Uncategorized

  • never is not void, and the analyser knows

    void means the function returns nothing and never means it does not return, and the second is information a static analyser can act on. The practical value is…

  • Enums, and the string column that was pretending

    8.1 on 25 November, and the feature PHP had been simulating with class constants for a decade. A status column holding three spellings of the same thing.

  • Scanning a base image is half the answer

    A scanner reports what it can identify from package metadata, and a binary copied into an image during the build has none. The blind spots are consistent and…

  • The framework extension is what makes level 8 possible

    A service container returning mixed and a model with magic properties defeat static analysis entirely without a framework-aware extension. The extension is not optional on a framework-heavy codebase…

  • Serialising an object with readonly properties

    unserialize creates an object without calling the constructor and then writes the properties, which is precisely the thing readonly forbids. Native serialisation is allowed by an explicit carve-out…

  • A dependency inventory you can answer questions from

    9 December, a Java vulnerability, and a stack with no Java in it. “Are we affected” took eleven hours to answer with confidence.

  • from() throws and tryFrom() returns null

    Hydrating an enum from a request parameter with from() produced an uncaught ValueError on the first malformed input, which was about nine minutes after deploy. The two methods…

  • __set on a class that declares the property does nothing

    __set is only called for inaccessible or undefined properties, so declaring the property you meant to intercept disables the magic silently. The private case is the one that…

  • new in initializers, and the default that is an object

    A constructor with an optional dependency needed a null default and a line of null-coalescing, in every class that had one. The exclusion of property defaults is the…

  • Readonly properties and the value object that stops defending itself

    8.1, and a keyword that removes a getter per property. Forty value objects, each with private fields and public accessors that existed only to prevent writes.