Currently we're on 5.2.0. As of writing, four newer releases exist
https://github.com/phan/phan/releases/tag/5.2.1
https://github.com/phan/phan/releases/tag/5.3.0
https://github.com/phan/phan/releases/tag/5.3.1
https://github.com/phan/phan/releases/tag/5.3.2
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T319596 Upgrade, release, and use new PHP 7.4+ versions of all our home-grown CI libraries | |||
| Resolved | Daimona | T319538 Release new version of mediawiki-phan-config with phan 5.4.1 and taint-check 4.0.0 and tell LibUp about it | |||
| Resolved | Daimona | T298571 PhanCommentAbstractOnInheritedMethod false positive | |||
| Resolved | Daimona | T301079 PhanPossiblyUndeclaredVariable false positive | |||
| Resolved | Daimona | T298576 Upgrade phan to 5.3.2 or later | |||
| Resolved | Daimona | T311452 Taint Check Plugin release |
Updates of phan in mediawiki/mediawiki-phan-config needs also update of phan in taint-plugin
For 5.2.1 there is a bump already - https://gerrit.wikimedia.org/r/c/mediawiki/tools/phan/SecurityCheckPlugin/+/721411, but no release
Change 760569 had a related patch set uploaded (by Daimona Eaytoy; author: Daimona Eaytoy):
[mediawiki/tools/phan/SecurityCheckPlugin@master] Bump phan to 5.3.2
I tried... CI is now failing with a mysterious message when running PHPUnit. It doesn't seem to fail for other patches in the same repo, but there shouldn't be any difference. Also, the disabling of xdebug inevitably clutters the output and it's unclear whether it might be related. The relevant task is T269489, which requires T280170, which iscurrently blocked on T243847 for the 7.2 package.
I've confirmed locally that T269489 is indeed the issue -- if I run the taint-check PHPUnit suite with xdebug enabled, it tries to restart itself but for some reason it fails. Likely, the xdebug-checking logic changed in phan > 5.2.1.
For now I'm setting the env var which bypasses the xdebug check, but that's not something I'd like to keep in the long term, since phan is terribly slow if xdebug is enabled (I think the docs used to say 5x slow, I personally saw it run like 20x slower with taint-check enabled). xdebug should really really really not be enabled in the base CI images.
Change 760569 merged by jenkins-bot:
[mediawiki/tools/phan/SecurityCheckPlugin@master] Bump phan to 5.3.2
I'd rather close this after we tag a new version of taint-check, use it in mw-phan-config and then tag a new version of that. Upgrading phan is a bit annoying, unfortunately...
Just as note:
When using the new version (5.3.2) one of the most (new) showing up issue is PhanParamTooFewUnpack/PhanParamTooFewInternalUnpack which warns when ... is used to unpack arguments to a function and that array may is empty.
Possible some false positives as well.
Example:
includes\api\ApiBase.php:1227 PhanParamTooFewUnpack Call with 0 or more arg(s) to \wfMessage($key, ...$params) which requires 1 arg(s) defined at includes\GlobalFunctions.php:1180. This may throw an ArgumentCountError if there are too few args at runtime.
for
$msg = wfMessage( ...$msg );
Phan sees a possible empty $msg array
This one (and possibly others) could also be fixed by annotating the parameter as non-empty-array. I'm not sure how "official" that is, and whether it's fine to have it in the standard @param annotation or whether it should be in @phan-param.
Change 838128 had a related patch set uploaded (by Daimona Eaytoy; author: Daimona Eaytoy):
[mediawiki/tools/phan/SecurityCheckPlugin@master] BUmp phan to 5.4.1 and prepare for 4.0.0 release
Change 838128 merged by jenkins-bot:
[mediawiki/tools/phan/SecurityCheckPlugin@master] Bump phan to 5.4.1 and prepare for 4.0.0 release
Change 839508 had a related patch set uploaded (by Daimona Eaytoy; author: Daimona Eaytoy):
[mediawiki/tools/phan@master] Bump phan to 5.4.1 and taint-check to 4.0.0
Change 839508 merged by jenkins-bot:
[mediawiki/tools/phan@master] Bump phan to 5.4.1 and taint-check to 4.0.0