vimeo/psalm

View on GitHub

A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications

Stars: 5.9k
Forks: 708
Open beginner issues: 4
Indexed issues: 1.9k
Avg merge: 2d 3h
Merged PRs (30d): 25

Dominant language: PHP
License: MIT
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 20, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: help wanted good first issue

Beginner friendly Everything

Open All

1,919 open issues indexed

Cold-cache scan crashes on PHP >= 8.3: AST serialize() in parallel worker fiber exceeds ~2 MiB fiber call-stack limit ("Infinite recursion?") Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

vimeo/psalm#11967 · 2 comments · Opened Sep 17, 2026
Template argument lost when a `ReflectionClass<T>` built from `class-string<T>` is passed to a generic method (regression in 6.17.0) Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

vimeo/psalm#11963 · Opened Sep 15, 2026
[7.x] Taint: one of two flows into the same sink is dropped when one path is longer (visited guard also suppresses reporting) Open

Difficulty 4/5 3-5 days Newbie friendliness 64/100

vimeo/psalm#11959 · 1 comment · Opened Sep 15, 2026
Uncaught TypeParseTreeException: an unparseable `@self-out` / `@this-out` type crashes the scan phase Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

vimeo/psalm#11958 · 1 comment · Opened Sep 15, 2026
Type variables minted in namespaced file-scope code are never reconciled Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

vimeo/psalm#11936 · 2 comments · Opened Sep 11, 2026
Strict comparaison Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

vimeo/psalm#11935 · 2 comments · 1 reaction · Opened Sep 10, 2026
Uncaught `UnexpectedValueException` from `Methods::getStorage()` during taint analysis — method identifier case-normalized against a declaring class that doesn't have it Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

vimeo/psalm#11933 · 2 comments · Opened Sep 8, 2026
Support PHPStan's star projection `*` as a generic type argument (`Foo<*>`) Open

Difficulty 4/5 3-5 days Newbie friendliness 68/100

vimeo/psalm#11931 · 2 comments · Opened Sep 2, 2026
false PossiblyUnusedParam errors and eval() Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

vimeo/psalm#11930 · 1 comment · Opened Aug 29, 2026
variable variables yield UnusedVariable errors Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

vimeo/psalm#11929 · Opened Aug 29, 2026
inherited methods and properties defined in child classes Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

vimeo/psalm#11928 · 1 comment · Opened Aug 29, 2026
Plugin RemoveTaints answers can land on shared @psalm-flow edges and silence unrelated taint flows (AddRemoveTaintsEvent has no dispatch context) Open

Difficulty 5/5 Over a week Newbie friendliness 38/100

vimeo/psalm#11924 · 1 comment · Opened Aug 26, 2026
Taint analysis attributes a named argument to its positional index, not the named parameter Open

Difficulty 3/5 1-2 days Newbie friendliness 74/100

vimeo/psalm#11923 · 2 comments · Opened Aug 25, 2026
RuntimeCaches::clearAll() between checkFile() calls breaks stub re-scanning, reproducing the #4117 crash on stub-dependent classes (6.16.1) Open

Difficulty 4/5 3-5 days Newbie friendliness 70/100

vimeo/psalm#11922 · 2 comments · Opened Aug 24, 2026
Psalm Crashed Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

vimeo/psalm#11921 · 2 comments · Opened Aug 19, 2026
Taint: `@psalm-taint-unescape` + `@psalm-flow` reports one sink twice when the value carries an unrelated taint kind Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

vimeo/psalm#11920 · 1 comment · Opened Aug 17, 2026
SIGSEGV on macOS arm64 with --force-jit: opcache.jit=1205 (trigger 0) crashes the JIT; tracing and 1235 complete Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

vimeo/psalm#11916 · 1 comment · Opened Aug 7, 2026
Trait method's data-flow node conflates taint across different using-classes Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

vimeo/psalm#11913 · 3 comments · Opened Jul 28, 2026
Taint edges are discarded when `ArrayAccess::offsetGet()` is reached through `$x['k']` sugar Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

vimeo/psalm#11912 · 1 comment · Opened Jul 26, 2026
Taint source on `__get` is lost when the property is read via `??` or behind `isset()` Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

vimeo/psalm#11909 · Opened Jul 23, 2026
StatementsAnalyzer emits dynamic-property warnings on dev-master Open

Difficulty 1/5 Under an hour Newbie friendliness 76/100

vimeo/psalm#11906 · Opened Jul 9, 2026
array_is_list() reported as impossible for array{key?: T} Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

vimeo/psalm#11905 · 3 comments · Opened Jul 9, 2026
Calling public methods declared by an interface of internally-annotated implementations Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

vimeo/psalm#11904 · 1 comment · Opened Jul 7, 2026
[regression] StatementsAnalyzer::$depth dynamic-property deprecation crash on PHP 8.2+ (master) Open

Difficulty 1/5 Under an hour Newbie friendliness 88/100

vimeo/psalm#11899 · 1 reaction · Opened Jul 2, 2026
psalm.dev/check emits php warnings as html Open

Difficulty 3/5 1-2 days Newbie friendliness 62/100

vimeo/psalm#11898 · 1 comment · 3 reactions · Opened Jun 30, 2026
Language Server sends `null` for optional LSP fields that must be absent Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

vimeo/psalm#11895 · 2 comments · Opened Jun 28, 2026
False positive InvalidAttribute: `#[\Override]` on properties is valid in PHP 8.5 Open

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

vimeo/psalm#11890 · 1 comment · Opened Jun 23, 2026
SARIF: taint rules lack `security-severity`, so Code Scanning shows them as "Other / Error" not "Security / Critical" Open

Difficulty 3/5 1-2 days Newbie friendliness 56/100

vimeo/psalm#11885 · 1 comment · Opened Jun 21, 2026
Psalm silently aborts (exit 0, zero output) when an analyzed file `class_exists()`-guards a `require_once` of an autoloadable file that has a top-level `exit` Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

vimeo/psalm#11881 · 2 comments · Opened Jun 13, 2026
@mixin-host method providers not consulted for mixin-forwarded methods Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

vimeo/psalm#11880 · Opened Jun 13, 2026
`MoreSpecificReturnType`/`LessSpecificReturnStatement` with narrowed `@method` annotations in inheritance chains Open

Difficulty 4/5 3-5 days Newbie friendliness 50/100

vimeo/psalm#11877 · 1 comment · Opened Jun 12, 2026
InvalidStaticInvocation false positive: static call to inaccessible non-static method routes to __callStatic at runtime Open

Difficulty 4/5 3-5 days Newbie friendliness 58/100

vimeo/psalm#11876 · 1 comment · Opened Jun 11, 2026
Programmatic usage triggers fatal memory exhaustion when inflating decompressed framework cache blobs Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

vimeo/psalm#11871 · 4 comments · Opened Jun 7, 2026
InvalidTemplateParam: true branch of conditional return type (T is X ? self<T> : ...) not narrowed by the `is` guard Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

vimeo/psalm#11867 · Opened Jun 5, 2026
PHP 8.5: support pipe operator Open

Difficulty 3/5 1-2 days Newbie friendliness 50/100

vimeo/psalm#11865 · 1 comment · 1 reaction · Opened May 29, 2026
UndefinedClass as function parameter suppressed via baseline hides other issues in function Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

vimeo/psalm#11864 · 2 comments · 1 reaction · Opened May 29, 2026
False positive for TypeDoesNotContainType/RedundantCondition with conditional @psalm-return Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

vimeo/psalm#11862 · 1 comment · Opened May 24, 2026
InvalidReturnStatement / InvalidReturnType false positive when array key is a function call Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

vimeo/psalm#11857 · 2 comments · Opened May 20, 2026
Properties with no default values are not passed to StatementsAnalyser Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

vimeo/psalm#11854 · 1 comment · Opened May 19, 2026
False positive RedundantCondition when method has multiple asserts Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

vimeo/psalm#11847 · 1 comment · 1 reaction · Opened May 15, 2026
False positive PossiblyUndefinedArrayOffset in loop when using less/greater than operators Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

vimeo/psalm#11845 · 1 comment · Opened May 12, 2026
Psalm does not warn when using an expression for a reference function parameter Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

vimeo/psalm#11844 · 1 comment · Opened May 12, 2026
Pseudo-method dispatch does not propagate `MethodStorage::$throws` to caller's `possibly_thrown_exceptions` Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

vimeo/psalm#11842 · 1 comment · Opened May 10, 2026
Conditional `@return` collapses to null branch when stub redeclares scanned-source method Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

vimeo/psalm#11837 · 4 comments · Opened May 7, 2026
Psalm crash due to NAN on PHP 8.5 Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

vimeo/psalm#11831 · 4 comments · 2 reactions · Opened May 6, 2026
Problem with using $this in conditional return type Open

Difficulty 4/5 3-5 days Newbie friendliness 42/100

vimeo/psalm#11828 · 2 comments · Opened May 3, 2026
multiple TypeDoesNotContainType errors with match on union of enums Open

Difficulty 3/5 1-2 days Newbie friendliness 52/100

vimeo/psalm#11827 · 1 comment · Opened Apr 30, 2026
False Positive: WordPress shortcode taint flow is missed: callback params are not treated as user input Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

vimeo/psalm#11826 · 1 comment · Opened Apr 29, 2026
TaintedSql false negative for WordPress request/wpdb flows Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

vimeo/psalm#11825 · 1 comment · Opened Apr 29, 2026
False positive `UnusedIssueHandlerSuppression` when using `UndefinedFunction` with `referencedFunction` Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

vimeo/psalm#11824 · 1 comment · Opened Apr 28, 2026

vimeo/psalm

Get new issues in your inbox