In the codesniffer repository is a job mw-tools-codesniffer-mwcore-testrun which runs phpcs with the unreleased changes to MediaWiki core
It would be nice to have a similiar job on mediawiki/tools/phan to test new config and to find if changes are working on core.
Background: Update to the newest version of phan fails, see https://gerrit.wikimedia.org/r/#/c/mediawiki/tools/phan/+/561093/ for more information.
Maybe the same could/should be done for the mediawiki/tools/phan/SecurityCheckPlugin repository