Setono · loevgaard · Aug 31, 2026 · Aug 31, 2026 · Aug 31, 2026 · Aug 31, 2026
diff --git a/.gitattributes b/.gitattributes
@@ -14,7 +14,7 @@
 /infection.json.dist                export-ignore
 /node_modules                       export-ignore
 /phpunit.xml.dist                   export-ignore
-/psalm-baseline.xml                 export-ignore
-/psalm.xml                          export-ignore
+/phpstan-baseline.neon              export-ignore
+/phpstan.neon                       export-ignore
 /rector.php                         export-ignore
 /tests                              export-ignore
diff --git a/.github/workflows/backwards-compatibility-check.yaml b/.github/workflows/backwards-compatibility-check.yaml
@@ -13,7 +13,7 @@ jobs:
 
         steps:
             -   name: "Checkout"
-                uses: "actions/checkout@v4"
+                uses: "actions/checkout@v7"
                 with:
                     fetch-depth: 0
 
@@ -26,5 +26,10 @@ jobs:
             -   name: "Install tool"
                 run: "composer global require roave/backward-compatibility-check"
 
+            # Sylius 1.x depends on api-platform/core ^2.7, which has known security advisories. Composer >= 2.10 refuses to
+            # install such versions by default, and the baseline (the base branch) cannot opt out itself, so opt out globally
+            -   name: "Allow installing packages with known security advisories"
+                run: "composer config --global policy.advisories.block false"
+
             -   name: "Check for BC breaks"
                 run: "~/.composer/vendor/bin/roave-backward-compatibility-check --from=origin/${{ github.event.pull_request.base.ref }} --format=github-actions"
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -31,7 +31,7 @@ jobs:
 
         steps:
             -   name: "Checkout"
-                uses: "actions/checkout@v4"
+                uses: "actions/checkout@v7"
 
             -   name: "Setup PHP, with composer and extensions"
                 uses: "shivammathur/setup-php@v2"
@@ -56,7 +56,6 @@ jobs:
 
             -   name: "Rector"
                 run: "vendor/bin/rector process --dry-run"
-                continue-on-error: true
 
             -   name: "Lint yaml files"
                 run: "(cd tests/Application && bin/console lint:yaml ../../src/Resources)"
@@ -74,18 +73,18 @@ jobs:
                 php-version:
                     - "8.1"
                     - "8.2"
+                    - "8.3"
 
                 dependencies:
                     - "lowest"
                     - "highest"
 
                 symfony:
-                    - "~5.4.0"
                     - "~6.4.0"
 
         steps:
             -   name: "Checkout"
-                uses: "actions/checkout@v4"
+                uses: "actions/checkout@v7"
 
             -   name: "Setup PHP, with composer and extensions"
                 uses: "shivammathur/setup-php@v2"
@@ -121,18 +120,18 @@ jobs:
                 php-version:
                     - "8.1"
                     - "8.2"
+                    - "8.3"
 
                 dependencies:
                     - "lowest"
                     - "highest"
 
                 symfony:
-                    - "~5.4.0"
                     - "~6.4.0"
 
         steps:
             -   name: "Checkout"
-                uses: "actions/checkout@v4"
+                uses: "actions/checkout@v7"
 
             -   name: "Setup PHP, with composer and extensions"
                 uses: "shivammathur/setup-php@v2"
@@ -153,7 +152,7 @@ jobs:
                     dependency-versions: "${{ matrix.dependencies }}"
 
             -   name: "Static analysis"
-                run: "vendor/bin/psalm --php-version=${{ matrix.php-version }}"
+                run: "composer analyse"
 
     unit-tests:
         name: "Unit tests (PHP${{ matrix.php-version }} | Deps: ${{ matrix.dependencies }} | SF${{ matrix.symfony }})"
@@ -165,18 +164,18 @@ jobs:
                 php-version:
                     - "8.1"
                     - "8.2"
+                    - "8.3"
 
                 dependencies:
                     - "lowest"
                     - "highest"
 
                 symfony:
-                    - "~5.4.0"
                     - "~6.4.0"
 
         steps:
             -   name: "Checkout"
-                uses: "actions/checkout@v4"
+                uses: "actions/checkout@v7"
 
             -   name: "Setup PHP, with composer and extensions"
                 uses: "shivammathur/setup-php@v2"
@@ -206,21 +205,21 @@ jobs:
                 php-version:
                     - "8.1"
                     - "8.2"
+                    - "8.3"
 
                 dependencies:
                     - "lowest"
                     - "highest"
 
                 symfony:
-                    - "~5.4.0"
                     - "~6.4.0"
 
         steps:
             -   name: "Start MySQL"
                 run: "sudo /etc/init.d/mysql start"
 
             -   name: "Checkout"
-                uses: "actions/checkout@v4"
+                uses: "actions/checkout@v7"
 
             -   name: "Setup PHP, with composer and extensions"
                 uses: "shivammathur/setup-php@v2"
@@ -257,14 +256,14 @@ jobs:
         strategy:
             matrix:
                 php-version:
-                    - "8.2"
+                    - "8.3"
 
                 dependencies:
                     - "highest"
 
         steps:
             -   name: "Checkout"
-                uses: "actions/checkout@v4"
+                uses: "actions/checkout@v7"
 
             -   name: "Setup PHP, with composer and extensions"
                 uses: "shivammathur/setup-php@v2"
@@ -291,14 +290,14 @@ jobs:
         strategy:
             matrix:
                 php-version:
-                    - "8.2"
+                    - "8.3"
 
                 dependencies:
                     - "highest"
 
         steps:
             -   name: "Checkout"
-                uses: "actions/checkout@v4"
+                uses: "actions/checkout@v7"
 
             -   name: "Setup PHP, with composer and extensions"
                 uses: "shivammathur/setup-php@v2"

diff --git a/.gitignore b/.gitignore
@@ -5,6 +5,7 @@
 
 /tests/Application/yarn.lock
 
+/.phpunit.cache/
 /.phpunit.result.cache
 
 # Symfony CLI https://symfony.com/doc/current/setup/symfony_server.html#different-php-settings-per-project

diff --git a/composer.json b/composer.json
@@ -31,34 +31,36 @@
         "sylius/resource-bundle": "^1.6",
         "sylius/taxonomy": "^1.0",
         "sylius/ui-bundle": "^1.0",
-        "symfony/config": "^5.4 || ^6.4 || ^7.0",
-        "symfony/dependency-injection": "^5.4 || ^6.4 || ^7.0",
-        "symfony/event-dispatcher": "^5.4 || ^6.4 || ^7.0",
-        "symfony/form": "^5.4 || ^6.4 || ^7.0",
-        "symfony/http-foundation": "^5.4 || ^6.4 || ^7.0",
-        "symfony/http-kernel": "^5.4 || ^6.4 || ^7.0",
-        "symfony/options-resolver": "^5.4 || ^6.4 || ^7.0",
+        "symfony/config": "^6.4",
+        "symfony/dependency-injection": "^6.4",
+        "symfony/event-dispatcher": "^6.4",
+        "symfony/form": "^6.4",
+        "symfony/http-foundation": "^6.4",
+        "symfony/http-kernel": "^6.4",
+        "symfony/options-resolver": "^6.4",
         "webmozart/assert": "^1.11"
     },
     "require-dev": {
-        "api-platform/core": "^2.7",
+        "api-platform/core": "^2.7.16",
         "babdev/pagerfanta-bundle": "^3.8",
         "behat/behat": "^3.14",
         "doctrine/doctrine-bundle": "^2.11",
         "jms/serializer-bundle": "^4.2",
-        "lexik/jwt-authentication-bundle": "^2.16",
+        "lexik/jwt-authentication-bundle": "^2.17",
         "nyholm/psr7": "^1.8",
-        "setono/sylius-plugin-pack": "^1.12",
+        "setono/sylius-plugin-pack": "~1.14.1",
         "setono/tag-bag": "^2.3",
         "setono/tag-bag-bundle": "^3.0",
-        "symfony/debug-bundle": "^5.4 || ^6.4 || ^7.0",
-        "symfony/dotenv": "^5.4 || ^6.4 || ^7.0",
-        "symfony/http-client": "^5.4 || ^6.4 || ^7.0",
-        "symfony/intl": "^5.4 || ^6.4 || ^7.0",
-        "symfony/property-info": "^5.4 || ^6.4 || ^7.0",
-        "symfony/serializer": "^5.4 || ^6.4 || ^7.0",
-        "symfony/web-profiler-bundle": "^5.4 || ^6.4 || ^7.0",
-        "symfony/webpack-encore-bundle": "^1.14",
+        "shipmonk/composer-dependency-analyser": "^1.6",
+        "sylius-labs/polyfill-symfony-security": "^1.1.2",
+        "symfony/debug-bundle": "^6.4",
+        "symfony/dotenv": "^6.4",
+        "symfony/http-client": "^6.4",
+        "symfony/intl": "^6.4",
+        "symfony/property-info": "^6.4",
+        "symfony/serializer": "^6.4",
+        "symfony/web-profiler-bundle": "^6.4",
+        "symfony/webpack-encore-bundle": "^1.17.2",
         "willdurand/negotiation": "^3.1"
     },
     "prefer-stable": true,
@@ -77,15 +79,19 @@
     },
     "config": {
         "allow-plugins": {
-            "dealerdirect/phpcodesniffer-composer-installer": false,
+            "dealerdirect/phpcodesniffer-composer-installer": true,
             "ergebnis/composer-normalize": true,
             "infection/extension-installer": true,
+            "phpstan/extension-installer": true,
             "symfony/thanks": false
         },
+        "audit": {
+            "block-insecure": false
+        },
         "sort-packages": true
     },
     "scripts": {
-        "analyse": "psalm",
+        "analyse": "phpstan analyse",
         "check-style": "ecs check",
         "fix-style": "ecs check --fix",
         "phpunit": "phpunit"

diff --git a/phpstan.neon b/phpstan.neon
@@ -0,0 +1,34 @@
+parameters:
+    level: max
+
+    paths:
+        - src
+        - tests
+
+    excludePaths:
+        - tests/Application/*
+
+    bootstrapFiles:
+        - vendor/autoload.php
+
+    # Symfony Configuration
+    symfony:
+        consoleApplicationLoader: tests/PHPStan/console_application.php
+
+    # Doctrine Configuration
+    doctrine:
+        repositoryClass: Doctrine\ORM\EntityRepository
+        objectManagerLoader: tests/PHPStan/object_manager.php
+        # Sylius resources keep required fields nullable until they are set through the form (e.g. Pixel::$pixelId)
+        allowNullablePropertyForRequiredField: true
+
+    reportUnmatchedIgnoredErrors: false
+    treatPhpDocTypesAsCertain: false
+
+    ignoreErrors:
+        # Sylius maps associations to interfaces (e.g. ChannelInterface) and resolves them to the host application's
+        # concrete entity at runtime via resolve_target_entities. The interface is therefore the correct static type,
+        # even though phpstan-doctrine compares against the resolved concrete class.
+        -
+            identifier: doctrine.associationType
+            path: src/Model/*
diff --git a/phpunit.xml.dist b/phpunit.xml.dist
@@ -1,19 +1,19 @@
 <?xml version="1.0" encoding="UTF-8"?>
-
 <phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"
-         colors="true"
+         xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd" colors="true"
          bootstrap="tests/Application/config/bootstrap.php">
+    <coverage includeUncoveredFiles="true" processUncoveredFiles="true">
+        <include>
+            <directory suffix=".php">src/</directory>
+        </include>
+    </coverage>
     <testsuites>
         <testsuite name="SetonoSyliusFacebookPlugin Test Suite">
             <directory>tests</directory>
         </testsuite>
     </testsuites>
-
     <php>
-        <server name="KERNEL_CLASS_PATH" value="/tests/Application/AppKernel.php" />
-        <server name="IS_DOCTRINE_ORM_SUPPORTED" value="true" />
         <env name="APP_ENV" value="test"/>
-        <env name="SHELL_VERBOSITY" value="-1" />
+        <env name="SHELL_VERBOSITY" value="-1"/>
     </php>
 </phpunit>
diff --git a/psalm.xml b/psalm.xml
diff --git a/src/Context/PixelContext.php b/src/Context/PixelContext.php
@@ -25,9 +25,7 @@ public function __construct(
 
     public function getPixels(): array
     {
-        if (null === $this->pixels) {
-            $this->pixels = $this->pixelRepository->findEnabledByChannel($this->channelContext->getChannel());
-        }
+        $this->pixels ??= $this->pixelRepository->findEnabledByChannel($this->channelContext->getChannel());
 
         return $this->pixels;
     }

diff --git a/src/DependencyInjection/Configuration.php b/src/DependencyInjection/Configuration.php
@@ -29,7 +29,6 @@ public function getConfigTreeBuilder(): TreeBuilder
 
     private function addResourcesSection(ArrayNodeDefinition $node): void
     {
-        /** @psalm-suppress MixedMethodCall,PossiblyUndefinedMethod,PossiblyNullReference,UndefinedInterfaceMethod */
         $node
             ->children()
                 ->arrayNode('resources')

diff --git a/src/DependencyInjection/SetonoSyliusFacebookExtension.php b/src/DependencyInjection/SetonoSyliusFacebookExtension.php
@@ -15,9 +15,7 @@ final class SetonoSyliusFacebookExtension extends AbstractResourceExtension
     public function load(array $configs, ContainerBuilder $container): void
     {
         /**
-         * @psalm-suppress PossiblyNullArgument
-         *
-         * @var array{driver: string, resources: array} $config
+         * @var array{driver: string, resources: array<string, array<string, mixed>>} $config
          */
         $config = $this->processConfiguration($this->getConfiguration([], $container), $configs);
         $loader = new XmlFileLoader($container, new FileLocator(__DIR__ . '/../Resources/config'));

diff --git a/src/Event/CategoryViewedEvent.php b/src/Event/CategoryViewedEvent.php
@@ -26,6 +26,9 @@ public function __construct(TaxonInterface $taxon, array $products = [])
         $this->customData->contentCategory = $this->getBreadcrumb($taxon);
     }
 
+    /**
+     * @return list<TaxonInterface>
+     */
     private function getBreadcrumbs(TaxonInterface $taxon): array
     {
         $breadcrumbs = [];