tree-sitter-php grammar.js does not support PHP 8.1+ language features

[bengibbs-pixieset]

I'm encountering warnings when running the GitLab SAST tool against my PHP repository. The output contains many readonly warning like this:

[WARN] [Semgrep] [2026-01-08T22:02:30Z] ▶ tool notification warning: Syntax error Syntax error at line src/app/DIR/FILENAME.php:22:
 `readonly` was unexpected

I found this Issue which outlines that the problem seems to be a lack of support for PHP 8.1+ language features. The comments in that issues led me to this semgrep/semgrep-php repository where I think I've spotted the bug.

Although the fyi/tree-sitter-version file says it is at v0.22.6, the fyi/semgrep-grammars/src/tree-sitter-php/grammar.js file does not seem to match the actual grammar.js file from the tree-sitter/tree-sitter-php repository at that version: https://github.com/tree-sitter/tree-sitter-php/blob/v0.22.6/common/define-grammar.js

The most obvious tell is that if you search for readonly in each grammar.js file you'll see:

• 0 results in https://github.com/semgrep/semgrep-php/blob/main/fyi/semgrep-grammars/src/tree-sitter-php/grammar.js
• 5 results in https://github.com/tree-sitter/tree-sitter-php/blob/v0.22.6/common/define-grammar.js

I imagine that if the fyi/semgrep-grammars/src/tree-sitter-php/grammar.js file is updated to match the 0.22.6 version from the tree-sitter/tree-sitter-php repository then these unexpected readonly warnings will no longer appear.

I don't feel confident creating a Pull Request because I don't really understand what is happening in these grammar.js files, and I wouldn't know how to test it, sorry.

[kopecs]

Thanks! This is something I am looking at updating. The tree-sitter-version listing actually corresponds to the version of tree-sitter we use to generate the parser (the sha of the grammar is listed here https://github.com/semgrep/semgrep-php/blob/main/fyi/versions). In order to use the latest version from upstream, we need to update the version of tree-sitter we use to 0.25.9 (which has added some new features from 0.22.6, so requires some updates to infrastructure at https://github.com/semgrep/ocaml-tree-sitter-semgrep).

This is all being actively worked on, it just creates an unfortunately long chain of dependencies we have to work through before addressing this.

[kopecs]

FYI: semgrep/ocaml-tree-sitter-semgrep#557

Once that's merged there's still more to do (update this repo, update semgrep's source to actually use it) but we're getting closer.