Build(deps-dev): Bump vimeo/psalm from 3.8.3 to 3.9.4

[dependabot-preview]

Bumps vimeo/psalm from 3.8.3 to 3.9.4.

Release notes

Sourced from vimeo/psalm's releases.

Bugfixes

Change in behaviour

• accessing a not-previously-specified key of an object-like array is now a bug (#2787)
• any args passed to an unknown method must now be defined beforehand (#2909)

Other bugfixes

• @Daeroni improved some builtin GD functions (#2851)
• @JaredCDN prevented a TypeError when generating xml reports (#2856)
• Psalter: fix MissingParamType replacement when for parameters passed by-reference (#2857)
• Prevent DuplicateArrayKey warning when unpacking multiple arrays without known key types (#2852)
• Allow comparison between different templated object-like arrays (#2849)
• Allow casting templated types (#2848)
• Allow class constants to contain array offset references for other class constants (#2844)
• Forbid passing in mutatable class to a mutation-free context (#2805)
• Allow "5.0" where numeric is expected (#2827)
• Only warn about deprecated classes where they're used explicitly (#2721)
• Warn when an immutable class depends on a mutable parent (#2242)
• Detect error when asserting on result of function call (#1684)
• Break apart a scalar type into constituent parts where necessary (#1311)
• Treat echo as impure (#2867)
• Prevent use of impure __toString (#2866)
• Prevent keyed arrays from being interpreted as callable (#2871)
• @ArSn fixed setting memory_limit artificially low when running Psalter (#2873)
• Allow @method as(string $s) (#2881)
• Handle templated intersections more equally (#2875)
• @pilif added a config skipChecksOnUnresolvableIncludes that you can disable to make Psalm more strict when it encounters includes for unknown files (#2817)
• @jdreesen improved the return type of range(...)
• Keep track of which argument a given template param was inferred from, to avoid overwriting the inference (#2900)
• Don't care about method case in the PhpStorm meta scanner (#2890)
• Rename stubs to prevent issues in PHPStorm (#2879)
• Trim carriage returns where necessary (#2859)
• Prevent ternaries from being considered a valid reference (#2910)
• @leightonthomas supported trailing commas in type aliases (#1799)
• Prevent contradiction with templated object equality (#2918)
• Don't emit MissingPropertyType where the property is defined in a third-party lib (#2388)

Adjust config flag behaviour for mixed issues

Version 3.9.0 essentially changed the default reporting level for a host of Mixed issues.

In retrospect this was not the best idea – people saw a (non-error-related) number go up (because of all the newly-reported mixed issues), and people don't like numbers going up.

So this reverts that behaviour – any project that had totallyTyped="false" before will show the same errors & info as it did in 3.8.

This also introduces new flag reportMixedIssues (documented here) that allows more fine-grained control than totallyTyped offers.

Fix a few incompatibilities introduced in 3.9.0

Psalm had an existing issue where it failed to detect the bug in the following code:

... (truncated)

Commits

• 352bd3f Remove redundant condition
• 766effb Improve accuracy of diff generation
• f3d7ed6 Remove var_dump
• 7f9e6b8 Increase processor consumption
• dc74f2b Add specific cast
• 10b807b Fix reference generation from methods in --diff mode
• a2a5071 Fix #2923 - remove hack to fix a template issue
• 51bfc7c Only emit mixed issues for MissingClassPropertyType
• 7ea06c7 Only emit PossiblyUndefinedVariable issue on variables
• 75a3412 Downgrade error when using unknown variable in mixed method
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

If all status checks pass Dependabot will automatically merge this pull request.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the .dependabot/config.yml file in this repo:

• Update frequency
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[codecov]

Codecov Report

Merging #201 into master will not change coverage by %.
The diff coverage is n/a.

@@             Coverage Diff             @@
##              master      #201   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity        41        41           
===========================================
  Files              4         4           
  Lines            159       159           
===========================================
  Hits             159       159           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 22ac2a7...198dd5b. Read the comment docs.

[dependabot-preview]

One of your CI runs failed on this pull request, so Dependabot won't merge it.

• Static Code Analysis (7.4, locked)

Dependabot will still automatically merge this pull request if you amend it and your tests pass.

[dependabot-preview]

Superseded by #202.