Bump the phpstan group with 3 updates

[dependabot]

Updates the requirements on phpstan/phpstan-strict-rules, spaze/phpstan-disallowed-calls and shipmonk/phpstan-rules to permit the latest version.
Updates phpstan/phpstan-strict-rules to 1.5.5

Release notes

Sourced from phpstan/phpstan-strict-rules's releases.

1.5.5

• 2e193a0 - ArrayFilterStrictRule - get rid of different behavour with treatPhpDocTypesAsCertain: false

Commits

• 2e193a0 ArrayFilterStrictRule - get rid of different behavour with `treatPhpDocTypesA...
• 8afd4af Loosen up ArrayFilterStrictRule for unions with clearly truthy/falsey types
• 568210b Introduce strict array_filter call (require callback method)
• 4723149 Require PHPStan 1.10.60
• 2fc12e5 Fix UselessCastRuleTest.
• See full diff in compare view

Updates spaze/phpstan-disallowed-calls to 3.2.0

Release notes

Sourced from spaze/phpstan-disallowed-calls's releases.

Add phpinfo() to dangerous calls config

Add phpinfo() to dangerous calls config (#255)

See

• https://www.michalspacek.com/stealing-session-ids-with-phpinfo-and-how-to-stop-it
• or https://www.michalspacek.cz/kradeni-session-id-pomoci-phpinfo-a-jak-tomu-zabranit (in Czech)

for reasons why (phpinfo() echoes cookie values like the session id, which may then be stolen with XSS for example, bypassing HttpOnly cookie flag), and use https://github.com/spaze/phpinfo instead of just calling phpinfo().

Internal changes

• It's already a list, no need to call array_values() (#253, this is a new bleeding edge rule added in PHPStan 1.10.59)
• Update dev dependencies (#254)

Commits

• 6d5ce7e Add phpinfo() to dangerous calls config (#255)
• a28a1e6 Add phpinfo() to dangerous calls config
• bcd693f Update dev dependencies (#254)
• e3f6e67 Move the flag config type check to paramFactory()
• 104dc95 Add attributes in addition to docblocks
• 75d9f4c Allow nikic/php-parser 5
• d363d00 It's already a list, no need to call array_values() (#253)
• d0f8166 It's already a list, no need to call array_values()
• See full diff in compare view

Updates shipmonk/phpstan-rules to 2.12.0

Release notes

Sourced from shipmonk/phpstan-rules's releases.

2.12.0

New features

• forbidNotNormalizedType: check invalid Parent|Child even in multi-catch and @throws (#231, #232)

Commits

• db342d8 Readme: whitelist what forbidNotNormalizedType supports (#233)
• a919257 ForbidNotNormalizedTypeRule: support also @​throws (#232)
• 7769c17 ForbidNotNormalizedTypeRule: check even multi-catch statements (#231)
• 32002c4 Bump the prod-dependencies group with 1 update (#230)
• 10afe5f Bump the dev-dependencies group with 4 updates (#229)
• e36bdd2 Bump the prod-dependencies group with 1 update (#228)
• 613df6f dependabot: use groups to avoid clutter (#227)
• 7738dab Readme: suggest reportAnyTypeWideningInVarTag along enforceListReturn (#226)
• 66c30cb Readme: link czech talk about checked exceptions (#225)
• 1814da4 Readme: mention reportAnyTypeWideningInVarTag extra strictness (#224)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot will merge this PR once CI passes on it, as requested by @xificurk.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[xificurk]

@dependabot squash and merge