build(deps-dev): bump carthage-software/mago from 1.45.0 to 1.46.0 in /tools/mago

[dependabot]

Bumps carthage-software/mago from 1.45.0 to 1.46.0.

Release notes

Sourced from carthage-software/mago's releases.

Mago 1.46.0

This release fixes a workflow-command injection in the GitHub reporting format (GHSA-f256-xqf4-x8pr), adds a redundant-static linter rule and a --stats shorthand, corrects a batch of generic-narrowing and late-static-binding false positives across the analyzer and codex, and speeds up the PHP parser.

🔒 Security

Reporting

• Workflow-command injection: escapes untrusted values written to workflow commands and log records. (GHSA-f256-xqf4-x8pr, cc8d5e4)

Reported by Liyi Zhou, Ziyue, Strick, Maurice, and Chenchen of the University of Sydney.

✨ Features

Linter

• redundant-static: reports static in a final class where self is equivalent. (#2154, ef06262)

CLI

• --stats: adds a shorthand for count output. (#2130, db4a2cb)

Prelude

• json_validate: asserts non-empty-string when the call succeeds. (#2155, 198f2b4)

🐛 Bug Fixes

Analyzer

• Array entry narrowing: narrows possibly-absent entries on the parent shape, independent of conjunct order. (#2132, 2af1cbc, 784b93b)
• Attribute arguments: validates the types of attribute constructor arguments. (#2161, ebf2f8d)
• Switch labels: detects duplicate and unreachable case labels. (#2162, 4119141)
• Mutation-free calls: narrows repeated calls to mutation-free methods. (#2138, b6e97ee)
• Identical arrays: folds comparisons between identical arrays. (#2149, c2c7bb4)
• Late-static returns: preserves late-static types in generic return positions. (#2151, fe272b8)
• void conditionals: stops demanding a return from conditionals in void functions. (#2160, bd85d70)
• self in attributes: resolves self in attributes applied to class-likes. (#2168, 7f88255)
• Specialized generics: accepts class-strings of specialized generic classes. (#2171, b0b0b91)
• Narrowing leaks: prevents method-call narrowing from leaking across scopes. (42cfd1f)

Codex

• Bounded templates: allows instanceof narrowing of generics parameterised by a bounded template. (#2135, a45ffec, 8b2edf6)
• Template defaults: populates default template arguments when the generic argument is omitted. (#2140, aff9ce8)
• Static return types: preserves generic parameters in static return types. (#2145, 327ca0a)
• void with never: keeps void when combined with never. (#2159, 864d0f7)
• Late-static rebinding: guards exact late-static type rebinding. (fcd42ec)

Linter

... (truncated)

Commits

• 256da8a release: 1.46.0
• cc8d5e4 fix(reporting): escape untrusted formatter values
• 654b3f4 docs(reporting): clarify that --sort is a no-op for some formats (#2174)
• b0b0b91 fix(analyzer): accept class-strings of specialized generic classes (#2171)
• 209f980 fix(composer): unbreak self-analysis of the availability markers (#2169)
• 7f88255 fix(analyzer): resolve self in attributes on class-likes (#2168)
• 1ec8868 perf(syntax): streamline PHP parser hot paths
• 3610502 fix(syntax): limit recursive string interpolation
• 9bef302 fix(prelude): add Attribute TARGET_CONSTANT
• 42cfd1f fix(analyzer): prevent method-call narrowing leaks
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like carthage-software/mago is up-to-date now, so this is no longer needed.