[DerManoMann]

Level 7, as the sibling projects have it. Every finding is fixed in the code, so phpstan-baseline.neon goes, and the config is phpstan.neon.dist.

Most of it is native types, in the tests and the older parts of the loader. The rest:

• file_get_contents() and ReflectionClass::getFileName() can return false, which went straight into json_decode() and dirname(). Both are checked now.
• The loader's $specification is a \stdClass, and any other object passed in is turned into plain data. YAML is recognised by its extension, rather than by .yaml appearing anywhere in the path.
• Two Laravel docblocks promise more than is true at runtime: Request::route() always returning a route, and the test case's $app always being set. The middleware calls the route resolver that route() uses, so a request that matched no route is still handled, and the Laravel test lets setUp() own $this->app instead of caching its own.
• The framework checks in the adapter tests, and LaravelTestCase with them, are gone. Both frameworks are always installed since Raise the floor to PHP 8.2, and test both adapters in one matrix #77.
• The discovery trait reads with early returns now, which also removes an always-false ternary.

The oldest phpstan allowed, 2.1, found two more in OpenApi30Translator that 2.3 does not, from reading properties of an object. Its nodes come from json_decode(), so they are typed as stdClass now. Checked locally with highest and lowest dependencies.