Update vimeo/psalm requirement from ^3.14.1 to ^4.2.0

Created by: dependabot[bot]

Updates the requirements on vimeo/psalm to permit the latest version.

Release notes

Sourced from vimeo/psalm's releases.

Add support for Github Security analysis

Security analysis

Support for sending analysis GitHub Security

Thanks to @LukasReschke, Psalm can now output its results in a format compatible with GitHub's Code Scanning feature (#4582)

More specific output for security issues

Psalm now separates out different security issues it finds, with code snippets that reproduce the issue e.g. TaintedHtml and TaintedUnserialize

Bugfixes

Inheritance for docblock return and param types

This ticket – #4537 – revealed a slight issue with Psalm's automatic inheritance of docblock param and return types.

Psalm will now only inherit docblock parameter and return types from a single docblock, which means you can't define param types in one parent class method and return types in another. It's a relatively minor change, but it might break some code.

Other bugfixes

• Security Analysis: @LukasReschke made a lot of improvements to Psalm's taint analysis (#4554, #4572, #4576, #4592, #4604, #4630)
• @pilif improved the mb_strtolower return type (#4469)
• perform better inference for literal int division (#2132)
• fix bugs caused by around ReflectionProperty stub not implementing Reflector (#4481)
• better error message for PossiblyInvalidArrayOffset (#4479)
• support assertions in new calls (#4491)
• fix type inference when unpacking typed iterables (#4487)
• @orklah added some undocumented properties to SoapFault (#4510)
• @wouterj added support for reflecting builtin PHP union types (#4505)
• autoloaded constants set in define are now inferred as mixed (#4509)
• prevent crash with empty match expression (#4519)
• treat exit expressions as the empty type (#4516)
• track type contradiction issues in match expressions (#4517)
• remember assignments when descending into property use (#4522)
• @adrienlucas added support for proxying functions for taint analysis (#4495)
• improve template param inference (#4485, #4524, #4545)
• fix property initialisation checks when parent::__construct refers to grandparent class (#4540)
• allow better get_class inference inside match expressions (#4544)
• mark closure uses as UnusedVariable where possible (#4547)
• prevent false-positive warning about calling unset on array with key (#4529)
• @orklah added a check for accessing an array with a negative int offset (#4552)
• @thomasvargiu fixed a bug intersecting with templated types (#4560)
• @duskwuff added support for passing named arguments to functions that use variadic params (#4575)
• added a more specific return type for substr in PHP 8 (#4580)
• @BenMorel improved mysqli property types and a DateTimeInterface signature (#4577, #4579)
• @mstilkerich added a more accurate stub for preg_filter (#4587)
• improved a lot of tainting (#4599, #4605)
• prevent negative line numbers in output (#4600)
• prevent string literals from carrying taints (#4620)

... (truncated)

Commits

• ccf6e28 Grammar
• 7c62b0c Make Readme more punchy
• acb4bb4 documented type in InternalTaintSinkMap (#4627)
• c562e1d Don’t taint foreach keys with array-fetch
• e04f219 return static instead of self when static context detected (#4632)
• 78d644d Change TaintedText to TaintedCallable
• 4c315ec Closure calls aren’t sinks
• 24fe7e5 Advertise SARIF export in the documentation (#4633)
• 78f4a06 Add dedicated types for 'file', 'header' and 'cookie' (#4630)
• 70c9fd9 Return empty instead of throwing
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)