Update PHPStan packages to v2 (major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
phpstan/phpstan	^1.10.7 -> ^2.0.0
phpstan/phpstan-deprecation-rules	^1.1.3 -> ^2.0.0
phpstan/phpstan-phpunit	^1.3.10 -> ^2.0.0
phpstan/phpstan-strict-rules	^1.5.0 -> ^2.0.0

---

Release Notes

phpstan/phpstan (phpstan/phpstan)

v2.0.1

Compare Source

v2.0.0

Compare Source

phpstan/phpstan-deprecation-rules (phpstan/phpstan-deprecation-rules)

v2.0.0

Compare Source

• 81833b5 - Removed always true PHP_VERSION_ID condition
• f4a969d - Merge branch '1.2.x' into 2.0.x
• 0ccccb1 - selectSingle() is being deprecated
• 392bbe7 - Updates for PHPStan 2.0 changes
• 89572d5 - Merge branch '1.2.x' into 2.0.x
• 398e2e2 - Merge remote-tracking branch 'origin/1.2.x' into 2.0.x
• 4590cf6 - Update build-cs
• 681b2db - Stop testing PHP 7.2 and 7.3
• 0e1d78a - Open 2.0.x

phpstan/phpstan-phpunit (phpstan/phpstan-phpunit)

v2.0.1

Compare Source

• 4b6ad7f - Fix
• bec49ea - Merge branch '1.4.x' into 2.0.x
• 3cc8554 - Fixes after PHPStan update
• 09e2d3b - Uncover everything behind the bleedingEdge flag
• 4d861e0 - Fix after TypeSpecifier BC break
• 3faa605 - Update build-cs
• 953195d - Stop testing PHP 7.2 and 7.3
• 7f1457f - Open 2.0.x

v2.0.0

Compare Source

• 3cc8554 - Fixes after PHPStan update
• 09e2d3b - Uncover everything behind the bleedingEdge flag
• 4d861e0 - Fix after TypeSpecifier BC break
• 3faa605 - Update build-cs
• 953195d - Stop testing PHP 7.2 and 7.3
• 7f1457f - Open 2.0.x
• 146d9c3 - Test newer PHP versions
• bb6bec0 - Pin build-cs

phpstan/phpstan-strict-rules (phpstan/phpstan-strict-rules)

v2.0.0

Compare Source

• a4a6a08 - Remove dead test because of raised min-php version
• b60bffc - Fix
• 5d50bde - Fix
• 0368403 - Fix
• 1721dbf - Fix after PHPStan update
• e208c93 - Fix after PHPStan update
• 63956f7 - Moved illegalConstructorMethodCall rules from phpstan to phpstan-strict-rules
• ad53bd9 - Remove options removed in PHPStan 2.0
• 914b5e3 - Everything from Bleeding Edge enabled
• 988fab9 - Add more separate rule toggles
• e227ffd - Merge remote-tracking branch 'origin/1.6.x' into 2.0.x
• 90006f2 - Merge branch '1.6.x' into 2.0.x
• 1062d48 - Fix
• 5eec39f - Set polluteScopeWithBlock to false
• 8e2c8b0 - Fix deprecations
• 1ccec91 - Remove unnecessary dependency on nikic/php-parser
• f8092f9 - Update build-cs
• f647999 - Stop testing PHP 7.2 and 7.3
• f6fb84e - Open 2.0.x

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[SvenRtbg]

I've been looking into reasons why PHPStan complains.

InMemory should be fixable by changing the @param non-empty-string $contents which is already guarded into @phpstan-assert non-empty-string - this is stating that empty strings may be passed, but won't be successful.

The Builder failure though is kinda hard. The constructor is still public, and cloning while trying to change readonly properties is only supported by PHP 8.3 and up, not by the current minimum PHP 8.2. In order to keep supporting PHP 8.2, we'd need to create an own cloning function that works on making $claims and $headers changeable while cloning. It's not impossible, but would work best if all properties would be passed via constructor - and changing it is an incompatible change.

Dealing with all that isn't impossible - and it revealed to me an interesting thing: Why are there default values in the first place?

It might make sense to initialize the claims array with an empty array, as that isn't too different from being uninitialized. Or to reverse that part.

But the headers still seem weird. "typ":"JWT" is forced, and the algorithm alg is just kept as a placeholder, but only filled once the token is rendered and signed - it's never set to anything else but null internally before that.