PHPStan

## What a rule level is **PHPStan** is a static analyser for PHP: it reads your code without running it and reports errors such as calling an undefined method or passing a string where an `int` is declared. A **rule level** is how you choose how strict it is. In PHPStan 2 there are **11 levels, 0 to 10**, selected with `--level` (`-l`) on the command line or `level:` in `phpstan.neon`. Levels are **cumulative**. Internally each level's config file includes the one below it (`config.level6.neon` includes `config.level5.neon`, and so on), so running level 6 gives you every check from levels 0 to 5 plus the new ones. ## What each level adds | Level | Adds | |---|---| | 0 | unknown classes and functions, unknown methods called on `$this`, wrong number of arguments, always-undefined variables | | 1 | possibly undefined variables, unknown magic methods and properties on classes with `__call` and `__get` | | 2 | unknown methods on all expressions, not just `$this`; PHPDoc validation | | 3 | return types, types assigned to properties | | 4 | basic dead code: always-false `instanceof` and type checks, dead `else` branches, unreachable code after `return` | | 5 | types of arguments passed to functions and methods | | 6 | missing typehints | | 7 | partially wrong union types, such as calling a method that exists on only some types in a union | | 8 | calling methods and accessing properties on nullable types | | 9 | strict about explicit `mixed`: you may only pass it to another `mixed` | | 10 | also strict about implicit `mixed`, meaning values with no type at all (new in PHPStan 2.0) | ## The levels interviewers ask about most - **Level 5** is where argument type errors appear. Below it, `strlen(42)`-style mismatches go unreported, which surprises people who assume PHPStan checks types from the start. - **Level 6** is the jump that hurts on legacy code: every parameter, return and property without a type becomes an error, so the count often goes up by thousands. - **Level 8** reports calling a method on something that might be `null`, such as the result of a repository `find()` that returns `?User`. This is where many real production bugs are caught. - **Level 9 versus 10**: level 9 (internally `checkExplicitMixed`) only restricts values declared as `mixed`. Level 10 (`checkImplicitMixed`) extends that to values whose type is simply unknown, for example the return of a third-party function with no return type, or a parameter left untyped and hidden from level 6 by a baseline. ## Defaults and the max alias 1. With no config file and no `--level`, PHPStan runs **level 0**. 2. With a config file, the level must come from `--level` or the `level` parameter. If neither is set, PHPStan stops with *No rules detected* and explains the choices. 3. A `--level` on the command line wins over `level:` in the config. 4. `--level max` (or `level: max`) always selects the highest level the installed PHPStan has. In 2.x that is 10. The docs warn about the last one: pinning `max` means a PHPStan upgrade that adds a level, as 2.0 did with level 10, can turn a green build red. ## How the levels are meant to be used - The levels exist for **incremental adoption**. You start where the error count is manageable, reach zero, merge, and raise the level one step at a time. - A level is a floor for the whole analysed code, not a score. Two codebases at level 6 have the same checks enabled, not the same quality. - For strictness beyond level 10, PHPStan points to the separate `phpstan-strict-rules` extension, Bleeding Edge, and extra config options such as `checkUninitializedProperties`. In an interview, knowing where argument types (5), missing types (6), nullability (8) and `mixed` (9 and 10) come in is usually what separates someone who has used the levels from someone who has only heard of them.