feat: migrate PHPStan 1 => 2

[Chris53897]

The goal is to improve code quality further.
I am not sure if i can fix all of the errors.
And have the time

Summary by CodeRabbit

• Chores

  • Upgraded core tooling and libraries, including the static analysis tool and various dependencies.
  • Added scripts to run static analysis and updated analysis baseline/configuration.

• New Integrations

  • Added and updated many geocoding/location providers to expand supported mapping services and compatibility.

• Bug Fixes / Behavior

  • Improved handling of fake-IP replacement logic and simplified provider selection paths to reduce runtime errors.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

Bumps many runtime and dev composer dependencies and adds new geocoder providers; updates PHPStan configuration and baseline (including new ignore identifiers); and makes two small provider/plugin code changes in src/ affecting FakeIpPlugin replacement logic and HereFactory provider instantiation. (48 words)

Changes

Cohort / File(s)	Summary
Composer manifest composer.json	Multiple dependency version bumps (runtime + dev), many new/updated geocoder provider entries, added willdurand/geocoder entry, and new scripts: phpstan and phpstan-baseline.
PHPStan baseline phpstan-baseline.php	Replaced/commented entries with explicit identifier fields, added many new ignoreError rules (targeted identifiers like return.type, foreach.nonIterable, etc.), and removed some older broader ignores.
PHPStan config phpstan.dist.neon	Added parameters.treatPhpDocTypesAsCertain = false to change PHPStan’s treatment of phpDoc types.
Fake IP plugin logic src/Plugin/FakeIpPlugin.php	Changed conditional: replacement now must be truthy as well as needle present before doing str_replace; otherwise uses withText($replacement) path (control-flow change).
Here provider factory src/ProviderFactory/HereFactory.php	Removed runtime guard that checked for Here::createUsingApiKey; now calls Here::createUsingApiKey directly when app_key is provided (removed existence check/exception path).

Sequence Diagram(s)

(omitted)

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• Make classes final and add some types #390 — Modifies same files (src/Plugin/FakeIpPlugin.php, src/ProviderFactory/HereFactory.php); likely overlapping changes.
• chore: remove unused + bump dev dependencies #380 — Overlaps composer dependency and provider list updates; related to package matrix changes.
• feat: add strong PHP Types, cleanup #392 — Touches FakeIpPlugin tests; likely relevant to the FakeIpPlugin behavioral change.

Suggested reviewers

• norkunas

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat: migrate PHPStan 1 => 2' accurately summarizes the main objective of the pull request, which is to upgrade PHPStan from version 1 to version 2 for improved code quality.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 55afe87 and 0bfee99.

📒 Files selected for processing (5)

• composer.json
• phpstan-baseline.php
• phpstan.dist.neon
• src/Plugin/FakeIpPlugin.php
• src/ProviderFactory/HereFactory.php

💤 Files with no reviewable changes (1)

• src/ProviderFactory/HereFactory.php

🔇 Additional comments (5)

phpstan.dist.neon (1)

11-11: Reasonable configuration for PHPStan 2 migration.

Setting treatPhpDocTypesAsCertain: false is a conservative choice that prevents PHPStan from fully trusting PHPDoc annotations, which can help surface type mismatches between documented and actual types. This is appropriate when migrating to stricter analysis.

src/Plugin/FakeIpPlugin.php (1)

57-65: Behavioral change may cause unintended null propagation.

The added && $replacement condition changes control flow: when needle is set but replacement is falsy (null or empty string), the code now falls through to the else branch, which calls withText($replacement) with a potentially null value. The baseline confirms this type mismatch is being suppressed.

Consider whether this is the intended behavior. If $replacement is null (no faker, no replacement configured), the else branch passes null to withText(), which expects a string.

🔎 Suggested fix to handle null replacement explicitly

-        if (null !== $this->needle && '' !== $this->needle && $replacement) {
+        if (null !== $this->needle && '' !== $this->needle && null !== $replacement && '' !== $replacement) {
             $text = str_replace($this->needle, $replacement, $query->getText(), $count);

             if ($count > 0) {
                 $query = $query->withText($text);
             }
-        } else {
-            $query = $query->withText($replacement);
+        } elseif (null !== $replacement) {
+            $query = $query->withText($replacement);
         }

phpstan-baseline.php (1)

1-211: Baseline properly formatted for PHPStan 2.

The baseline has been correctly updated with explicit identifier fields required by PHPStan 2. The error classifications (argument.type, return.type, offsetAccess.nonOffsetAccessible, etc.) match PHPStan 2's standard identifiers. This approach allows incremental type-safety improvements as suggested in the PR comments.

composer.json (2)

81-83: Helpful scripts for PHPStan workflow.

The added phpstan and phpstan-baseline scripts provide a convenient workflow for running analysis and regenerating the baseline. The --memory-limit=1024m flag is appropriate for larger codebases.

---

18-19: Dependency bumps align with migration goals.

The version bumps for geocoder-php/plugin, php-http/discovery, fakerphp/faker, and friendsofphp/php-cs-fixer follow the reviewer recommendations for accompanying the PHPStan 2 migration.

Also applies to: 28-29

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

composer.json (1)

82-82: Good addition for developer convenience.

The phpstan script provides a convenient way to run PHPStan with an appropriate memory limit. The script will automatically use the configuration file (phpstan.neon or phpstan.neon.dist) if present in the project root.

Optionally, you could make the script more explicit by specifying the configuration file and analyze paths:

Optional: Make the script more explicit

-    "phpstan": "vendor/bin/phpstan --memory-limit=1024m"
+    "phpstan": "vendor/bin/phpstan analyze --memory-limit=1024m --configuration=phpstan.neon"

This would make it clearer what's being analyzed and which configuration is used, though the current version is perfectly functional.

📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 6b42484 and 6958ec1.

📒 Files selected for processing (1)

• composer.json

[norkunas]

You can move to baseline them

[norkunas]

Btw i think we should bump more deps:

• geocoder-php/plugin
• php-http/discovery
• fakerphp/faker
• friendsofphp/php-cs-fixer
• all of the providers also could be bumped if there are no major releases

[Chris53897]

This change needs a closer look https://github.com/geocoder-php/BazingaGeocoderBundle/pull/393/files#diff-2bddfd9704c87a4483aa410e32c197e9f27261146f5226930bbe92c878255552R57
$replace should not be null for str_replace()

As we bumped the HereFactory, i guess the change should not change anythink in userland.

[norkunas]

Thanks @Chris53897