Fix PHP-Scoper & PHPStan issues (#14482)

swissspidy · web-flow · commit 857d19dadb5e · 2026-03-23T16:13:00.000+01:00
diff --git a/.github/workflows/tests-unit-php.yml b/.github/workflows/tests-unit-php.yml
@@ -55,17 +55,17 @@ jobs:
     continue-on-error: ${{ matrix.experimental }}
     strategy:
       matrix:
-        php: ['8.3', '8.2', '8.1', '8.0']
+        php: ['8.4', '8.3', '8.2', '8.1', '8.0']
         wp: ['latest']
         coverage: [false]
         experimental: [false]
         include:
-          - php: '8.4'
+          - php: '8.5'
             wp: 'latest'
             coverage: true
             experimental: false
 
-          - php: '8.4'
+          - php: '8.5'
             wp: 'latest'
             random: true
             experimental: true
@@ -74,7 +74,7 @@ jobs:
             wp: '6.6'
             experimental: false
 
-          - php: '8.4'
+          - php: '8.5'
             wp: 'trunk'
             experimental: true
 
@@ -137,11 +137,6 @@ jobs:
         with:
           composer-options: '--prefer-dist --no-progress --no-interaction --no-scripts'
 
-      - name: Update PHPUnit
-        run: |
-          echo "Installing latest version of PHPUnit"
-          composer update --ignore-platform-reqs --no-interaction --no-scripts yoast/phpunit-polyfills --with-dependencies
-
       - name: Composer dump autoload
         run: composer dump-autoload --no-interaction
 
diff --git a/composer.json b/composer.json
@@ -87,6 +87,9 @@
     ],
     "installer-disable": true,
     "patches": {
+      "humbug/php-scoper": {
+        "Fix using null as array key": "./patches/humbug-php-scoper-php85.diff"
+      },
       "thecodingmachine/safe": {
         "Fix explicit nullable errors": "./patches/thecodingmachine-safe-nullable.diff"
       }
diff --git a/composer.lock b/composer.lock
diff --git a/includes/Admin/Customizer.php b/includes/Admin/Customizer.php
@@ -664,8 +664,8 @@ public function get_stories_theme_support(): array {
 	 *
 	 * @since 1.5.0
 	 *
-	 * @param array<string,mixed> $view_type View type to check.
-	 * @return array<string,mixed> An array of view type choices.
+	 * @param array<string,string> $view_type View type to check.
+	 * @return array<string,string> An array of view type choices.
 	 */
 	private function get_view_type_choices( array $view_type ): array {
 		$view_type_choices = $this->stories_script_data->get_layouts();
diff --git a/includes/Admin/Site_Health.php b/includes/Admin/Site_Health.php
@@ -239,7 +239,8 @@ public function modify_test_result( $test_result ) {
 		// Set the `https_status` test status to critical if its current status is recommended, along with adding to the
 		// description for why its required for Web Stories.
 		if ( isset( $test_result['test'], $test_result['status'], $test_result['description'] ) && 'https_status' === $test_result['test'] && 'recommended' === $test_result['status'] ) {
-			$test_result['status']       = 'critical';
+			$test_result['status'] = 'critical';
+			// @phpstan-ignore assignOp.invalid (False positive.)
 			$test_result['description'] .= '<p>' . __( 'Additionally, Web Stories requires HTTPS for most components to work properly, including iframes and videos.', 'web-stories' ) . '</p>';
 		}
 
diff --git a/includes/Infrastructure/Injector/SimpleInjector.php b/includes/Infrastructure/Injector/SimpleInjector.php
@@ -364,6 +364,8 @@ private function resolve_argument(
 		$type = $parameter->getType();
 
 		// In PHP 8.0, the isBuiltin method was removed from the parent {@see ReflectionType} class.
+
+		// @phpstan-ignore identical.alwaysFalse
 		if ( null === $type || ( $type instanceof ReflectionNamedType && $type->isBuiltin() ) ) {
 			return $this->resolve_argument_by_name(
 				$class_name,
diff --git a/includes/Integrations/AMP.php b/includes/Integrations/AMP.php
@@ -137,10 +137,10 @@ public static function get_requirements(): array {
 	 *
 	 * @since 1.2.0
 	 *
-	 * @param array|mixed $options Options.
+	 * @param array|false $options Options.
 	 * @return array|mixed Filtered options.
 	 *
-	 * @phpstan-param AMPOptions|mixed $options
+	 * @phpstan-param AMPOptions|false $options
 	 *
 	 * @template T
 	 *
@@ -166,12 +166,10 @@ public function filter_amp_options( $options ) {
 	 *
 	 * @since 1.2.0
 	 *
-	 * @param string[]|mixed $post_types Supportable post types.
-	 * @return array|mixed Supportable post types.
+	 * @param string[]|false $post_types Supportable post types.
+	 * @return string[]|false Supportable post types.
 	 *
-	 * @template T
-	 *
-	 * @phpstan-return ($post_types is array<T> ? array<T> : mixed)
+	 * @phpstan-return ($post_types is string[] ? string[] : false)
 	 */
 	public function filter_supportable_post_types( $post_types ) {
 		if ( ! \is_array( $post_types ) ) {
diff --git a/includes/Integrations/Site_Kit.php b/includes/Integrations/Site_Kit.php
@@ -145,7 +145,8 @@ public function filter_site_kit_gtag_opt( $gtag_opt ) {
 		$default_config['triggers'] = $default_config['triggers'] ?? [];
 
 		$gtag_opt['triggers'] ??= [];
-		$gtag_opt['triggers']   = array_merge( $default_config['triggers'], $gtag_opt['triggers'] );
+		// @phpstan-ignore argument.type
+		$gtag_opt['triggers'] = array_merge( $default_config['triggers'], $gtag_opt['triggers'] );
 
 		return $gtag_opt;
 	}
diff --git a/includes/KSES.php b/includes/KSES.php
@@ -137,6 +137,7 @@ public function filter_insert_post_data( $data, $postarr, $unsanitized_postarr )
 
 		if (
 			! \is_string( $data['post_type'] ) ||
+			// @phpstan-ignore argument.type
 			! $this->is_allowed_post_type( $data['post_type'], $data['post_parent'] )
 		) {
 			return $data;
@@ -150,6 +151,7 @@ public function filter_insert_post_data( $data, $postarr, $unsanitized_postarr )
 		}
 
 		if ( isset( $unsanitized_postarr['post_content'] ) ) {
+			// @phpstan-ignore argument.type
 			$data['post_content'] = wp_slash( $this->sanitize_content( wp_unslash( $unsanitized_postarr['post_content'] ) ) );
 		}
 
diff --git a/includes/Media/Media_Source_Taxonomy.php b/includes/Media/Media_Source_Taxonomy.php
@@ -304,7 +304,6 @@ public function filter_rest_generated_media_attachments( $args ) {
 	 * @since 1.29.0
 	 */
 	private function add_missing_terms(): void {
-		// @phpstan-ignore function.internal (false positive)
 		$existing_terms = get_terms(
 			[
 				'taxonomy'   => $this->get_taxonomy_slug(),
diff --git a/includes/Media/Video/Muting.php b/includes/Media/Video/Muting.php
@@ -142,6 +142,7 @@ public function wp_prepare_attachment_for_js( $response ) {
 			return $response;
 		}
 		if ( 'video' === $response['type'] ) {
+			// @phpstan-ignore argument.type
 			$response[ self::IS_MUTED_REST_API_KEY ] = $this->get_callback_is_muted( $response );
 		}
 
diff --git a/includes/Model/Story.php b/includes/Model/Story.php
@@ -89,15 +89,15 @@ class Story {
 	 * Publisher logo size.
 	 *
 	 * @var int[]
-	 * @phpstan-var array{0?: int, 1?: int}
+	 * @phpstan-var array{0: int, 1: int}|array{}
 	 */
 	protected array $publisher_logo_size = [];
 
 	/**
 	 * Poster portrait logo size.
 	 *
 	 * @var int[]
-	 * @phpstan-var array{0?: int, 1?: int}
+	 * @phpstan-var array{0: int, 1: int}|array{}
 	 */
 	protected array $poster_portrait_size = [];
 
@@ -189,7 +189,7 @@ public function load_from_post( $_post ): bool {
 			/**
 			 * Poster.
 			 *
-			 * @var array{url?:string, width?: int, height?: int}|false $poster
+			 * @var array{url:string, width: int, height: int}|false $poster
 			 */
 			$poster = get_post_meta( $post->ID, Story_Post_Type::POSTER_META_KEY, true );
 			if ( ! empty( $poster ) ) {
@@ -394,7 +394,7 @@ public function get_publisher_logo_url(): ?string {
 	 *     @type int    $2 Image height in pixels.
 	 * }
 	 *
-	 * @phpstan-return array{0?: int, 1?: int}
+	 * @phpstan-return array{0: int, 1: int}|array{}
 	 */
 	public function get_publisher_logo_size(): array {
 		/**
@@ -429,7 +429,7 @@ public function get_publisher_logo_size(): array {
 	 *     @type int    $2 Image height in pixels.
 	 * }
 	 *
-	 * @phpstan-return array{0?: int, 1?: int}
+	 * @phpstan-return array{0: int, 1: int}|array{}
 	 */
 	public function get_poster_portrait_size(): array {
 		return $this->poster_portrait_size;
diff --git a/includes/REST_API/Font_Controller.php b/includes/REST_API/Font_Controller.php
@@ -315,7 +315,6 @@ public function prepare_item_for_response( $item, $request ): WP_REST_Response {
 				$self = $links['self']['href'];
 
 				foreach ( $actions as $rel ) {
-					// @phpstan-ignore method.internal (false positive)
 					$response->add_link( $rel, $self );
 				}
 			}
@@ -605,6 +604,12 @@ protected function get_custom_fonts( $request ): array {
 			remove_filter( 'post_password_required', [ $this, 'check_password_required' ] );
 		}
 
+		/**
+		 * List of custom fonts.
+		 *
+		 * @phpstan-var Font[] $posts
+		 */
+
 		return $posts;
 	}
 
diff --git a/includes/REST_API/Products_Controller.php b/includes/REST_API/Products_Controller.php
@@ -228,6 +228,7 @@ public function get_items( $request ) {
 	 * Prepares a single post output for response.
 	 *
 	 * @SuppressWarnings("PHPMD.NPathComplexity")
+	 * @SuppressWarnings("PHPMD.CyclomaticComplexity")
 	 *
 	 * @since 1.20.0
 	 *
@@ -294,15 +295,15 @@ public function prepare_item_for_response( $item, $request ): WP_REST_Response {
 			}
 
 			if ( rest_is_field_included( 'aggregateRating.ratingValue', $fields ) ) {
-				$data['aggregateRating']['ratingValue'] = (float) $rating['rating_value'];
+				$data['aggregateRating']['ratingValue'] = isset( $rating['rating_value'] ) ? (float) $rating['rating_value'] : 0;
 			}
 
 			if ( rest_is_field_included( 'aggregateRating.reviewCount', $fields ) ) {
-				$data['aggregateRating']['reviewCount'] = (int) $rating['review_count'];
+				$data['aggregateRating']['reviewCount'] = isset( $rating['review_count'] ) ? (int) $rating['review_count'] : 0;
 			}
 
 			if ( rest_is_field_included( 'aggregateRating.reviewUrl', $fields ) ) {
-				$data['aggregateRating']['reviewUrl'] = $rating['review_url'];
+				$data['aggregateRating']['reviewUrl'] = $rating['review_url'] ?? null;
 			}
 		}
 
diff --git a/includes/REST_API/Stories_Autosaves_Controller.php b/includes/REST_API/Stories_Autosaves_Controller.php
@@ -158,7 +158,6 @@ public function prepare_item_for_response( $post, $request ): WP_REST_Response {
 		$response = new WP_REST_Response( $data );
 		foreach ( $links as $rel => $rel_links ) {
 			foreach ( $rel_links as $link ) {
-				// @phpstan-ignore method.internal (false positive)
 				$response->add_link( $rel, $link['href'], $link['attributes'] );
 			}
 		}
diff --git a/includes/REST_API/Stories_Base_Controller.php b/includes/REST_API/Stories_Base_Controller.php
@@ -147,7 +147,6 @@ public function prepare_item_for_response( $post, $request ): WP_REST_Response {
 		$response = new WP_REST_Response( $data );
 		foreach ( $links as $rel => $rel_links ) {
 			foreach ( $rel_links as $link ) {
-				// @phpstan-ignore method.internal (false positive)
 				$response->add_link( $rel, $link['href'], $link['attributes'] );
 			}
 		}
diff --git a/includes/REST_API/Stories_Controller.php b/includes/REST_API/Stories_Controller.php
@@ -153,7 +153,6 @@ public function prepare_item_for_response( $post, $request ): WP_REST_Response {
 		$response = new WP_REST_Response( $data );
 		foreach ( $links as $rel => $rel_links ) {
 			foreach ( $rel_links as $link ) {
-				// @phpstan-ignore method.internal (false positive)
 				$response->add_link( $rel, $link['href'], $link['attributes'] );
 			}
 		}
@@ -543,7 +542,7 @@ protected function add_response_headers( WP_REST_Response $response, WP_REST_Req
 			$statuses_count[ $key ] = absint( $posts_query->found_posts );
 			$statuses_count['all'] += $statuses_count[ $key ];
 			if ( \in_array( $status, $this->args['post_status'] ?? [], true ) ) {
-				$total_posts += $statuses_count[ $key ];
+				$total_posts += $statuses_count[ $key ] ?? 0;
 			}
 		}
 
diff --git a/includes/REST_API/Stories_Lock_Controller.php b/includes/REST_API/Stories_Lock_Controller.php
@@ -295,7 +295,7 @@ public function prepare_item_for_response( $item, $request ) { // phpcs:ignore S
 			/** This filter is documented in wp-admin/includes/ajax-actions.php */
 			$time_window = apply_filters( 'wp_check_post_lock_window', 150 );
 
-			if ( $item['time'] && $item['time'] > time() - $time_window ) {
+			if ( isset( $item['time'] ) && $item['time'] > time() - $time_window ) {
 				$lock_data = [
 					'locked' => true,
 					'time'   => $item['time'],
@@ -487,7 +487,7 @@ protected function prepare_links( $lock, int $post_id ): array {
 			/** This filter is documented in wp-admin/includes/ajax-actions.php */
 			$time_window = apply_filters( 'wp_check_post_lock_window', 150 );
 
-			if ( $lock['time'] && $lock['time'] > time() - $time_window && isset( $lock['user'] ) ) {
+			if ( isset( $lock['time'] ) && $lock['time'] > time() - $time_window && isset( $lock['user'] ) ) {
 				$links['author'] = [
 					'href'       => rest_url( \sprintf( '%s/%s/%s', $this->namespace, 'users', $lock['user'] ) ),
 					'embeddable' => true,
diff --git a/includes/Settings.php b/includes/Settings.php
@@ -578,7 +578,7 @@ protected function get_registered_options(): array {
 			$schema = array_merge( $default_schema, $rest_args['schema'] );
 			$schema = rest_default_additional_properties_to_false( $schema );
 
-			$rest_options[ $name ] = $schema;
+			$rest_options[ (string) $name ] = $schema;
 		}
 
 		return $rest_options;
diff --git a/includes/Shopping/Product.php b/includes/Shopping/Product.php
@@ -224,9 +224,9 @@ public function jsonSerialize() { // phpcs:ignore WordPress.NamingConventions.Va
 
 		if ( $rating ) {
 			$data['aggregateRating'] = [
-				'ratingValue' => $rating['rating_value'],
-				'reviewCount' => $rating['review_count'],
-				'reviewUrl'   => $rating['review_url'],
+				'ratingValue' => $rating['rating_value'] ?? null,
+				'reviewCount' => $rating['review_count'] ?? null,
+				'reviewUrl'   => $rating['review_url'] ?? null,
 			];
 		}
 
diff --git a/includes/Shortcode/Embed_Shortcode.php b/includes/Shortcode/Embed_Shortcode.php
@@ -54,10 +54,10 @@ public function register(): void {
 	 * @since 1.1.0
 	 *
 	 * @param array<string, string|int>|string $attributes Shortcode attributes.
-	 * @param string                           $content    Shortcode content.
+	 * @param string|null                      $content    Shortcode content.
 	 * @return string Rendered Shortcode
 	 */
-	public function render_shortcode( $attributes, string $content ): string { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
+	public function render_shortcode( $attributes, ?string $content ): string { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
 		// Initialize '$attrs' when not an array OR is an empty string.
 		if ( empty( $attributes ) || ! \is_array( $attributes ) ) {
 			$attributes = [];
diff --git a/patches/humbug-php-scoper-php85.diff b/patches/humbug-php-scoper-php85.diff
@@ -0,0 +1,13 @@
+diff --git a/src/PhpParser/NodeVisitor/UseStmt/UseStmtCollection.php b/src/PhpParser/NodeVisitor/UseStmt/UseStmtCollection.php
+index ec64786..74e40d3 100644
+--- a/src/PhpParser/NodeVisitor/UseStmt/UseStmtCollection.php
++++ b/src/PhpParser/NodeVisitor/UseStmt/UseStmtCollection.php
+@@ -53,7 +53,7 @@ final class UseStmtCollection implements IteratorAggregate
+      * @var array<string, list<Use_>>
+      */
+     private array $nodes = [
+-        null => [],
++        '' => [],
+     ];
+ 
+     public function add(?Name $namespaceName, Use_ $use): void
diff --git a/patches/thecodingmachine-safe-nullable.diff b/patches/thecodingmachine-safe-nullable.diff
diff --git a/phpstan.neon.dist b/phpstan.neon.dist
diff --git a/tests/phpunit/integration/tests/Migrations/Replace_Conic_Style_Presets.php b/tests/phpunit/integration/tests/Migrations/Replace_Conic_Style_Presets.php
diff --git a/tests/phpunit/integration/tests/REST_API/Stories_Media_Controller.php b/tests/phpunit/integration/tests/REST_API/Stories_Media_Controller.php
diff --git a/tests/phpunit/integration/tests/Tracking.php b/tests/phpunit/integration/tests/Tracking.php

Original file line number	Diff line number	Diff line change
`@@ -664,8 +664,8 @@ public function get_stories_theme_support(): array {`
`664`	`664`	`*`
`665`	`665`	`* @since 1.5.0`
`666`	`666`	`*`
`667`		`- * @param array<string,mixed> $view_type View type to check.`
`668`		`- * @return array<string,mixed> An array of view type choices.`
	`667`	`+ * @param array<string,string> $view_type View type to check.`
	`668`	`+ * @return array<string,string> An array of view type choices.`
`669`	`669`	`*/`
`670`	`670`	`private function get_view_type_choices( array $view_type ): array {`
`671`	`671`	`$view_type_choices = $this->stories_script_data->get_layouts();`
Original file line number	Diff line number	Diff line change
`@@ -239,7 +239,8 @@ public function modify_test_result( $test_result ) {`
`239`	`239`	// Set the `https_status` test status to critical if its current status is recommended, along with adding to the
`240`	`240`	`// description for why its required for Web Stories.`
`241`	`241`	`if ( isset( $test_result['test'], $test_result['status'], $test_result['description'] ) && 'https_status' === $test_result['test'] && 'recommended' === $test_result['status'] ) {`
`242`		`- $test_result['status'] = 'critical';`
	`242`	`+ $test_result['status'] = 'critical';`
	`243`	`+ // @phpstan-ignore assignOp.invalid (False positive.)`
`243`	`244`	`$test_result['description'] .= '<p>' . __( 'Additionally, Web Stories requires HTTPS for most components to work properly, including iframes and videos.', 'web-stories' ) . '</p>';`
`244`	`245`	`}`
`245`	`246`
Original file line number	Diff line number	Diff line change
`@@ -137,10 +137,10 @@ public static function get_requirements(): array {`
`137`	`137`	`*`
`138`	`138`	`* @since 1.2.0`
`139`	`139`	`*`
`140`		`- * @param array\|mixed $options Options.`
	`140`	`+ * @param array\|false $options Options.`
`141`	`141`	`* @return array\|mixed Filtered options.`
`142`	`142`	`*`
`143`		`- * @phpstan-param AMPOptions\|mixed $options`
	`143`	`+ * @phpstan-param AMPOptions\|false $options`
`144`	`144`	`*`
`145`	`145`	`* @template T`
`146`	`146`	`*`
`@@ -166,12 +166,10 @@ public function filter_amp_options( $options ) {`
`166`	`166`	`*`
`167`	`167`	`* @since 1.2.0`
`168`	`168`	`*`
`169`		`- * @param string[]\|mixed $post_types Supportable post types.`
`170`		`- * @return array\|mixed Supportable post types.`
	`169`	`+ * @param string[]\|false $post_types Supportable post types.`
	`170`	`+ * @return string[]\|false Supportable post types.`
`171`	`171`	`*`
`172`		`- * @template T`
`173`		`- *`
`174`		`- * @phpstan-return ($post_types is array<T> ? array<T> : mixed)`
	`172`	`+ * @phpstan-return ($post_types is string[] ? string[] : false)`
`175`	`173`	`*/`
`176`	`174`	`public function filter_supportable_post_types( $post_types ) {`
`177`	`175`	`if ( ! \is_array( $post_types ) ) {`
Original file line number	Diff line number	Diff line change
`@@ -145,7 +145,8 @@ public function filter_site_kit_gtag_opt( $gtag_opt ) {`
`145`	`145`	`$default_config['triggers'] = $default_config['triggers'] ?? [];`
`146`	`146`
`147`	`147`	`$gtag_opt['triggers'] ??= [];`
`148`		`- $gtag_opt['triggers'] = array_merge( $default_config['triggers'], $gtag_opt['triggers'] );`
	`148`	`+ // @phpstan-ignore argument.type`
	`149`	`+ $gtag_opt['triggers'] = array_merge( $default_config['triggers'], $gtag_opt['triggers'] );`
`149`	`150`
`150`	`151`	`return $gtag_opt;`
`151`	`152`	`}`
Original file line number	Diff line number	Diff line change
`@@ -137,6 +137,7 @@ public function filter_insert_post_data( $data, $postarr, $unsanitized_postarr )`
`137`	`137`
`138`	`138`	`if (`
`139`	`139`	`! \is_string( $data['post_type'] ) \|\|`
	`140`	`+ // @phpstan-ignore argument.type`
`140`	`141`	`! $this->is_allowed_post_type( $data['post_type'], $data['post_parent'] )`
`141`	`142`	`) {`
`142`	`143`	`return $data;`
`@@ -150,6 +151,7 @@ public function filter_insert_post_data( $data, $postarr, $unsanitized_postarr )`
`150`	`151`	`}`
`151`	`152`
`152`	`153`	`if ( isset( $unsanitized_postarr['post_content'] ) ) {`
	`154`	`+ // @phpstan-ignore argument.type`
`153`	`155`	`$data['post_content'] = wp_slash( $this->sanitize_content( wp_unslash( $unsanitized_postarr['post_content'] ) ) );`
`154`	`156`	`}`
`155`	`157`
Original file line number	Diff line number	Diff line change
`@@ -304,7 +304,6 @@ public function filter_rest_generated_media_attachments( $args ) {`
`304`	`304`	`* @since 1.29.0`
`305`	`305`	`*/`
`306`	`306`	`private function add_missing_terms(): void {`
`307`		`- // @phpstan-ignore function.internal (false positive)`
`308`	`307`	`$existing_terms = get_terms(`
`309`	`308`	`[`
`310`	`309`	`'taxonomy' => $this->get_taxonomy_slug(),`