From 2cf918a662787c182a1341f23a3180ab6c3300ab Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 6 Sep 2026 05:42:29 +0000
Subject: [PATCH 1/2] build(deps-dev): bump phpstan/phpstan from 2.2.9 to
 2.2.12

Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) from 2.2.9 to 2.2.12.
- [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits)

---
updated-dependencies:
- dependency-name: phpstan/phpstan
  dependency-version: 2.2.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 composer.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/composer.lock b/composer.lock
index 50cd6c148..aca35cc86 100644
--- a/composer.lock
+++ b/composer.lock
@@ -3465,11 +3465,11 @@
         },
         {
             "name": "phpstan/phpstan",
-            "version": "2.2.9",
+            "version": "2.2.12",
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/13d6b4f347bad222da436580c8304fa6f83e6bd0",
-                "reference": "13d6b4f347bad222da436580c8304fa6f83e6bd0",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/174b0d88710f00a42598886504dd7a146f91ace5",
+                "reference": "174b0d88710f00a42598886504dd7a146f91ace5",
                 "shasum": ""
             },
             "require": {
@@ -3525,7 +3525,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-08-22T07:38:16+00:00"
+            "time": "2026-08-31T19:09:43+00:00"
         },
         {
             "name": "phpunit/php-code-coverage",

From 6f9c3dfaf2d6bf8acd91dd0b01293a656b569dfb Mon Sep 17 00:00:00 2001
From: blaipr <blaipr@hotmail.com>
Date: Mon, 7 Sep 2026 23:23:24 +0200
Subject: [PATCH 2/2] fix: annotate buildFromItemData's input as what callers
 actually pass
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PHPStan 2.2.12 reports the instanceof in ItemDataTrait::buildFromItemData() as always
true, because the docblock declares the parameter Item[] — the very guarantee the method
exists to provide. Every caller takes a bare array at runtime (AccountAclDto's constructor
and AccountEnrichedDto's with*() methods all declare array $x) and the values arrive from
the database and from deserialized DTOs, so the filter is what makes the array an Item[].

Annotating the input as mixed[] makes the check meaningful again rather than silencing it,
and lets the matching baseline entry for AccountEnrichedDto go: the baseline shrinks from
291 to 290.
---
 phpstan.baseline.neon                    |  6 ------
 src/Domain/Common/Dtos/ItemDataTrait.php | 13 +++++++++++--
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/phpstan.baseline.neon b/phpstan.baseline.neon
index f5cbd4942..ccc406bef 100644
--- a/phpstan.baseline.neon
+++ b/phpstan.baseline.neon
@@ -198,12 +198,6 @@ parameters:
 			count: 1
 			path: src/Domain/Account/Adapters/AccountPermission.php
 
-		-
-			message: '#^Instanceof between SP\\Domain\\Common\\Models\\Item and SP\\Domain\\Common\\Models\\Item will always evaluate to true\.$#'
-			identifier: instanceof.alwaysTrue
-			count: 1
-			path: src/Domain/Account/Dtos/AccountEnrichedDto.php
-
 		-
 			message: '#^Instanceof between SP\\Domain\\Account\\Dtos\\AccountUpdateDto and SP\\Domain\\Account\\Dtos\\AccountUpdateDto will always evaluate to true\.$#'
 			identifier: instanceof.alwaysTrue
diff --git a/src/Domain/Common/Dtos/ItemDataTrait.php b/src/Domain/Common/Dtos/ItemDataTrait.php
index 7230d5167..902a89e34 100644
--- a/src/Domain/Common/Dtos/ItemDataTrait.php
+++ b/src/Domain/Common/Dtos/ItemDataTrait.php
@@ -33,12 +33,21 @@
 trait ItemDataTrait
 {
     /**
-     * @param Item[] $items
+     * Keep only the `Item`s out of whatever was handed over.
+     *
+     * The parameter is deliberately `mixed[]` rather than `Item[]`: every caller takes a bare
+     * `array` at runtime — `AccountAclDto`'s constructor and `AccountEnrichedDto`'s `with*()`
+     * methods all declare `array $x` — and the values arrive from the database and from
+     * deserialized DTOs, so this filter is the thing that makes the array an `Item[]`. Annotating
+     * the input as `Item[]` claimed the guarantee this method exists to provide, which is why
+     * PHPStan 2.2.12 began reporting the `instanceof` as always true.
+     *
+     * @param mixed[] $items
      *
      * @return Item[]
      */
     private static function buildFromItemData(array $items): array
     {
-        return array_filter($items, static fn($value) => $value instanceof Item);
+        return array_filter($items, static fn(mixed $value): bool => $value instanceof Item);
     }
 }