Announcing Psalm 7

Psalm 7, the latest major release of the open-source PHP static analysis tool maintained by Daniil Gentili, shipped with security analysis enabled by default and folded into a single run alongside type checking and dead code detection. The release adds deeper taint tracking covering NoSQL, LLM prompt and URL injection, new sources such as php://input and uploaded file names, and ready-made stubs for Guzzle, PSR-7, Monolog and MongoDB, with taint analysis now up to 10x faster through bitmask-based taint storage. It also introduces a Hack-inspired purity model for declaring side effects, graph-based dead code detection that handles unused cycles, template defaults such as `@template TError of Throwable = RuntimeException`, and support for PHP 8.5 and 8.6 features including partial function application and the pipe operator. Psalm 7 bundles PHPUnit, Symfony, Laravel, Mockery and sabre/event plugins that activate automatically with zero setup, moves to daily releases, adds maintainer @alies-dev and launches an official Discord community, running on 64-bit PHP 8.2 through 8.6. The release matters because always-on taint analysis brings security scanning into ordinary CI type-checking runs for PHP projects, and the bundled framework plugins lower adoption friction. Next, watch upgrade reports from large PHP codebases and whether the daily release cadence and expanded maintainer team sustain the project's velocity.