Psalm 7 release: PHP security&static analysis software
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Psalm 7, the PHP static analyzer, was released on November 2 by maintainer Daniil Gentili. Taint-based security analysis now runs by default in the same pass as type checking and dead code detection, and the project says it is up to 10x faster, though no benchmark is given. It adds NoSQL, LLM prompt and URL taint kinds, a Hack-style capabilities model replacing the old purity annotations, and graph-based dead code detection. Framework plugins load automatically, and the plugin API is versioned separately. Projects can opt out of taint analysis.