Range min() / max() over unsealed extras of a constant array

`processArrayType` fed only the explicit `getValueTypes()` into the
min/max comparison, so `min(array{1, 2, ...<int, int>})` inferred `1`
and `max(...)` inferred `2` — unsound, since the unsealed extras can
be any int above or below the explicit entries.

Append the unsealed value type to the comparison arguments when the
constant array `isUnsealed()->yes()`, so the result widens to cover
the extras (`int` here). Sealed constant arrays keep their exact
min/max.

`vsprintf` was on the same verify list but is already sound: it reads
only the positions the format references (extras beyond them are
ignored) and bails to a general string when a referenced position
falls outside the explicit keys.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ondrejmirtes

src/Type/Php/MinMaxFunctionReturnTypeExtension.php

@@ -128,6 +128,14 @@ private function processArrayType(string $functionName, Type $argType): Type
 					$argumentTypes[] = $innerType;
 				}
 
+				$unsealedTypes = $constArrayType->getUnsealedTypes();
+				if ($unsealedTypes !== null && $constArrayType->isUnsealed()->yes()) {
+					// Unsealed extras can hold further values, so the min/max
+					// must also range over the unsealed value type — otherwise
+					// the explicit entries would be reported as the answer.
+					$argumentTypes[] = $unsealedTypes[1];
+				}
+
 				$resultTypes[] = $this->processType($functionName, $argumentTypes);
 			}
 

tests/PHPStan/Analyser/nsrt/minmax.php

@@ -18,6 +18,18 @@ function dummy5(int $i, int $j): void
 	assertType('array{1: true}', array_filter([false, true]));
 }
 
+/**
+ * @param array{1, 2, ...<int, int>} $unsealed
+ */
+function unsealedMinMax(array $unsealed): void
+{
+	// The unsealed `<int, int>` extras can be any int, so min/max of
+	// `{1, 2} ∪ extras` is unbounded — the explicit `1`/`2` must not be
+	// reported as the result.
+	assertType('int', min($unsealed));
+	assertType('int', max($unsealed));
+}
+
 function dummy6(string $s, string $t): void {
 	assertType('array{0?: non-falsy-string, 1?: non-falsy-string}', array_filter([$s, $t]));
 }