Bump phpstan/phpstan from 2.1.46 to 2.1.54 (#8753)

* Bump phpstan/phpstan from 2.1.46 to 2.1.54

---
updated-dependencies:
- dependency-name: phpstan/phpstan
  dependency-version: 2.1.54
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* Fixes some PHPStan issues, including compatibility PHP 8.2-
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/8713

Co-authored-by: Copilot <copilot@github.com>

* Bump PHPStan-strict-rules

* Fix PHPStan for PHP 8.3

* Ignore PHPStan warning for PHP 8.2 and PHP 8.3

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: Copilot <copilot@github.com>

app/Controllers/updateController.php

@@ -231,9 +231,9 @@ class FreshRSS_update_Controller extends FreshRSS_ActionController {
 			curl_setopt($curlResource, CURLOPT_SSL_VERIFYHOST, 2);
 
 			$curl_options = [];
-			if (defined('CURLOPT_PROTOCOLS_STR')) {
+			if (defined('CURLOPT_PROTOCOLS_STR') && is_int(CURLOPT_PROTOCOLS_STR)) {
 				$curl_options[CURLOPT_PROTOCOLS_STR] = 'http,https';
-				if (defined('CURLOPT_REDIR_PROTOCOLS_STR')) {
+				if (defined('CURLOPT_REDIR_PROTOCOLS_STR') && is_int(CURLOPT_REDIR_PROTOCOLS_STR)) {
 					$curl_options[CURLOPT_REDIR_PROTOCOLS_STR] = 'http,https';
 				}
 			} elseif (defined('CURLPROTO_HTTP') && defined('CURLPROTO_HTTPS')) {

app/Models/Feed.php

@@ -1457,9 +1457,9 @@ class FreshRSS_Feed extends Minz_Model {
 			]);
 
 			$curl_options = [];
-			if (defined('CURLOPT_PROTOCOLS_STR')) {
+			if (defined('CURLOPT_PROTOCOLS_STR') && is_int(CURLOPT_PROTOCOLS_STR)) {
 				$curl_options[CURLOPT_PROTOCOLS_STR] = 'http,https';
-				if (defined('CURLOPT_REDIR_PROTOCOLS_STR')) {
+				if (defined('CURLOPT_REDIR_PROTOCOLS_STR') && is_int(CURLOPT_REDIR_PROTOCOLS_STR)) {
 					$curl_options[CURLOPT_REDIR_PROTOCOLS_STR] = 'http,https';
 				}
 			} elseif (defined('CURLPROTO_HTTP') && defined('CURLPROTO_HTTPS')) {

app/Models/SimplePieCustom.php

@@ -44,9 +44,9 @@ final class FreshRSS_SimplePieCustom extends \SimplePie\SimplePie
 				unset($curl_options[CURLOPT_PROXY]);
 			}
 		}
-		if (defined('CURLOPT_PROTOCOLS_STR')) {
+		if (defined('CURLOPT_PROTOCOLS_STR') && is_int(CURLOPT_PROTOCOLS_STR)) {
 			$curl_options[CURLOPT_PROTOCOLS_STR] = 'http,https';
-			if (defined('CURLOPT_REDIR_PROTOCOLS_STR')) {
+			if (defined('CURLOPT_REDIR_PROTOCOLS_STR') && is_int(CURLOPT_REDIR_PROTOCOLS_STR)) {
 				$curl_options[CURLOPT_REDIR_PROTOCOLS_STR] = 'http,https';
 			}
 		} elseif (defined('CURLPROTO_HTTP') && defined('CURLPROTO_HTTPS')) {

app/Utils/httpUtil.php

@@ -369,9 +369,9 @@ final class FreshRSS_http_Util {
 			}
 		}
 
-		if (defined('CURLOPT_PROTOCOLS_STR')) {
+		if (defined('CURLOPT_PROTOCOLS_STR') && is_int(CURLOPT_PROTOCOLS_STR)) {
 			$curl_options[CURLOPT_PROTOCOLS_STR] = 'http,https';
-			if (defined('CURLOPT_REDIR_PROTOCOLS_STR')) {
+			if (defined('CURLOPT_REDIR_PROTOCOLS_STR') && is_int(CURLOPT_REDIR_PROTOCOLS_STR)) {
 				$curl_options[CURLOPT_REDIR_PROTOCOLS_STR] = 'http,https';
 			}
 		} elseif (defined('CURLPROTO_HTTP') && defined('CURLPROTO_HTTPS')) {

composer.lock

@@ -245,11 +245,11 @@
         },
         {
             "name": "phpstan/phpstan",
-            "version": "2.1.46",
+            "version": "2.1.54",
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/a193923fc2d6325ef4e741cf3af8c3e8f54dbf25",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/8be50c3992107dc837b17da4d140fbbdf9a5c5bd",
-                "reference": "a193923fc2d6325ef4e741cf3af8c3e8f54dbf25",
+                "reference": "8be50c3992107dc837b17da4d140fbbdf9a5c5bd",
                 "shasum": ""
             },
             "require": {
@@ -294,7 +294,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-04-01T09:25:14+00:00"
+            "time": "2026-04-29T13:31:09+00:00"
         },
         {
             "name": "phpstan/phpstan-deprecation-rules",
@@ -404,16 +404,16 @@
         },
         {
             "name": "phpstan/phpstan-strict-rules",
-            "version": "2.0.10",
+            "version": "2.0.11",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan-strict-rules.git",
-                "reference": "1aba28b697c1e3b6bbec8a1725f8b11b6d3e5a5f"
+                "reference": "9b000a578b85b32945b358b172c7b20e91189024"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan-strict-rules/zipball/1aba28b697c1e3b6bbec8a1725f8b11b6d3e5a5f",
+                "url": "https://api.github.com/repos/phpstan/phpstan-strict-rules/zipball/9b000a578b85b32945b358b172c7b20e91189024",
-                "reference": "1aba28b697c1e3b6bbec8a1725f8b11b6d3e5a5f",
+                "reference": "9b000a578b85b32945b358b172c7b20e91189024",
                 "shasum": ""
             },
             "require": {
@@ -449,9 +449,9 @@
             ],
             "support": {
                 "issues": "https://github.com/phpstan/phpstan-strict-rules/issues",
-                "source": "https://github.com/phpstan/phpstan-strict-rules/tree/2.0.10"
+                "source": "https://github.com/phpstan/phpstan-strict-rules/tree/2.0.11"
             },
-            "time": "2026-02-11T14:17:32+00:00"
+            "time": "2026-05-02T06:54:10+00:00"
         },
         {
             "name": "phpunit/php-code-coverage",
@@ -2003,5 +2003,5 @@
     "platform-overrides": {
         "php": "8.1"
     },
-    "plugin-api-version": "2.9.0"
+    "plugin-api-version": "2.6.0"
 }

lib/Minz/ModelPdo.php

@@ -58,11 +58,12 @@ class Minz_ModelPdo {
 					$dsn .= ';port=' . $dbServer['port'];
 				}
 				if (class_exists('Pdo\Mysql')) {
-					$driver_options[Pdo\Mysql::ATTR_INIT_COMMAND] = 'SET NAMES utf8mb4';	// @phpstan-ignore offsetAccess.invalidOffset
+					assert(is_int(Pdo\Mysql::ATTR_INIT_COMMAND));	// For PHPStan with PHP 8.4+
+					$driver_options[Pdo\Mysql::ATTR_INIT_COMMAND] = 'SET NAMES utf8mb4';
 				} else {
 					$driver_options[PDO::MYSQL_ATTR_INIT_COMMAND] = 'SET NAMES utf8mb4';	// PHP < 8.4
 				}
-				$this->pdo = new Minz_PdoMysql($dsn . $dsnParams, $db['user'], $db['password'], $driver_options);	// @phpstan-ignore argument.type
+				$this->pdo = new Minz_PdoMysql($dsn . $dsnParams, $db['user'], $db['password'], $driver_options);
 				$this->pdo->setPrefix($db['prefix'] . $this->current_user . '_');
 				break;
 			case 'sqlite':

lib/Minz/PdoMysql.php

@@ -14,7 +14,8 @@ class Minz_PdoMysql extends Minz_Pdo {
 	public function __construct(string $dsn, ?string $username = null, ?string $passwd = null, ?array $options = null) {
 		parent::__construct($dsn, $username, $passwd, $options);
 		if (class_exists('Pdo\Mysql')) {
-			$this->setAttribute(Pdo\Mysql::ATTR_USE_BUFFERED_QUERY, false);	// @phpstan-ignore argument.type
+			assert(is_int(Pdo\Mysql::ATTR_USE_BUFFERED_QUERY));	// For PHPStan with PHP 8.4+
+			$this->setAttribute(Pdo\Mysql::ATTR_USE_BUFFERED_QUERY, false);
 		} else {
 			$this->setAttribute(PDO::MYSQL_ATTR_USE_BUFFERED_QUERY, false);	// PHP < 8.4
 		}

lib/lib_rss.php

@@ -146,7 +146,7 @@ function echoJson($json, int $optimisationDepth = -1): void {
 }
 
 function safe_ascii(?string $text): string {
-	return $text === null ? '' : (filter_var($text, FILTER_DEFAULT, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH) ?: '');
+	return $text === null ? '' : (filter_var($text, FILTER_UNSAFE_RAW, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH) ?: '');
 }
 
 if (function_exists('mb_convert_encoding')) {

phpstan.dist.neon

@@ -60,6 +60,14 @@ parameters:
 		-
 			message: '#Access to deprecated#'
 			path: app/Models/Context.php
+		-
+			# For PHP 8.2 and PHP 8.3
+			identifier: function.alreadyNarrowedType
+			message: '#Call to function is_int\(\) with 1\d{3} will always evaluate to true\.#'
+			paths:
+				- lib/Minz/ModelPdo.php
+				- lib/Minz/PdoMysql.php
+			reportUnmatched: false
 includes:
 	- vendor/phpstan/phpstan-deprecation-rules/rules.neon
 	- vendor/phpstan/phpstan-phpunit/extension.neon