So, last time I thought we should've waited for some work in taint-check to be finished before tagging a new release. However, a few months have passed without me being able to do anything to the plugin, so I think we may as well just tag a new version now, especially because some bugfixes are needed in various repos (e.g., T318184). There are roughly 80 commits between 3.3.2 and master, some of which are fairly large. In particular, there are two breaking changes that may introduce lots of "unused suppression" warnings and potentially other warnings. All in all, I think this should be version 4.0.0, and I'm gonna write the pre-release commit now.

Tagged: https://gerrit.wikimedia.org/g/mediawiki/tools/phan/SecurityCheckPlugin/+/refs/tags/4.0.0