Skip to content

Update apigen dependencies - #6846

Merged
ondrejmirtes merged 7 commits into
2.3.xfrom
update-apigen
Oct 26, 2026
Merged

ondrejmirtes merged 7 commits into
2.3.xfrom
update-apigen

Conversation

@ondrejmirtes

Copy link
Copy Markdown
Member

Updates ApiGen and the apiref.phpstan.org CDK app in small steps, one commit per step.

ApiGen (apigen/apigen is already pinned to the latest upstream master commit):

  1. Escape generic types in descriptions. ApiGen renders PHPDoc descriptions as Markdown, which passes inline HTML through, so array<int> in a description was rendered as array because browsers treat <int> as an unknown tag. league/commonmark 2.10.3 also stopped escaping tags with uppercase letters (case insensitive for HTML attributes thephpleague/commonmark#1096), so after the update array<T>, <TKey> and similar would have disappeared too. A small HtmlInline renderer keeps the formatting tags PHPDocs actually use (php-parser uses <code>) and escapes the rest.
  2. Latest minor and patch versions of ApiGen's dependencies, including the league/commonmark security fixes (2.7.0 → 2.10.4), latte 3.1 and nikic/php-parser 5.9.

I generated the docs locally before and after (apigen -c apigen/apigen.neon --output docs -- src vendor/nikic/php-parser vendor/ondrejmirtes/better-reflection vendor/phpstan/phpdoc-parser). Both runs produce 1776 files. ApiGen lists implementers in a different order on each run, so I compared sorted file contents. The only differences are raw <…> generics that are now escaped. <code> in the php-parser pages is kept.

apigen/infra (CDK app):

  1. Latest minor and patch versions (aws-cdk 2.1146.1, aws-cdk-lib 2.274.0, @types/node 22.20.5)
  2. vitest 4, which fixes the open vitest/vite/tinypool advisories (npm audit: 0 vulnerabilities)
  3. vitest 5
  4. Node 24 in the workflow, with @types/node 24
  5. TypeScript 6. It no longer includes every package in typeRoots by default, so tsconfig.json lists "types": ["node"].

After every step, npm run check, npm test (38 tests) and cdk synth --all pass. The synthesized PhpstanApirefOidcRoles and PhpstanApirefWebsite templates are identical to the ones from before the change, apart from the CDKMetadata analytics string, which encodes the CDK version.

Not updated: TypeScript 7. It type-checks this code fine but no longer ships the JavaScript compiler API that ts-node uses, so cdk synth (npx ts-node bin/infra.ts) fails. Moving to TypeScript 7 means replacing ts-node, for example with tsx. That is best done together with the main-site infra in phpstan/phpstan, which this app mirrors and which uses the same ts-node setup.

Supersedes #6309 and #5925.

PHPDoc descriptions are rendered as Markdown, which passes inline HTML
through. A type such as array<int> written in a description therefore
lost its <int>, because browsers treat it as an unknown tag.
league/commonmark 2.10.3 also stopped escaping tags with uppercase
letters, so array<T> would lose its <T> as well.

Keep the formatting tags PHPDocs use, such as <code>, and escape the
rest.
TypeScript 6 no longer includes every package in typeRoots by default,
so list the Node.js types explicitly.

Amp-Thread-ID: https://ampcode.com/threads/T-01a176c6-528a-7430-b296-e66930d153b4
@ondrejmirtes
ondrejmirtes merged commit dcf6762 into 2.3.x Oct 26, 2026
718 checks passed
@ondrejmirtes
ondrejmirtes deleted the update-apigen branch October 26, 2026 06:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant