageID;
 
diff --git a/wcfsetup/install/files/lib/acp/form/PaidSubscriptionAddForm.class.php b/wcfsetup/install/files/lib/acp/form/PaidSubscriptionAddForm.class.php
index e254fd2713e..fd449076edf 100644
--- a/wcfsetup/install/files/lib/acp/form/PaidSubscriptionAddForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/PaidSubscriptionAddForm.class.php
@@ -59,7 +59,7 @@ class PaidSubscriptionAddForm extends AbstractForm
 
     /**
      * indicates if the subscription is disabled
-     * @var bool
+     * @var int
      */
     public $isDisabled = 0;
 
@@ -83,7 +83,7 @@ class PaidSubscriptionAddForm extends AbstractForm
 
     /**
      * indicates if the subscription is permanent
-     * @var bool
+     * @var int
      */
     public $subscriptionLengthPermanent = 0;
 
@@ -101,7 +101,7 @@ class PaidSubscriptionAddForm extends AbstractForm
 
     /**
      * indicates if the subscription is a recurring payment
-     * @var bool
+     * @var int
      */
     public $isRecurring = 0;
 
diff --git a/wcfsetup/install/files/lib/acp/form/PaidSubscriptionEditForm.class.php b/wcfsetup/install/files/lib/acp/form/PaidSubscriptionEditForm.class.php
index acfceda1f02..dde638ed878 100644
--- a/wcfsetup/install/files/lib/acp/form/PaidSubscriptionEditForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/PaidSubscriptionEditForm.class.php
@@ -9,6 +9,7 @@
 use wcf\system\exception\PermissionDeniedException;
 use wcf\system\language\I18nHandler;
 use wcf\system\WCF;
+use wcf\util\ArrayUtil;
 
 /**
  * Shows the paid subscription edit form.
@@ -108,8 +109,8 @@ public function readData()
             $this->subscriptionLength = $this->subscription->subscriptionLength;
             $this->subscriptionLengthUnit = $this->subscription->subscriptionLengthUnit;
             $this->isRecurring = $this->subscription->isRecurring;
-            $this->groupIDs = \explode(',', $this->subscription->groupIDs);
-            $this->excludedSubscriptionIDs = \explode(',', $this->subscription->excludedSubscriptionIDs);
+            $this->groupIDs = ArrayUtil::toIntegerArray(\explode(',', $this->subscription->groupIDs));
+            $this->excludedSubscriptionIDs = ArrayUtil::toIntegerArray(\explode(',', $this->subscription->excludedSubscriptionIDs));
         }
     }
 
diff --git a/wcfsetup/install/files/lib/acp/form/StyleAddForm.class.php b/wcfsetup/install/files/lib/acp/form/StyleAddForm.class.php
index 132e8c31d46..a601d49c376 100644
--- a/wcfsetup/install/files/lib/acp/form/StyleAddForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/StyleAddForm.class.php
@@ -13,6 +13,7 @@
 use wcf\system\exception\SystemException;
 use wcf\system\exception\UserInputException;
 use wcf\system\file\upload\UploadField;
+use wcf\system\file\upload\UploadFile;
 use wcf\system\file\upload\UploadHandler;
 use wcf\system\image\ImageHandler;
 use wcf\system\language\I18nHandler;
@@ -112,9 +113,9 @@ class StyleAddForm extends AbstractForm
 
     /**
      * tainted style
-     * @var bool
+     * @var int
      */
-    public $isTainted = true;
+    public $isTainted = 1;
 
     /**
      * license name
@@ -170,13 +171,13 @@ class StyleAddForm extends AbstractForm
     public $tmpHash = '';
 
     /**
-     * @var string
+     * @var ?string
      */
     public $styleTestFileDir;
 
     /**
      * list of variables and their value
-     * @var string[]
+     * @var array<string, mixed>
      */
     public $variables = [];
 
@@ -199,7 +200,7 @@ class StyleAddForm extends AbstractForm
     public $uploads = [];
 
     /**
-     * @var UploadField[]
+     * @var array{}|array{added: UploadFile[], removed: UploadFile[]}
      * @since 5.3
      */
     public $customAssets = [];
@@ -895,7 +896,7 @@ public function save()
         $this->authorName = $this->authorURL = $this->copyright = $this->packageName = '';
         $this->license = $this->styleDate = $this->styleDescription = $this->styleName = $this->styleVersion = '';
         $this->setDefaultValues();
-        $this->isTainted = true;
+        $this->isTainted = 1;
         $this->templateGroupID = 0;
         $this->styleTestFileDir = null;
         $this->rebuildUploadFields();
diff --git a/wcfsetup/install/files/lib/acp/form/TrophyAddForm.class.php b/wcfsetup/install/files/lib/acp/form/TrophyAddForm.class.php
index 4e111cf1d41..7019936c9cc 100644
--- a/wcfsetup/install/files/lib/acp/form/TrophyAddForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/TrophyAddForm.class.php
@@ -2,8 +2,8 @@
 
 namespace wcf\acp\form;
 
-use wcf\data\category\Category;
 use wcf\data\object\type\ObjectType;
+use wcf\data\trophy\category\TrophyCategory;
 use wcf\data\trophy\category\TrophyCategoryCache;
 use wcf\data\trophy\Trophy;
 use wcf\data\trophy\TrophyAction;
@@ -50,7 +50,7 @@ class TrophyAddForm extends AbstractAcpForm
 
     /**
      * Category object.
-     * @var Category
+     * @var ?TrophyCategory
      */
     public $category;
 
diff --git a/wcfsetup/install/files/lib/acp/form/UserAddForm.class.php b/wcfsetup/install/files/lib/acp/form/UserAddForm.class.php
index afce997d975..0221ce34da6 100644
--- a/wcfsetup/install/files/lib/acp/form/UserAddForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/UserAddForm.class.php
@@ -55,7 +55,7 @@ class UserAddForm extends UserOptionListForm
 
     /**
      * user password
-     * @var string
+     * @var ?string
      */
     public $password = '';
 
@@ -96,7 +96,7 @@ class UserAddForm extends UserOptionListForm
 
     /**
      * true to disable this signature
-     * @var bool
+     * @var int
      */
     public $disableSignature = 0;
 
diff --git a/wcfsetup/install/files/lib/acp/form/UserEditForm.class.php b/wcfsetup/install/files/lib/acp/form/UserEditForm.class.php
index 12e7987b632..f3df9310d42 100755
--- a/wcfsetup/install/files/lib/acp/form/UserEditForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/UserEditForm.class.php
@@ -4,7 +4,7 @@
 
 use wcf\data\file\File;
 use wcf\data\style\Style;
-use wcf\data\user\cover\photo\UserCoverPhoto;
+use wcf\data\user\cover\photo\IUserCoverPhoto;
 use wcf\data\user\group\UserGroup;
 use wcf\data\user\User;
 use wcf\data\user\UserAction;
@@ -58,7 +58,7 @@ class UserEditForm extends UserAddForm
 
     /**
      * ban status
-     * @var bool
+     * @var int
      */
     public $banned = 0;
 
@@ -87,7 +87,7 @@ class UserEditForm extends UserAddForm
 
     /**
      * true to disable this avatar
-     * @var bool
+     * @var int
      */
     public $disableAvatar = 0;
 
@@ -105,13 +105,13 @@ class UserEditForm extends UserAddForm
 
     /**
      * user cover photo object
-     * @var UserCoverPhoto
+     * @var IUserCoverPhoto
      */
     public $userCoverPhoto;
 
     /**
      * true to disable this cover photo
-     * @var bool
+     * @var int
      */
     public $disableCoverPhoto = 0;
 
@@ -129,19 +129,19 @@ class UserEditForm extends UserAddForm
 
     /**
      * true to delete the current cover photo
-     * @var bool
+     * @var int
      */
     public $deleteCoverPhoto = 0;
 
     /**
      * true to delete the current auth data
-     * @var bool
+     * @var int
      */
     public $disconnect3rdParty = 0;
 
     /**
      * true to disable multifactor authentication
-     * @var bool
+     * @var int
      */
     public $multifactorDisable = 0;
 
diff --git a/wcfsetup/install/files/lib/acp/form/UserGroupEditForm.class.php b/wcfsetup/install/files/lib/acp/form/UserGroupEditForm.class.php
index 879d9fc865e..2c6408d1076 100755
--- a/wcfsetup/install/files/lib/acp/form/UserGroupEditForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/UserGroupEditForm.class.php
@@ -91,7 +91,7 @@ public function validate()
         parent::validate();
 
         if ($this->allowMention && $this->isUnmentionableGroup) {
-            $this->allowMention = false;
+            $this->allowMention = 0;
         }
     }
 
diff --git a/wcfsetup/install/files/lib/acp/form/UserOptionSetDefaultsForm.class.php b/wcfsetup/install/files/lib/acp/form/UserOptionSetDefaultsForm.class.php
index 84ea66f8f82..14c07f77e9b 100644
--- a/wcfsetup/install/files/lib/acp/form/UserOptionSetDefaultsForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/UserOptionSetDefaultsForm.class.php
@@ -34,7 +34,7 @@ class UserOptionSetDefaultsForm extends AbstractForm
 
     /**
      * true to apply change to existing users
-     * @var bool
+     * @var int
      */
     public $applyChangesToExistingUsers = 0;
 
diff --git a/wcfsetup/install/files/lib/acp/form/UserTrophyAddForm.class.php b/wcfsetup/install/files/lib/acp/form/UserTrophyAddForm.class.php
index 1e5efa6fdfb..00bb51d5574 100644
--- a/wcfsetup/install/files/lib/acp/form/UserTrophyAddForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/UserTrophyAddForm.class.php
@@ -213,7 +213,7 @@ public function reset()
 
         $this->user = '';
         $this->userIDs = [];
-        $this->trophyID = '';
+        $this->trophyID = 0;
         $this->useCustomDescription = $this->trophyUseHtml = 0;
     }
 
diff --git a/wcfsetup/install/files/lib/acp/page/PageListPage.class.php b/wcfsetup/install/files/lib/acp/page/PageListPage.class.php
index 36b0da8b410..c822d27620d 100644
--- a/wcfsetup/install/files/lib/acp/page/PageListPage.class.php
+++ b/wcfsetup/install/files/lib/acp/page/PageListPage.class.php
@@ -32,7 +32,7 @@ class PageListPage extends AbstractGridViewPage
 
     /**
      * display 'Add Page' dialog on load
-     * @var bool
+     * @var int
      */
     public $showPageAddDialog = 0;
 
diff --git a/wcfsetup/install/files/lib/acp/page/VersionTrackerListPage.class.php b/wcfsetup/install/files/lib/acp/page/VersionTrackerListPage.class.php
index 132113a8d3a..9e893431ec2 100644
--- a/wcfsetup/install/files/lib/acp/page/VersionTrackerListPage.class.php
+++ b/wcfsetup/install/files/lib/acp/page/VersionTrackerListPage.class.php
@@ -62,7 +62,7 @@ class VersionTrackerListPage extends AbstractPage
 
     /**
      * right / new version id
-     * @var int
+     * @var int|string
      */
     public $newID = 0;
 
diff --git a/wcfsetup/install/files/lib/data/AbstractDatabaseObjectAction.class.php b/wcfsetup/install/files/lib/data/AbstractDatabaseObjectAction.class.php
index 5d48507e2c8..999a5a15b27 100644
--- a/wcfsetup/install/files/lib/data/AbstractDatabaseObjectAction.class.php
+++ b/wcfsetup/install/files/lib/data/AbstractDatabaseObjectAction.class.php
@@ -254,7 +254,7 @@ public function getObjectIDs()
     /**
      * Sets the database objects.
      *
-     * @param DatabaseObject[] $objects
+     * @param DatabaseObjectEditor[] $objects
      */
     public function setObjects(array $objects)
     {
diff --git a/wcfsetup/install/files/lib/data/DatabaseObject.class.php b/wcfsetup/install/files/lib/data/DatabaseObject.class.php
index 15200e9aa32..d680ab781bf 100644
--- a/wcfsetup/install/files/lib/data/DatabaseObject.class.php
+++ b/wcfsetup/install/files/lib/data/DatabaseObject.class.php
@@ -217,7 +217,8 @@ public static function getDatabaseTableIndexName()
     /**
      * Sorts a list of database objects.
      *
-     * @param DatabaseObject[] $objects
+     * @template T of object
+     * @param T[] $objects
      * @param mixed $sortBy
      * @param string $sortOrder
      * @param bool $maintainIndexAssociation
diff --git a/wcfsetup/install/files/lib/data/ISearchAction.class.php b/wcfsetup/install/files/lib/data/ISearchAction.class.php
index 6d4d377a190..030262013fb 100644
--- a/wcfsetup/install/files/lib/data/ISearchAction.class.php
+++ b/wcfsetup/install/files/lib/data/ISearchAction.class.php
@@ -15,7 +15,7 @@ interface ISearchAction
     /**
      * Returns a list with data of objects that match the given search criteria.
      *
-     * @return  array<array>
+     * @return mixed[]
      */
     public function getSearchResultList();
 
diff --git a/wcfsetup/install/files/lib/data/TObjectTreeNode.class.php b/wcfsetup/install/files/lib/data/TObjectTreeNode.class.php
index 593160f66e9..f7d2f635c9a 100644
--- a/wcfsetup/install/files/lib/data/TObjectTreeNode.class.php
+++ b/wcfsetup/install/files/lib/data/TObjectTreeNode.class.php
@@ -28,7 +28,7 @@ trait TObjectTreeNode
 
     /**
      * parent node object
-     * @var static
+     * @var ?static
      */
     protected $parentNode;
 
@@ -46,6 +46,7 @@ public function addChild(IObjectTreeNode $child)
 
         $child->setParentNode($this);
 
+        /** @var static $child */
         $this->children[] = $child;
     }
 
@@ -172,6 +173,7 @@ public function setParentNode(IObjectTreeNode $parentNode)
             throw new \InvalidArgumentException("Parent has to be a (decorated) instance of '" . static::class . "', but instance of '" . \get_class($parentNode) . "' given.");
         }
 
+        /** @var static $parentNode */
         $this->parentNode = $parentNode;
     }
 
diff --git a/wcfsetup/install/files/lib/data/acp/session/ACPSessionEditor.class.php b/wcfsetup/install/files/lib/data/acp/session/ACPSessionEditor.class.php
index 684965846ff..6e33c89d3e2 100644
--- a/wcfsetup/install/files/lib/data/acp/session/ACPSessionEditor.class.php
+++ b/wcfsetup/install/files/lib/data/acp/session/ACPSessionEditor.class.php
@@ -35,8 +35,9 @@ public static function create(array $parameters = [])
             $parameters['userID'] = null;
         }
 
-        /** @noinspection PhpIncompatibleReturnTypeInspection */
-        return parent::create($parameters);
+        $object = parent::create($parameters);
+        \assert($object instanceof ACPSession);
+        return $object;
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/data/box/Box.class.php b/wcfsetup/install/files/lib/data/box/Box.class.php
index c58ce5c8348..76d363c8fbe 100644
--- a/wcfsetup/install/files/lib/data/box/Box.class.php
+++ b/wcfsetup/install/files/lib/data/box/Box.class.php
@@ -51,7 +51,7 @@
  * @property-read   string|null $sortField      sort field of the objects shown in the box for `AbstractDatabaseObjectListBoxController` controllers or `null` otherwise
  * @property-read   string|null $sortOrder      sort order of the objects shown in the box for `AbstractDatabaseObjectListBoxController` controllers or `null` otherwise
  * @property-read   int $isDisabled     is `1` if the box is disabled and thus is not displayed, otherwise `0`
- * @property-read   bool $invertPermissions     is `1` if the permissions are inverted
+ * @property-read   int $invertPermissions     is `1` if the permissions are inverted
  */
 class Box extends DatabaseObject
 {
diff --git a/wcfsetup/install/files/lib/data/category/CategoryEditor.class.php b/wcfsetup/install/files/lib/data/category/CategoryEditor.class.php
index 900031db5f2..e176f5517e8 100644
--- a/wcfsetup/install/files/lib/data/category/CategoryEditor.class.php
+++ b/wcfsetup/install/files/lib/data/category/CategoryEditor.class.php
@@ -129,8 +129,9 @@ public static function create(array $parameters = [])
             $parameters['additionalData'] = \serialize([]);
         }
 
-        /** @noinspection PhpIncompatibleReturnTypeInspection */
-        return parent::create($parameters);
+        $object = parent::create($parameters);
+        \assert($object instanceof Category);
+        return $object;
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/data/comment/CommentAction.class.php b/wcfsetup/install/files/lib/data/comment/CommentAction.class.php
index 4d9ed114654..e33ecf1de82 100644
--- a/wcfsetup/install/files/lib/data/comment/CommentAction.class.php
+++ b/wcfsetup/install/files/lib/data/comment/CommentAction.class.php
@@ -48,6 +48,7 @@
  * @method  Comment         create()
  * @method  CommentEditor[]     getObjects()
  * @method  CommentEditor       getSingleObject()
+ * @property-read CommentEditor[] $objects
  */
 class CommentAction extends AbstractDatabaseObjectAction implements IMessageInlineEditorAction
 {
@@ -64,7 +65,7 @@ class CommentAction extends AbstractDatabaseObjectAction implements IMessageInli
 
     /**
      * captcha object type used for comments
-     * @var ObjectType
+     * @var ?ObjectType
      * @deprecated 6.1
      */
     public $captchaObjectType;
@@ -727,7 +728,9 @@ public function validateEnable()
     public function enable()
     {
         if ($this->comment === null) {
-            $this->comment = \reset($this->objects);
+            $comment = \reset($this->objects);
+            \assert($comment !== false);
+            $this->comment = $comment;
         }
 
         if ($this->comment->isDisabled) {
@@ -779,10 +782,14 @@ public function validateEnableResponse()
     public function enableResponse()
     {
         if ($this->comment === null) {
-            $this->comment = \reset($this->objects);
+            $comment = \reset($this->objects);
+            \assert($comment !== false);
+            $this->comment = $comment;
         }
         if ($this->response === null) {
-            $this->response = \reset($this->parameters['responses']);
+            $response = \reset($this->parameters['responses']);
+            \assert($response !== false);
+            $this->response = $response;
         }
 
         if ($this->response->isDisabled) {
diff --git a/wcfsetup/install/files/lib/data/comment/response/StructuredCommentResponse.class.php b/wcfsetup/install/files/lib/data/comment/response/StructuredCommentResponse.class.php
index c0df61ffdbe..433cb41efd0 100644
--- a/wcfsetup/install/files/lib/data/comment/response/StructuredCommentResponse.class.php
+++ b/wcfsetup/install/files/lib/data/comment/response/StructuredCommentResponse.class.php
@@ -74,7 +74,7 @@ public function getUserProfile()
      * Returns a structured response.
      *
      * @param int $responseID
-     * @return  StructuredCommentResponse
+     * @return ?StructuredCommentResponse
      */
     public static function getResponse($responseID)
     {
diff --git a/wcfsetup/install/files/lib/data/cronjob/Cronjob.class.php b/wcfsetup/install/files/lib/data/cronjob/Cronjob.class.php
index 98f7e014a28..84d3ff95b3f 100644
--- a/wcfsetup/install/files/lib/data/cronjob/Cronjob.class.php
+++ b/wcfsetup/install/files/lib/data/cronjob/Cronjob.class.php
@@ -108,7 +108,7 @@ public function getExpression(): CronExpression
      */
     public function isEditable()
     {
-        return $this->canBeEdited;
+        return !!$this->canBeEdited;
     }
 
     /**
@@ -128,7 +128,7 @@ public function isDeletable()
      */
     public function canBeDisabled()
     {
-        return $this->canBeDisabled;
+        return !!$this->canBeDisabled;
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/data/cronjob/CronjobEditor.class.php b/wcfsetup/install/files/lib/data/cronjob/CronjobEditor.class.php
index 25072ceb0c8..dc2707dc2d3 100644
--- a/wcfsetup/install/files/lib/data/cronjob/CronjobEditor.class.php
+++ b/wcfsetup/install/files/lib/data/cronjob/CronjobEditor.class.php
@@ -51,7 +51,7 @@ public static function create(array $parameters = [])
             $cronjobEditor->saveDescriptions($descriptions);
         }
 
-        /** @noinspection PhpIncompatibleReturnTypeInspection */
+        \assert($cronjob instanceof Cronjob);
         return $cronjob;
     }
 
diff --git a/wcfsetup/install/files/lib/data/file/FileEditor.class.php b/wcfsetup/install/files/lib/data/file/FileEditor.class.php
index d3e5ac3d578..5ae0dde3472 100644
--- a/wcfsetup/install/files/lib/data/file/FileEditor.class.php
+++ b/wcfsetup/install/files/lib/data/file/FileEditor.class.php
@@ -126,7 +126,7 @@ public static function createFromExistingFile(
 
         $objectType = FileProcessor::getInstance()->getObjectType($objectTypeName);
         if ($objectType === null) {
-            return new \RuntimeException("The object type '{$objectTypeName}' is not valid.");
+            throw new \RuntimeException("The object type '{$objectTypeName}' is not valid.");
         }
 
         $mimeType = FileUtil::getMimeType($pathname);
diff --git a/wcfsetup/install/files/lib/data/file/temporary/FileTemporary.class.php b/wcfsetup/install/files/lib/data/file/temporary/FileTemporary.class.php
index 0b5a4bfd4ab..bd0fc030fca 100644
--- a/wcfsetup/install/files/lib/data/file/temporary/FileTemporary.class.php
+++ b/wcfsetup/install/files/lib/data/file/temporary/FileTemporary.class.php
@@ -34,7 +34,7 @@ public function getChunkCount(): int
 
     public function getChunkSize(): int
     {
-        return \ceil($this->fileSize / $this->getChunkCount());
+        return (int)\ceil($this->fileSize / $this->getChunkCount());
     }
 
     public function hasChunk(int $sequenceNo): bool
@@ -81,6 +81,6 @@ public function getContext(): array
 
     public static function getNumberOfChunks(int $fileSize): int
     {
-        return \ceil($fileSize / FileProcessor::getInstance()->getOptimalChunkSize());
+        return (int)\ceil($fileSize / FileProcessor::getInstance()->getOptimalChunkSize());
     }
 }
diff --git a/wcfsetup/install/files/lib/data/label/group/ViewableLabelGroup.class.php b/wcfsetup/install/files/lib/data/label/group/ViewableLabelGroup.class.php
index 9583bda8035..0dc95b2f38d 100644
--- a/wcfsetup/install/files/lib/data/label/group/ViewableLabelGroup.class.php
+++ b/wcfsetup/install/files/lib/data/label/group/ViewableLabelGroup.class.php
@@ -256,7 +256,7 @@ public function search($objectID)
 
             return $this->current();
         } catch (SystemException $e) {
-            return;
+            return null;
         }
     }
 
diff --git a/wcfsetup/install/files/lib/data/like/LikeAction.class.php b/wcfsetup/install/files/lib/data/like/LikeAction.class.php
index 5b8862de71d..3ac12c25a18 100644
--- a/wcfsetup/install/files/lib/data/like/LikeAction.class.php
+++ b/wcfsetup/install/files/lib/data/like/LikeAction.class.php
@@ -127,8 +127,9 @@ public function validateLike()
         }
 
         // check if liking own content but forbidden by configuration
-        $this->likeableObject = $this->objectTypeProvider->getObjectByID($this->parameters['data']['objectID']);
-        \assert($this->likeableObject instanceof ILikeObject);
+        $likeableObject = $this->objectTypeProvider->getObjectByID($this->parameters['data']['objectID']);
+        \assert($likeableObject instanceof ILikeObject);
+        $this->likeableObject = $likeableObject;
         $this->likeableObject->setObjectType($this->objectType);
         if ($this->likeableObject->getUserID() == WCF::getUser()->userID) {
             throw new PermissionDeniedException();
diff --git a/wcfsetup/install/files/lib/data/media/MediaAction.class.php b/wcfsetup/install/files/lib/data/media/MediaAction.class.php
index 2cf50428b5c..2b84cab9958 100644
--- a/wcfsetup/install/files/lib/data/media/MediaAction.class.php
+++ b/wcfsetup/install/files/lib/data/media/MediaAction.class.php
@@ -146,7 +146,7 @@ public function generateThumbnails()
      * Returns the data of the media file to be returned by AJAX requests.
      *
      * @param Media|ViewableMedia $media media files whose data will be returned
-     * @return  string[]
+     * @return mixed[]
      */
     protected function getMediaData($media)
     {
@@ -227,7 +227,7 @@ public function validateGetManagementDialog()
     /**
      * Returns the dialog to manage media.
      *
-     * @return  string[]
+     * @return mixed[]
      */
     public function getManagementDialog()
     {
@@ -322,7 +322,7 @@ public function validateGetEditorDialog()
     /**
      * Returns the template for the media editor.
      *
-     * @return  string[]
+     * @return mixed[]
      */
     public function getEditorDialog()
     {
diff --git a/wcfsetup/install/files/lib/data/menu/item/MenuItemNode.class.php b/wcfsetup/install/files/lib/data/menu/item/MenuItemNode.class.php
index f3aeeb5b574..92d17cb2df2 100644
--- a/wcfsetup/install/files/lib/data/menu/item/MenuItemNode.class.php
+++ b/wcfsetup/install/files/lib/data/menu/item/MenuItemNode.class.php
@@ -56,6 +56,7 @@ public function __construct($parentNode = null, ?MenuItem $menuItem = null, $dep
         }
         parent::__construct($menuItem);
 
+        // @phpstan-ignore assign.propertyType
         $this->parentNode = $parentNode;
         $this->depth = $depth;
     }
@@ -67,6 +68,7 @@ public function __construct($parentNode = null, ?MenuItem $menuItem = null, $dep
      */
     public function setChildren(array $children): void
     {
+        // @phpstan-ignore assign.propertyType
         $this->children = $children;
     }
 
diff --git a/wcfsetup/install/files/lib/data/menu/item/MenuItemNodeTree.class.php b/wcfsetup/install/files/lib/data/menu/item/MenuItemNodeTree.class.php
index 8ea55836edc..2b434a954c9 100644
--- a/wcfsetup/install/files/lib/data/menu/item/MenuItemNodeTree.class.php
+++ b/wcfsetup/install/files/lib/data/menu/item/MenuItemNodeTree.class.php
@@ -169,6 +169,7 @@ protected function generateNodeTree($parentID = null, ?MenuItemNode $parentNode
      */
     public function getNodeTree()
     {
+        // @phpstan-ignore return.type
         return $this->node->getChildren();
     }
 
diff --git a/wcfsetup/install/files/lib/data/moderation/queue/ModerationQueueAction.class.php b/wcfsetup/install/files/lib/data/moderation/queue/ModerationQueueAction.class.php
index 66c688beef5..8c2de902789 100644
--- a/wcfsetup/install/files/lib/data/moderation/queue/ModerationQueueAction.class.php
+++ b/wcfsetup/install/files/lib/data/moderation/queue/ModerationQueueAction.class.php
@@ -56,8 +56,9 @@ public function create()
             $this->parameters['data']['lastChangeTime'] = TIME_NOW;
         }
 
-        /** @noinspection PhpIncompatibleReturnTypeInspection */
-        return parent::create();
+        $object = parent::create();
+        \assert($object instanceof ModerationQueue);
+        return $object;
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/data/package/Package.class.php b/wcfsetup/install/files/lib/data/package/Package.class.php
index 5efb91456ab..6af985aaacc 100644
--- a/wcfsetup/install/files/lib/data/package/Package.class.php
+++ b/wcfsetup/install/files/lib/data/package/Package.class.php
@@ -394,7 +394,7 @@ public static function checkFromversion(string $currentVersion, string $fromVers
      * Compares two version number strings.
      *
      * @param string $operator
-     * @return  bool        result
+     * @return int|bool        result
      * @see http://www.php.net/manual/en/function.version-compare.php
      */
     public static function compareVersion(string $version1, string $version2, $operator = null)
diff --git a/wcfsetup/install/files/lib/data/package/PackageCache.class.php b/wcfsetup/install/files/lib/data/package/PackageCache.class.php
index 1a0d4b43a79..b1ebe5944ff 100644
--- a/wcfsetup/install/files/lib/data/package/PackageCache.class.php
+++ b/wcfsetup/install/files/lib/data/package/PackageCache.class.php
@@ -64,7 +64,7 @@ public function getPackages()
      * Returns a specific package.
      *
      * @param string $package
-     * @return  Package
+     * @return ?Package
      */
     public function getPackageByIdentifier($package)
     {
diff --git a/wcfsetup/install/files/lib/data/package/installation/plugin/PackageInstallationPluginAction.class.php b/wcfsetup/install/files/lib/data/package/installation/plugin/PackageInstallationPluginAction.class.php
index 9c22db545d2..b5b4350758d 100644
--- a/wcfsetup/install/files/lib/data/package/installation/plugin/PackageInstallationPluginAction.class.php
+++ b/wcfsetup/install/files/lib/data/package/installation/plugin/PackageInstallationPluginAction.class.php
@@ -95,7 +95,7 @@ public function validateInvoke()
     /**
      * Invokes a single PIP and returns the time needed to process it.
      *
-     * @return      string[]
+     * @return array{invokeAgain: bool, pluginName: string, target: string, timeElapsed: string}
      */
     public function invoke()
     {
diff --git a/wcfsetup/install/files/lib/data/page/Page.class.php b/wcfsetup/install/files/lib/data/page/Page.class.php
index 419a92eb242..b00f3c32288 100644
--- a/wcfsetup/install/files/lib/data/page/Page.class.php
+++ b/wcfsetup/install/files/lib/data/page/Page.class.php
@@ -46,13 +46,13 @@
  * @property-read   int $hasFixedParent             is `1` if the page's parent page cannot be changed, otherwise `0`
  * @property-read   int $lastUpdateTime             timestamp at which the page has been updated the last time
  * @property-read   string $cssClassName               css class name(s) of the page
- * @property-read   string $availableDuringOfflineMode     is `1` if the page is available during offline mode, otherwise `0`
- * @property-read   string $allowSpidersToIndex            is `1` if the page is accessible for search spiders, otherwise `0`
- * @property-read   string $excludeFromLandingPage         is `1` if the page can never be set as landing page, otherwise `0`
- * @property-read   string $enableShareButtons             is `1` if the page should display share buttons, otherwise `0`
+ * @property-read   int $availableDuringOfflineMode     is `1` if the page is available during offline mode, otherwise `0`
+ * @property-read   int $allowSpidersToIndex            is `1` if the page is accessible for search spiders, otherwise `0`
+ * @property-read   int $excludeFromLandingPage         is `1` if the page can never be set as landing page, otherwise `0`
+ * @property-read   int $enableShareButtons             is `1` if the page should display share buttons, otherwise `0`
  * @property-read   string $permissions                comma separated list of user group permissions of which the active user needs to have at least one to access the page
  * @property-read   string $options                comma separated list of options of which at least one needs to be enabled for the page to be accessible
- * @property-read   bool $invertPermissions                is `1` if the permissions are inverted
+ * @property-read   int $invertPermissions                is `1` if the permissions are inverted
  */
 class Page extends DatabaseObject implements ILinkableObject, ITitledObject
 {
diff --git a/wcfsetup/install/files/lib/data/page/PageNode.class.php b/wcfsetup/install/files/lib/data/page/PageNode.class.php
index 36cc0283acc..0a66552abc9 100644
--- a/wcfsetup/install/files/lib/data/page/PageNode.class.php
+++ b/wcfsetup/install/files/lib/data/page/PageNode.class.php
@@ -43,6 +43,7 @@ public function __construct($parentNode = null, ?Page $page = null, int $depth =
         }
         parent::__construct($page);
 
+        // @phpstan-ignore assign.propertyType
         $this->parentNode = $parentNode;
         $this->depth = $depth;
     }
@@ -54,6 +55,7 @@ public function __construct($parentNode = null, ?Page $page = null, int $depth =
      */
     public function setChildren(array $children): void
     {
+        // @phpstan-ignore assign.propertyType
         $this->children = $children;
     }
 
diff --git a/wcfsetup/install/files/lib/data/page/PageNodeTree.class.php b/wcfsetup/install/files/lib/data/page/PageNodeTree.class.php
index ca637b16cc6..f4b758d1cf3 100644
--- a/wcfsetup/install/files/lib/data/page/PageNodeTree.class.php
+++ b/wcfsetup/install/files/lib/data/page/PageNodeTree.class.php
@@ -103,6 +103,7 @@ protected function generateNodeTree($parentID, ?PageNode $parentNode = null)
      */
     public function getNodeTree()
     {
+        // @phpstan-ignore return.type
         return $this->node->getChildren();
     }
 
diff --git a/wcfsetup/install/files/lib/data/poll/option/PollOption.class.php b/wcfsetup/install/files/lib/data/poll/option/PollOption.class.php
index e45b42d5b14..0a8c27aae9d 100644
--- a/wcfsetup/install/files/lib/data/poll/option/PollOption.class.php
+++ b/wcfsetup/install/files/lib/data/poll/option/PollOption.class.php
@@ -35,7 +35,7 @@ class PollOption extends DatabaseObject
     public function getRelativeVotes(Poll $poll)
     {
         if ($poll->votes) {
-            return \round(($this->votes / $poll->votes) * 100);
+            return (int)\round(($this->votes / $poll->votes) * 100);
         }
 
         return 0;
diff --git a/wcfsetup/install/files/lib/data/reaction/ReactionAction.class.php b/wcfsetup/install/files/lib/data/reaction/ReactionAction.class.php
index 48444b98b89..54739a5b639 100644
--- a/wcfsetup/install/files/lib/data/reaction/ReactionAction.class.php
+++ b/wcfsetup/install/files/lib/data/reaction/ReactionAction.class.php
@@ -198,8 +198,9 @@ public function validateReact()
         }
 
         // check if liking own content but forbidden by configuration
-        $this->likeableObject = $this->objectTypeProvider->getObjectByID($this->parameters['data']['objectID']);
-        \assert($this->likeableObject instanceof ILikeObject);
+        $likeableObject = $this->objectTypeProvider->getObjectByID($this->parameters['data']['objectID']);
+        \assert($likeableObject instanceof ILikeObject);
+        $this->likeableObject = $likeableObject;
         $this->likeableObject->setObjectType($this->objectType);
         if ($this->likeableObject->getUserID() == WCF::getUser()->userID) {
             throw new PermissionDeniedException();
diff --git a/wcfsetup/install/files/lib/data/search/ISearchResultObject.class.php b/wcfsetup/install/files/lib/data/search/ISearchResultObject.class.php
index daea87c6ed3..299dee1a240 100644
--- a/wcfsetup/install/files/lib/data/search/ISearchResultObject.class.php
+++ b/wcfsetup/install/files/lib/data/search/ISearchResultObject.class.php
@@ -2,6 +2,8 @@
 
 namespace wcf\data\search;
 
+use wcf\data\user\UserProfile;
+
 /**
  * All search result objects should implement this interface.
  *
@@ -14,7 +16,7 @@ interface ISearchResultObject
     /**
      * Returns author's user profile.
      *
-     * @return  \wcf\data\user\UserProfile
+     * @return ?UserProfile
      */
     public function getUserProfile();
 
diff --git a/wcfsetup/install/files/lib/data/session/SessionAction.class.php b/wcfsetup/install/files/lib/data/session/SessionAction.class.php
index 95b91bf1f70..91dfec0d3d9 100644
--- a/wcfsetup/install/files/lib/data/session/SessionAction.class.php
+++ b/wcfsetup/install/files/lib/data/session/SessionAction.class.php
@@ -75,7 +75,7 @@ public function validatePoll()
     /**
      * Polls notification data, including values provided by `keepAlive()`.
      *
-     * @return      array[]
+     * @return array{keepAliveData: array<string, mixed>, lastRequestTimestamp: int, pollData: array<string, mixed>}
      */
     public function poll()
     {
diff --git a/wcfsetup/install/files/lib/data/tag/TagCloudTag.class.php b/wcfsetup/install/files/lib/data/tag/TagCloudTag.class.php
index 8d0991812e6..adc5d3e1b11 100644
--- a/wcfsetup/install/files/lib/data/tag/TagCloudTag.class.php
+++ b/wcfsetup/install/files/lib/data/tag/TagCloudTag.class.php
@@ -32,7 +32,7 @@ class TagCloudTag extends DatabaseObjectDecorator
     /**
      * Sets the weight of the tag.
      *
-     * @param double $weight
+     * @param int $weight
      */
     public function setWeight($weight)
     {
diff --git a/wcfsetup/install/files/lib/data/template/TemplateEditor.class.php b/wcfsetup/install/files/lib/data/template/TemplateEditor.class.php
index 3370b9cd8ab..1611ce0b276 100644
--- a/wcfsetup/install/files/lib/data/template/TemplateEditor.class.php
+++ b/wcfsetup/install/files/lib/data/template/TemplateEditor.class.php
@@ -36,8 +36,9 @@ public static function create(array $parameters = [])
             $parameters['packageID'] = PACKAGE_ID;
         }
 
-        /** @noinspection PhpIncompatibleReturnTypeInspection */
-        return parent::create($parameters);
+        $object = parent::create($parameters);
+        \assert($object instanceof Template);
+        return $object;
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/data/trophy/TrophyCache.class.php b/wcfsetup/install/files/lib/data/trophy/TrophyCache.class.php
index 9533edc322b..75626af662f 100644
--- a/wcfsetup/install/files/lib/data/trophy/TrophyCache.class.php
+++ b/wcfsetup/install/files/lib/data/trophy/TrophyCache.class.php
@@ -29,7 +29,7 @@ class TrophyCache extends SingletonFactory
 
     /**
      * Contains all trophies sorted by the category.
-     * @var Trophy[]
+     * @var array<int, array<int, Trophy>>
      */
     protected $categorySortedTrophies;
 
diff --git a/wcfsetup/install/files/lib/data/unfurl/url/UnfurlUrlAction.class.php b/wcfsetup/install/files/lib/data/unfurl/url/UnfurlUrlAction.class.php
index c5160d5e884..3d922c7e572 100644
--- a/wcfsetup/install/files/lib/data/unfurl/url/UnfurlUrlAction.class.php
+++ b/wcfsetup/install/files/lib/data/unfurl/url/UnfurlUrlAction.class.php
@@ -75,7 +75,7 @@ private function saveImageData(array $imageData): int
         $statement = WCF::getDB()->prepare($sql);
         $statement->execute($statementParameters);
 
-        return WCF::getDB()->getInsertID("wcf1_unfurl_url_image", "imageID");
+        return (int)WCF::getDB()->getInsertID("wcf1_unfurl_url_image", "imageID");
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/data/user/User.class.php b/wcfsetup/install/files/lib/data/user/User.class.php
index 1199b6248df..25c433acdce 100644
--- a/wcfsetup/install/files/lib/data/user/User.class.php
+++ b/wcfsetup/install/files/lib/data/user/User.class.php
@@ -423,7 +423,7 @@ public function getAuthProvider()
     /**
      * Returns true if this user is marked.
      *
-     * @return  bool
+     * @return int
      */
     public function isMarked()
     {
@@ -731,7 +731,7 @@ public function canEmailConfirm()
      */
     public function mustSelfEmailConfirm()
     {
-        return REGISTER_ACTIVATION_METHOD & self::REGISTER_ACTIVATION_USER;
+        return !!(REGISTER_ACTIVATION_METHOD & self::REGISTER_ACTIVATION_USER);
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/data/user/UserProfile.class.php b/wcfsetup/install/files/lib/data/user/UserProfile.class.php
index 3efb0e051bd..48e7dc911a6 100644
--- a/wcfsetup/install/files/lib/data/user/UserProfile.class.php
+++ b/wcfsetup/install/files/lib/data/user/UserProfile.class.php
@@ -108,7 +108,7 @@ class UserProfile extends DatabaseObjectDecorator implements ITitledLinkObject
 
     /**
      * user cover photo
-     * @var UserCoverPhoto
+     * @var ?IUserCoverPhoto
      */
     protected $coverPhoto;
 
@@ -350,42 +350,40 @@ public function isIgnoredByUser($userID)
     public function getAvatar()
     {
         if ($this->avatar === null) {
+            $avatar = null;
             if (!$this->disableAvatar) {
                 if ($this->canSeeAvatar()) {
                     if ($this->avatarFileID !== null) {
                         $data = UserStorageHandler::getInstance()->getField('avatar', $this->userID);
                         if ($data === null) {
-                            $this->avatar = FileRuntimeCache::getInstance()->getObject($this->avatarFileID);
+                            $avatar = FileRuntimeCache::getInstance()->getObject($this->avatarFileID);
 
                             UserStorageHandler::getInstance()->update(
                                 $this->userID,
                                 'avatar',
-                                \serialize($this->avatar)
+                                \serialize($avatar)
                             );
                         } else {
-                            $this->avatar = \unserialize($data);
+                            $avatar = \unserialize($data);
                         }
                     } else {
                         $parameters = ['avatar' => null];
                         EventHandler::getInstance()->fireAction($this, 'getAvatar', $parameters);
 
-                        if ($parameters['avatar'] !== null) {
-                            if (!($parameters['avatar'] instanceof IUserAvatar)) {
-                                throw new ImplementationException(
-                                    \get_class($parameters['avatar']),
-                                    IUserAvatar::class
-                                );
-                            }
-
-                            $this->avatar = $parameters['avatar'];
+                        $avatar = $parameters['avatar'];
+                        if ($avatar !== null && !($avatar instanceof IUserAvatar)) {
+                            throw new ImplementationException(
+                                \get_class($avatar),
+                                IUserAvatar::class
+                            );
                         }
                     }
                 }
             }
 
             // use default avatar
-            if ($this->avatar === null) {
-                $this->avatar = new DefaultAvatar($this->username ?: '');
+            if ($avatar === null) {
+                $avatar = new DefaultAvatar($this->username ?: '');
             }
 
             $this->avatar = new AvatarDecorator($this->avatar);
diff --git a/wcfsetup/install/files/lib/data/user/activity/event/UserActivityEventAction.class.php b/wcfsetup/install/files/lib/data/user/activity/event/UserActivityEventAction.class.php
index 96883e85d9c..cf87a5ed1ac 100644
--- a/wcfsetup/install/files/lib/data/user/activity/event/UserActivityEventAction.class.php
+++ b/wcfsetup/install/files/lib/data/user/activity/event/UserActivityEventAction.class.php
@@ -49,9 +49,11 @@ public function validateLoad()
         if ($this->parameters['boxID']) {
             $box = new Box($this->parameters['boxID']);
             if ($box->boxID) {
-                $this->boxController = $box->getController();
-                if ($this->boxController instanceof RecentActivityListBoxController) {
+                $boxController = $box->getController();
+                if ($boxController instanceof RecentActivityListBoxController) {
                     // all checks passed, end validation; otherwise throw the exception below
+                    $this->boxController = $boxController;
+
                     return;
                 }
             }
diff --git a/wcfsetup/install/files/lib/data/user/group/UserGroup.class.php b/wcfsetup/install/files/lib/data/user/group/UserGroup.class.php
index b9fd5600d64..49a42ef0f12 100644
--- a/wcfsetup/install/files/lib/data/user/group/UserGroup.class.php
+++ b/wcfsetup/install/files/lib/data/user/group/UserGroup.class.php
@@ -9,6 +9,7 @@
 use wcf\system\database\util\PreparedStatementConditionBuilder;
 use wcf\system\exception\SystemException;
 use wcf\system\WCF;
+use wcf\util\ArrayUtil;
 
 /**
  * Represents a user group.
@@ -68,7 +69,7 @@ class UserGroup extends DatabaseObject implements ITitledObject
 
     /**
      * group cache
-     * @var UserGroup[]
+     * @var array{groups: array<int, UserGroup>, types: array<string, int[]>}
      */
     protected static $cache;
 
@@ -79,7 +80,7 @@ class UserGroup extends DatabaseObject implements ITitledObject
     protected static $accessibleGroups;
 
     /**
-     * @var UserGroup|null
+     * @var UserGroup|false
      */
     protected static $ownerGroup = false;
 
@@ -276,10 +277,10 @@ public function canCopy()
     public static function isAccessibleGroup(array $groupIDs = [])
     {
         if (self::$accessibleGroups === null) {
-            self::$accessibleGroups = \explode(
+            self::$accessibleGroups = ArrayUtil::toIntegerArray(\explode(
                 ',',
                 WCF::getSession()->getPermission('admin.user.accessibleGroups') ?: ''
-            );
+            ));
         }
 
         if (empty($groupIDs)) {
@@ -642,7 +643,7 @@ public static function sortGroups(array &$userGroups)
         $collator = new \Collator(WCF::getLanguage()->getLocale());
         \uasort(
             $userGroups,
-            static fn (self $groupA, self $groupB) => $collator->compare($groupA->getName(), $groupB->getName())
+            static fn(self $groupA, self $groupB) => $collator->compare($groupA->getName(), $groupB->getName())
         );
     }
 }
diff --git a/wcfsetup/install/files/lib/data/user/option/category/UserOptionCategoryEditor.class.php b/wcfsetup/install/files/lib/data/user/option/category/UserOptionCategoryEditor.class.php
index 05bb63ec4c0..afbb4587646 100644
--- a/wcfsetup/install/files/lib/data/user/option/category/UserOptionCategoryEditor.class.php
+++ b/wcfsetup/install/files/lib/data/user/option/category/UserOptionCategoryEditor.class.php
@@ -34,8 +34,9 @@ public static function create(array $parameters = [])
             $parameters['packageID'] = PACKAGE_ID;
         }
 
-        /** @noinspection PhpIncompatibleReturnTypeInspection */
-        return parent::create($parameters);
+        $object = parent::create($parameters);
+        \assert($object instanceof UserOptionCategory);
+        return $object;
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/data/user/profile/menu/item/UserProfileMenuItemEditor.class.php b/wcfsetup/install/files/lib/data/user/profile/menu/item/UserProfileMenuItemEditor.class.php
index 93a2ac6a097..6620732d0db 100644
--- a/wcfsetup/install/files/lib/data/user/profile/menu/item/UserProfileMenuItemEditor.class.php
+++ b/wcfsetup/install/files/lib/data/user/profile/menu/item/UserProfileMenuItemEditor.class.php
@@ -33,8 +33,9 @@ public static function create(array $parameters = [])
         // calculate show order
         $parameters['showOrder'] = self::getShowOrder($parameters['showOrder'] ?? 0);
 
-        /** @noinspection PhpIncompatibleReturnTypeInspection */
-        return parent::create($parameters);
+        $object = parent::create($parameters);
+        \assert($object instanceof UserProfileMenuItem);
+        return $object;
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/data/user/trophy/UserTrophy.class.php b/wcfsetup/install/files/lib/data/user/trophy/UserTrophy.class.php
index f5e6fb1fc0d..57c74b7bbe7 100644
--- a/wcfsetup/install/files/lib/data/user/trophy/UserTrophy.class.php
+++ b/wcfsetup/install/files/lib/data/user/trophy/UserTrophy.class.php
@@ -25,7 +25,7 @@
  * @property-read   int $userID             user id
  * @property-read   int $time               the time when the trophy was rewarded
  * @property-read   string $description            the custom trophy description
- * @property-read   string $useCustomDescription       `1`, if the trophy use a custom description
+ * @property-read   int $useCustomDescription       `1`, if the trophy use a custom description
  * @property-read   int $trophyUseHtml              `1`, if the trophy use a html description
  */
 class UserTrophy extends DatabaseObject
diff --git a/wcfsetup/install/files/lib/form/AbstractCaptchaForm.class.php b/wcfsetup/install/files/lib/form/AbstractCaptchaForm.class.php
index 084fdf1a774..eb7a7ba2729 100644
--- a/wcfsetup/install/files/lib/form/AbstractCaptchaForm.class.php
+++ b/wcfsetup/install/files/lib/form/AbstractCaptchaForm.class.php
@@ -2,6 +2,7 @@
 
 namespace wcf\form;
 
+use wcf\data\object\type\ObjectType;
 use wcf\system\captcha\CaptchaHandler;
 use wcf\system\exception\SystemException;
 use wcf\system\WCF;
@@ -17,7 +18,7 @@ abstract class AbstractCaptchaForm extends AbstractForm
 {
     /**
      * captcha object type object
-     * @var \wcf\data\object\type\ObjectType
+     * @var ?ObjectType
      */
     public $captchaObjectType;
 
diff --git a/wcfsetup/install/files/lib/form/AbstractForm.class.php b/wcfsetup/install/files/lib/form/AbstractForm.class.php
index 448ef75e13c..17388bc6520 100644
--- a/wcfsetup/install/files/lib/form/AbstractForm.class.php
+++ b/wcfsetup/install/files/lib/form/AbstractForm.class.php
@@ -27,13 +27,13 @@ abstract class AbstractForm extends AbstractPage implements IForm
 
     /**
      * name of error field
-     * @var string
+     * @var string|string[]
      */
     public $errorField = '';
 
     /**
      * error type
-     * @var string
+     * @var string|string[]
      */
     public $errorType = '';
 
diff --git a/wcfsetup/install/files/lib/form/MessageForm.class.php b/wcfsetup/install/files/lib/form/MessageForm.class.php
index 332da7da8f0..68d71dd8005 100644
--- a/wcfsetup/install/files/lib/form/MessageForm.class.php
+++ b/wcfsetup/install/files/lib/form/MessageForm.class.php
@@ -84,7 +84,7 @@ abstract class MessageForm extends AbstractCaptchaForm
 
     /**
      * content language id
-     * @var int
+     * @var ?int
      */
     public $languageID;
 
diff --git a/wcfsetup/install/files/lib/form/RegisterForm.class.php b/wcfsetup/install/files/lib/form/RegisterForm.class.php
index 5e5616d86c7..74b39868d86 100644
--- a/wcfsetup/install/files/lib/form/RegisterForm.class.php
+++ b/wcfsetup/install/files/lib/form/RegisterForm.class.php
@@ -63,7 +63,7 @@ class RegisterForm extends UserAddForm
 
     /**
      * captcha object type object
-     * @var ObjectType
+     * @var ?ObjectType
      */
     public $captchaObjectType;
 
@@ -77,7 +77,7 @@ class RegisterForm extends UserAddForm
      * true if captcha is used
      * @var bool
      */
-    public $useCaptcha = REGISTER_USE_CAPTCHA;
+    public $useCaptcha = !!REGISTER_USE_CAPTCHA;
 
     /**
      * field names
diff --git a/wcfsetup/install/files/lib/form/SearchForm.class.php b/wcfsetup/install/files/lib/form/SearchForm.class.php
index 09d3a77b86d..304c68ea73e 100644
--- a/wcfsetup/install/files/lib/form/SearchForm.class.php
+++ b/wcfsetup/install/files/lib/form/SearchForm.class.php
@@ -35,13 +35,12 @@ class SearchForm extends AbstractCaptchaForm
 
     /**
      * end date
-     * @var int
+     * @var string
      */
     public $endDate = '';
 
     /**
-     * true, if search should be modified
-     * @var bool
+     * @var ?Search
      */
     public $modifySearch;
 
@@ -123,7 +122,7 @@ class SearchForm extends AbstractCaptchaForm
 
     /**
      * start date
-     * @var int
+     * @var string
      */
     public $startDate = '';
 
diff --git a/wcfsetup/install/files/lib/page/AbstractPage.class.php b/wcfsetup/install/files/lib/page/AbstractPage.class.php
index d9379b876c5..14925b01f04 100644
--- a/wcfsetup/install/files/lib/page/AbstractPage.class.php
+++ b/wcfsetup/install/files/lib/page/AbstractPage.class.php
@@ -91,7 +91,7 @@ abstract class AbstractPage implements IPage
 
     /**
      * enables template usage
-     * @var string
+     * @var bool
      */
     public $useTemplate = true;
 
diff --git a/wcfsetup/install/files/lib/page/AttachmentPage.class.php b/wcfsetup/install/files/lib/page/AttachmentPage.class.php
index 8bffb9a48af..aa790df2be4 100644
--- a/wcfsetup/install/files/lib/page/AttachmentPage.class.php
+++ b/wcfsetup/install/files/lib/page/AttachmentPage.class.php
@@ -41,13 +41,13 @@ class AttachmentPage extends AbstractPage
 
     /**
      * shows the tiny thumbnail
-     * @var bool
+     * @var int
      */
     public $tiny = 0;
 
     /**
      * shows the standard thumbnail
-     * @var bool
+     * @var int
      */
     public $thumbnail = 0;
 
@@ -169,7 +169,7 @@ public function readData()
             $mimeType = $this->attachment->fileType;
             $filesize = $this->attachment->filesize;
             $location = $this->attachment->getLocation();
-            $this->eTag = $this->attachmentID;
+            $this->eTag = (string)$this->attachmentID;
         }
 
         // unsaved attachments may be cached by the browser for up to 5 minutes only
diff --git a/wcfsetup/install/files/lib/page/MediaPage.class.php b/wcfsetup/install/files/lib/page/MediaPage.class.php
index 70cd69bcc99..a2cf6a7324f 100644
--- a/wcfsetup/install/files/lib/page/MediaPage.class.php
+++ b/wcfsetup/install/files/lib/page/MediaPage.class.php
@@ -88,7 +88,7 @@ public function readData()
             $mimeType = $this->media->fileType;
             $filesize = $this->media->filesize;
             $location = $this->media->getLocation();
-            $this->eTag = $this->mediaID;
+            $this->eTag = (string)$this->mediaID;
         }
 
         $this->eTag .= '_' . $this->media->fileHash;
diff --git a/wcfsetup/install/files/lib/page/PaidSubscriptionListPage.class.php b/wcfsetup/install/files/lib/page/PaidSubscriptionListPage.class.php
index 4ad4a3afbe4..6183e146c60 100644
--- a/wcfsetup/install/files/lib/page/PaidSubscriptionListPage.class.php
+++ b/wcfsetup/install/files/lib/page/PaidSubscriptionListPage.class.php
@@ -40,9 +40,9 @@ class PaidSubscriptionListPage extends AbstractPage
 
     /**
      * list of user subscriptions
-     * @var PaidSubscriptionUserList
+     * @var ?PaidSubscriptionUserList
      */
-    public $userSubscriptionList = [];
+    public $userSubscriptionList;
 
     /**
      * @inheritDoc
diff --git a/wcfsetup/install/files/lib/system/MetaTagHandler.class.php b/wcfsetup/install/files/lib/system/MetaTagHandler.class.php
index 5b6edc03500..6c7eedf8da2 100644
--- a/wcfsetup/install/files/lib/system/MetaTagHandler.class.php
+++ b/wcfsetup/install/files/lib/system/MetaTagHandler.class.php
@@ -112,7 +112,7 @@ public function current(): string
      *
      * @see \Iterator::key()
      */
-    public function key(): string
+    public function key(): int
     {
         return $this->indexToObject[$this->index];
     }
diff --git a/wcfsetup/install/files/lib/system/SingletonFactory.class.php b/wcfsetup/install/files/lib/system/SingletonFactory.class.php
index a79146bec5d..89dda5ff1ff 100644
--- a/wcfsetup/install/files/lib/system/SingletonFactory.class.php
+++ b/wcfsetup/install/files/lib/system/SingletonFactory.class.php
@@ -15,7 +15,7 @@ abstract class SingletonFactory
 {
     /**
      * list of singletons
-     * @var SingletonFactory[]
+     * @var static[]
      */
     protected static $__singletonObjects = [];
 
diff --git a/wcfsetup/install/files/lib/system/WCFSetup.class.php b/wcfsetup/install/files/lib/system/WCFSetup.class.php
index ca13beca36b..4af2da609f5 100644
--- a/wcfsetup/install/files/lib/system/WCFSetup.class.php
+++ b/wcfsetup/install/files/lib/system/WCFSetup.class.php
@@ -71,7 +71,7 @@ final class WCFSetup extends WCF
 
     /**
      * indicates if developer mode is used to install
-     * @var bool
+     * @var int
      */
     protected static $developerMode = 0;
 
diff --git a/wcfsetup/install/files/lib/system/acl/ACLHandler.class.php b/wcfsetup/install/files/lib/system/acl/ACLHandler.class.php
index 4059f3aa618..6f0fd9bd6d6 100644
--- a/wcfsetup/install/files/lib/system/acl/ACLHandler.class.php
+++ b/wcfsetup/install/files/lib/system/acl/ACLHandler.class.php
@@ -27,7 +27,7 @@ class ACLHandler extends SingletonFactory
 {
     /**
      * indicates if assignment of variables is disabled
-     * @var int
+     * @var bool
      */
     protected $assignVariablesDisabled = false;
 
diff --git a/wcfsetup/install/files/lib/system/ad/AdHandler.class.php b/wcfsetup/install/files/lib/system/ad/AdHandler.class.php
index e720d67f34a..0c0861431ed 100644
--- a/wcfsetup/install/files/lib/system/ad/AdHandler.class.php
+++ b/wcfsetup/install/files/lib/system/ad/AdHandler.class.php
@@ -105,7 +105,7 @@ public function getLocationObjectTypes($categoryName = null)
     /**
      * Returns the list of available locations used to be used for selections.
      *
-     * @return  string[]
+     * @return array<string, array<int, string>>
      */
     public function getLocationSelection()
     {
diff --git a/wcfsetup/install/files/lib/system/attachment/AbstractAttachmentObjectType.class.php b/wcfsetup/install/files/lib/system/attachment/AbstractAttachmentObjectType.class.php
index 8dee070931a..9174592d4e4 100644
--- a/wcfsetup/install/files/lib/system/attachment/AbstractAttachmentObjectType.class.php
+++ b/wcfsetup/install/files/lib/system/attachment/AbstractAttachmentObjectType.class.php
@@ -2,7 +2,7 @@
 
 namespace wcf\system\attachment;
 
-use wcf\data\DatabaseObject;
+use wcf\data\IUserContent;
 use wcf\system\WCF;
 use wcf\util\ArrayUtil;
 
@@ -17,7 +17,7 @@ abstract class AbstractAttachmentObjectType implements IAttachmentObjectType
 {
     /**
      * cached objects
-     * @var DatabaseObject[]
+     * @var IUserContent[]
      */
     protected $cachedObjects = [];
 
diff --git a/wcfsetup/install/files/lib/system/attachment/AttachmentHandler.class.php b/wcfsetup/install/files/lib/system/attachment/AttachmentHandler.class.php
index 0cdd3a32015..da898966d8e 100644
--- a/wcfsetup/install/files/lib/system/attachment/AttachmentHandler.class.php
+++ b/wcfsetup/install/files/lib/system/attachment/AttachmentHandler.class.php
@@ -356,7 +356,9 @@ public function getHtmlElement(): string
     private function getFileProcessor(): AttachmentFileProcessor
     {
         if (!isset($this->fileProcessor)) {
-            $this->fileProcessor = FileProcessor::getInstance()->getProcessorByName('com.woltlab.wcf.attachment');
+            $fileProcessor = FileProcessor::getInstance()->getProcessorByName('com.woltlab.wcf.attachment');
+            \assert($fileProcessor instanceof AttachmentFileProcessor);
+            $this->fileProcessor = $fileProcessor;
         }
 
         return $this->fileProcessor;
diff --git a/wcfsetup/install/files/lib/system/attachment/IAttachmentObjectType.class.php b/wcfsetup/install/files/lib/system/attachment/IAttachmentObjectType.class.php
index 41eb02cfbb9..3fcfec06fc2 100644
--- a/wcfsetup/install/files/lib/system/attachment/IAttachmentObjectType.class.php
+++ b/wcfsetup/install/files/lib/system/attachment/IAttachmentObjectType.class.php
@@ -73,7 +73,7 @@ public function getMaxCount();
      * Returns the container object of an attachment or `null` if the container object does not exist.
      *
      * @param int $objectID
-     * @return  IUserContent|null
+     * @return  ?IUserContent
      */
     public function getObject($objectID);
 
diff --git a/wcfsetup/install/files/lib/system/bbcode/AttachmentBBCode.class.php b/wcfsetup/install/files/lib/system/bbcode/AttachmentBBCode.class.php
index 066716a924c..b9878698a7b 100644
--- a/wcfsetup/install/files/lib/system/bbcode/AttachmentBBCode.class.php
+++ b/wcfsetup/install/files/lib/system/bbcode/AttachmentBBCode.class.php
@@ -270,9 +270,13 @@ private function getAttachment(int $attachmentID): ?Attachment
             return null;
         }
 
-        return MessageEmbeddedObjectManager::getInstance()->getObject(
+        $attachment = MessageEmbeddedObjectManager::getInstance()->getObject(
             'com.woltlab.wcf.attachment',
             $attachmentID
         );
+
+        \assert($attachment === null || $attachment instanceof Attachment);
+
+        return $attachment;
     }
 }
diff --git a/wcfsetup/install/files/lib/system/bbcode/BBCodeHandler.class.php b/wcfsetup/install/files/lib/system/bbcode/BBCodeHandler.class.php
index ea228ee98dd..15f251171db 100644
--- a/wcfsetup/install/files/lib/system/bbcode/BBCodeHandler.class.php
+++ b/wcfsetup/install/files/lib/system/bbcode/BBCodeHandler.class.php
@@ -29,7 +29,7 @@ class BBCodeHandler extends SingletonFactory
 
     /**
      * list of BBCodes disallowed for usage
-     * @var BBCode[]
+     * @var string[]
      */
     protected $disallowedBBCodes = [];
 
diff --git a/wcfsetup/install/files/lib/system/bbcode/WoltLabSuiteArticleBBCode.class.php b/wcfsetup/install/files/lib/system/bbcode/WoltLabSuiteArticleBBCode.class.php
index eac43642314..5ef58313dba 100644
--- a/wcfsetup/install/files/lib/system/bbcode/WoltLabSuiteArticleBBCode.class.php
+++ b/wcfsetup/install/files/lib/system/bbcode/WoltLabSuiteArticleBBCode.class.php
@@ -51,9 +51,12 @@ public function getParsedTag(array $openingTag, $content, array $closingTag, BBC
 
     private function getArticle(int $articleID): ?ViewableArticle
     {
-        return MessageEmbeddedObjectManager::getInstance()->getObject(
+        $article = MessageEmbeddedObjectManager::getInstance()->getObject(
             'com.woltlab.wcf.article',
             $articleID
         );
+        \assert($article === null || $article instanceof ViewableArticle);
+
+        return $article;
     }
 }
diff --git a/wcfsetup/install/files/lib/system/box/AbstractDatabaseObjectListBoxController.class.php b/wcfsetup/install/files/lib/system/box/AbstractDatabaseObjectListBoxController.class.php
index 5ecb2584f30..878e3b2c395 100644
--- a/wcfsetup/install/files/lib/system/box/AbstractDatabaseObjectListBoxController.class.php
+++ b/wcfsetup/install/files/lib/system/box/AbstractDatabaseObjectListBoxController.class.php
@@ -281,7 +281,7 @@ public function getConditionsTemplate()
     /**
      * Returns the database object list used to read the objects displayed in the box.
      *
-     * @return  DatabaseObjectList
+     * @return ?DatabaseObjectList
      */
     abstract protected function getObjectList();
 
diff --git a/wcfsetup/install/files/lib/system/box/RecentActivityListBoxController.class.php b/wcfsetup/install/files/lib/system/box/RecentActivityListBoxController.class.php
index 42a5212a500..b6ec1b372fc 100644
--- a/wcfsetup/install/files/lib/system/box/RecentActivityListBoxController.class.php
+++ b/wcfsetup/install/files/lib/system/box/RecentActivityListBoxController.class.php
@@ -87,6 +87,7 @@ public function getLink(): string
 
     /**
      * @inheritDoc
+     * @return ViewableUserActivityEventList
      */
     protected function getObjectList()
     {
diff --git a/wcfsetup/install/files/lib/system/bulk/processing/user/SendMailUserBulkProcessingAction.class.php b/wcfsetup/install/files/lib/system/bulk/processing/user/SendMailUserBulkProcessingAction.class.php
index 782fd7aeaed..f596f11f7a9 100644
--- a/wcfsetup/install/files/lib/system/bulk/processing/user/SendMailUserBulkProcessingAction.class.php
+++ b/wcfsetup/install/files/lib/system/bulk/processing/user/SendMailUserBulkProcessingAction.class.php
@@ -58,7 +58,7 @@ public function executeAction(DatabaseObjectList $objectList)
             if ($userMailData === null) {
                 $userMailData = [];
             }
-            $this->mailID = \count($userMailData) + 1;
+            $this->mailID = (string)(\count($userMailData) + 1);
             $userMailData[$this->mailID] = [
                 'action' => '',
                 'enableHTML' => $this->enableHTML,
diff --git a/wcfsetup/install/files/lib/system/cache/builder/ACPMenuCacheBuilder.class.php b/wcfsetup/install/files/lib/system/cache/builder/ACPMenuCacheBuilder.class.php
index 635d70ffd29..38341e3ffbe 100644
--- a/wcfsetup/install/files/lib/system/cache/builder/ACPMenuCacheBuilder.class.php
+++ b/wcfsetup/install/files/lib/system/cache/builder/ACPMenuCacheBuilder.class.php
@@ -26,7 +26,7 @@ class ACPMenuCacheBuilder extends AbstractCacheBuilder
 
     /**
      * list of option categories grouped by the name of their parent category
-     * @var OptionCategory[]
+     * @var array<string, OptionCategory[]>
      */
     protected $categoryStructure = [];
 
diff --git a/wcfsetup/install/files/lib/system/cache/builder/RoutingCacheBuilder.class.php b/wcfsetup/install/files/lib/system/cache/builder/RoutingCacheBuilder.class.php
index b0f3543bcd3..c6bcfe9bea8 100644
--- a/wcfsetup/install/files/lib/system/cache/builder/RoutingCacheBuilder.class.php
+++ b/wcfsetup/install/files/lib/system/cache/builder/RoutingCacheBuilder.class.php
@@ -233,7 +233,7 @@ protected function getCustomUrls()
     /**
      * Returns the list of landing pages per application.
      *
-     * @return  string[]
+     * @return array<string, array{controller: string, routePart: string, className: string}>
      */
     protected function getLandingPages()
     {
diff --git a/wcfsetup/install/files/lib/system/cache/builder/TagCloudCacheBuilder.class.php b/wcfsetup/install/files/lib/system/cache/builder/TagCloudCacheBuilder.class.php
index 7b6d2df9755..8a7ca6b62c3 100644
--- a/wcfsetup/install/files/lib/system/cache/builder/TagCloudCacheBuilder.class.php
+++ b/wcfsetup/install/files/lib/system/cache/builder/TagCloudCacheBuilder.class.php
@@ -18,14 +18,12 @@
 class TagCloudCacheBuilder extends AbstractCacheBuilder
 {
     /**
-     * list of tags
      * @var TagCloudTag[]
      */
     protected $tags = [];
 
     /**
-     * language ids
-     * @var int
+     * @var int[]
      */
     protected $languageIDs = [];
 
@@ -35,8 +33,7 @@ class TagCloudCacheBuilder extends AbstractCacheBuilder
     protected $maxLifetime = 3600;
 
     /**
-     * object type ids
-     * @var int
+     * @var int[]
      */
     protected $objectTypeIDs = [];
 
diff --git a/wcfsetup/install/files/lib/system/clipboard/action/AbstractClipboardAction.class.php b/wcfsetup/install/files/lib/system/clipboard/action/AbstractClipboardAction.class.php
index 7e5b8839999..e5ac3e5e980 100644
--- a/wcfsetup/install/files/lib/system/clipboard/action/AbstractClipboardAction.class.php
+++ b/wcfsetup/install/files/lib/system/clipboard/action/AbstractClipboardAction.class.php
@@ -67,7 +67,7 @@ public function execute(array $objects, ClipboardAction $action)
         if (\method_exists($this, $methodName)) {
             $objectIDs = $this->{$methodName}();
             if (empty($objectIDs)) {
-                return;
+                return null;
             }
 
             $item->addParameter('objectIDs', $objectIDs);
diff --git a/wcfsetup/install/files/lib/system/clipboard/action/ArticleClipboardAction.class.php b/wcfsetup/install/files/lib/system/clipboard/action/ArticleClipboardAction.class.php
new file mode 100644
index 00000000000..e6d2fa5292c
--- /dev/null
+++ b/wcfsetup/install/files/lib/system/clipboard/action/ArticleClipboardAction.class.php
@@ -0,0 +1,215 @@
+<?php
+
+namespace wcf\system\clipboard\action;
+
+use wcf\data\article\Article;
+use wcf\data\article\ArticleAction;
+use wcf\data\category\CategoryNodeTree;
+use wcf\data\clipboard\action\ClipboardAction;
+use wcf\system\WCF;
+
+/**
+ * Clipboard action implementation for articles.
+ *
+ * @author  Matthias Schmidt
+ * @copyright   2001-2019 WoltLab GmbH
+ * @license GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @since   3.1
+ */
+class ArticleClipboardAction extends AbstractClipboardAction
+{
+    /**
+     * @inheritDoc
+     */
+    protected $actionClassActions = [
+        'delete',
+        'publish',
+        'restore',
+        'trash',
+        'unpublish',
+    ];
+
+    /**
+     * @inheritDoc
+     */
+    protected $supportedActions = [
+        'delete',
+        'publish',
+        'restore',
+        'setCategory',
+        'trash',
+        'unpublish',
+    ];
+
+    /**
+     * @inheritDoc
+     */
+    public function execute(array $objects, ClipboardAction $action)
+    {
+        $item = parent::execute($objects, $action);
+
+        if ($item === null) {
+            return null;
+        }
+
+        // handle actions
+        switch ($action->actionName) {
+            case 'delete':
+                $item->addInternalData(
+                    'confirmMessage',
+                    WCF::getLanguage()->getDynamicVariable(
+                        'wcf.clipboard.item.com.woltlab.wcf.article.delete.confirmMessage',
+                        [
+                            'count' => $item->getCount(),
+                        ]
+                    )
+                );
+                break;
+
+            case 'setCategory':
+                $item->addInternalData('template', WCF::getTPL()->fetch('articleCategoryDialog', 'wcf', [
+                    'categoryNodeList' => (new CategoryNodeTree('com.woltlab.wcf.article.category'))->getIterator(),
+                ]));
+                break;
+
+            case 'trash':
+                $item->addInternalData(
+                    'confirmMessage',
+                    WCF::getLanguage()->getDynamicVariable(
+                        'wcf.clipboard.item.com.woltlab.wcf.article.trash.confirmMessage',
+                        [
+                            'count' => $item->getCount(),
+                        ]
+                    )
+                );
+                break;
+        }
+
+        return $item;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getClassName()
+    {
+        return ArticleAction::class;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getTypeName()
+    {
+        return 'com.woltlab.wcf.article';
+    }
+
+    /**
+     * Returns the ids of the articles that can be deleted.
+     *
+     * @return  int[]
+     */
+    public function validateDelete()
+    {
+        $objectIDs = [];
+
+        /** @var Article $article */
+        foreach ($this->objects as $article) {
+            if ($article->canDelete() && $article->isDeleted) {
+                $objectIDs[] = $article->articleID;
+            }
+        }
+
+        return $objectIDs;
+    }
+
+    /**
+     * Returns the ids of the articles that can be published.
+     *
+     * @return  int[]
+     */
+    public function validatePublish()
+    {
+        $objectIDs = [];
+
+        /** @var Article $article */
+        foreach ($this->objects as $article) {
+            if ($article->canPublish() && $article->publicationStatus == Article::UNPUBLISHED) {
+                $objectIDs[] = $article->articleID;
+            }
+        }
+
+        return $objectIDs;
+    }
+
+    /**
+     * Returns the ids of the articles that can be restored.
+     *
+     * @return  int[]
+     */
+    public function validateRestore()
+    {
+        return $this->validateDelete();
+    }
+
+    /**
+     * Returns the ids of the articles whose category can be set.
+     *
+     * @return  int[]
+     */
+    public function validateSetCategory()
+    {
+        if (!WCF::getSession()->getPermission('admin.content.article.canManageArticle')) {
+            return [];
+        }
+
+        $objectIDs = [];
+
+        /** @var Article $article */
+        foreach ($this->objects as $article) {
+            if ($article->canEdit()) {
+                $objectIDs[] = $article->articleID;
+            }
+        }
+
+        return $objectIDs;
+    }
+
+    /**
+     * Returns the ids of the articles that can be trashed.
+     *
+     * @return  int[]
+     */
+    public function validateTrash()
+    {
+        $objectIDs = [];
+
+        /** @var Article $article */
+        foreach ($this->objects as $article) {
+            if ($article->canDelete() && !$article->isDeleted) {
+                $objectIDs[] = $article->articleID;
+            }
+        }
+
+        return $objectIDs;
+    }
+
+    /**
+     * Returns the ids of the articles that can be unpublished.
+     *
+     * @return  int[]
+     */
+    public function validateUnpublish()
+    {
+        $objectIDs = [];
+
+        /** @var Article $article */
+        foreach ($this->objects as $article) {
+            if ($article->canPublish() && $article->publicationStatus == Article::PUBLISHED) {
+                $objectIDs[] = $article->articleID;
+            }
+        }
+
+        return $objectIDs;
+    }
+}
diff --git a/wcfsetup/install/files/lib/system/clipboard/action/MediaClipboardAction.class.php b/wcfsetup/install/files/lib/system/clipboard/action/MediaClipboardAction.class.php
index 9392706c9b5..dabac452ad1 100644
--- a/wcfsetup/install/files/lib/system/clipboard/action/MediaClipboardAction.class.php
+++ b/wcfsetup/install/files/lib/system/clipboard/action/MediaClipboardAction.class.php
@@ -40,7 +40,7 @@ public function execute(array $objects, ClipboardAction $action)
         $item = parent::execute($objects, $action);
 
         if ($item === null) {
-            return;
+            return null;
         }
 
         // handle actions
diff --git a/wcfsetup/install/files/lib/system/clipboard/action/ModerationQueueActivationClipboardAction.class.php b/wcfsetup/install/files/lib/system/clipboard/action/ModerationQueueActivationClipboardAction.class.php
index 0a0ffdaeb08..f992ee4c654 100644
--- a/wcfsetup/install/files/lib/system/clipboard/action/ModerationQueueActivationClipboardAction.class.php
+++ b/wcfsetup/install/files/lib/system/clipboard/action/ModerationQueueActivationClipboardAction.class.php
@@ -51,7 +51,7 @@ public function execute(array $objects, ClipboardAction $action)
         $item = parent::execute($objects, $action);
 
         if ($item === null) {
-            return;
+            return null;
         }
 
         switch ($action->actionName) {
diff --git a/wcfsetup/install/files/lib/system/clipboard/action/ModerationQueueReportClipboardAction.class.php b/wcfsetup/install/files/lib/system/clipboard/action/ModerationQueueReportClipboardAction.class.php
index bf4971a0028..7a2cdc77b73 100644
--- a/wcfsetup/install/files/lib/system/clipboard/action/ModerationQueueReportClipboardAction.class.php
+++ b/wcfsetup/install/files/lib/system/clipboard/action/ModerationQueueReportClipboardAction.class.php
@@ -51,7 +51,7 @@ public function execute(array $objects, ClipboardAction $action)
         $item = parent::execute($objects, $action);
 
         if ($item === null) {
-            return;
+            return null;
         }
 
         switch ($action->actionName) {
diff --git a/wcfsetup/install/files/lib/system/clipboard/action/TagClipboardAction.class.php b/wcfsetup/install/files/lib/system/clipboard/action/TagClipboardAction.class.php
new file mode 100644
index 00000000000..c7be9fcbef7
--- /dev/null
+++ b/wcfsetup/install/files/lib/system/clipboard/action/TagClipboardAction.class.php
@@ -0,0 +1,116 @@
+<?php
+
+namespace wcf\system\clipboard\action;
+
+use wcf\data\clipboard\action\ClipboardAction;
+use wcf\data\tag\TagAction;
+use wcf\system\WCF;
+
+/**
+ * Clipboard action implementation for tags.
+ *
+ * @author  Matthias Schmidt
+ * @copyright   2001-2019 WoltLab GmbH
+ * @license GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @since   3.0
+ */
+class TagClipboardAction extends AbstractClipboardAction
+{
+    /**
+     * @inheritDoc
+     */
+    protected $actionClassActions = ['delete'];
+
+    /**
+     * @inheritDoc
+     */
+    protected $supportedActions = ['delete', 'setAsSynonyms'];
+
+    /**
+     * @inheritDoc
+     */
+    public function execute(array $objects, ClipboardAction $action)
+    {
+        $item = parent::execute($objects, $action);
+
+        if ($item === null) {
+            return null;
+        }
+
+        // handle actions
+        switch ($action->actionName) {
+            case 'delete':
+                $item->addInternalData(
+                    'confirmMessage',
+                    WCF::getLanguage()->getDynamicVariable(
+                        'wcf.clipboard.item.com.woltlab.wcf.tag.delete.confirmMessage',
+                        [
+                            'count' => $item->getCount(),
+                        ]
+                    )
+                );
+                break;
+
+            case 'setAsSynonyms':
+                $item->addParameter(
+                    'template',
+                    WCF::getTPL()->fetch(
+                        'tagSetAsSynonyms',
+                        'wcf',
+                        ['tags' => $this->objects]
+                    )
+                );
+                break;
+        }
+
+        return $item;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getClassName()
+    {
+        return TagAction::class;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getTypeName()
+    {
+        return 'com.woltlab.wcf.tag';
+    }
+
+    /**
+     * Returns the ids of the tags which can be deleted.
+     *
+     * @return  int[]
+     */
+    protected function validateDelete()
+    {
+        if (!WCF::getSession()->getPermission('admin.content.tag.canManageTag')) {
+            return [];
+        }
+
+        return \array_keys($this->objects);
+    }
+
+    /**
+     * Returns the ids of the tags which can be set as synonyms.
+     *
+     * @return  int[]
+     */
+    protected function validateSetAsSynonyms()
+    {
+        if (!WCF::getSession()->getPermission('admin.content.tag.canManageTag')) {
+            return [];
+        }
+
+        if (\count($this->objects) < 2) {
+            return [];
+        }
+
+        return \array_keys($this->objects);
+    }
+}
diff --git a/wcfsetup/install/files/lib/system/clipboard/action/UserClipboardAction.class.php b/wcfsetup/install/files/lib/system/clipboard/action/UserClipboardAction.class.php
index 46b3f7c86f8..498462c8e62 100644
--- a/wcfsetup/install/files/lib/system/clipboard/action/UserClipboardAction.class.php
+++ b/wcfsetup/install/files/lib/system/clipboard/action/UserClipboardAction.class.php
@@ -52,7 +52,7 @@ public function execute(array $objects, ClipboardAction $action)
         $item = parent::execute($objects, $action);
 
         if ($item === null) {
-            return;
+            return null;
         }
 
         // handle actions
diff --git a/wcfsetup/install/files/lib/system/clipboard/action/UserContentClipboardAction.class.php b/wcfsetup/install/files/lib/system/clipboard/action/UserContentClipboardAction.class.php
index b640cc51dab..75616c871f4 100644
--- a/wcfsetup/install/files/lib/system/clipboard/action/UserContentClipboardAction.class.php
+++ b/wcfsetup/install/files/lib/system/clipboard/action/UserContentClipboardAction.class.php
@@ -32,7 +32,7 @@ public function execute(array $objects, ClipboardAction $action)
         $item = parent::execute($objects, $action);
 
         if ($item === null) {
-            return;
+            return null;
         }
 
         // handle actions
diff --git a/wcfsetup/install/files/lib/system/condition/AbstractCondition.class.php b/wcfsetup/install/files/lib/system/condition/AbstractCondition.class.php
index 6d72687cb7a..8f8be205e93 100644
--- a/wcfsetup/install/files/lib/system/condition/AbstractCondition.class.php
+++ b/wcfsetup/install/files/lib/system/condition/AbstractCondition.class.php
@@ -10,6 +10,8 @@
  * @author  Matthias Schmidt
  * @copyright   2001-2019 WoltLab GmbH
  * @license GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ *
+ * @method ?array getData()
  */
 abstract class AbstractCondition extends AbstractObjectTypeProcessor implements ICondition
 {
diff --git a/wcfsetup/install/files/lib/system/condition/AbstractIntegerCondition.class.php b/wcfsetup/install/files/lib/system/condition/AbstractIntegerCondition.class.php
index ca8b368c942..e5986151f6f 100644
--- a/wcfsetup/install/files/lib/system/condition/AbstractIntegerCondition.class.php
+++ b/wcfsetup/install/files/lib/system/condition/AbstractIntegerCondition.class.php
@@ -17,13 +17,13 @@ abstract class AbstractIntegerCondition extends AbstractSingleFieldCondition
 {
     /**
      * property value has to be greater than the given value
-     * @var int
+     * @var ?int
      */
     protected $greaterThan;
 
     /**
      * property value has to be less than the given value
-     * @var int
+     * @var ?int
      */
     protected $lessThan;
 
diff --git a/wcfsetup/install/files/lib/system/condition/AbstractSelectCondition.class.php b/wcfsetup/install/files/lib/system/condition/AbstractSelectCondition.class.php
index d286105888a..b5fa0656a6f 100644
--- a/wcfsetup/install/files/lib/system/condition/AbstractSelectCondition.class.php
+++ b/wcfsetup/install/files/lib/system/condition/AbstractSelectCondition.class.php
@@ -119,7 +119,7 @@ abstract protected function getOptions();
     public function readFormParameters()
     {
         if (isset($_POST[$this->fieldName])) {
-            $this->fieldValue = \intval($_POST[$this->fieldName]);
+            $this->fieldValue = (string)\intval($_POST[$this->fieldName]);
         }
     }
 
diff --git a/wcfsetup/install/files/lib/system/condition/ICondition.class.php b/wcfsetup/install/files/lib/system/condition/ICondition.class.php
index ce0a6944ee6..1cbf3f82130 100644
--- a/wcfsetup/install/files/lib/system/condition/ICondition.class.php
+++ b/wcfsetup/install/files/lib/system/condition/ICondition.class.php
@@ -18,7 +18,7 @@ interface ICondition extends IDatabaseObjectProcessor
      * Returns the data saved with the condition used to check if the condition
      * is fulfilled. If null is returned, there is no condition to be created.
      *
-     * @return  array|null
+     * @return ?array
      */
     public function getData();
 
diff --git a/wcfsetup/install/files/lib/system/condition/TimeCondition.class.php b/wcfsetup/install/files/lib/system/condition/TimeCondition.class.php
index 0c50b2d0e12..1bc2b34d79c 100644
--- a/wcfsetup/install/files/lib/system/condition/TimeCondition.class.php
+++ b/wcfsetup/install/files/lib/system/condition/TimeCondition.class.php
@@ -41,7 +41,7 @@ class TimeCondition extends AbstractMultipleFieldsCondition implements IContentC
      * timezone used to evaluate the start/end time
      * @var string
      */
-    protected $timezone = 0;
+    protected $timezone = '';
 
     /**
      * @inheritDoc
@@ -140,7 +140,7 @@ public function reset()
     {
         $this->endTime = '00:00';
         $this->startTime = '00:00';
-        $this->timezone = 0;
+        $this->timezone = '';
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/system/condition/UserMobileBrowserCondition.class.php b/wcfsetup/install/files/lib/system/condition/UserMobileBrowserCondition.class.php
index 4023a4e0d7d..5f8da60cc99 100644
--- a/wcfsetup/install/files/lib/system/condition/UserMobileBrowserCondition.class.php
+++ b/wcfsetup/install/files/lib/system/condition/UserMobileBrowserCondition.class.php
@@ -100,7 +100,7 @@ public function reset()
     public function setData(Condition $condition)
     {
         $this->usesMobileBrowser = $condition->usesMobileBrowser;
-        $this->usesNoMobileBrowser = !$condition->usesMobileBrowser;
+        $this->usesNoMobileBrowser = $condition->usesMobileBrowser ? 0 : 1;
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/system/condition/UserMultifactorCondition.class.php b/wcfsetup/install/files/lib/system/condition/UserMultifactorCondition.class.php
index 1038ab593c2..1dcee0277a4 100644
--- a/wcfsetup/install/files/lib/system/condition/UserMultifactorCondition.class.php
+++ b/wcfsetup/install/files/lib/system/condition/UserMultifactorCondition.class.php
@@ -108,7 +108,7 @@ public function reset()
     public function setData(Condition $condition)
     {
         $this->multifactorActive = $condition->multifactorActive;
-        $this->multifactorNotActive = !$condition->multifactorActive;
+        $this->multifactorNotActive = $condition->multifactorActive ? 0 : 1;
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/system/condition/UserStateCondition.class.php b/wcfsetup/install/files/lib/system/condition/UserStateCondition.class.php
index 0ba2eb05e54..9202197566f 100644
--- a/wcfsetup/install/files/lib/system/condition/UserStateCondition.class.php
+++ b/wcfsetup/install/files/lib/system/condition/UserStateCondition.class.php
@@ -241,25 +241,25 @@ public function reset()
      */
     public function setData(Condition $condition)
     {
-        /** @noinspection PhpUndefinedFieldInspection */
+        /** @var ?int $userIsBanned */
         $userIsBanned = $condition->userIsBanned;
         if ($condition->userIsBanned !== null) {
             $this->userIsBanned = $userIsBanned;
-            $this->userIsNotBanned = !$userIsBanned;
+            $this->userIsNotBanned = $userIsBanned ? 0 : 1;
         }
 
-        /** @noinspection PhpUndefinedFieldInspection */
+        /** @var ?int $userIsEnabled */
         $userIsEnabled = $condition->userIsEnabled;
         if ($condition->userIsEnabled !== null) {
             $this->userIsEnabled = $userIsEnabled;
-            $this->userIsDisabled = !$userIsEnabled;
+            $this->userIsDisabled = $userIsEnabled ? 0 : 1;
         }
 
-        /** @noinspection PhpUndefinedFieldInspection */
+        /** @var ?int $userIsEmailConfirmed */
         $userIsEmailConfirmed = $condition->userIsEmailConfirmed;
         if ($condition->userIsEmailConfirmed !== null) {
             $this->userIsEmailConfirmed = $userIsEmailConfirmed;
-            $this->userIsNotEmailConfirmed = !$userIsEmailConfirmed;
+            $this->userIsNotEmailConfirmed = $userIsEmailConfirmed ? 0 : 1;
         }
     }
 
diff --git a/wcfsetup/install/files/lib/system/condition/page/MultiPageCondition.class.php b/wcfsetup/install/files/lib/system/condition/page/MultiPageCondition.class.php
index 62f21803b7d..c351294533b 100644
--- a/wcfsetup/install/files/lib/system/condition/page/MultiPageCondition.class.php
+++ b/wcfsetup/install/files/lib/system/condition/page/MultiPageCondition.class.php
@@ -96,7 +96,7 @@ public function readFormParameters()
         parent::readFormParameters();
 
         if (isset($_POST[$this->fieldName . '_reverseLogic'])) {
-            $this->reverseLogic = (bool)$this->fieldName . '_reverseLogic';
+            $this->reverseLogic = (bool)$_POST[$this->fieldName . '_reverseLogic'];
         }
     }
 
diff --git a/wcfsetup/install/files/lib/system/database/Database.class.php b/wcfsetup/install/files/lib/system/database/Database.class.php
index 5d955a2b26e..360e7506009 100644
--- a/wcfsetup/install/files/lib/system/database/Database.class.php
+++ b/wcfsetup/install/files/lib/system/database/Database.class.php
@@ -156,13 +156,21 @@ abstract public function connect();
      *
      * @param string $table
      * @param string $field
-     * @return  string|false
+     * @return  string
      * @throws  DatabaseException
      */
     public function getInsertID($table, $field)
     {
         try {
-            return $this->pdo->lastInsertId();
+            $lastInsertID = $this->pdo->lastInsertId();
+
+            // The only supported implementation `MySQLDatabase` sets the error
+            // mode to “exception” which prevents `false` ever being returned
+            // here. The entire code base relies on this method never returning
+            // anything but a string.
+            \assert($lastInsertID !== false);
+
+            return $lastInsertID;
         } catch (\PDOException $e) {
             throw new GenericDatabaseException("Cannot fetch last insert id", $e);
         }
@@ -401,17 +409,18 @@ public function handleLimitParameter($query, $limit = 0, $offset = 0)
     }
 
     /**
-     * Returns the number of the last error.
+     * Returns the code of the last error.
      *
-     * @return  int
+     * @return string
      */
     public function getErrorNumber()
     {
-        if ($this->pdo !== null) {
-            return $this->pdo->errorCode();
+        $errorCode = $this->pdo?->errorCode();
+        if ($errorCode === null) {
+            return '0';
         }
 
-        return 0;
+        return $errorCode;
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/system/database/DatabaseException.class.php b/wcfsetup/install/files/lib/system/database/DatabaseException.class.php
index c2195e7e19d..823c900806b 100644
--- a/wcfsetup/install/files/lib/system/database/DatabaseException.class.php
+++ b/wcfsetup/install/files/lib/system/database/DatabaseException.class.php
@@ -17,7 +17,7 @@ class DatabaseException extends SystemException
 {
     /**
      * error number
-     * @var int
+     * @var string
      */
     protected $errorNumber;
 
@@ -85,9 +85,9 @@ public function __construct($message, Database $db, ?PreparedStatement $prepared
     }
 
     /**
-     * Returns the error number of this exception.
+     * Returns the error code of this exception.
      *
-     * @return  int
+     * @return string
      */
     public function getErrorNumber()
     {
diff --git a/wcfsetup/install/files/lib/system/database/statement/PreparedStatement.class.php b/wcfsetup/install/files/lib/system/database/statement/PreparedStatement.class.php
index 6f25be1a31e..8b618785185 100644
--- a/wcfsetup/install/files/lib/system/database/statement/PreparedStatement.class.php
+++ b/wcfsetup/install/files/lib/system/database/statement/PreparedStatement.class.php
@@ -269,7 +269,7 @@ public function fetchObjects($className, $keyProperty = null)
      * @param string $keyColumn name of the key column
      * @param string $valueColumn name of the value column
      * @param bool $uniqueKey if `true`, a one-dimensional array is returned, otherwise, for each key an array of fetched values is returned
-     * @return  string[]|string[][]
+     * @return  array<string|int, (string|int)|(string|int)[]>
      */
     public function fetchMap($keyColumn, $valueColumn, $uniqueKey = true)
     {
@@ -327,17 +327,18 @@ public function getAffectedRows()
     }
 
     /**
-     * Returns the number of the last error.
+     * Returns the code of the last error.
      *
-     * @return  int
+     * @return string
      */
     public function getErrorNumber()
     {
-        if ($this->pdoStatement !== null) {
-            return $this->pdoStatement->errorCode();
+        $errorCode = $this->pdoStatement?->errorCode();
+        if ($errorCode === null) {
+            return '0';
         }
 
-        return 0;
+        return $errorCode;
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/system/database/table/column/AbstractIntDatabaseTableColumn.class.php b/wcfsetup/install/files/lib/system/database/table/column/AbstractIntDatabaseTableColumn.class.php
index 6fd6c0b9135..00693afadb3 100644
--- a/wcfsetup/install/files/lib/system/database/table/column/AbstractIntDatabaseTableColumn.class.php
+++ b/wcfsetup/install/files/lib/system/database/table/column/AbstractIntDatabaseTableColumn.class.php
@@ -39,7 +39,6 @@ public static function createFromData(string $name, array $data): static
         // which is done below.
         $data['length'] = null;
 
-        /** @var static $column */
         $column = parent::createFromData($name, $data);
 
         if ($length) {
diff --git a/wcfsetup/install/files/lib/system/database/table/index/DatabaseTableForeignKey.class.php b/wcfsetup/install/files/lib/system/database/table/index/DatabaseTableForeignKey.class.php
index c6efb165359..cab69a41c7d 100644
--- a/wcfsetup/install/files/lib/system/database/table/index/DatabaseTableForeignKey.class.php
+++ b/wcfsetup/install/files/lib/system/database/table/index/DatabaseTableForeignKey.class.php
@@ -290,7 +290,7 @@ public function referencedTable($referencedTable)
     protected function normalizeAction($action)
     {
         if ($action === 'RESTRICT' || $action === 'NO ACTION') {
-            return;
+            return null;
         }
 
         return $action;
diff --git a/wcfsetup/install/files/lib/system/devtools/pip/DevtoolsPip.class.php b/wcfsetup/install/files/lib/system/devtools/pip/DevtoolsPip.class.php
index 1427c179753..8274d424c95 100644
--- a/wcfsetup/install/files/lib/system/devtools/pip/DevtoolsPip.class.php
+++ b/wcfsetup/install/files/lib/system/devtools/pip/DevtoolsPip.class.php
@@ -278,7 +278,7 @@ public function getTargets(DevtoolsProject $project)
      *
      * @param DevtoolsProject $project
      * @param string $target
-     * @return      string[]
+     * @return array<string, array<string, string>|string>
      */
     public function getInstructions(DevtoolsProject $project, $target)
     {
diff --git a/wcfsetup/install/files/lib/system/devtools/pip/TXmlGuiPackageInstallationPlugin.class.php b/wcfsetup/install/files/lib/system/devtools/pip/TXmlGuiPackageInstallationPlugin.class.php
index 2f96ac7b5f4..1a3c96aa2bd 100644
--- a/wcfsetup/install/files/lib/system/devtools/pip/TXmlGuiPackageInstallationPlugin.class.php
+++ b/wcfsetup/install/files/lib/system/devtools/pip/TXmlGuiPackageInstallationPlugin.class.php
@@ -334,6 +334,8 @@ protected function getElementByIdentifier(XML $xml, $identifier)
     {
         foreach ($this->getImportElements($xml->xpath()) as $element) {
             if ($this->getElementIdentifier($element) === $identifier) {
+                \assert($element instanceof \DOMElement);
+
                 return $element;
             }
         }
diff --git a/wcfsetup/install/files/lib/system/email/Email.class.php b/wcfsetup/install/files/lib/system/email/Email.class.php
index 66c79934d90..c870456029e 100644
--- a/wcfsetup/install/files/lib/system/email/Email.class.php
+++ b/wcfsetup/install/files/lib/system/email/Email.class.php
@@ -25,13 +25,13 @@ class Email
 {
     /**
      * From header
-     * @var Mailbox
+     * @var ?Mailbox
      */
     protected $sender;
 
     /**
      * Reply-To header
-     * @var Mailbox
+     * @var ?Mailbox
      */
     protected $replyTo;
 
@@ -43,7 +43,7 @@ class Email
 
     /**
      * Message-Id header
-     * @var string
+     * @var ?string
      */
     protected $messageID;
 
@@ -61,21 +61,21 @@ class Email
 
     /**
      * List-Id header
-     * @var string
+     * @var ?string
      * @since 5.3
      */
     protected $listId;
 
     /**
      * Human readable part of the List-Id header
-     * @var string
+     * @var ?string
      * @since 5.3
      */
     protected $listIdHuman;
 
     /**
      * List-Unsubscribe URI
-     * @var string
+     * @var ?string
      * @since 5.3
      */
     protected $listUnsubscribe;
@@ -89,7 +89,7 @@ class Email
 
     /**
      * Date header
-     * @var \DateTime
+     * @var ?\DateTime
      */
     protected $date;
 
@@ -107,13 +107,13 @@ class Email
 
     /**
      * The body of this Email.
-     * @var AbstractMimePart
+     * @var ?AbstractMimePart
      */
     protected $body;
 
     /**
      * Mail host for use in the Message-Id
-     * @var string
+     * @var ?string
      */
     private static $host;
 
@@ -332,7 +332,7 @@ public function setListID($listId, $humanReadable = null)
     public function getListID()
     {
         if ($this->listId === null) {
-            return;
+            return null;
         }
 
         return ($this->listIdHuman ? $this->listIdHuman . ' ' : '') . '<' . $this->listId . '.list-id.' . self::getHost() . '>';
diff --git a/wcfsetup/install/files/lib/system/email/transport/SmtpEmailTransport.class.php b/wcfsetup/install/files/lib/system/email/transport/SmtpEmailTransport.class.php
index a52ea619a61..f19ceeaed58 100644
--- a/wcfsetup/install/files/lib/system/email/transport/SmtpEmailTransport.class.php
+++ b/wcfsetup/install/files/lib/system/email/transport/SmtpEmailTransport.class.php
@@ -23,37 +23,37 @@ final class SmtpEmailTransport implements IStatusReportingEmailTransport
 {
     /**
      * SMTP connection
-     * @var RemoteFile
+     * @var ?RemoteFile
      */
     protected $connection;
 
     /**
      * host of the smtp server to use
-     * @var string
+     * @var ?string
      */
     protected $host;
 
     /**
      * port to use
-     * @var int
+     * @var ?int
      */
     protected $port;
 
     /**
      * username to use for authentication
-     * @var string
+     * @var ?string
      */
     protected $username;
 
     /**
      * password corresponding to the username
-     * @var string
+     * @var ?string
      */
     protected $password;
 
     /**
      * STARTTLS encryption level
-     * @var string
+     * @var ?string
      */
     protected $starttls;
 
@@ -72,7 +72,7 @@ final class SmtpEmailTransport implements IStatusReportingEmailTransport
     /**
      * if this property is an instance of \Exception email delivery will be locked
      * and the \Exception will be thrown when attempting to deliver() an email
-     * @var \Exception
+     * @var ?\Exception
      */
     protected $locked;
 
diff --git a/wcfsetup/install/files/lib/system/event/EventHandler.class.php b/wcfsetup/install/files/lib/system/event/EventHandler.class.php
index 5c6bcaab165..dc1bbe8e9e0 100644
--- a/wcfsetup/install/files/lib/system/event/EventHandler.class.php
+++ b/wcfsetup/install/files/lib/system/event/EventHandler.class.php
@@ -25,12 +25,12 @@ final class EventHandler extends SingletonFactory
     public const DEFAULT_EVENT_NAME = ':default';
 
     /**
-     * @var array<string, EventListener>
+     * @var array<string, EventListener[]>
      */
     private array $actions = [];
 
     /**
-     * @var array<class-string, array<string, EventListener>>
+     * @var array<class-string, array<string, EventListener[]>>
      */
     private array $inheritedActions = [];
 
@@ -98,7 +98,6 @@ private function executeInheritedActions($eventObj, string $eventName, string $c
                     continue;
                 }
 
-                /** @var EventListener $eventListener */
                 foreach ($this->inheritedActions[$member][$eventName] as $eventListener) {
                     if (
                         $eventListener->validateOptions()
@@ -211,7 +210,6 @@ public function fireAction($eventObj, string $eventName, array &$parameters = []
             }
 
             $this->actionsObjects[$name] = [];
-            /** @var EventListener $eventListener */
             foreach ($this->actions[$name] as $eventListener) {
                 if (
                     $eventListener->validateOptions()
diff --git a/wcfsetup/install/files/lib/system/exporter/AbstractExporter.class.php b/wcfsetup/install/files/lib/system/exporter/AbstractExporter.class.php
index 8553cc966a7..b7e21171ed3 100644
--- a/wcfsetup/install/files/lib/system/exporter/AbstractExporter.class.php
+++ b/wcfsetup/install/files/lib/system/exporter/AbstractExporter.class.php
@@ -159,7 +159,7 @@ public function countLoops($objectType)
         $count = \call_user_func([$this, 'count' . $this->methods[$objectType]]);
         $limit = ($this->limits[$objectType] ?? $this->defaultLimit);
 
-        return \ceil($count / $limit);
+        return (int)\ceil($count / $limit);
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/system/file/upload/UploadField.class.php b/wcfsetup/install/files/lib/system/file/upload/UploadField.class.php
index b593df90b27..74ab0d763e8 100644
--- a/wcfsetup/install/files/lib/system/file/upload/UploadField.class.php
+++ b/wcfsetup/install/files/lib/system/file/upload/UploadField.class.php
@@ -14,7 +14,7 @@ class UploadField
 {
     /**
      * The max number of files for this field.
-     * @var int
+     * @var ?int
      */
     public $maxFiles = 10;
 
diff --git a/wcfsetup/install/files/lib/system/file/upload/UploadFile.class.php b/wcfsetup/install/files/lib/system/file/upload/UploadFile.class.php
index 90c163df172..fd5f3470bc6 100644
--- a/wcfsetup/install/files/lib/system/file/upload/UploadFile.class.php
+++ b/wcfsetup/install/files/lib/system/file/upload/UploadFile.class.php
@@ -135,7 +135,7 @@ public function isImage()
     public function getImage()
     {
         if (!$this->isImage() || !$this->viewableImage) {
-            return;
+            return null;
         }
 
         if ($this->processed) {
diff --git a/wcfsetup/install/files/lib/system/form/builder/TFormElement.class.php b/wcfsetup/install/files/lib/system/form/builder/TFormElement.class.php
index 94b6e8f6c02..5bf2a9991cf 100644
--- a/wcfsetup/install/files/lib/system/form/builder/TFormElement.class.php
+++ b/wcfsetup/install/files/lib/system/form/builder/TFormElement.class.php
@@ -18,13 +18,13 @@ trait TFormElement
 
     /**
      * description of this element
-     * @var string
+     * @var ?string
      */
     protected $description;
 
     /**
      * label of this element
-     * @var string
+     * @var ?string
      */
     protected $label;
 
diff --git a/wcfsetup/install/files/lib/system/form/builder/field/IAttributeFormField.class.php b/wcfsetup/install/files/lib/system/form/builder/field/IAttributeFormField.class.php
index 432bbcc2a3b..446b4ca7911 100644
--- a/wcfsetup/install/files/lib/system/form/builder/field/IAttributeFormField.class.php
+++ b/wcfsetup/install/files/lib/system/form/builder/field/IAttributeFormField.class.php
@@ -22,7 +22,7 @@ interface IAttributeFormField extends IFormField
      * Returns the value of the additional attribute of the actual field element with the given name.
      *
      * @throws      \InvalidArgumentException       if the given attribute is invalid or no such attribute exists
-     * @return      static                          this form field
+     * @return      mixed
      */
     public function getFieldAttribute(string $name);
 
diff --git a/wcfsetup/install/files/lib/system/form/builder/field/TAttributeFormField.class.php b/wcfsetup/install/files/lib/system/form/builder/field/TAttributeFormField.class.php
index 332fa9ea3e6..eecd9408565 100644
--- a/wcfsetup/install/files/lib/system/form/builder/field/TAttributeFormField.class.php
+++ b/wcfsetup/install/files/lib/system/form/builder/field/TAttributeFormField.class.php
@@ -39,7 +39,7 @@ trait TAttributeFormField
      * Returns the value of the additional attribute of the actual field element with the given name.
      *
      * @throws      \InvalidArgumentException       if the given attribute is invalid or no such attribute exists
-     * @return      static                          this form field
+     * @return      mixed
      */
     public function getFieldAttribute(string $name)
     {
diff --git a/wcfsetup/install/files/lib/system/form/builder/field/TPlaceholderFormField.class.php b/wcfsetup/install/files/lib/system/form/builder/field/TPlaceholderFormField.class.php
index 79a8fae3070..81e7dcee66e 100644
--- a/wcfsetup/install/files/lib/system/form/builder/field/TPlaceholderFormField.class.php
+++ b/wcfsetup/install/files/lib/system/form/builder/field/TPlaceholderFormField.class.php
@@ -16,7 +16,7 @@ trait TPlaceholderFormField
 {
     /**
      * placeholder value of this element
-     * @var string
+     * @var ?string
      */
     protected $placeholder;
 
diff --git a/wcfsetup/install/files/lib/system/gridView/AbstractGridView.class.php b/wcfsetup/install/files/lib/system/gridView/AbstractGridView.class.php
index 8a286cceb34..580c54767d0 100644
--- a/wcfsetup/install/files/lib/system/gridView/AbstractGridView.class.php
+++ b/wcfsetup/install/files/lib/system/gridView/AbstractGridView.class.php
@@ -379,7 +379,7 @@ protected function getData(DatabaseObject $row, string $identifer): mixed
      */
     public function countPages(): int
     {
-        return \ceil($this->countRows() / $this->getRowsPerPage());
+        return (int)\ceil($this->countRows() / $this->getRowsPerPage());
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/system/gridView/renderer/ObjectIdColumnRenderer.class.php b/wcfsetup/install/files/lib/system/gridView/renderer/ObjectIdColumnRenderer.class.php
index a20fdec9ba6..e824f5d11d2 100644
--- a/wcfsetup/install/files/lib/system/gridView/renderer/ObjectIdColumnRenderer.class.php
+++ b/wcfsetup/install/files/lib/system/gridView/renderer/ObjectIdColumnRenderer.class.php
@@ -17,7 +17,7 @@ class ObjectIdColumnRenderer extends AbstractColumnRenderer
     #[\Override]
     public function render(mixed $value, DatabaseObject $row): string
     {
-        return \intval($value);
+        return (string)\intval($value);
     }
 
     #[\Override]
diff --git a/wcfsetup/install/files/lib/system/html/input/HtmlInputProcessor.class.php b/wcfsetup/install/files/lib/system/html/input/HtmlInputProcessor.class.php
index b6ad5d84d93..18b4f06e7c2 100644
--- a/wcfsetup/install/files/lib/system/html/input/HtmlInputProcessor.class.php
+++ b/wcfsetup/install/files/lib/system/html/input/HtmlInputProcessor.class.php
@@ -26,12 +26,12 @@ class HtmlInputProcessor extends AbstractHtmlProcessor
     protected $embeddedContent = [];
 
     /**
-     * @var IHtmlInputFilter
+     * @var ?IHtmlInputFilter
      */
     protected $htmlInputFilter;
 
     /**
-     * @var HtmlInputNodeProcessor
+     * @var ?HtmlInputNodeProcessor
      */
     protected $htmlInputNodeProcessor;
 
diff --git a/wcfsetup/install/files/lib/system/html/input/node/HtmlInputNodeTextParser.class.php b/wcfsetup/install/files/lib/system/html/input/node/HtmlInputNodeTextParser.class.php
index 4f14f51340f..3d5362cb937 100644
--- a/wcfsetup/install/files/lib/system/html/input/node/HtmlInputNodeTextParser.class.php
+++ b/wcfsetup/install/files/lib/system/html/input/node/HtmlInputNodeTextParser.class.php
@@ -320,7 +320,7 @@ protected function lookupUsernames(array $usernames)
 
     /**
      * @param string[] $usernames
-     * @return UserGroup[]
+     * @return array<int, string>
      * @since 5.2
      */
     protected function lookupGroups(array $usernames)
diff --git a/wcfsetup/install/files/lib/system/html/node/AbstractHtmlNodeProcessor.class.php b/wcfsetup/install/files/lib/system/html/node/AbstractHtmlNodeProcessor.class.php
index f93aee3416d..ca877404eb7 100644
--- a/wcfsetup/install/files/lib/system/html/node/AbstractHtmlNodeProcessor.class.php
+++ b/wcfsetup/install/files/lib/system/html/node/AbstractHtmlNodeProcessor.class.php
@@ -42,7 +42,7 @@ abstract class AbstractHtmlNodeProcessor implements IHtmlNodeProcessor
 
     /**
      * XPath instance
-     * @var \DOMXPath
+     * @var ?\DOMXPath
      */
     protected $xpath;
 
diff --git a/wcfsetup/install/files/lib/system/html/node/HtmlNodePlainLink.class.php b/wcfsetup/install/files/lib/system/html/node/HtmlNodePlainLink.class.php
index 134432303be..8b16f766e1d 100644
--- a/wcfsetup/install/files/lib/system/html/node/HtmlNodePlainLink.class.php
+++ b/wcfsetup/install/files/lib/system/html/node/HtmlNodePlainLink.class.php
@@ -48,7 +48,7 @@ class HtmlNodePlainLink
     protected bool $aloneInParagraph = true;
 
     /**
-     * @var \DOMElement
+     * @var ?\DOMElement
      */
     protected $topLevelParent;
 
diff --git a/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputUnfurlUrlNode.class.php b/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputUnfurlUrlNode.class.php
index 4fbf09ad256..b2918a3622d 100644
--- a/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputUnfurlUrlNode.class.php
+++ b/wcfsetup/install/files/lib/system/html/output/node/HtmlOutputUnfurlUrlNode.class.php
@@ -86,6 +86,9 @@ public function replaceTag(array $data)
      */
     protected function getUnfurlUrl(int $id): UnfurlUrl
     {
-        return MessageEmbeddedObjectManager::getInstance()->getObject('com.woltlab.wcf.unfurlUrl', $id);
+        $object = MessageEmbeddedObjectManager::getInstance()->getObject('com.woltlab.wcf.unfurlUrl', $id);
+        \assert($object instanceof UnfurlUrl);
+
+        return $object;
     }
 }
diff --git a/wcfsetup/install/files/lib/system/image/adapter/GDImageAdapter.class.php b/wcfsetup/install/files/lib/system/image/adapter/GDImageAdapter.class.php
index 1511d07ba5e..0816b12278d 100644
--- a/wcfsetup/install/files/lib/system/image/adapter/GDImageAdapter.class.php
+++ b/wcfsetup/install/files/lib/system/image/adapter/GDImageAdapter.class.php
@@ -16,7 +16,7 @@ class GDImageAdapter implements IImageAdapter, IWebpImageAdapter
 {
     /**
      * active color
-     * @var int
+     * @var ?int
      */
     protected $color;
 
diff --git a/wcfsetup/install/files/lib/system/importer/AbstractACLImporter.class.php b/wcfsetup/install/files/lib/system/importer/AbstractACLImporter.class.php
index 037f8d7d4bf..9f055f1b201 100644
--- a/wcfsetup/install/files/lib/system/importer/AbstractACLImporter.class.php
+++ b/wcfsetup/install/files/lib/system/importer/AbstractACLImporter.class.php
@@ -21,7 +21,7 @@ class AbstractACLImporter extends AbstractImporter
 
     /**
      * object type name
-     * @var int
+     * @var string
      */
     protected $objectTypeName = '';
 
diff --git a/wcfsetup/install/files/lib/system/importer/AbstractCategoryImporter.class.php b/wcfsetup/install/files/lib/system/importer/AbstractCategoryImporter.class.php
index 3cff6188660..b66302fda42 100644
--- a/wcfsetup/install/files/lib/system/importer/AbstractCategoryImporter.class.php
+++ b/wcfsetup/install/files/lib/system/importer/AbstractCategoryImporter.class.php
@@ -30,7 +30,7 @@ class AbstractCategoryImporter extends AbstractImporter
 
     /**
      * object type name
-     * @var int
+     * @var string
      */
     protected $objectTypeName = '';
 
diff --git a/wcfsetup/install/files/lib/system/importer/AbstractCommentImporter.class.php b/wcfsetup/install/files/lib/system/importer/AbstractCommentImporter.class.php
index 7afbb55cc41..36951ab9795 100644
--- a/wcfsetup/install/files/lib/system/importer/AbstractCommentImporter.class.php
+++ b/wcfsetup/install/files/lib/system/importer/AbstractCommentImporter.class.php
@@ -27,7 +27,7 @@ class AbstractCommentImporter extends AbstractImporter
 
     /**
      * object type name
-     * @var int
+     * @var string
      */
     protected $objectTypeName = '';
 
diff --git a/wcfsetup/install/files/lib/system/importer/ArticleImporter.class.php b/wcfsetup/install/files/lib/system/importer/ArticleImporter.class.php
index 08a3ad6b437..be762d6b20f 100644
--- a/wcfsetup/install/files/lib/system/importer/ArticleImporter.class.php
+++ b/wcfsetup/install/files/lib/system/importer/ArticleImporter.class.php
@@ -162,7 +162,7 @@ private function getImportCategoryID()
                         VALUES      (?, ?, ?, ?, ?)";
                 $statement = WCF::getDB()->prepare($sql);
                 $statement->execute([$objectTypeID, 0, 'Import', 0, TIME_NOW]);
-                $this->importCategoryID = WCF::getDB()->getInsertID("wcf1_category", 'categoryID');
+                $this->importCategoryID = (int)WCF::getDB()->getInsertID("wcf1_category", 'categoryID');
             }
         }
 
diff --git a/wcfsetup/install/files/lib/system/importer/TrophyImporter.class.php b/wcfsetup/install/files/lib/system/importer/TrophyImporter.class.php
index 9b01a96b6fb..7e3cc223f39 100644
--- a/wcfsetup/install/files/lib/system/importer/TrophyImporter.class.php
+++ b/wcfsetup/install/files/lib/system/importer/TrophyImporter.class.php
@@ -131,7 +131,7 @@ private function getImportCategoryID()
                         VALUES      (?, ?, ?, ?, ?)";
                 $statement = WCF::getDB()->prepare($sql);
                 $statement->execute([$objectTypeID, 0, 'Import', 0, TIME_NOW]);
-                $this->importCategoryID = WCF::getDB()->getInsertID("wcf1_category", 'categoryID');
+                $this->importCategoryID = (int)WCF::getDB()->getInsertID("wcf1_category", 'categoryID');
             }
         }
 
diff --git a/wcfsetup/install/files/lib/system/io/FTP.class.php b/wcfsetup/install/files/lib/system/io/FTP.class.php
index 431ab63f9ab..d6e52735526 100644
--- a/wcfsetup/install/files/lib/system/io/FTP.class.php
+++ b/wcfsetup/install/files/lib/system/io/FTP.class.php
@@ -11,7 +11,7 @@ class FTP
 {
     /**
      * file pointer resource
-     * @var resource
+     * @var \FTP\Connection
      */
     protected $resource;
 
@@ -25,10 +25,12 @@ class FTP
      */
     public function __construct($host = 'localhost', $port = 21, $timeout = 30)
     {
-        $this->resource = \ftp_connect($host, $port, $timeout);
-        if ($this->resource === false) {
+        $resource = \ftp_connect($host, $port, $timeout);
+        if ($resource === false) {
             throw new SystemException('Can not connect to ' . $host);
         }
+
+        $this->resource = $resource;
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/system/io/HttpFactory.class.php b/wcfsetup/install/files/lib/system/io/HttpFactory.class.php
index 3f63ba639f1..9c8a39c411f 100644
--- a/wcfsetup/install/files/lib/system/io/HttpFactory.class.php
+++ b/wcfsetup/install/files/lib/system/io/HttpFactory.class.php
@@ -24,7 +24,7 @@
 final class HttpFactory
 {
     /**
-     * @var Client
+     * @var PsrClientInterface&ClientInterface
      */
     private static $defaultClient;
 
diff --git a/wcfsetup/install/files/lib/system/io/IArchive.class.php b/wcfsetup/install/files/lib/system/io/IArchive.class.php
index eb85774c84f..d4de64474d8 100644
--- a/wcfsetup/install/files/lib/system/io/IArchive.class.php
+++ b/wcfsetup/install/files/lib/system/io/IArchive.class.php
@@ -14,7 +14,7 @@ interface IArchive
     /**
      * Returns the table of contents (TOC) list for this archive.
      *
-     * @return  array       list of content
+     * @return array list of contents
      */
     public function getContentList();
 
@@ -23,7 +23,7 @@ public function getContentList();
      * in the archive.
      *
      * @param mixed $index index or name of the requested file
-     * @return  array
+     * @return array
      */
     public function getFileInfo($index);
 
@@ -32,7 +32,7 @@ public function getFileInfo($index);
      * false if extraction failed.
      *
      * @param mixed $index index or name of the requested file
-     * @return  string              content of the requested file
+     * @return string|false content of the requested file
      */
     public function extractToString($index);
 
@@ -42,7 +42,7 @@ public function extractToString($index);
      *
      * @param mixed $index index or name of the requested file
      * @param string $destination
-     * @return  bool        $success
+     * @return bool
      */
     public function extract($index, $destination);
 
@@ -51,7 +51,7 @@ public function extract($index, $destination);
      * Returns false if not found.
      *
      * @param string $filename
-     * @return  int             index of the requested file
+     * @return int|false index of the requested file
      */
     public function getIndexByFilename($filename);
 }
diff --git a/wcfsetup/install/files/lib/system/io/Tar.class.php b/wcfsetup/install/files/lib/system/io/Tar.class.php
index ba565c014eb..87a90ee5b04 100644
--- a/wcfsetup/install/files/lib/system/io/Tar.class.php
+++ b/wcfsetup/install/files/lib/system/io/Tar.class.php
@@ -228,11 +228,11 @@ public function extract($index, $destination)
         if ($header['type'] === 'folder') {
             FileUtil::makePath($destination);
 
-            return;
+            return true;
         }
         if ($header['type'] === 'symlink') {
             // skip symlinks
-            return;
+            return true;
         }
 
         // seek to offset
diff --git a/wcfsetup/install/files/lib/system/io/Zip.class.php b/wcfsetup/install/files/lib/system/io/Zip.class.php
index fb250e28388..71756298159 100644
--- a/wcfsetup/install/files/lib/system/io/Zip.class.php
+++ b/wcfsetup/install/files/lib/system/io/Zip.class.php
@@ -127,7 +127,7 @@ public function extract($index, $destination)
         if ($file['header']['type'] === 'folder') {
             FileUtil::makePath($destination);
 
-            return;
+            return true;
         }
 
         \file_put_contents($destination, $file['content']);
diff --git a/wcfsetup/install/files/lib/system/language/LanguageFactory.class.php b/wcfsetup/install/files/lib/system/language/LanguageFactory.class.php
index d642e43d25d..0a86b4dfee8 100644
--- a/wcfsetup/install/files/lib/system/language/LanguageFactory.class.php
+++ b/wcfsetup/install/files/lib/system/language/LanguageFactory.class.php
@@ -91,7 +91,7 @@ public function getUserLanguage($languageID = 0)
      * language exists.
      *
      * @param string $languageCode
-     * @return  Language
+     * @return ?Language
      */
     public function getLanguageByCode($languageCode)
     {
diff --git a/wcfsetup/install/files/lib/system/message/embedded/object/ArticleMessageEmbeddedObjectHandler.class.php b/wcfsetup/install/files/lib/system/message/embedded/object/ArticleMessageEmbeddedObjectHandler.class.php
index 5757ad647fd..67d985ce53e 100644
--- a/wcfsetup/install/files/lib/system/message/embedded/object/ArticleMessageEmbeddedObjectHandler.class.php
+++ b/wcfsetup/install/files/lib/system/message/embedded/object/ArticleMessageEmbeddedObjectHandler.class.php
@@ -92,22 +92,21 @@ public function validateValues($objectType, $objectID, array $values)
      */
     public function replaceSimple($objectType, $objectID, $value, array $attributes)
     {
-        /** @var Article $article */
         $article = MessageEmbeddedObjectManager::getInstance()->getObject('com.woltlab.wcf.article', $value);
         if ($article === null) {
-            return;
+            return null;
         }
 
+        \assert($article instanceof Article);
+
         $return = (!empty($attributes['return'])) ? $attributes['return'] : 'link';
         switch ($return) {
             case 'title':
                 return $article->getTitle();
-                break;
 
             case 'link':
             default:
                 return $article->getLink();
-                break;
         }
     }
 }
diff --git a/wcfsetup/install/files/lib/system/message/embedded/object/MediaMessageEmbeddedObjectHandler.class.php b/wcfsetup/install/files/lib/system/message/embedded/object/MediaMessageEmbeddedObjectHandler.class.php
index 389973117f2..d0150889269 100644
--- a/wcfsetup/install/files/lib/system/message/embedded/object/MediaMessageEmbeddedObjectHandler.class.php
+++ b/wcfsetup/install/files/lib/system/message/embedded/object/MediaMessageEmbeddedObjectHandler.class.php
@@ -95,14 +95,13 @@ public function replaceSimple($objectType, $objectID, $value, array $attributes)
         /** @var Media $media */
         $media = MessageEmbeddedObjectManager::getInstance()->getObject('com.woltlab.wcf.media', $value);
         if ($media === null) {
-            return;
+            return null;
         }
 
         $return = (!empty($attributes['return'])) ? $attributes['return'] : 'link';
         switch ($return) {
             case 'title':
                 return $media->getTitle();
-                break;
 
             case 'link':
             default:
@@ -112,15 +111,11 @@ public function replaceSimple($objectType, $objectID, $value, array $attributes)
                     case 'medium':
                     case 'large':
                         return $media->getThumbnailLink($size);
-                        break;
 
                     case 'original':
                     default:
                         return $media->getLink();
-                        break;
                 }
-
-                break;
         }
     }
 }
diff --git a/wcfsetup/install/files/lib/system/message/embedded/object/MessageEmbeddedObjectManager.class.php b/wcfsetup/install/files/lib/system/message/embedded/object/MessageEmbeddedObjectManager.class.php
index 1c18345690a..039c61c19fe 100644
--- a/wcfsetup/install/files/lib/system/message/embedded/object/MessageEmbeddedObjectManager.class.php
+++ b/wcfsetup/install/files/lib/system/message/embedded/object/MessageEmbeddedObjectManager.class.php
@@ -56,7 +56,7 @@ class MessageEmbeddedObjectManager extends SingletonFactory
 
     /**
      * content language id
-     * @var int
+     * @var ?int
      */
     protected $contentLanguageID;
 
diff --git a/wcfsetup/install/files/lib/system/message/embedded/object/PageMessageEmbeddedObjectHandler.class.php b/wcfsetup/install/files/lib/system/message/embedded/object/PageMessageEmbeddedObjectHandler.class.php
index 7f088a441c4..93be66986c4 100644
--- a/wcfsetup/install/files/lib/system/message/embedded/object/PageMessageEmbeddedObjectHandler.class.php
+++ b/wcfsetup/install/files/lib/system/message/embedded/object/PageMessageEmbeddedObjectHandler.class.php
@@ -68,22 +68,16 @@ public function validateValues($objectType, $objectID, array $values)
      */
     public function replaceSimple($objectType, $objectID, $value, array $attributes)
     {
-        /** @var Page $page */
         $page = MessageEmbeddedObjectManager::getInstance()->getObject('com.woltlab.wcf.page', $value);
         if ($page === null) {
-            return;
+            return null;
         }
 
-        $return = (!empty($attributes['return'])) ? $attributes['return'] : 'link';
-        switch ($return) {
-            case 'title':
-                return $page->getTitle();
-                break;
+        \assert($page instanceof Page);
 
-            case 'link':
-            default:
-                return $page->getLink();
-                break;
-        }
+        return match ($attributes['return'] ?? 'link') {
+            'title' => $page->getTitle(),
+            default => $page->getLink()
+        };
     }
 }
diff --git a/wcfsetup/install/files/lib/system/message/quote/QuotedMessage.class.php b/wcfsetup/install/files/lib/system/message/quote/QuotedMessage.class.php
index db856fa4708..61ddc1b78ee 100644
--- a/wcfsetup/install/files/lib/system/message/quote/QuotedMessage.class.php
+++ b/wcfsetup/install/files/lib/system/message/quote/QuotedMessage.class.php
@@ -182,7 +182,7 @@ public function current(): string
      *
      * @see \Iterator::key()
      */
-    public function key(): string
+    public function key(): int
     {
         return $this->indexToObject[$this->index];
     }
diff --git a/wcfsetup/install/files/lib/system/message/unfurl/UnfurlResponse.class.php b/wcfsetup/install/files/lib/system/message/unfurl/UnfurlResponse.class.php
index 585ad8fd2cd..c2fd9c7298e 100644
--- a/wcfsetup/install/files/lib/system/message/unfurl/UnfurlResponse.class.php
+++ b/wcfsetup/install/files/lib/system/message/unfurl/UnfurlResponse.class.php
@@ -10,6 +10,7 @@
 use GuzzleHttp\Psr7\Response;
 use GuzzleHttp\RequestOptions;
 use Psr\Http\Client\ClientExceptionInterface;
+use Psr\Http\Message\ResponseInterface;
 use ValueError;
 use wcf\system\io\http\RedirectGuard;
 use wcf\system\io\HttpFactory;
@@ -299,7 +300,7 @@ public function getImageUrl(): ?string
      * @throws DownloadFailed If the url can not be downloaded. This can be a temporary error.
      * @throws UrlInaccessible If the url is inaccessible (e.g. sends status code 403).
      */
-    public function getImage(): Response
+    public function getImage(): ResponseInterface
     {
         if (!$this->getImageUrl()) {
             throw new BadMethodCallException("This url does not have an image.");
diff --git a/wcfsetup/install/files/lib/system/moderation/queue/report/IModerationQueueReportHandler.class.php b/wcfsetup/install/files/lib/system/moderation/queue/report/IModerationQueueReportHandler.class.php
index 0e6e040f2dc..a35a99106a9 100644
--- a/wcfsetup/install/files/lib/system/moderation/queue/report/IModerationQueueReportHandler.class.php
+++ b/wcfsetup/install/files/lib/system/moderation/queue/report/IModerationQueueReportHandler.class.php
@@ -2,6 +2,7 @@
 
 namespace wcf\system\moderation\queue\report;
 
+use wcf\data\IUserContent;
 use wcf\data\moderation\queue\ViewableModerationQueue;
 use wcf\system\moderation\queue\IModerationQueueHandler;
 
@@ -34,7 +35,7 @@ public function getReportedContent(ViewableModerationQueue $queue);
      * Returns reported object.
      *
      * @param int $objectID
-     * @return  \wcf\data\IUserContent
+     * @return  ?IUserContent
      */
     public function getReportedObject($objectID);
 }
diff --git a/wcfsetup/install/files/lib/system/moderation/queue/report/UserModerationQueueReportHandler.class.php b/wcfsetup/install/files/lib/system/moderation/queue/report/UserModerationQueueReportHandler.class.php
index b5fa0c0522a..1d61402c5b2 100644
--- a/wcfsetup/install/files/lib/system/moderation/queue/report/UserModerationQueueReportHandler.class.php
+++ b/wcfsetup/install/files/lib/system/moderation/queue/report/UserModerationQueueReportHandler.class.php
@@ -79,9 +79,11 @@ public function getContainerID($objectID)
      */
     public function getReportedContent(ViewableModerationQueue $queue)
     {
-        /** @noinspection PhpParamsInspection */
+        $user = $queue->getAffectedObject();
+        \assert($user instanceof User);
+
         return WCF::getTPL()->render('wcf', 'moderationUser', [
-            'user' => new UserProfile($queue->getAffectedObject()),
+            'user' => new UserProfile($user),
         ]);
     }
 
diff --git a/wcfsetup/install/files/lib/system/option/BooleanOptionType.class.php b/wcfsetup/install/files/lib/system/option/BooleanOptionType.class.php
index b26f8e594ff..9d9ae906161 100644
--- a/wcfsetup/install/files/lib/system/option/BooleanOptionType.class.php
+++ b/wcfsetup/install/files/lib/system/option/BooleanOptionType.class.php
@@ -45,9 +45,11 @@ public function getFormElement(Option $option, $value)
     public function getData(Option $option, $newValue)
     {
         if ($newValue == 1) {
+            // @phpstan-ignore return.type
             return 1;
         }
 
+        // @phpstan-ignore return.type
         return 0;
     }
 
diff --git a/wcfsetup/install/files/lib/system/option/FileSizeOptionType.class.php b/wcfsetup/install/files/lib/system/option/FileSizeOptionType.class.php
index 7d9d26624cf..ac688f46207 100644
--- a/wcfsetup/install/files/lib/system/option/FileSizeOptionType.class.php
+++ b/wcfsetup/install/files/lib/system/option/FileSizeOptionType.class.php
@@ -29,6 +29,7 @@ public function getContent(Option $option, $newValue)
         $number = \str_replace(WCF::getLanguage()->get('wcf.global.decimalPoint'), '.', $number);
 
         if (!\preg_match('~^(?:\d*)\.?\d+~', $number, $matches)) {
+            // @phpstan-ignore return.type
             return 0;
         }
 
@@ -62,6 +63,7 @@ public function getContent(Option $option, $newValue)
             }
         }
 
+        // @phpstan-ignore return.type
         return $number;
     }
 
diff --git a/wcfsetup/install/files/lib/system/option/FloatOptionType.class.php b/wcfsetup/install/files/lib/system/option/FloatOptionType.class.php
index 967f29d3613..050508ab158 100644
--- a/wcfsetup/install/files/lib/system/option/FloatOptionType.class.php
+++ b/wcfsetup/install/files/lib/system/option/FloatOptionType.class.php
@@ -36,6 +36,7 @@ public function getFormElement(Option $option, $value)
      */
     public function getData(Option $option, $newValue)
     {
+        // @phpstan-ignore return.type
         return $this->toFloat($newValue);
     }
 
diff --git a/wcfsetup/install/files/lib/system/option/IntegerOptionType.class.php b/wcfsetup/install/files/lib/system/option/IntegerOptionType.class.php
index d2036b8510c..2f010f0b64a 100644
--- a/wcfsetup/install/files/lib/system/option/IntegerOptionType.class.php
+++ b/wcfsetup/install/files/lib/system/option/IntegerOptionType.class.php
@@ -37,6 +37,7 @@ public function getFormElement(Option $option, $value)
      */
     public function getData(Option $option, $newValue)
     {
+        // @phpstan-ignore return.type
         return \intval($newValue);
     }
 
diff --git a/wcfsetup/install/files/lib/system/option/OptionHandler.class.php b/wcfsetup/install/files/lib/system/option/OptionHandler.class.php
index b9520f4225a..45e161ea2e0 100644
--- a/wcfsetup/install/files/lib/system/option/OptionHandler.class.php
+++ b/wcfsetup/install/files/lib/system/option/OptionHandler.class.php
@@ -347,7 +347,7 @@ public function save($categoryName = null, $optionPrefix = null)
      * Returns a parsed option.
      *
      * @param string $optionName
-     * @return  array
+     * @return  ?array
      */
     protected function getOption($optionName)
     {
@@ -445,7 +445,7 @@ public function getTypeObject($type)
      * Returns class name for option type.
      *
      * @param string $optionType
-     * @return  string
+     * @return  ?string
      * @throws  ImplementationException
      */
     protected function getClassName($optionType)
@@ -478,7 +478,7 @@ protected function getClassName($optionType)
 
         // validate class
         if (!$isValid) {
-            return;
+            return null;
         }
 
         if (!\is_subclass_of($className, IOptionType::class)) {
diff --git a/wcfsetup/install/files/lib/system/option/user/UserOptionHandler.class.php b/wcfsetup/install/files/lib/system/option/user/UserOptionHandler.class.php
index c45c8053e43..8406d67cb6a 100644
--- a/wcfsetup/install/files/lib/system/option/user/UserOptionHandler.class.php
+++ b/wcfsetup/install/files/lib/system/option/user/UserOptionHandler.class.php
@@ -212,7 +212,7 @@ public function getOption($optionName)
             }
 
             if ($this->removeEmptyOptions && empty($optionData['object']->optionValue)) {
-                return;
+                return null;
             }
         }
 
diff --git a/wcfsetup/install/files/lib/system/option/user/group/UserGroupOptionHandler.class.php b/wcfsetup/install/files/lib/system/option/user/group/UserGroupOptionHandler.class.php
index 287a8981481..486e3b6e868 100644
--- a/wcfsetup/install/files/lib/system/option/user/group/UserGroupOptionHandler.class.php
+++ b/wcfsetup/install/files/lib/system/option/user/group/UserGroupOptionHandler.class.php
@@ -94,7 +94,7 @@ protected function getClassName($optionType)
 
         // validate class
         if (!\class_exists($className)) {
-            return;
+            return null;
         }
         if (!\is_subclass_of($className, IUserGroupOptionType::class)) {
             throw new ImplementationException($className, IUserGroupOptionType::class);
diff --git a/wcfsetup/install/files/lib/system/package/PackageInstallationDispatcher.class.php b/wcfsetup/install/files/lib/system/package/PackageInstallationDispatcher.class.php
index d9c096fa7ad..7fa69a84a82 100644
--- a/wcfsetup/install/files/lib/system/package/PackageInstallationDispatcher.class.php
+++ b/wcfsetup/install/files/lib/system/package/PackageInstallationDispatcher.class.php
@@ -72,7 +72,7 @@ class PackageInstallationDispatcher
 
     /**
      * instance of Package
-     * @var Package
+     * @var ?Package
      */
     protected $package;
 
diff --git a/wcfsetup/install/files/lib/system/package/PackageInstallationFormManager.class.php b/wcfsetup/install/files/lib/system/package/PackageInstallationFormManager.class.php
index 127ffb2d5c9..22645fc7a49 100644
--- a/wcfsetup/install/files/lib/system/package/PackageInstallationFormManager.class.php
+++ b/wcfsetup/install/files/lib/system/package/PackageInstallationFormManager.class.php
@@ -131,7 +131,7 @@ public static function deleteForms(PackageInstallationQueue $queue)
      *
      * @param PackageInstallationQueue $queue
      * @param string $formName
-     * @return  FormDocument
+     * @return ?FormDocument
      */
     public static function getForm(PackageInstallationQueue $queue, $formName)
     {
diff --git a/wcfsetup/install/files/lib/system/package/PackageInstallationNodeBuilder.class.php b/wcfsetup/install/files/lib/system/package/PackageInstallationNodeBuilder.class.php
index f9e075e15a3..deac7a21705 100644
--- a/wcfsetup/install/files/lib/system/package/PackageInstallationNodeBuilder.class.php
+++ b/wcfsetup/install/files/lib/system/package/PackageInstallationNodeBuilder.class.php
@@ -341,7 +341,7 @@ public function calculateProgress($node)
         } else {
             $total = $progress['done'] + $progress['outstanding'];
 
-            return \round(($progress['done'] / $total) * 100);
+            return (int)\round(($progress['done'] / $total) * 100);
         }
     }
 
diff --git a/wcfsetup/install/files/lib/system/package/PackageInstallationSQLParser.class.php b/wcfsetup/install/files/lib/system/package/PackageInstallationSQLParser.class.php
index 80b0b5fe1a1..f9f3b3510a8 100644
--- a/wcfsetup/install/files/lib/system/package/PackageInstallationSQLParser.class.php
+++ b/wcfsetup/install/files/lib/system/package/PackageInstallationSQLParser.class.php
@@ -259,9 +259,9 @@ protected function getIndexOwnerID($tableName, $indexName)
             return $row['packageID'];
         } elseif (isset($this->knownTables[$tableName])) {
             return $this->knownTables[$tableName];
-        } else {
-            return;
         }
+
+        return 0;
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/system/package/PackageInstallationScheduler.class.php b/wcfsetup/install/files/lib/system/package/PackageInstallationScheduler.class.php
index d1d8635618d..2b0b1614b03 100644
--- a/wcfsetup/install/files/lib/system/package/PackageInstallationScheduler.class.php
+++ b/wcfsetup/install/files/lib/system/package/PackageInstallationScheduler.class.php
@@ -360,6 +360,9 @@ protected function downloadPackage($package, $packageUpdateVersions, $validateIn
             return $filename;
         }
 
+        // I was unable to figure out how the `archive` key is used to determine
+        // if `false` is an acceptable value or if this should fail hard instead.
+        // @phpstan-ignore return.type
         return false;
     }
 
diff --git a/wcfsetup/install/files/lib/system/package/license/LicenseData.class.php b/wcfsetup/install/files/lib/system/package/license/LicenseData.class.php
index b5863e27fe2..ef33c5b9199 100644
--- a/wcfsetup/install/files/lib/system/package/license/LicenseData.class.php
+++ b/wcfsetup/install/files/lib/system/package/license/LicenseData.class.php
@@ -22,8 +22,8 @@ final class LicenseData
      *              expiryDates?: array<string, int>,
      *              ckeditorLicenseKey?: string,
      *          } $license
-     * @param   array<string,string> $pluginstore 
-     * @param   array<string,string> $woltlab 
+     * @param   array<string,string> $pluginstore
+     * @param   array<string,string> $woltlab
      */
     public function __construct(
         public readonly array $license,
@@ -34,7 +34,7 @@ public function __construct(
         $this->creationDate = new \DateTimeImmutable();
     }
 
-    public function getLicenseNumber(): ?string
+    public function getLicenseNumber(): ?int
     {
         return $this->license['licenseID'] ?? null;
     }
diff --git a/wcfsetup/install/files/lib/system/package/plugin/AbstractOptionPackageInstallationPlugin.class.php b/wcfsetup/install/files/lib/system/package/plugin/AbstractOptionPackageInstallationPlugin.class.php
index a6473dfd94a..820a0d71d41 100644
--- a/wcfsetup/install/files/lib/system/package/plugin/AbstractOptionPackageInstallationPlugin.class.php
+++ b/wcfsetup/install/files/lib/system/package/plugin/AbstractOptionPackageInstallationPlugin.class.php
@@ -962,7 +962,7 @@ public function getSortedCategories()
     /**
      * Returns an option handler used for sorting.
      *
-     * @return  IOptionHandler
+     * @return  ?IOptionHandler
      * @see     OptionPackageInstallationPlugin::getSortOptionHandler()
      */
     protected function getSortOptionHandler()
diff --git a/wcfsetup/install/files/lib/system/package/plugin/IPackageInstallationPlugin.class.php b/wcfsetup/install/files/lib/system/package/plugin/IPackageInstallationPlugin.class.php
index cc65b250c55..97618f10ce1 100644
--- a/wcfsetup/install/files/lib/system/package/plugin/IPackageInstallationPlugin.class.php
+++ b/wcfsetup/install/files/lib/system/package/plugin/IPackageInstallationPlugin.class.php
@@ -40,7 +40,7 @@ public function uninstall();
      * Returns the default file name containing the instructions or `null` if no default
      * file name is supported.
      *
-     * @return  string
+     * @return  ?string
      * @since   3.0
      */
     public static function getDefaultFilename();
diff --git a/wcfsetup/install/files/lib/system/page/handler/ILookupPageHandler.class.php b/wcfsetup/install/files/lib/system/page/handler/ILookupPageHandler.class.php
index c241b2d9781..a0cad5052a8 100644
--- a/wcfsetup/install/files/lib/system/page/handler/ILookupPageHandler.class.php
+++ b/wcfsetup/install/files/lib/system/page/handler/ILookupPageHandler.class.php
@@ -34,7 +34,7 @@ public function isValid($objectID);
      * an `objectID => title` relation.
      *
      * @param string $searchString search string
-     * @return  string[][]
+     * @return list<array<string, mixed>>
      */
     public function lookup($searchString);
 }
diff --git a/wcfsetup/install/files/lib/system/page/handler/TDecoratedCategoryLookupPageHandler.class.php b/wcfsetup/install/files/lib/system/page/handler/TDecoratedCategoryLookupPageHandler.class.php
index c9a6e6ebca5..4697bb3b61c 100644
--- a/wcfsetup/install/files/lib/system/page/handler/TDecoratedCategoryLookupPageHandler.class.php
+++ b/wcfsetup/install/files/lib/system/page/handler/TDecoratedCategoryLookupPageHandler.class.php
@@ -81,7 +81,7 @@ public function isValid($objectID = null)
      * an `objectID => title` relation.
      *
      * @param string $searchString search string
-     * @return  string[]
+     * @return list<array<string, mixed>>
      * @see ILookupPageHandler::lookup()
      */
     public function lookup($searchString)
diff --git a/wcfsetup/install/files/lib/system/page/handler/TDecoratedCategoryOnlineLocationPageHandler.class.php b/wcfsetup/install/files/lib/system/page/handler/TDecoratedCategoryOnlineLocationPageHandler.class.php
index a943101b3cc..eb0ebe93d84 100644
--- a/wcfsetup/install/files/lib/system/page/handler/TDecoratedCategoryOnlineLocationPageHandler.class.php
+++ b/wcfsetup/install/files/lib/system/page/handler/TDecoratedCategoryOnlineLocationPageHandler.class.php
@@ -55,7 +55,7 @@ public function getOnlineLocation(Page $page, UserOnline $user)
         }
 
         if ($category instanceof IAccessibleObject && !$category->isAccessible()) {
-            return;
+            return '';
         }
 
         return WCF::getLanguage()->getDynamicVariable(
diff --git a/wcfsetup/install/files/lib/system/page/handler/TUserLookupPageHandler.class.php b/wcfsetup/install/files/lib/system/page/handler/TUserLookupPageHandler.class.php
index 8f0198855f0..de231ace46c 100644
--- a/wcfsetup/install/files/lib/system/page/handler/TUserLookupPageHandler.class.php
+++ b/wcfsetup/install/files/lib/system/page/handler/TUserLookupPageHandler.class.php
@@ -32,7 +32,7 @@ public function isValid($objectID)
      * an `objectID => title` relation.
      *
      * @param string $searchString search string
-     * @return  string[]
+     * @return list<array<string, int|string>>
      * @see ILookupPageHandler::lookup()
      */
     public function lookup($searchString)
diff --git a/wcfsetup/install/files/lib/system/poll/PollManager.class.php b/wcfsetup/install/files/lib/system/poll/PollManager.class.php
index 3bb374dc1eb..293ca4cca9a 100644
--- a/wcfsetup/install/files/lib/system/poll/PollManager.class.php
+++ b/wcfsetup/install/files/lib/system/poll/PollManager.class.php
@@ -47,7 +47,7 @@ class PollManager extends SingletonFactory
 
     /**
      * poll object
-     * @var Poll
+     * @var ?Poll
      */
     protected $poll;
 
diff --git a/wcfsetup/install/files/lib/system/request/ControllerMap.class.php b/wcfsetup/install/files/lib/system/request/ControllerMap.class.php
index 5e97d4a9959..3e205faab68 100644
--- a/wcfsetup/install/files/lib/system/request/ControllerMap.class.php
+++ b/wcfsetup/install/files/lib/system/request/ControllerMap.class.php
@@ -37,13 +37,13 @@ final class ControllerMap extends SingletonFactory
     protected $customUrls;
 
     /**
-     * @var string[]
+     * @var string[][]
      */
     protected $landingPages;
 
     /**
      * list of <ControllerName> to <controller-name> mappings
-     * @var string[]
+     * @var array<string, string>
      */
     protected $lookupCache = [];
 
diff --git a/wcfsetup/install/files/lib/system/search/PageSearch.class.php b/wcfsetup/install/files/lib/system/search/PageSearch.class.php
index 32ea886ecbf..7ff26761edd 100644
--- a/wcfsetup/install/files/lib/system/search/PageSearch.class.php
+++ b/wcfsetup/install/files/lib/system/search/PageSearch.class.php
@@ -157,6 +157,6 @@ public function getJoins(): string
      */
     public function isAccessible(): bool
     {
-        return SEARCH_ENABLE_PAGES;
+        return !!SEARCH_ENABLE_PAGES;
     }
 }
diff --git a/wcfsetup/install/files/lib/system/session/SessionHandler.class.php b/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
index 13916248591..4ee15d07b94 100644
--- a/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
+++ b/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
@@ -55,7 +55,7 @@ final class SessionHandler extends SingletonFactory
 
     /**
      * group data and permissions
-     * @var mixed[][]
+     * @var mixed[][]|null
      */
     private $groupData;
 
diff --git a/wcfsetup/install/files/lib/system/sitemap/object/ArticleCategorySitemapObject.class.php b/wcfsetup/install/files/lib/system/sitemap/object/ArticleCategorySitemapObject.class.php
index 2fc2ccaa6b1..3724a744544 100644
--- a/wcfsetup/install/files/lib/system/sitemap/object/ArticleCategorySitemapObject.class.php
+++ b/wcfsetup/install/files/lib/system/sitemap/object/ArticleCategorySitemapObject.class.php
@@ -59,7 +59,7 @@ public function isAvailableType()
             return false;
         }
 
-        return PageCache::getInstance()
+        return !!PageCache::getInstance()
             ->getPageByIdentifier('com.woltlab.wcf.CategoryArticleList')
             ->allowSpidersToIndex;
     }
diff --git a/wcfsetup/install/files/lib/system/sitemap/object/ArticleSitemapObject.class.php b/wcfsetup/install/files/lib/system/sitemap/object/ArticleSitemapObject.class.php
index ddb78c207ad..9d8acd0f35b 100644
--- a/wcfsetup/install/files/lib/system/sitemap/object/ArticleSitemapObject.class.php
+++ b/wcfsetup/install/files/lib/system/sitemap/object/ArticleSitemapObject.class.php
@@ -42,6 +42,6 @@ public function isAvailableType()
             return false;
         }
 
-        return PageCache::getInstance()->getPageByIdentifier('com.woltlab.wcf.Article')->allowSpidersToIndex;
+        return !!PageCache::getInstance()->getPageByIdentifier('com.woltlab.wcf.Article')->allowSpidersToIndex;
     }
 }
diff --git a/wcfsetup/install/files/lib/system/sitemap/object/UserSitemapObject.class.php b/wcfsetup/install/files/lib/system/sitemap/object/UserSitemapObject.class.php
index 87929423311..1b6ad83cf25 100755
--- a/wcfsetup/install/files/lib/system/sitemap/object/UserSitemapObject.class.php
+++ b/wcfsetup/install/files/lib/system/sitemap/object/UserSitemapObject.class.php
@@ -41,6 +41,6 @@ public function isAvailableType()
             return false;
         }
 
-        return PageCache::getInstance()->getPageByIdentifier('com.woltlab.wcf.User')->allowSpidersToIndex;
+        return !!PageCache::getInstance()->getPageByIdentifier('com.woltlab.wcf.User')->allowSpidersToIndex;
     }
 }
diff --git a/wcfsetup/install/files/lib/system/tagging/AbstractCombinedTaggable.class.php b/wcfsetup/install/files/lib/system/tagging/AbstractCombinedTaggable.class.php
index d6b7fe563fd..5fedf864873 100644
--- a/wcfsetup/install/files/lib/system/tagging/AbstractCombinedTaggable.class.php
+++ b/wcfsetup/install/files/lib/system/tagging/AbstractCombinedTaggable.class.php
@@ -21,12 +21,4 @@ public function getObjectList(Tag $tag)
     {
         return $this->getObjectListFor([$tag]);
     }
-
-    /**
-     * @inheritDoc
-     */
-    public function getObjectListFor(array $tags)
-    {
-        return null;
-    }
 }
diff --git a/wcfsetup/install/files/lib/system/template/TemplateScriptingCompiler.class.php b/wcfsetup/install/files/lib/system/template/TemplateScriptingCompiler.class.php
index 6a8bd1075fa..4b271d94f79 100644
--- a/wcfsetup/install/files/lib/system/template/TemplateScriptingCompiler.class.php
+++ b/wcfsetup/install/files/lib/system/template/TemplateScriptingCompiler.class.php
@@ -182,7 +182,7 @@ class TemplateScriptingCompiler
 
     /**
      * current line number during template compilation
-     * @var string
+     * @var int
      */
     protected $currentLineNo;
 
diff --git a/wcfsetup/install/files/lib/system/template/plugin/ImplodeCompilerTemplatePlugin.class.php b/wcfsetup/install/files/lib/system/template/plugin/ImplodeCompilerTemplatePlugin.class.php
index 9408788131a..855047e482a 100644
--- a/wcfsetup/install/files/lib/system/template/plugin/ImplodeCompilerTemplatePlugin.class.php
+++ b/wcfsetup/install/files/lib/system/template/plugin/ImplodeCompilerTemplatePlugin.class.php
@@ -20,7 +20,7 @@ class ImplodeCompilerTemplatePlugin implements ICompilerTemplatePlugin
 {
     /**
      * local tag stack
-     * @var string[]
+     * @var string[]|string[][]
      */
     protected $tagStack = [];
 
diff --git a/wcfsetup/install/files/lib/system/upload/UploadFile.class.php b/wcfsetup/install/files/lib/system/upload/UploadFile.class.php
index 7173cdb0ceb..1564dbe82e2 100644
--- a/wcfsetup/install/files/lib/system/upload/UploadFile.class.php
+++ b/wcfsetup/install/files/lib/system/upload/UploadFile.class.php
@@ -73,7 +73,7 @@ class UploadFile
     public function __construct($filename, $location, $filesize, $errorCode = 0, $mimeType = '')
     {
         if (\preg_match('~^__wcf_([0-9]+)_(.*)~', $filename, $matches)) {
-            $this->internalFileID = $matches[1];
+            $this->internalFileID = (int)$matches[1];
             $filename = $matches[2];
         }
 
diff --git a/wcfsetup/install/files/lib/system/user/activity/event/TCommentResponseUserActivityEvent.class.php b/wcfsetup/install/files/lib/system/user/activity/event/TCommentResponseUserActivityEvent.class.php
index ab980c506c9..24d6642fd8c 100644
--- a/wcfsetup/install/files/lib/system/user/activity/event/TCommentResponseUserActivityEvent.class.php
+++ b/wcfsetup/install/files/lib/system/user/activity/event/TCommentResponseUserActivityEvent.class.php
@@ -4,6 +4,8 @@
 
 use wcf\data\comment\Comment;
 use wcf\data\comment\response\CommentResponse;
+use wcf\data\comment\response\ViewableCommentResponse;
+use wcf\data\comment\ViewableComment;
 use wcf\data\user\activity\event\ViewableUserActivityEvent;
 use wcf\data\user\UserProfile;
 use wcf\system\cache\runtime\UserProfileRuntimeCache;
@@ -35,13 +37,13 @@ trait TCommentResponseUserActivityEvent
 
     /**
      * comment objects the responses belongs to
-     * @var Comment[]
+     * @var (Comment|ViewableComment)[]
      */
     protected $comments = [];
 
     /**
      * comment response the comment response user activity events belong to
-     * @var CommentResponse[]
+     * @var (CommentResponse|ViewableCommentResponse)[]
      */
     protected $responses = [];
 
diff --git a/wcfsetup/install/files/lib/system/user/authentication/password/algorithm/Wcf1e.class.php b/wcfsetup/install/files/lib/system/user/authentication/password/algorithm/Wcf1e.class.php
index bab73bafd02..65d5dcc0e14 100644
--- a/wcfsetup/install/files/lib/system/user/authentication/password/algorithm/Wcf1e.class.php
+++ b/wcfsetup/install/files/lib/system/user/authentication/password/algorithm/Wcf1e.class.php
@@ -118,7 +118,7 @@ private function encrypt(
     ): string {
         switch ($this->encryptionMethod) {
             case 'c':
-                return \crc32($string);
+                return (string)\crc32($string);
                 break;
 
             case 'm':
diff --git a/wcfsetup/install/files/lib/system/user/notification/event/TReactionUserNotificationEvent.class.php b/wcfsetup/install/files/lib/system/user/notification/event/TReactionUserNotificationEvent.class.php
index e8ef532043e..f5ee595f77a 100644
--- a/wcfsetup/install/files/lib/system/user/notification/event/TReactionUserNotificationEvent.class.php
+++ b/wcfsetup/install/files/lib/system/user/notification/event/TReactionUserNotificationEvent.class.php
@@ -20,14 +20,14 @@ trait TReactionUserNotificationEvent
 {
     /**
      * Cached reactions
-     * @var int[]
+     * @var array<int, int>
      */
     private $cachedReactions;
 
     /**
      * Returns the count of reactionTypeIDs for the specific user notification object.
      *
-     * @return int[]
+     * @return array<int, int>
      */
     final protected function getReactionsForAuthors()
     {
@@ -39,12 +39,12 @@ final protected function getReactionsForAuthors()
         $conditionBuilder->add('like_table.userID IN (?)', [\array_keys($this->getAuthors())]);
         $conditionBuilder->add('like_table_join.likeID = ?', [$this->getUserNotificationObject()->getObjectID()]);
 
-        $sql = "SELECT      like_table.reactionTypeID, COUNT(like_table.reactionTypeID) as count 
+        $sql = "SELECT      like_table.reactionTypeID, COUNT(like_table.reactionTypeID) as count
                 FROM        wcf1_like like_table
                 LEFT JOIN   wcf1_like like_table_join
                 ON          like_table_join.objectTypeID = like_table.objectTypeID
                         AND like_table_join.objectID = like_table.objectID
-                " . $conditionBuilder . " 
+                " . $conditionBuilder . "
                 GROUP BY    like_table.reactionTypeID";
 
         $statement = WCF::getDB()->prepare($sql);
diff --git a/wcfsetup/install/files/lib/system/user/notification/object/PaidSubscriptionUserUserNotificationObject.class.php b/wcfsetup/install/files/lib/system/user/notification/object/PaidSubscriptionUserUserNotificationObject.class.php
index 871b4a38221..3b5aa440d01 100644
--- a/wcfsetup/install/files/lib/system/user/notification/object/PaidSubscriptionUserUserNotificationObject.class.php
+++ b/wcfsetup/install/files/lib/system/user/notification/object/PaidSubscriptionUserUserNotificationObject.class.php
@@ -29,7 +29,7 @@ class PaidSubscriptionUserUserNotificationObject extends DatabaseObjectDecorator
      */
     public function getAuthorID()
     {
-        return null;
+        return 0;
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/system/user/signature/SignatureCache.class.php b/wcfsetup/install/files/lib/system/user/signature/SignatureCache.class.php
index 45223b92070..c77ae7e83ae 100644
--- a/wcfsetup/install/files/lib/system/user/signature/SignatureCache.class.php
+++ b/wcfsetup/install/files/lib/system/user/signature/SignatureCache.class.php
@@ -23,7 +23,7 @@ class SignatureCache extends SingletonFactory
 
     /**
      * cached signatures
-     * @var string
+     * @var array<int, string>
      */
     protected $signatures = [];
 
diff --git a/wcfsetup/install/files/lib/system/version/VersionTracker.class.php b/wcfsetup/install/files/lib/system/version/VersionTracker.class.php
index e392b262b47..967be49b3cf 100644
--- a/wcfsetup/install/files/lib/system/version/VersionTracker.class.php
+++ b/wcfsetup/install/files/lib/system/version/VersionTracker.class.php
@@ -124,6 +124,7 @@ public function getVersions($objectTypeName, $objectID)
         $statement->execute([$objectID]);
         $versions = [];
         while ($version = $statement->fetchObject(VersionTrackerEntry::class)) {
+            /** @var VersionTrackerEntry $version */
             $versions[] = $version;
         }
 
diff --git a/wcfsetup/install/files/lib/system/worker/AbstractWorker.class.php b/wcfsetup/install/files/lib/system/worker/AbstractWorker.class.php
index bca2d7d2525..471d1b7019c 100644
--- a/wcfsetup/install/files/lib/system/worker/AbstractWorker.class.php
+++ b/wcfsetup/install/files/lib/system/worker/AbstractWorker.class.php
@@ -72,7 +72,7 @@ public function getProgress()
             $progress = 100;
         }
 
-        return \floor($progress);
+        return (int)\floor($progress);
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/system/worker/ImportWorker.class.php b/wcfsetup/install/files/lib/system/worker/ImportWorker.class.php
index 9af157a9750..e358434245f 100644
--- a/wcfsetup/install/files/lib/system/worker/ImportWorker.class.php
+++ b/wcfsetup/install/files/lib/system/worker/ImportWorker.class.php
@@ -119,7 +119,7 @@ public function getProgress()
             $progress = 100;
         }
 
-        return \floor($progress);
+        return (int)\floor($progress);
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/system/worker/SitemapRebuildWorker.class.php b/wcfsetup/install/files/lib/system/worker/SitemapRebuildWorker.class.php
index 08cc60aa950..d99faefa9f7 100755
--- a/wcfsetup/install/files/lib/system/worker/SitemapRebuildWorker.class.php
+++ b/wcfsetup/install/files/lib/system/worker/SitemapRebuildWorker.class.php
@@ -121,7 +121,7 @@ public function countObjects()
                         }
 
                         $objectCount = $list->countObjects();
-                        $iterations = \ceil($objectCount / $this->limit);
+                        $iterations = (int)\ceil($objectCount / $this->limit);
                         if (($objectCount % $this->limit) === 0) {
                             // We need an additional iteration to finalize the sitemap.
                             $iterations++;
diff --git a/wcfsetup/install/files/lib/system/worker/StatDailyRebuildDataWorker.class.php b/wcfsetup/install/files/lib/system/worker/StatDailyRebuildDataWorker.class.php
index 6c45eec9578..1f9fe906c67 100644
--- a/wcfsetup/install/files/lib/system/worker/StatDailyRebuildDataWorker.class.php
+++ b/wcfsetup/install/files/lib/system/worker/StatDailyRebuildDataWorker.class.php
@@ -42,7 +42,7 @@ public function countObjects()
     {
         $this->getStartDate();
 
-        $this->count = \ceil((TIME_NOW - $this->startDate) / 86400);
+        $this->count = (int)\ceil((TIME_NOW - $this->startDate) / 86400);
     }
 
     /**
diff --git a/wcfsetup/install/files/lib/system/worker/UserContentRemoveWorker.class.php b/wcfsetup/install/files/lib/system/worker/UserContentRemoveWorker.class.php
index a3b0bd742cc..68a94a1b2f2 100644
--- a/wcfsetup/install/files/lib/system/worker/UserContentRemoveWorker.class.php
+++ b/wcfsetup/install/files/lib/system/worker/UserContentRemoveWorker.class.php
@@ -45,7 +45,7 @@ class UserContentRemoveWorker extends AbstractWorker
     protected $data;
 
     /**
-     * @var null
+     * @var string[]
      */
     public $contentProviders;
 
diff --git a/wcfsetup/install/files/lib/util/ArrayUtil.class.php b/wcfsetup/install/files/lib/util/ArrayUtil.class.php
index ef1d0f11ab6..c44e35924cb 100644
--- a/wcfsetup/install/files/lib/util/ArrayUtil.class.php
+++ b/wcfsetup/install/files/lib/util/ArrayUtil.class.php
@@ -42,7 +42,7 @@ public static function trim($array, $removeEmptyElements = true)
      * Applies intval() to all elements of the given array.
      *
      * @param array|string $array
-     * @return  array|string
+     * @return  array|int
      */
     public static function toIntegerArray($array)
     {
@@ -79,8 +79,8 @@ public static function encodeHTML($array)
     /**
      * Applies stripslashes on all elements of the given array.
      *
-     * @param array $array
-     * @return  array
+     * @param array|string $array
+     * @return  array|string
      */
     public static function stripslashes($array)
     {
diff --git a/wcfsetup/install/files/lib/util/CronjobUtil.class.php b/wcfsetup/install/files/lib/util/CronjobUtil.class.php
index 1927a9d429e..180db3fecd8 100644
--- a/wcfsetup/install/files/lib/util/CronjobUtil.class.php
+++ b/wcfsetup/install/files/lib/util/CronjobUtil.class.php
@@ -36,7 +36,7 @@ final class CronjobUtil
     /**
      * valid ranges for each known field (range for 'day of month' is missing
      * since it varies from month to month)
-     * @var int[]
+     * @var array<string, array{0: int, 1: int}>
      */
     public static $ranges = [
         'minute' => [0, 59],
@@ -607,19 +607,19 @@ public static function validateAttribute($name, $value)
                     && \preg_match('/^(((' . $pattern . ')-(' . $pattern . '))(\/' . $step . ')?)+$/', $testField)
                 ) {
                     $compare = \explode('-', $testField);
-                    $compareSlash = \explode('/', $compare['1']);
+                    $compareSlash = \explode('/', $compare[1]);
                     if (\count($compareSlash) == 2) {
-                        $compare['1'] = $compareSlash['0'];
+                        $compare[1] = $compareSlash[0];
                     }
 
                     // see if digits or names are being given.
-                    $left = \array_search(\mb_strtolower($compare['0']), $namesArr);
-                    $right = \array_search(\mb_strtolower($compare['1']), $namesArr);
+                    $left = \array_search(\mb_strtolower($compare[0]), $namesArr);
+                    $right = \array_search(\mb_strtolower($compare[1]), $namesArr);
                     if (!$left) {
-                        $left = $compare['0'];
+                        $left = $compare[0];
                     }
                     if (!$right) {
-                        $right = $compare['1'];
+                        $right = $compare[1];
                     }
                     // now check the values.
                     if (\intval($left) > \intval($right)) {
diff --git a/wcfsetup/install/files/lib/util/DOMUtil.class.php b/wcfsetup/install/files/lib/util/DOMUtil.class.php
index 2d1c5e831fd..33b9341030a 100644
--- a/wcfsetup/install/files/lib/util/DOMUtil.class.php
+++ b/wcfsetup/install/files/lib/util/DOMUtil.class.php
@@ -132,7 +132,11 @@ public static function getParentBefore(\DOMNode $node, \DOMElement $ancestor): \
      */
     public static function getParentNode(\DOMNode $node): \DOMElement|\DOMDocument
     {
-        return $node->parentNode ?: $node->ownerDocument;
+        if ($node->parentNode instanceof \DOMElement) {
+            return $node->parentNode;
+        }
+
+        return $node->ownerDocument;
     }
 
     /**
@@ -147,6 +151,7 @@ public static function getParents(\DOMNode $node, bool $reverseOrder = false): a
 
         $parent = $node;
         while ($parent = $parent->parentNode) {
+            /** @var \DOMElement $parent */
             $parents[] = $parent;
         }
 
diff --git a/wcfsetup/install/files/lib/util/ExifUtil.class.php b/wcfsetup/install/files/lib/util/ExifUtil.class.php
index bc2d5158074..455a392182c 100644
--- a/wcfsetup/install/files/lib/util/ExifUtil.class.php
+++ b/wcfsetup/install/files/lib/util/ExifUtil.class.php
@@ -124,7 +124,7 @@ public static function getCamera(array $exifData)
      * Returns the creation timestamp based on the given exif data.
      *
      * @param array $exifData
-     * @return  string
+     * @return  int
      */
     public static function getCreationTime(array $exifData)
     {
@@ -293,7 +293,7 @@ private static function simplifyRational(string $rational): string
     {
         $data = \explode('/', $rational);
         if (\count($data) == 1) {
-            return $data;
+            return $rational;
         }
 
         $numerator = $data[0];
diff --git a/wcfsetup/install/files/lib/util/HTTPRequest.class.php b/wcfsetup/install/files/lib/util/HTTPRequest.class.php
index 50bf70962b6..3f0b86fd1dc 100644
--- a/wcfsetup/install/files/lib/util/HTTPRequest.class.php
+++ b/wcfsetup/install/files/lib/util/HTTPRequest.class.php
@@ -73,7 +73,7 @@ final class HTTPRequest
     private $replyBody;
 
     /**
-     * @var ResponseInterface
+     * @var ?ResponseInterface
      */
     private $response;
 
diff --git a/wcfsetup/install/files/lib/util/Url.class.php b/wcfsetup/install/files/lib/util/Url.class.php
index 9a4f8a9d215..0834b0035bb 100644
--- a/wcfsetup/install/files/lib/util/Url.class.php
+++ b/wcfsetup/install/files/lib/util/Url.class.php
@@ -25,7 +25,7 @@ final class Url implements \ArrayAccess
 
     /**
      * maps properties to the array indices
-     * @var int[]
+     * @var array<int, string>
      */
     private static $propertyMap = [
         \PHP_URL_SCHEME => 'scheme',
@@ -146,7 +146,7 @@ public function offsetSet(mixed $offset, mixed $value): void
      * making it easier to spot typos.
      *
      * @param mixed $property
-     * @return      int
+     * @return      int|string
      * @throws      \RuntimeException
      */
     private function getIndex($property)
diff --git a/wcfsetup/install/files/lib/util/XML.class.php b/wcfsetup/install/files/lib/util/XML.class.php
index 7eb1b995693..c2d8e0f81c1 100644
--- a/wcfsetup/install/files/lib/util/XML.class.php
+++ b/wcfsetup/install/files/lib/util/XML.class.php
@@ -185,7 +185,7 @@ public function xpath()
     /**
      * Reads errors from libxml since be bypassed built-in error handler.
      *
-     * @return  string[][]
+     * @return  list<array<string, int|string>>
      * @see     \wcf\util\XML::__construct()
      */
     public function pollErrors()