To make upgrading/releasing new versions of the phan-taint-check plugin sane, we need to move the version number into extensions themselves, so we can do per-repository upgrades. However, we can't use the normal require-dev method, since the plugin depends upon exactly PHP 7.0.x, so it would prevent installation on any newer or older version.
Instead, I propose/plan on using composer.json's extra field:
"extra": {
"phan-taint-check-plugin": "1.1.0",
},And CI will read from that to determine which version of the plugin to install.