Bump the phpstan group across 1 directory with 3 updates

[dependabot]

Updates the requirements on phpstan/phpstan, phpstan/phpstan-nette and spaze/phpstan-disallowed-calls to permit the latest version.
Updates phpstan/phpstan to 2.2.5

Commits

• See full diff in compare view

Updates phpstan/phpstan-nette to 2.0.12

Release notes

Sourced from phpstan/phpstan-nette's releases.

2.0.12

• 2c104f1 - Fix "False positive staticMethod.alreadyNarrowedType for Strings::length() inside numeric comparison" (#210)
• 038d6e7 - Remove accidental committed file (#208)

Commits

• 2c104f1 Fix "False positive staticMethod.alreadyNarrowedType for Strings::length() in...
• 038d6e7 Remove accidental committed file (#208)
• 3dace7c Narrow to non-empty-string via Strings::length (#207)
• 845f5d0 Fix build on PHPStan 2.2.3 (#206)
• 3cd4502 Update github-actions to v3.0.1 (#204)
• cb29eca Update github-actions to v7 (#205)
• 466f89b Update github-actions (#202)
• 8d19711 Fix build after revert in phpstan-src (#203)
• See full diff in compare view

Updates spaze/phpstan-disallowed-calls to 4.13.0

Release notes

Sourced from spaze/phpstan-disallowed-calls's releases.

Attributes on methods match allowInMethods, and allow directives compose predictably

New

• Attributes placed on a method or a function - not just used inside one - now match the name-based allowInMethods/allowInFunctions patterns, the same way allowInMethodsWithAttributes already matched them (#427, #428 - possible BC break)

• Allow directives now fall through to the next one in the same config entry when they don't match, so e.g. allowInInstanceOf combined with allowInClassWithAttributes works as alternatives; how the directives compose is now documented (#429, #430)

• Documented that directive aliases (allowInFunctions/allowInMethods, disallowInMethods/allowExceptInMethods etc.) refer to one single directive and only one of them is used when an entry sets several (#430)

Internal changes

• Array types in PHPDoc adjusted for sealed arrays introduced in PHPStan 2.2 (#421), with the property config types following suit (#422)
• The lowest supported PHPUnit is now 9.6 so tests run on PHP 7.4 again (#426), and the PHPUnit 13.2 expectExceptionMessage() deprecation is handled while keeping older PHPUnit versions working (#425)
• shipmonk/dead-code-detector updated to ^1.1, which requires PHP 8.1+ so it's uninstalled when testing on older versions (#423)
• goto is reachable again in the test fixture (#420)
• actions/checkout bumped to 7 (#424, thanks @​dependabot)

Possible BC break note: allowExceptInMethods and its aliases can now report an attribute placed on a matching method or function, which was previously always allowed - if attribute errors newly appear, check your patterns. Other than that, errors can only disappear with this release.

Commits

• 94bd445 Allow directives fall through to the next one when they don't match (#430)
• be678df Document that setting multiple aliases of one directive uses just one of them
• edef780 Allow directives fall through to the next one when they don't match
• 46cd043 Match attributes on methods and functions with allowInMethods and `allowInFun...
• d79e6e2 Link the methods-with-attributes list item to its own doc
• 14c9e85 Match attributes on methods and functions with allowInMethods and `allowInF...
• 8ade936 Bump actions/checkout from 6 to 7 (#424)
• 30c9ca3 Bump actions/checkout from 6 to 7
• 7966237 "Upgrade" the lowest possible PHPUnit to 9.6 which supports PHP 7.4 (#426)
• d2d897f "Upgrade" the lowest possible PHPUnit to 9.6 which supports PHP 7.4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions