Put the PHP version the analysis targets into the result cache metadata

The metadata recorded PHP_VERSION_ID, the version PHPStan runs on, and nothing else about versions. The version the analysis targets is a different number: it comes from the phpVersion parameter, which is part of projectConfig, or from config.platform.php in composer.json, which is hashed nowhere. composerLocks and composerInstalled cover composer.lock and installed.php, and neither of those moves when composer.json alone changes - its config and autoload keys are not part of Composer's lock content hash either. Lowering config.platform.php from 8.4 to 7.4 therefore left the cache untouched while a run from a cleared cache reported the functions that do not exist on 7.4, and raising it back kept the errors. The PhpVersion service the rest of PHPStan reads is now injected here and its version and source go into the metadata, together with the version range ComposerPhpVersionFactory derives from composer.json's require section - the same input, reaching the analysis through a different door. e2e/result-cache-composer-json changes only config.platform.php and expects the error a cleared cache reports.
ondrejmirtes · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026
commit b7cb6864296608498131a959fba492b8d03f0dfa
diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
@@ -901,6 +901,18 @@ jobs:
               echo "$OUTPUT"
               ../bashunit -a contains 'Result cache restored. 1 file will be reanalysed.' "$OUTPUT"
               ../bashunit -a contains 'UsesCopied.php:16:Method ResultCacheE2EPathRepository\UsesCopied::doUsesCopied() should return int but returns string.' "$OUTPUT"
+          - script: |
+              cd e2e/result-cache-composer-json
+              composer install
+              ../../bin/phpstan analyse
+              # composer.json decides which PHP version the analysis targets (config.platform.php) and
+              # which symbols the autoloader can reach, but its contents are hashed nowhere in the cache
+              # metadata - composerLocks and composerInstalled cover composer.lock and installed.php, and
+              # neither of those moves when only composer.json changes.
+              patch -p0 < platform.patch
+              OUTPUT=$(../bashunit -a exit_code "1" "../../bin/phpstan analyse -vv --error-format raw")
+              echo "$OUTPUT"
+              ../bashunit -a contains 'Foo.php:10:Function str_contains not found.' "$OUTPUT"
           - script: |
               cd e2e/result-cache-extension-update
               composer install

diff --git a/e2e/result-cache-composer-json/.gitignore b/e2e/result-cache-composer-json/.gitignore
@@ -0,0 +1,2 @@
+/vendor
+/composer.lock
diff --git a/e2e/result-cache-composer-json/composer.json b/e2e/result-cache-composer-json/composer.json
@@ -0,0 +1,11 @@
+{
+	"name": "phpstan/result-cache-composer-json-e2e",
+	"autoload": {
+		"classmap": ["src"]
+	},
+	"config": {
+		"platform": {
+			"php": "8.4.0"
+		}
+	}
+}
diff --git a/e2e/result-cache-composer-json/phpstan.neon b/e2e/result-cache-composer-json/phpstan.neon
@@ -0,0 +1,5 @@
+parameters:
+	level: 0
+	tmpDir: tmp
+	paths:
+		- src
diff --git a/e2e/result-cache-composer-json/platform.patch b/e2e/result-cache-composer-json/platform.patch
@@ -0,0 +1,11 @@
+--- composer.json
++++ composer.json
+@@ -5,7 +5,7 @@
+ 	},
+ 	"config": {
+ 		"platform": {
+-			"php": "8.4.0"
++			"php": "7.4.0"
+ 		}
+ 	}
+ }
diff --git a/e2e/result-cache-composer-json/src/Foo.php b/e2e/result-cache-composer-json/src/Foo.php
@@ -0,0 +1,13 @@
+<?php declare(strict_types = 1);
+
+namespace ResultCacheE2EComposerJson;
+
+class Foo
+{
+
+	public function doFoo(string $s): bool
+	{
+		return str_contains($s, 'a');
+	}
+
+}
diff --git a/e2e/result-cache-composer-json/tmp/.gitignore b/e2e/result-cache-composer-json/tmp/.gitignore
@@ -0,0 +1,2 @@
+*
+!.*
diff --git a/src/Analyser/ResultCache/ResultCacheManager.php b/src/Analyser/ResultCache/ResultCacheManager.php
@@ -24,6 +24,8 @@
 use PHPStan\File\FileHelper;
 use PHPStan\Internal\ArrayHelper;
 use PHPStan\Internal\ComposerHelper;
+use PHPStan\Php\ComposerPhpVersionFactory;
+use PHPStan\Php\PhpVersion;
 use PHPStan\PhpDoc\StubFilesProvider;
 use PHPStan\ShouldNotHappenException;
 use ReflectionClass;
@@ -84,7 +86,7 @@ final class ResultCacheManager
 	 */
 	private const EXTENSIONS_NOT_INVALIDATING_CACHE = ['xdebug', 'blackfire', 'phpstan_turbo'];
 
-	private const CACHE_VERSION = 'v16-nonAnalysedExportedNodes';
+	private const CACHE_VERSION = 'v17-phpVersionForAnalysis';
 
 	private const SCANNED_FILE_APPEARED = 'appeared';
 	private const SCANNED_FILE_EDITED = 'edited';
@@ -159,6 +161,8 @@ public function __construct(
 		private int $skipResultCacheIfOlderThanDays,
 		#[AutowiredParameter(ref: '%rootDir%')]
 		private string $anchorDirectory,
+		private PhpVersion $phpVersion,
+		private ComposerPhpVersionFactory $composerPhpVersionFactory,
 	)
 	{
 	}
@@ -1760,11 +1764,24 @@ private function getMeta(array $allAnalysedFiles, ?array $projectConfigArray): a
 		// __DIR__ . '/../x', --autoload-file may be given as ./vendor/autoload.php. Normalizing them
 		// here makes the comparison one of paths, not of spellings - otherwise such an entry reads
 		// as a metadata change on every run and the whole cache is discarded every time.
+		$composerMinPhpVersion = $this->composerPhpVersionFactory->getMinVersion();
+		$composerMaxPhpVersion = $this->composerPhpVersionFactory->getMaxVersion();
+
 		return $this->getPathTransformer()->normalizeMeta([
 			'cacheVersion' => self::CACHE_VERSION,
 			'phpstanVersion' => ComposerHelper::getPhpStanVersion(),
 			'metaExtensions' => $this->getMetaFromPhpStanExtensions(),
 			'phpVersion' => PHP_VERSION_ID,
+			// The version the analysis targets, which is not the one PHPStan runs on: it can come from
+			// the phpVersion parameter, or from config.platform.php in composer.json. The parameter is
+			// part of projectConfig, but composer.json is hashed nowhere - and the two version ranges
+			// below come from its require section, which is not in composer.lock's content hash either,
+			// so a composer update need not move anything else in this metadata.
+			'phpVersionForAnalysis' => [$this->phpVersion->getVersionId(), $this->phpVersion->getSource()],
+			'composerPhpVersionRange' => [
+				$composerMinPhpVersion !== null ? $composerMinPhpVersion->getVersionId() : null,
+				$composerMaxPhpVersion !== null ? $composerMaxPhpVersion->getVersionId() : null,
+			],
 			'projectConfig' => $projectConfigArray,
 			'analysedPaths' => $this->analysedPaths,
 			'scannedFiles' => $this->getScannedFiles($allAnalysedFiles),