Weave Code
Phpstan Symfony Laravel Package
phpstan/phpstan-symfony
PHPStan extension for Symfony that provides accurate return types for the container, controllers, requests, responses, forms, serializer, cache, and other framework APIs, helping catch bugs earlier and improving static analysis in Symfony projects.
phpstan/phpstan-symfony is a PHPStan extension that adds precise type inference for the Symfony framework, eliminating a large class of false positives and catching real bugs in container-heavy applications.
By teaching PHPStan about Symfony's dynamic behavior, it turns vague mixed returns into accurate types across services, parameters, and framework classes.
- Correct return types for container and controller
get(),has(), andgetParameter()calls - Precise types for request/response helpers like
InputBag,HeaderBag, andRequest::getContent() - Typed results for Serializer, Form, and Messenger APIs
- Improved inference for Kernel, config trees, and cache callbacks
Install with Composer and enable the extension in your PHPStan configuration.
Frequently asked questions about Phpstan Symfony
- What does phpstan/phpstan-symfony actually add to PHPStan?
- It teaches PHPStan the real types behind Symfony APIs that would otherwise be reported as mixed or object, including ContainerInterface::get(), AbstractController::getParameter(), InputBag::get(), SerializerInterface::deserialize(), CacheInterface::get(), TreeBuilder and Messenger's HandleTrait::handle(). It also registers framework-aware rules that flag things such as access to private or unregistered services and undefined console arguments and options. Everything runs at analysis time only, so nothing ships to production and no services are added to the container.
- How do I install and enable phpstan/phpstan-symfony?
- Run composer require --dev phpstan/phpstan-symfony. If phpstan/extension-installer is already installed, the extension and its rules are registered automatically with no further setup. Otherwise add vendor/phpstan/phpstan-symfony/extension.neon and, if you want the framework rules, rules.neon to the includes section of your phpstan.neon. Check your installed PHPStan version against the extension's minimum before upgrading either package.
- Why does PHPStan still report mixed or object for my Symfony container calls?
- The extension derives service and parameter types from the compiled container XML, configured through the containerXmlPath parameter. If that file is missing, stale, or built for a different environment, PHPStan quietly falls back to mixed or object instead of failing with a clear error. Point containerXmlPath at a fresh dump such as var/cache/dev/App_KernelDevDebugContainer.xml and regenerate it in every environment where analysis runs.
- How do I run phpstan/phpstan-symfony in CI without breaking the build?
- CI needs the container XML to exist before PHPStan executes, so dump the container or warm the cache as an explicit build step and set containerXmlPath to that file. Enabling console analysis via consoleApplicationLoader boots your kernel and runs application code during analysis, so keep that loader script minimal. If you hit PhpParser errors saying an interface is already in use, create a dedicated phpstan_env with container.dumper.inline_class_loader set to false rather than treating it as a PHPStan bug.
- Which PHPStan version does phpstan/phpstan-symfony require?
- Version coupling is explicit: release 2.1.0 requires PHPStan 2.3.0 or newer, so the extension is effectively bound to a PHPStan minor rather than only to a Symfony version. Upgrade the two together and pin both in composer.json so a PHPStan bump cannot silently degrade analysis. Check the exact Symfony constraint for the tag you install on Packagist, since supported ranges change between majors.
- Does the extension support Symfony 5.3+ PHP container configuration?
- Projects using PHP-based container configuration keep generated config classes and the ContainerConfigurator outside the default autoloader reach, so you must help PHPStan find them. Add scanDirectories for var/cache/dev/Symfony/Config and scanFiles for ContainerConfigurator.php. Skipping this produces confusing class-not-found noise that looks like a broken extension instead of a missing configuration entry.
- How do I get correct types for Symfony console arguments and options?
- PHPStan can only type $input->getArgument() and $input->getOption() when it can see your registered commands and their input definitions. That requires the optional consoleApplicationLoader setting, a small script that boots the kernel and returns the Application instance. It is useful but raises CI complexity because application bootstrap code runs during analysis, so treat it as an opt-in step.
- How do I get typed results from Messenger HandleTrait::handle()?
- HandleTrait::handle() is typed from the message-to-handler map, so PHPStan narrows the return value only when it can resolve which handler handles which message class. In setups where that map is dynamic, small wrapper classes that call handle() with a concrete message give PHPStan enough information. The payoff is dropping manual @var annotations around messenger dispatch code.
- Should I set constantHassers: false in my PHPStan config?
- That option disables the constant-hasser rules, which can quieten noise in codebases that reference constants dynamically or compare them loosely. The documentation is clear that it can hide genuine errors, so treat it as a last resort rather than a default. If you enable it, leave a comment in phpstan.neon explaining why so the decision is not lost later.
- Is phpstan/phpstan-symfony safe as a dev dependency, and does it replace tests?
- Yes, it belongs in require-dev: it is a static analysis extension with no runtime code, no service registration and no deployment artifact, so it should never appear in production dependencies. It is MIT licensed and maintained under the phpstan organisation with a steady release cadence. It does not replace integration tests, lint:container or debug:container, because it only improves what PHPStan understands rather than what Symfony enforces at runtime.
Weaver
How can I help you explore Laravel packages today?