Skip to content

Remove the keyFile option from the Google Cloud config array #4

Remove the keyFile option from the Google Cloud config array

Remove the keyFile option from the Google Cloud config array #4

Triggered via pull request October 12, 2025 21:50
Status Failure
Total duration 15m 46s
Artifacts

static-analysis.yml

on: pull_request
Matrix: phpstan
Fit to window
Zoom out
Zoom in

Annotations

15 errors
PHPStan (PHP 8.1)
Process completed with exit code 1.
PHPStan (PHP 8.1): src/Firebase/Firestore.php#L26
Call to deprecated method __construct() of class Google\Cloud\Firestore\FirestoreClient: This option is being deprecated because of a potential security risk. This option does not validate the credential configuration. The security risk occurs when a credential configuration is accepted from a source that is not under your control and used without validation on your side. If you know that you will be loading credential configurations of a specific type, it is recommended to create the credentials directly and configure them using the `credentialsFetcher` option instead. ``` use Google\Auth\Credentials\ServiceAccountCredentials; $credentialsFetcher = new ServiceAccountCredentials($scopes, $json); $creds = new FirestoreClient(['credentialsFetcher' => $creds]); ``` This will ensure that an unexpected credential type with potential for malicious intent is not loaded unintentionally. You might still have to do validation for certain credential types. If you are loading your credential configuration from an untrusted source and have not mitigated the risks (e.g. by validating the configuration yourself), make these changes as soon as possible to prevent security risks to your environment. Regardless of the method used, it is always your responsibility to validate configurations received from external sources.
PHPStan (PHP 8.1): src/Firebase/Factory.php#L527
Call to deprecated method __construct() of class Google\Cloud\Storage\StorageClient: This option is being deprecated because of a potential security risk. This option does not validate the credential configuration. The security risk occurs when a credential configuration is accepted from a source that is not under your control and used without validation on your side. If you know that you will be loading credential configurations of a specific type, it is recommended to create the credentials directly and configure them using the `credentialsFetcher` option instead. ``` use Google\Auth\Credentials\ServiceAccountCredentials; $credentialsFetcher = new ServiceAccountCredentials($scopes, $json); $creds = new StorageClient(['credentialsFetcher' => $creds]); ``` This will ensure that an unexpected credential type with potential for malicious intent is not loaded unintentionally. You might still have to do validation for certain credential types. If you are loading your credential configuration from an untrusted source and have not mitigated the risks (e.g. by validating the configuration yourself), make these changes as soon as possible to prevent security risks to your environment. Regardless of the method used, it is always your responsibility to validate configurations received from external sources.
PHPStan (PHP 8.2)
Process completed with exit code 1.
PHPStan (PHP 8.2): src/Firebase/Firestore.php#L26
Call to deprecated method __construct() of class Google\Cloud\Firestore\FirestoreClient: This option is being deprecated because of a potential security risk. This option does not validate the credential configuration. The security risk occurs when a credential configuration is accepted from a source that is not under your control and used without validation on your side. If you know that you will be loading credential configurations of a specific type, it is recommended to create the credentials directly and configure them using the `credentialsFetcher` option instead. ``` use Google\Auth\Credentials\ServiceAccountCredentials; $credentialsFetcher = new ServiceAccountCredentials($scopes, $json); $creds = new FirestoreClient(['credentialsFetcher' => $creds]); ``` This will ensure that an unexpected credential type with potential for malicious intent is not loaded unintentionally. You might still have to do validation for certain credential types. If you are loading your credential configuration from an untrusted source and have not mitigated the risks (e.g. by validating the configuration yourself), make these changes as soon as possible to prevent security risks to your environment. Regardless of the method used, it is always your responsibility to validate configurations received from external sources.
PHPStan (PHP 8.2): src/Firebase/Factory.php#L527
Call to deprecated method __construct() of class Google\Cloud\Storage\StorageClient: This option is being deprecated because of a potential security risk. This option does not validate the credential configuration. The security risk occurs when a credential configuration is accepted from a source that is not under your control and used without validation on your side. If you know that you will be loading credential configurations of a specific type, it is recommended to create the credentials directly and configure them using the `credentialsFetcher` option instead. ``` use Google\Auth\Credentials\ServiceAccountCredentials; $credentialsFetcher = new ServiceAccountCredentials($scopes, $json); $creds = new StorageClient(['credentialsFetcher' => $creds]); ``` This will ensure that an unexpected credential type with potential for malicious intent is not loaded unintentionally. You might still have to do validation for certain credential types. If you are loading your credential configuration from an untrusted source and have not mitigated the risks (e.g. by validating the configuration yourself), make these changes as soon as possible to prevent security risks to your environment. Regardless of the method used, it is always your responsibility to validate configurations received from external sources.
PHPStan (PHP 8.3)
Process completed with exit code 1.
PHPStan (PHP 8.3): src/Firebase/Firestore.php#L26
Call to deprecated method __construct() of class Google\Cloud\Firestore\FirestoreClient: This option is being deprecated because of a potential security risk. This option does not validate the credential configuration. The security risk occurs when a credential configuration is accepted from a source that is not under your control and used without validation on your side. If you know that you will be loading credential configurations of a specific type, it is recommended to create the credentials directly and configure them using the `credentialsFetcher` option instead. ``` use Google\Auth\Credentials\ServiceAccountCredentials; $credentialsFetcher = new ServiceAccountCredentials($scopes, $json); $creds = new FirestoreClient(['credentialsFetcher' => $creds]); ``` This will ensure that an unexpected credential type with potential for malicious intent is not loaded unintentionally. You might still have to do validation for certain credential types. If you are loading your credential configuration from an untrusted source and have not mitigated the risks (e.g. by validating the configuration yourself), make these changes as soon as possible to prevent security risks to your environment. Regardless of the method used, it is always your responsibility to validate configurations received from external sources.
PHPStan (PHP 8.3): src/Firebase/Factory.php#L527
Call to deprecated method __construct() of class Google\Cloud\Storage\StorageClient: This option is being deprecated because of a potential security risk. This option does not validate the credential configuration. The security risk occurs when a credential configuration is accepted from a source that is not under your control and used without validation on your side. If you know that you will be loading credential configurations of a specific type, it is recommended to create the credentials directly and configure them using the `credentialsFetcher` option instead. ``` use Google\Auth\Credentials\ServiceAccountCredentials; $credentialsFetcher = new ServiceAccountCredentials($scopes, $json); $creds = new StorageClient(['credentialsFetcher' => $creds]); ``` This will ensure that an unexpected credential type with potential for malicious intent is not loaded unintentionally. You might still have to do validation for certain credential types. If you are loading your credential configuration from an untrusted source and have not mitigated the risks (e.g. by validating the configuration yourself), make these changes as soon as possible to prevent security risks to your environment. Regardless of the method used, it is always your responsibility to validate configurations received from external sources.
PHPStan (PHP 8.4)
Process completed with exit code 1.
PHPStan (PHP 8.4): src/Firebase/Firestore.php#L26
Call to deprecated method __construct() of class Google\Cloud\Firestore\FirestoreClient: This option is being deprecated because of a potential security risk. This option does not validate the credential configuration. The security risk occurs when a credential configuration is accepted from a source that is not under your control and used without validation on your side. If you know that you will be loading credential configurations of a specific type, it is recommended to create the credentials directly and configure them using the `credentialsFetcher` option instead. ``` use Google\Auth\Credentials\ServiceAccountCredentials; $credentialsFetcher = new ServiceAccountCredentials($scopes, $json); $creds = new FirestoreClient(['credentialsFetcher' => $creds]); ``` This will ensure that an unexpected credential type with potential for malicious intent is not loaded unintentionally. You might still have to do validation for certain credential types. If you are loading your credential configuration from an untrusted source and have not mitigated the risks (e.g. by validating the configuration yourself), make these changes as soon as possible to prevent security risks to your environment. Regardless of the method used, it is always your responsibility to validate configurations received from external sources.
PHPStan (PHP 8.4): src/Firebase/Factory.php#L527
Call to deprecated method __construct() of class Google\Cloud\Storage\StorageClient: This option is being deprecated because of a potential security risk. This option does not validate the credential configuration. The security risk occurs when a credential configuration is accepted from a source that is not under your control and used without validation on your side. If you know that you will be loading credential configurations of a specific type, it is recommended to create the credentials directly and configure them using the `credentialsFetcher` option instead. ``` use Google\Auth\Credentials\ServiceAccountCredentials; $credentialsFetcher = new ServiceAccountCredentials($scopes, $json); $creds = new StorageClient(['credentialsFetcher' => $creds]); ``` This will ensure that an unexpected credential type with potential for malicious intent is not loaded unintentionally. You might still have to do validation for certain credential types. If you are loading your credential configuration from an untrusted source and have not mitigated the risks (e.g. by validating the configuration yourself), make these changes as soon as possible to prevent security risks to your environment. Regardless of the method used, it is always your responsibility to validate configurations received from external sources.
PHPStan (PHP 8.5)
Process completed with exit code 1.
PHPStan (PHP 8.5): src/Firebase/Firestore.php#L26
Call to deprecated method __construct() of class Google\Cloud\Firestore\FirestoreClient: This option is being deprecated because of a potential security risk. This option does not validate the credential configuration. The security risk occurs when a credential configuration is accepted from a source that is not under your control and used without validation on your side. If you know that you will be loading credential configurations of a specific type, it is recommended to create the credentials directly and configure them using the `credentialsFetcher` option instead. ``` use Google\Auth\Credentials\ServiceAccountCredentials; $credentialsFetcher = new ServiceAccountCredentials($scopes, $json); $creds = new FirestoreClient(['credentialsFetcher' => $creds]); ``` This will ensure that an unexpected credential type with potential for malicious intent is not loaded unintentionally. You might still have to do validation for certain credential types. If you are loading your credential configuration from an untrusted source and have not mitigated the risks (e.g. by validating the configuration yourself), make these changes as soon as possible to prevent security risks to your environment. Regardless of the method used, it is always your responsibility to validate configurations received from external sources.
PHPStan (PHP 8.5): src/Firebase/Factory.php#L527
Call to deprecated method __construct() of class Google\Cloud\Storage\StorageClient: This option is being deprecated because of a potential security risk. This option does not validate the credential configuration. The security risk occurs when a credential configuration is accepted from a source that is not under your control and used without validation on your side. If you know that you will be loading credential configurations of a specific type, it is recommended to create the credentials directly and configure them using the `credentialsFetcher` option instead. ``` use Google\Auth\Credentials\ServiceAccountCredentials; $credentialsFetcher = new ServiceAccountCredentials($scopes, $json); $creds = new StorageClient(['credentialsFetcher' => $creds]); ``` This will ensure that an unexpected credential type with potential for malicious intent is not loaded unintentionally. You might still have to do validation for certain credential types. If you are loading your credential configuration from an untrusted source and have not mitigated the risks (e.g. by validating the configuration yourself), make these changes as soon as possible to prevent security risks to your environment. Regardless of the method used, it is always your responsibility to validate configurations received from external sources.