[Adi-ty]

What this PR does

Bumps rtCamp's shared PHPStan baseline (rtcamp/wp-phpstan) from level 5 to level 8 and pins the analysis to the rtCamp PHP range (8.2–8.5), so every WordPress project extending this baseline gets the same, stricter, and — for the first time — deterministic set of errors regardless of which PHP its CI runs on.

Closes

N/A

Changes

• Level 5 → 8 in the shipped phpstan.neon.dist. Consumers now also get level 6 (missing types on params, returns, properties, array values), level 7 (partially wrong union types), and level 8 (method calls and property access on nullable types).
• New phpVersion: 80200–80599. Analysis no longer follows whatever PHP the machine or composer.json implies: code is checked against the 8.2 floor (8.3+ syntax such as typed class constants is rejected), while 8.3–8.5 symbols stay known. Consumers can override it.
• phpstan/phpstan raised to ^2.3 for its rewritten, faster engine. The root dev tooling and monorepo-builder's appended require-dev move to ^2.3 with it.
• Tests pin level 8 (a nullable WP_Post access) and the 8.2 floor (a typed class constant).

How I verified

❯ composer test
PHPUnit 11.5.57 by Sebastian Bergmann and contributors.

Runtime:       PHP 8.5.9
Configuration: /Users/adi/rtproj/wp-tooling-phpstan-level-8/composer-packages/phpstan/phpunit.xml.dist

....                                                                4 / 4 (100%)

Time: 00:06.929, Memory: 8.00 MB

OK (4 tests, 43 assertions)

CI runs the same suite on PHP 8.2, 8.3 and 8.4.

Acceptance criteria

Runtime behavior

• A consumer with only the single includes: entry analyses at level 8
• WordPress stubs still resolve with no extra consumer config

Code quality

• Tests pass locally (PHP 8.5) and in CI (PHP 8.2, 8.3, 8.4)

Housekeeping

• CHANGELOG.md entry under ## Unreleased

Reviewer notes

• Stacked on this: fix(scaffolds): ask for lint/phpstan paths instead of hardcoding them #84 fixes the lint/phpstan scaffold, whose generated config lists src and includes and so fails composer analyse in any project without both.
• The scaffold's bump to rtcamp/wp-phpstan ^2.0 follows the release tag.

[Copilot]

🟡 Changes recommended

The PHP version upper bound excludes PHP 8.5 patch releases after 8.5.0, which can produce incorrect analysis of version-dependent branches.

1 open issue

• Use 80599 to cover all PHP 8.5 patch releases · New

What changed in this PR

Raises the shared rtcamp/wp-phpstan baseline to level 8 and sets an explicit PHP analysis range for consistent checks across consumer projects.

Changes:

• Enables stricter type and nullable-access checks with a PHP 8.2–8.5 target range.
• Raises PHPStan requirements to ^2.3 and updates the root lockfile.
• Adds regression fixtures and tests, and updates usage and migration documentation.

File	Description
monorepo-builder.php	Aligns generated development requirements with PHPStan ^2.3.
composer.lock	Locks PHPStan to 2.3.1.
composer.json	Raises the root PHPStan requirement.
composer-packages/​phpstan/​tests/​fixtures/​typed-constant.php	Adds syntax requiring PHP 8.3 to test the 8.2 floor.
composer-packages/​phpstan/​tests/​fixtures/​nullable.php	Adds nullable property access to test level 8.
composer-packages/​phpstan/​tests/​ConfigTest.php	Tests stricter defaults in an isolated consumer project.
composer-packages/​phpstan/​README.md	Documents new defaults and revises example analysis paths.
composer-packages/​phpstan/​phpstan.neon.dist	Sets level 8 and explicit PHP version bounds.
composer-packages/​phpstan/​composer.json	Requires PHPStan ^2.3 for consumers.
composer-packages/​phpstan/​CHANGELOG.md	Records stricter checks, version targeting, and migration guidance.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The configuration, dependency updates, regression tests, and migration guidance are consistent, with no unresolved blocking issues identified.

No open issues 🎉

1 resolved since last review

• Use 80599 to cover all PHP 8.5 patch releases

_{Review effort: Balanced}