Psalm 7 Turns On Taint Analysis by Default for PHP

Psalm 7, the PHP static analyzer, now runs security (taint) analysis in the same pass as type checking and dead-code detection, with no opt-in. Daniil Gentili published the release announcement on Nov. 2, 2026, and the GitHub releases page shows the 7.x line at 7.2.0 on Nov. 9, seven days later.

Taint analysis follows untrusted input, such as a request parameter, to places where it becomes dangerous, such as a SQL query, and reports the path. In Psalm 6 that was a separate run. Anyone who upgrades with composer require --dev vimeo/psalm:^7.0 -W gets it automatically and will see new findings on code that was previously clean. The opt-out is runTaintAnalysis="false" in the config.

What the new taint kinds cover

The announcement lists new taint kinds including TaintedNosql, TaintedLlmPrompt, TaintedUrlComponent and TaintedUrlPath. TaintedLlmPrompt is the one that reflects 2026 code: it flags user input that flows into a prompt string. Psalm 7 also tracks taint through closures, generators, traits and by-reference parameters, which earlier versions lost.

Gentili wrote that security analysis is "up to 10x faster" because taints are stored as a bitmask and resolved over compact function summaries. That is the author's own figure, and the announcement gives no hardware or project size to reproduce it against.

To make results useful without configuration, the release ships taint stubs for more than 10 libraries, including Guzzle, PSR-7, Monolog and MongoDB, plus five bundled framework plugins: PHPUnit, Symfony, Laravel, Mockery and sabre/event.

Purity annotations are replaced

@psalm-pure and @psalm-mutation-free give way to capability annotations such as io, time and write-props. A function can now say what it touches rather than only that it is impure. Functions and classes can also inherit purity from the closures or subclasses they receive. Opt-in purity suggestions add two new issue types, MissingPureAnnotation and MissingImmutableAnnotation.

Dead-code detection is now graph-based: code is flagged when it cannot be reached from an entry point, which catches unused cycles that a simple reference count misses.

Upgrade notes and release cadence

Psalm 7 runs on 64-bit PHP 8.2 to 8.6 and adds typed support for the pipe operator and partial function application in PHP 8.5 and 8.6. The official Docker image moved to ghcr.io/psalm/psalm, and the old compact output format is now called table. Plugin authors get the sharpest warning: plugin API changes "may ship in any Psalm release, including minor and patch releases," so plugins should depend on the psalm/psalm-plugin-api metapackage with a caret range.

Release	Date (Nov. 2026)	Line
7.0.1	3	7.x
7.0.5	7	7.x
7.1.0	8	7.x
7.2.0	9	7.x

The project now ships on a near-daily rhythm; Gentili's post promises "daily releases" instead of waiting on dev-master. The 6.x line is running in parallel, with 6.20.10 out on Nov. 7. The 7.0.1 notes add regression tests for 92 issues already fixed in Psalm 7, which suggests the first week was spent on stabilisation rather than features. A CI pipeline that pins ^7.0 picks up each of these automatically, so unattended bumps matter here; The Terminal's report on Dependabot's version-updates-only handling of agent manifests covers how that tool treats such files. Another Copilot-related policy change shows the same pattern of defaults moving under existing users.

The next release to watch is 7.3, and whether plugin authors keep up with an API that the maintainers say can change in a patch.