[westonruter]

Updates PHPStan from 2.3.4 to 2.3.5, and documents its new --fix option as the quick way to update the baselines after fixing a baselined error.

The phpstan-phpunit and phpstan-strict-rules extensions are already at their latest versions (2.1.1 each). With 2.3.5, the analysis of phpstan.neon.dist reports no errors and no stale baseline entries, so the baselines are unchanged.

--fix for stale ignores

PHPStan 2.3.5 marks errors it can fix itself with 🔧, and these include stale ignores. composer phpstan -- --fix (or npm run typecheck:php -- --fix) lowers a baseline entry's count that is now too high, removes an entry that matches nothing, and removes an @phpstan-ignore comment that no longer ignores anything. That is quicker than composer phpstan:baselines, since it reuses the result cache. Unlike regenerating, it also clears stale inline ignores, which the CI messages previously said had to be removed by hand.

Verified against the per-identifier baselines:

• An entry's count inflated from 1 to 3 was lowered back to 1, leaving the rest of the file untouched.
• Removing the last entry of a baseline leaves that file in place as ignoreErrors: []. That still passes, and composer phpstan:baselines -- --identifier=… then deletes the file and its includes entry.
• A run limited to some paths reports no stale ignores at all, so --fix has to be run on the whole tree.

Changes

• tests/phpstan/README.md gains a section, "Removing stale entries with --fix", covering the above, the fact that it applies every fixable error the run reports, and --fix-ignored.
• The CI step summary, the ::error annotation, and the pull request comment now suggest --fix first, with regenerating as the alternative that also retires an emptied baseline.
• Annotations of errors that PHPStan's JSON output flags as fixable say how to fix them. The flag is left out of the results passed to the comment workflow, as tips are.
• A workflow comment is corrected: since 2.3.5, an unmatched ignoreErrors entry without a path is reported against the config file it is in, rather than as an error not specific to a file.

Not adopted

• Registering the extensions with attributes rather than in base.neon: this only works when PHPStan runs on PHP 8.0+, and core's tooling still supports 7.4. The comments documenting each service in base.neon are also worth keeping.
• Making the hook rules auto-fixable: each of their errors needs a decision from a person (writing the documentation, or choosing which argument count is right), which PHPStan's release notes say is not a good fit for --fix.

Trac ticket: Core-65817

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5 (medium effort)
Used for: Researching the 2.3.5 changes, testing --fix against the baselines, and writing the version bump, documentation, and workflow changes, all reviewed by me.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[westonruter]

Seems like there should be a phpstan:fix command.