Replace Psalm with PHPStan, require PHP 8.1 and Symfony ^6.4 || ^7.4 || ^8.0

[loevgaard]

Summary

• Psalm → PHPStan at level max, analysing bin, src and tests. The tools are listed directly in composer.json instead of requiring setono/code-quality-pack: 2.x pulls in Psalm and 3.x requires PHP 8.2.

• PHPStan fixes:

  • Parameter types are now explicitly nullable (?Request $request = null, ?array $popular = null), because implicitly nullable parameters are deprecated in PHP 8.4. Existing implementations of BotDetectorInterface stay compatible.
  • The short ternary in BotDetector::isBot() is replaced with ||, which behaves the same.
  • A few docblock types are more precise.

• Requirements: PHP >=8.1 and Symfony ^6.4 || ^7.4 || ^8.0.

• Service config: services.xml is converted to services.php, because Symfony 7.4 deprecates the XML configuration format.

• Test tooling:

  • PHPUnit is upgraded to ^10.5, which matthiasnoback/symfony-dependency-injection-test needs for Symfony 8.
  • infection/infection now allows ^0.32.0, the first versions that install with Symfony 8.
  • phpunit.xml.dist is migrated to the PHPUnit 10 format, and the data providers are static.

• ecs.php: migrated to ECSConfig. The old ContainerConfigurator format fails with newer ECS versions.

• CI: the matrix covers PHP 8.1–8.4 and Symfony 6.4, 7.4 and 8.0. It excludes combinations that can't install: Symfony 7.4 needs PHP 8.2 and Symfony 8 needs PHP 8.4.

• Popular bots list: updated to the 20 highest-volume crawlers, based on Cloudflare Radar data. It now covers search engines, AI crawlers, SEO crawlers and Meta's fetchers. Yahoo! Slurp, ia_archiver and facebookcatalog are dropped: Yahoo search is served by Bing, Alexa was retired in 2022 and facebookcatalog is low volume.

• Case-insensitive matching: the list is now matched case-insensitively. Previously the Bingbot entry never matched Bing's real user agent, which uses bingbot. Real user agents for the new entries are added to the test data.

Test plan

Run locally:

Setup	PHPStan	PHPUnit (46 tests before the bot list change)
PHP 8.1, lowest (Symfony 6.4.0)	pass	pass
PHP 8.1, highest (Symfony 6.4)	pass	pass
PHP 8.4, lowest (Symfony 8.0.0)	pass	pass
PHP 8.4, highest (Symfony 8.1)	pass	pass

In the two lowest runs, PHPUnit also shows 2 deprecations and 1 skipped test. Both come from Twig 3.27's own IntegrationTestCase and don't appear with newer Twig.

Also checked:

• ECS, composer validate --strict, composer normalize --dry-run and composer-dependency-analyser pass on PHP 8.4 with highest dependencies
• Infection passes on PHP 8.4 with an MSI of 93.3%, above the 87.5% minimum
• After the bot list change: 62 tests, PHPStan and ECS pass on PHP 8.4. Each list entry matches its real user agent and none matches a human user agent in the test data
• CI is green

[codecov]

Codecov Report

❌ Patch coverage is 40.00000% with 36 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.00%. Comparing base (61118cc) to head (789a98a).

Files with missing lines	Patch %	Lines
src/Resources/config/services.php	0.00%	36 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff               @@
##              master      #38       +/-   ##
==============================================
- Coverage     100.00%   60.00%   -40.00%     
  Complexity        13       13               
==============================================
  Files              4        5        +1     
  Lines             43       90       +47     
==============================================
+ Hits              43       54       +11     
- Misses             0       36       +36     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.