Psalm 7 release: PHP security&static analysis software

Psalm 7 is a major release of the PHP static-analysis tool, combining type checking, security analysis and dead-code detection in one run, with security analysis enabled by default and reported to be more than ten times faster. Its expanded taint tracking detects risks including NoSQL injection, LLM prompt injection, URL injection and SSRF, and recognizes new input sources such as request bodies, uploaded filenames, command-line arguments and DNS answers. Taints now propagate through closures, generators, traits, references and other complex flows, while more precise type handling aims to reduce false positives. Built-in library stubs add security and purity knowledge for commonly used packages, and graph-based analysis finds unreachable code, including unused cycles.

The release also replaces older purity annotations with a capability model that specifies effects such as I/O, time access and property or global writes. Purity templates let a function’s effects depend on its callbacks, inputs or subclasses, with annotations sometimes inferred automatically. Generic template defaults make types such as Result usable without explicitly supplying every parameter, while other type-system changes improve conditional and scalar types. Psalm supports PHP 8.5’s pipe operator and PHP 8.6’s partial function application, checking types throughout each expression. PHPUnit, Symfony, Laravel, Mockery and sabre/event plugins are bundled and enabled automatically; releases are now issued daily. Psalm 7 runs on 64-bit PHP 8.2-8.6, and plugin compatibility is managed through a separately versioned API package, so plugin developers must account for API-breaking changes.