Drop vimeo/psalm, add phpstan/phpstan

.gitattributes

@@ -1,12 +1,16 @@
-/.github                export-ignore
-/test                   export-ignore
-/tools                  export-ignore
-/examples               export-ignore
 /.gitattributes         export-ignore
+/.github                export-ignore
 /.gitignore             export-ignore
+/Dockerfile             export-ignore
+/Makefile               export-ignore
 /composer.lock          export-ignore
+/docker-compose.yml     export-ignore
+/examples               export-ignore
 /infection.json.dist    export-ignore
 /phpcs.xml.dist         export-ignore
-/psalm.xml              export-ignore
+/phpstan-baseline.neon  export-ignore
+/phpstan.neon           export-ignore
 /phpunit.xml.dist       export-ignore
 /renovate.json          export-ignore
+/test                   export-ignore
+/tools                  export-ignore

.github/workflows/continuous-integration.yml

@@ -55,7 +55,7 @@ jobs:
           ini-values: "${{ env.INI_VALUES }}"
       - uses: "ramsey/composer-install@v3"
 
-      - run: "vendor/bin/psalm --shepherd --stats --output-format=github --no-cache"
+      - run: "vendor/bin/phpstan"
 
   tests:
     name: "Tests"
@@ -101,7 +101,7 @@ jobs:
 
       - name: "Run Infection"
         timeout-minutes: 30
-        run: "vendor/bin/roave-infection-static-analysis-plugin"
+        run: "vendor/bin/infection --ansi --show-mutations"
         env:
           INFECTION_DASHBOARD_API_KEY: "${{ secrets.INFECTION_DASHBOARD_API_KEY }}"
           STRYKER_DASHBOARD_API_KEY: "${{ secrets.STRYKER_DASHBOARD_API_KEY }}"

.gitignore

@@ -1,5 +1,6 @@
 /vendor
 /.phpcs-cache
+/tmp
 .env
 clover.xml
 .phpunit.result.cache

Makefile

@@ -32,7 +32,7 @@ cs: vendor ## verify code style rules
 
 .PHONY: static-analysis
 static-analysis: vendor ## verify that no static analysis issues were introduced
-	$(DOCKER_PHP_EXEC) vendor/bin/psalm
+	$(DOCKER_PHP_EXEC) vendor/bin/phpstan
 
 .PHONY: bc-check
 bc-check: vendor ## check for backwards compatibility breaks
@@ -43,7 +43,7 @@ bc-check: vendor ## check for backwards compatibility breaks
 
 .PHONY: coverage
 coverage: vendor ## generate code coverage reports
-	$(DOCKER_PHP_EXEC) vendor/bin/roave-infection-static-analysis-plugin --show-mutations
+	$(DOCKER_PHP_EXEC) vendor/bin/infection --show-mutations
 
 .PHONY: clean
 clean:

composer.json

@@ -32,13 +32,13 @@
     },
     "require-dev": {
         "doctrine/coding-standard": "^12.0.0",
+        "infection/infection": "^0.29.7",
         "laminas/laminas-diactoros": "^3.5.0",
         "laminas/laminas-httphandlerrunner": "^2.11.0",
+        "phpstan/phpstan": "^1.12.7",
+        "phpstan/phpstan-phpunit": "^1.4.0",
         "phpunit/phpunit": "^10.5.38",
-        "psalm/plugin-phpunit": "^0.19.0",
-        "roave/infection-static-analysis-plugin": "^1.35.0",
-        "squizlabs/php_codesniffer": "^3.10.3",
-        "vimeo/psalm": "^5.26.1"
+        "squizlabs/php_codesniffer": "^3.10.3"
     },
     "replace": {
         "ocramius/psr7-session": "self.version"
@@ -56,7 +56,7 @@
     "config": {
         "allow-plugins": {
             "dealerdirect/phpcodesniffer-composer-installer": true,
-            "infection/extension-installer": false
+            "infection/extension-installer": true
         },
         "platform": {
             "php": "8.3.99"