Psalm 7.0.0 Released With PHP 8.6 Support and New Taint Analysis Features
Psalm 7.0.0 introduces native support for PHP 8.6, a new capability-based purity model, and expanded security taint analysis for modern PHP applications.
Psalm 7.0.0 released on 2 November as a major update to the PHP static analyzer, running on 64-bit PHP 8.2 to 8.6 while adding support for PHP 8.5 and 8.6. Security analysis runs by default in the same pass as type checking and dead code detection, storing taints as a bitmask and resolving taint graphs over compact per-function summaries. You can disable this by setting runTaintAnalysis="false".
New issue types cover MongoDB sinks, prompt injection, and query and path injection, alongside sources like php://input, STDIN, getopt(), and DNS answers. Taint flows through closures, generators, and trait method bodies, while stubs for Guzzle, PSR-7, Monolog, and other libraries load only when used.
Old purity annotations are replaced by a Hack-inspired capability model with declared side effects such as read-props, io, and time. Purity templates allow higher-order functions like array_map() and usort to inherit purity from callbacks. Dead code detection uses a reference graph, flagging unused classes and unthrown exceptions. The type system adds template defaults like @template TError of Throwable = RuntimeException, and you get typing for the PHP 8.5 pipe operator and PHP 8.6 partial function application. Upgrading generally requires composer require --dev vimeo/psalm:^7.0 -W.