chore(deps-dev): bump phpmd/phpmd from 2.15.0 to 3.0.0

[dependabot]

Bumps phpmd/phpmd from 2.15.0 to 3.0.0.

Release notes

Sourced from phpmd/phpmd's releases.

PHPMD 3.0.0

New major release of PHPMD. See UPGRADING.md for a detailed migration guide from PHPMD 2 to PHPMD 3.

Key New Features

• Interactive Configuration Wizard: Run phpmd init to generate a custom configuration file through an interactive setup tool.
• Configuration Migration Tool: Run phpmd migrate to upgrade legacy PHPMD 2 XML configurations directly into YAML.
• Zero-Config CLI Execution: Running phpmd without arguments now automatically detects configuration and target paths.
• Centralized Settings: Most analysis options (such as paths, format, cache, threads, and baseline) can now be defined directly inside configuration files instead of requiring CLI arguments.
• PHP 8 Attributes Support: Use #[SuppressWarnings] as the preferred way to suppress warnings, backed by a new UnusedSuppression rule to identify stale suppressions.
• Parallel Processing: Speed up analysis on large codebases using the new --threads option for multi-threaded parsing.
• Visual Feedback: Added a progress bar during CLI analysis (with controls via --no-progress and --progress).
• New Analysis Rules: IfStatementWithoutLogic and LongMethodName For flagging dead code and long method names.
• Enhanced Rule Flexibility: Added exceptions parameter support to ignore specific methods across UnusedFormalParameter, UnusedPrivateField, and ExcessiveParameterList, along with enum method handling in StaticAccess.
• GitHub Check Runs Renderer: Added native output renderer support for GitHub Check Runs integration.

Breaking changes:

• Changed minimum PHP version from 5.3.9 to 8.1.
• Changed CLI from positional arguments to Symfony Console with named options. The command signature is now phpmd analyze [options] [--] [<paths>...].
• Standardized rule threshold properties to maximum (#670). Rules now report only when the measured value exceeds (>) the configured maximum. Rules that check a lower bound (ShortVariable, ShortMethodName, ShortClassName) keep the minimum property. Renamed properties (the old names remain accepted as aliases):
  • CyclomaticComplexity: reportLevel -> maximum
  • NPathComplexity: minimum -> maximum
  • ExcessiveMethodLength: minimum -> maximum
  • ExcessiveClassLength: minimum -> maximum
  • ExcessiveParameterList: minimum -> maximum
  • ExcessivePublicCount: minimum -> maximum
  • TooManyFields: maxfields -> maximum
  • TooManyMethods: maxmethods -> maximum
  • TooManyPublicMethods: maxmethods -> maximum
  • NumberOfChildren: minimum -> maximum
  • DepthOfInheritance: minimum -> maximum
  • Rules that previously reported when the value equaled the threshold (CyclomaticComplexity, NPathComplexity, ExcessiveMethodLength, ExcessiveClassLength, ExcessiveParameterList, ExcessivePublicCount, NumberOfChildren, DepthOfInheritance, ExcessiveClassComplexity, CouplingBetweenObjects) now only report when the value is greater than the threshold, so the configured maximum is the highest accepted value.
• Removed --ignore option, use --exclude instead.
• Removed --extensions option, use --suffixes instead.
• Removed --reportfile option, use --reportfile-text, --reportfile-xml, etc.
• Removed --minimumpriority and --maximumpriority aliases, use --minimum-priority and --maximum-priority.
• Removed PHPMD\PHPMD::getIgnorePatterns() and setIgnorePatterns(), use getExcludePatterns() and addExcludePatterns().
• Removed deprecated PHP_PMD_* class aliases.
• Require pdepend/pdepend 3.x.
• Changed exit code for processing errors from 1 to 3.
• Introduced PHPMD-specific exception hierarchy under PHPMD\Exception\.
• Removed PHPMD\RuleSetFactory::getIgnorePattern(), use getExcludePatterns() instead.
• Renamed Rule::getBooleanProperty() to isTruthyProperty().
• Renamed RuleSetFactory::getCache() to isCacheEnabled().
• Changed --update-baseline to report violations that are not in the baseline (#1344). They are rendered with the configured format, make the command exit with code 2 and are not added to the baseline file. PHPMD\Baseline\BaselineValidator no longer takes a BaselineMode.
• Renamed the rule classes PHPMD\Rule\Design\LongClass to ExcessiveClassLength, LongMethod to ExcessiveMethodLength, LongParameterList to ExcessiveParameterList, NpathComplexity to NPathComplexity and WeightedMethodCount to ExcessiveClassComplexity. The rule names are unchanged.
• Changed suppressions to be applied by filtering the violations after the rules have run, instead of skipping suppressed code. RuleSet::apply() no longer skips suppressed nodes, and AbstractRule::setStrict() has been removed. Custom rules no longer need to check for suppressions.
• Marked the parallel rule runner, the PDepend integration, the suppression handling and the Baseline, Cache, Config, RuleProperty, TextUI and Utility namespaces @internal. They are not covered by the 3.x compatibility promise.

... (truncated)

Changelog

Sourced from phpmd/phpmd's changelog.

phpmd-3.0.0 (2026/10/04)

See UPGRADING.md for a detailed migration guide from PHPMD 2 to PHPMD 3.

Breaking changes:

• Changed minimum PHP version from 5.3.9 to 8.1.

• Changed CLI from positional arguments to Symfony Console with named options. The command signature is now phpmd analyze [options] [--] [<paths>...].

• Standardized rule threshold properties to maximum (#670). Rules now report only when the measured value exceeds (>) the configured maximum. Rules that check a lower bound (ShortVariable, ShortMethodName, ShortClassName) keep the minimum property. Renamed properties (the old names remain accepted as aliases):

  • CyclomaticComplexity: reportLevel -> maximum
  • NPathComplexity: minimum -> maximum
  • ExcessiveMethodLength: minimum -> maximum
  • ExcessiveClassLength: minimum -> maximum
  • ExcessiveParameterList: minimum -> maximum
  • ExcessivePublicCount: minimum -> maximum
  • TooManyFields: maxfields -> maximum
  • TooManyMethods: maxmethods -> maximum
  • TooManyPublicMethods: maxmethods -> maximum
  • NumberOfChildren: minimum -> maximum
  • DepthOfInheritance: minimum -> maximum

  Rules that previously reported when the value equaled the threshold (CyclomaticComplexity, NPathComplexity, ExcessiveMethodLength, ExcessiveClassLength, ExcessiveParameterList, ExcessivePublicCount, NumberOfChildren, DepthOfInheritance, ExcessiveClassComplexity, CouplingBetweenObjects) now only report when the value is greater than the threshold, so the configured maximum is the highest accepted value.

• Removed --ignore option, use --exclude instead.

• Removed --extensions option, use --suffixes instead.

• Removed --reportfile option, use --reportfile-text, --reportfile-xml, etc.

• Removed --minimumpriority and --maximumpriority aliases, use --minimum-priority and --maximum-priority.

• Removed PHPMD\PHPMD::getIgnorePatterns() and setIgnorePatterns(), use getExcludePatterns() and addExcludePatterns().

• Removed deprecated PHP_PMD_* class aliases.

• Require pdepend/pdepend 3.x.

• Changed exit code for processing errors from 1 to 3.

• Introduced PHPMD-specific exception hierarchy under PHPMD\Exception\.

• Removed PHPMD\RuleSetFactory::getIgnorePattern(), use getExcludePatterns() instead.

• Renamed Rule::getBooleanProperty() to isTruthyProperty().

• Renamed RuleSetFactory::getCache() to isCacheEnabled().

• Changed --update-baseline to report violations that are not in the baseline (#1344). They are rendered with the configured format, make the command exit with code 2 and are not added to the baseline file. PHPMD\Baseline\BaselineValidator no longer takes a BaselineMode.

• Renamed the rule classes PHPMD\Rule\Design\LongClass to ExcessiveClassLength, LongMethod to ExcessiveMethodLength, LongParameterList to ExcessiveParameterList, NpathComplexity to

... (truncated)

Commits

• b0f328d Fix #991 UndefinedVariable false positives for static properties from traits ...
• 68ffb31 Merge pull request #1356 from phpmd/3.x-pdepend
• 168a37f Update to latest Pdepend
• 54ee353 Fix UndefinedVariable false positives for $this in anonymous classes
• 3b04dbb Merge pull request #1353 from phpmd/3.x-internal
• 19554f5 Mark internal APIs
• 7e875c9 Add UnusedSuppression rule
• 4879072 Add config managment commands
• a9e2504 Run the rules in parallel
• c8187fe Adjust to new Pdepend IPC format
• Additional commits viewable in compare view

[github-actions]

Quality Report — ConductionNL/integriq @ 44da76e

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	❌
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
build		✅
check-specs		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 146/146
npm			✅	✅ 647/647
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 5474/5474 · 1 skipped
Newman					✅ 130/130
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅
Hydra gates (axe)					✅

---

Quality workflow — 2026-10-14 17:36 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/integriq @ d7424ce

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	❌
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
build		✅
check-specs		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 146/146
npm			✅	✅ 647/647
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 5490/5490 · 1 skipped
Newman					✅ 130/130
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅
Hydra gates (axe)					✅

---

Quality workflow — 2026-10-15 18:37 UTC

Download the full PDF report from the workflow artifacts.