diff --git a/.ddev/commands/web/magerun b/.ddev/commands/web/magerun
old mode 100644
new mode 100755
index 5ddff79db21a..a03899bf01fc
--- a/.ddev/commands/web/magerun
+++ b/.ddev/commands/web/magerun
@@ -5,7 +5,7 @@
 ## Example: "ddev magerun"
 
 if [ ! -f vendor/bin/n98-magerun ]; then
-  read -r -p "n98-magerun is not installed. Do you want to install it? [y/N] " INSTALL_MAGE
+  read -r -p "n98-magerun is not installed. Do you want to install it? [y/N] " INSTALL_MAGERUN
   INSTALL_MAGERUN=${INSTALL_MAGERUN,,} # to lower
   if [[ "${INSTALL_MAGERUN}" =~ ^(yes|y) ]]; then
     composer require --dev n98/magerun:dev-develop
diff --git a/.ddev/commands/web/openmage-admin b/.ddev/commands/web/openmage-admin
old mode 100644
new mode 100755
diff --git a/.github/labeler.yml b/.github/labeler.yml
index 61d73ee8dbac..a1b1d9fad162 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -887,6 +887,7 @@
 'phpstan':
   - changed-files:
     - any-glob-to-any-file: [
+      .phpstan*,
       phpstan*,
       .github/workflows/phpstan.yml
     ]
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 473bd972f402..aa4625cc418e 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -13,15 +13,8 @@ name: "CodeQL"
 
 on:
   workflow_call:
+  # Allow manually triggering the workflow.
   workflow_dispatch:
-  push:
-    branches: [ "main", "next", "v19" ]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ "main", "next", "v19" ]
-    paths-ignore:
-      - '**/*.md'
-      - '**/*.txt'
 
 jobs:
   analyze:
diff --git a/.gitignore b/.gitignore
index b4818b734030..e5aaad872a9e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -70,8 +70,11 @@
 .phpcs*.xml
 !.phpcs*.xml.dist
 
+# PhpStan
+.phpstan*.neon
 phpstan*.neon
-!phpstan.dist.*.neon
+!.phpstan.dist.neon
+!.phpstan.dist.*.neon
 
 # dev scripts loaded via composer
 /shell/update-copyright.php
diff --git a/.php-cs-fixer.dist.php b/.php-cs-fixer.dist.php
index 8c1bf39a95b4..562995289288 100644
--- a/.php-cs-fixer.dist.php
+++ b/.php-cs-fixer.dist.php
@@ -20,6 +20,8 @@
         'class_definition' => true,
         // Remove extra spaces in a nullable typehint.
         'compact_nullable_typehint' => true,
+        // Concatenation should be spaced according to configuration.
+        'concat_space' => ['spacing' => 'one'],
         // The PHP constants `true`, `false`, and `null` MUST be written using the correct casing.
         'constant_case' => true,
         // Equal sign in declare statement should be surrounded by spaces or not following configuration.
diff --git a/phpstan.dist.baseline.neon b/.phpstan.dist.baseline.neon
similarity index 99%
rename from phpstan.dist.baseline.neon
rename to .phpstan.dist.baseline.neon
index b417687de7de..d70de2060532 100644
--- a/phpstan.dist.baseline.neon
+++ b/.phpstan.dist.baseline.neon
@@ -3965,6 +3965,11 @@ parameters:
 			count: 1
 			path: app/code/core/Mage/Sales/Model/Entity/Quote/Address/Attribute/Frontend/Tax.php
 
+		-
+			message: "#^Negated boolean expression is always true\\.$#"
+			count: 1
+			path: app/code/core/Mage/Sales/Model/Order.php
+
 		-
 			message: "#^Variable \\$oldArea might not be defined\\.$#"
 			count: 1
diff --git a/phpstan.dist.neon b/.phpstan.dist.neon
similarity index 98%
rename from phpstan.dist.neon
rename to .phpstan.dist.neon
index c95f0f645946..a3a1dc335cb1 100644
--- a/phpstan.dist.neon
+++ b/.phpstan.dist.neon
@@ -1,6 +1,6 @@
 includes:
     - vendor/macopedia/phpstan-magento1/extension.neon
-    - phpstan.dist.baseline.neon
+    - .phpstan.dist.baseline.neon
     - phar://phpstan.phar/conf/bleedingEdge.neon
 parameters:
     magentoRootPath: %currentWorkingDirectory%
diff --git a/app/Mage.php b/app/Mage.php
index e52278f171b0..29a0ce52bcb5 100644
--- a/app/Mage.php
+++ b/app/Mage.php
@@ -433,7 +433,7 @@ public static function getStoreConfigAsInt(string $path, $store = null): int
      * Retrieve config flag for store by path
      *
      * @param string $path
-     * @param mixed $store
+     * @param null|string|bool|int|Mage_Core_Model_Store $store
      * @return bool
      */
     public static function getStoreConfigFlag($path, $store = null)
diff --git a/app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Settings.php b/app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Settings.php
index 9255504e2f35..218ef0eb592b 100644
--- a/app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Settings.php
+++ b/app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Settings.php
@@ -76,7 +76,7 @@ protected function _prepareForm()
 
         $fieldset->addField('req_text', 'note', [
             'text' => '<ul class="messages"><li class="notice-msg"><ul><li>'
-                .  $this->__('Only attributes with scope "Global", input type "Dropdown" and Use To Create Configurable Product "Yes" are available.')
+                . $this->__('Only attributes with scope "Global", input type "Dropdown" and Use To Create Configurable Product "Yes" are available.')
                 . '</li></ul></li></ul>'
         ]);
 
diff --git a/app/code/core/Mage/Adminhtml/Block/Customer/Edit/Tab/Account.php b/app/code/core/Mage/Adminhtml/Block/Customer/Edit/Tab/Account.php
index b7296fb11621..b0846a73b7c7 100644
--- a/app/code/core/Mage/Adminhtml/Block/Customer/Edit/Tab/Account.php
+++ b/app/code/core/Mage/Adminhtml/Block/Customer/Edit/Tab/Account.php
@@ -78,7 +78,7 @@ public function initForm()
             $form->getElement('website_id')->setAfterElementHtml(
                 '<script type="text/javascript">'
                 . "
-                var {$prefix}_websites = " . Mage::helper('core')->jsonEncode($websites) .";
+                var {$prefix}_websites = " . Mage::helper('core')->jsonEncode($websites) . ";
                 Validation.add(
                     'validate-website-has-store',
                     '" . Mage::helper('core')->jsQuoteEscape(
diff --git a/app/code/core/Mage/Adminhtml/Block/Customer/Edit/Tab/Addresses.php b/app/code/core/Mage/Adminhtml/Block/Customer/Edit/Tab/Addresses.php
index 29f6126d9a65..49e8af595801 100644
--- a/app/code/core/Mage/Adminhtml/Block/Customer/Edit/Tab/Addresses.php
+++ b/app/code/core/Mage/Adminhtml/Block/Customer/Edit/Tab/Addresses.php
@@ -63,7 +63,7 @@ protected function _prepareLayout()
                     'name'   => 'add_address_button',
                     'element_name' => 'add_address_button',
                     'disabled' => $this->isReadonly(),
-                    'class'  => 'add'  . ($this->isReadonly() ? ' disabled' : ''),
+                    'class'  => 'add' . ($this->isReadonly() ? ' disabled' : ''),
                     'onclick' => 'customerAddresses.addNewAddress()'
                 ])
         );
@@ -75,7 +75,7 @@ protected function _prepareLayout()
                     'id'     => 'cancel_add_address' . $this->getTemplatePrefix(),
                     'name'   => 'cancel_address',
                     'element_name' => 'cancel_address',
-                    'class'  => 'cancel delete-address'  . ($this->isReadonly() ? ' disabled' : ''),
+                    'class'  => 'cancel delete-address' . ($this->isReadonly() ? ' disabled' : ''),
                     'disabled' => $this->isReadonly(),
                     'onclick' => 'customerAddresses.cancelAdd(this)',
                 ])
diff --git a/app/code/core/Mage/Adminhtml/Block/Sales/Order/Comments/View.php b/app/code/core/Mage/Adminhtml/Block/Sales/Order/Comments/View.php
index 425363091250..6e43ea89528a 100644
--- a/app/code/core/Mage/Adminhtml/Block/Sales/Order/Comments/View.php
+++ b/app/code/core/Mage/Adminhtml/Block/Sales/Order/Comments/View.php
@@ -77,9 +77,9 @@ public function canSendCommentEmail()
     /**
      * Replace links in string
      *
-     * @param array|string $data
-     * @param null|array $allowedTags
-     * @return string
+     * @param string|string[] $data
+     * @param array|null $allowedTags
+     * @return null|string|string[]
      */
     public function escapeHtml($data, $allowedTags = null)
     {
diff --git a/app/code/core/Mage/Adminhtml/Block/Sales/Order/View/History.php b/app/code/core/Mage/Adminhtml/Block/Sales/Order/View/History.php
index 372a968706e0..cadd04f47d82 100644
--- a/app/code/core/Mage/Adminhtml/Block/Sales/Order/View/History.php
+++ b/app/code/core/Mage/Adminhtml/Block/Sales/Order/View/History.php
@@ -80,9 +80,9 @@ public function isCustomerNotificationNotApplicable(Mage_Sales_Model_Order_Statu
     /**
      * Replace links in string
      *
-     * @param array|string $data
-     * @param null|array $allowedTags
-     * @return string
+     * @param string|string[] $data
+     * @param array|null $allowedTags
+     * @return null|string|string[]
      */
     public function escapeHtml($data, $allowedTags = null)
     {
diff --git a/app/code/core/Mage/Adminhtml/Helper/Sales.php b/app/code/core/Mage/Adminhtml/Helper/Sales.php
index 87a2ea7da46e..8e6f84457df3 100644
--- a/app/code/core/Mage/Adminhtml/Helper/Sales.php
+++ b/app/code/core/Mage/Adminhtml/Helper/Sales.php
@@ -109,9 +109,9 @@ public function applySalableProductTypesFilter($collection)
     /**
      * Escape string preserving links
      *
-     * @param array|string $data
-     * @param null|array $allowedTags
-     * @return string
+     * @param string|string[] $data
+     * @param array|null $allowedTags
+     * @return null|string|string[]
      */
     public function escapeHtmlWithLinks($data, $allowedTags = null)
     {
diff --git a/app/code/core/Mage/Catalog/Model/Product/Image.php b/app/code/core/Mage/Catalog/Model/Product/Image.php
index 112d1827231c..e4ae6c3e3810 100644
--- a/app/code/core/Mage/Catalog/Model/Product/Image.php
+++ b/app/code/core/Mage/Catalog/Model/Product/Image.php
@@ -389,9 +389,9 @@ public function setBaseFile($file)
         // add misc params as a hash
         $miscParams = [
                 ($this->_keepAspectRatio ? '' : 'non') . 'proportional',
-                ($this->_keepFrame ? '' : 'no')  . 'frame',
-                ($this->_keepTransparency ? '' : 'no')  . 'transparency',
-                ($this->_constrainOnly ? 'do' : 'not')  . 'constrainonly',
+                ($this->_keepFrame ? '' : 'no') . 'frame',
+                ($this->_keepTransparency ? '' : 'no') . 'transparency',
+                ($this->_constrainOnly ? 'do' : 'not') . 'constrainonly',
                 $this->_backgroundColorStr,
                 'angle' . $this->_angle,
                 'quality' . $this->_quality
diff --git a/app/code/core/Mage/Core/Block/Abstract.php b/app/code/core/Mage/Core/Block/Abstract.php
index a164fea34fc8..39f49084c8ea 100644
--- a/app/code/core/Mage/Core/Block/Abstract.php
+++ b/app/code/core/Mage/Core/Block/Abstract.php
@@ -165,6 +165,7 @@ abstract class Mage_Core_Block_Abstract extends Varien_Object
     /**
      * @var Varien_Object
      */
+    // phpcs:ignore Ecg.PHP.PrivateClassMember.PrivateClassMemberError
     private static $_transportObject;
 
     /**
@@ -524,6 +525,7 @@ public function unsetCallChild($alias, $callback, $result, $params)
             }
 
             Mage::helper('core/security')->validateAgainstBlockMethodBlacklist($child, $callback, $params);
+            // phpcs:ignore Ecg.Security.ForbiddenFunction.Found
             if ($result == call_user_func_array([&$child, $callback], $params)) {
                 $this->unsetChild($alias);
             }
@@ -863,7 +865,7 @@ public function getChildGroup($groupName, $callback = null, $skipEmptyResults =
      *
      * @param string $alias
      * @param string $key
-     * @return mixed
+     * @return mixed|void
      */
     public function getChildData($alias, $key = '')
     {
@@ -1167,6 +1169,7 @@ public function getModuleName()
     public function __()
     {
         $args = func_get_args();
+        // phpcs:ignore Ecg.Classes.ObjectInstantiation.DirectInstantiation
         $expr = new Mage_Core_Model_Translate_Expr(array_shift($args), $this->getModuleName());
         array_unshift($args, $expr);
         return $this->_getApp()->getTranslator()->translate($args);
@@ -1187,15 +1190,49 @@ public function htmlEscape($data, $allowedTags = null)
     /**
      * Escape html entities
      *
-     * @param   string|array $data
-     * @param   array $allowedTags
-     * @return  string
+     * @param string|string[] $data
+     * @param array|null $allowedTags
+     * @return null|string|string[]
      */
     public function escapeHtml($data, $allowedTags = null)
     {
         return $this->helper('core')->escapeHtml($data, $allowedTags);
     }
 
+    /**
+     * Wrapper for escapeHtml() function with keeping original value
+     *
+     * @param string $data
+     * @param string[]|null $allowedTags
+     * @return Mage_Core_Model_Security_HtmlEscapedString
+     *
+     * @see Mage_Core_Model_Security_HtmlEscapedString::getUnescapedValue()
+     */
+    public function escapeHtmlAsObject(string $data, ?array $allowedTags = null): Mage_Core_Model_Security_HtmlEscapedString
+    {
+        // phpcs:ignore Ecg.Classes.ObjectInstantiation.DirectInstantiation
+        return new Mage_Core_Model_Security_HtmlEscapedString($data, $allowedTags);
+    }
+
+    /**
+     * Wrapper for escapeHtml() function with keeping original value
+     *
+     * @param string[] $data
+     * @param string[]|null $allowedTags
+     * @return Mage_Core_Model_Security_HtmlEscapedString[]
+     *
+     *  @see Mage_Core_Model_Security_HtmlEscapedString::getUnescapedValue()
+     */
+    public function escapeHtmlArrayAsObject(array $data, ?array $allowedTags = null): array
+    {
+        $result = [];
+        foreach ($data as $key => $string) {
+            $result[$key] = $this->escapeHtmlAsObject($string, $allowedTags);
+        }
+
+        return $result;
+    }
+
     /**
      * Wrapper for standard strip_tags() function with extra functionality for html entities
      *
diff --git a/app/code/core/Mage/Core/Helper/Abstract.php b/app/code/core/Mage/Core/Helper/Abstract.php
index fc0580855c7f..81a2d5832bdf 100644
--- a/app/code/core/Mage/Core/Helper/Abstract.php
+++ b/app/code/core/Mage/Core/Helper/Abstract.php
@@ -178,9 +178,10 @@ public function __()
     }
 
     /**
-     * @param array $data
-     * @param array $allowedTags
-     * @return mixed
+     * @param string|string[] $data
+     * @param array|null $allowedTags
+     * @return null|string|string[]
+     *
      * @see self::escapeHtml()
      * @deprecated after 1.4.0.0-rc1
      */
@@ -192,9 +193,9 @@ public function htmlEscape($data, $allowedTags = null)
     /**
      * Escape html entities
      *
-     * @param   string|array $data
-     * @param   array $allowedTags
-     * @return  mixed
+     * @param string|string[] $data
+     * @param array|null $allowedTags
+     * @return null|string|string[]
      */
     public function escapeHtml($data, $allowedTags = null)
     {
@@ -244,7 +245,7 @@ function ($matches) {
      * Wrapper for standard strip_tags() function with extra functionality for html entities
      *
      * @param string $data
-     * @param string $allowableTags
+     * @param null|string|string[] $allowableTags
      * @param bool $escape
      * @return string
      */
@@ -320,9 +321,9 @@ public function escapeScriptIdentifiers($data)
     /**
      * Escape quotes in java script
      *
-     * @param mixed $data
+     * @param string|string[] $data
      * @param string $quote
-     * @return mixed
+     * @return string|string[]
      */
     public function jsQuoteEscape($data, $quote = '\'')
     {
diff --git a/app/code/core/Mage/Core/Model/Layout.php b/app/code/core/Mage/Core/Model/Layout.php
index 33243ff947f5..0c645edf50c6 100644
--- a/app/code/core/Mage/Core/Model/Layout.php
+++ b/app/code/core/Mage/Core/Model/Layout.php
@@ -419,7 +419,7 @@ protected function _translateLayoutNode($node, &$args)
      * Save block in blocks registry
      *
      * @param string $name
-     * @param Mage_Core_Model_Layout $block
+     * @param Mage_Core_Block_Abstract $block
      * @return $this
      */
     public function setBlock($name, $block)
diff --git a/app/code/core/Mage/Core/Model/Security/HtmlEscapedString.php b/app/code/core/Mage/Core/Model/Security/HtmlEscapedString.php
index dd3c3f476328..afda0b6e9a09 100644
--- a/app/code/core/Mage/Core/Model/Security/HtmlEscapedString.php
+++ b/app/code/core/Mage/Core/Model/Security/HtmlEscapedString.php
@@ -3,12 +3,35 @@
 declare(strict_types=1);
 
 /**
+ * OpenMage
  *
+ * This source file is subject to the Open Software License (OSL 3.0)
+ * that is bundled with this package in the file LICENSE.txt.
+ * It is also available at https://opensource.org/license/osl-3-0-php
+ *
+ * @category   Mage
+ * @package    Mage_Core
+ * @copyright  Copyright (c) 2024 The OpenMage Contributors (https://www.openmage.org)
+ * @license    https://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
+ */
+
+/**
+ * Wrapper to escape a string value with a method to get the original string value
+ *
+ * @category   Mage
+ * @package    Mage_Core
  */
 class Mage_Core_Model_Security_HtmlEscapedString implements Stringable
 {
-    protected $originalValue;
-    protected $allowedTags;
+    /**
+     * @var string
+     */
+    protected string $originalValue;
+
+    /**
+     * @var string[]|null
+     */
+    protected ?array $allowedTags;
 
     /**
      * @param string $originalValue
@@ -20,6 +43,11 @@ public function __construct(string $originalValue, ?array $allowedTags = null)
         $this->allowedTags = $allowedTags;
     }
 
+    /**
+     * Get escaped html entities
+     *
+     * @return string
+     */
     public function __toString(): string
     {
         return (string) Mage::helper('core')->escapeHtml(
@@ -28,6 +56,11 @@ public function __toString(): string
         );
     }
 
+    /**
+     * Get un-escaped html entities
+     *
+     * @return string
+     */
     public function getUnescapedValue(): string
     {
         return $this->originalValue;
diff --git a/app/code/core/Mage/Core/Model/Translate.php b/app/code/core/Mage/Core/Model/Translate.php
index 2f5f4a2ec094..fde16b111107 100644
--- a/app/code/core/Mage/Core/Model/Translate.php
+++ b/app/code/core/Mage/Core/Model/Translate.php
@@ -465,7 +465,7 @@ public function getTemplateFile($file, $type, $localeCode = null)
             $localeCode = $this->getLocale();
         }
 
-        $filePath = Mage::getBaseDir('locale')  . DS
+        $filePath = Mage::getBaseDir('locale') . DS
                   . $localeCode . DS . 'template' . DS . $type . DS . $file;
 
         if (!file_exists($filePath)) { // If no template specified for this locale, use store default
diff --git a/app/code/core/Mage/Customer/controllers/AccountController.php b/app/code/core/Mage/Customer/controllers/AccountController.php
index 8cf9e7399a9d..f01405c3090b 100644
--- a/app/code/core/Mage/Customer/controllers/AccountController.php
+++ b/app/code/core/Mage/Customer/controllers/AccountController.php
@@ -895,8 +895,8 @@ public function resetPasswordPostAction()
      */
     protected function getCustomerId()
     {
-        $customerId = $this->getRequest()->getQuery('id');
-        if (strlen($customerId) > 12) {
+        $customerId = $this->getRequest()->getQuery('id', false);
+        if (is_string($customerId) && strlen($customerId) > 12) {
             $customerCollection = Mage::getModel('customer/customer')
                 ->getCollection()
                 ->addAttributeToSelect(['rp_customer_id'])
diff --git a/app/code/core/Mage/ImportExport/Model/Export.php b/app/code/core/Mage/ImportExport/Model/Export.php
index 9893ce2744e8..a8bf61d1cd33 100644
--- a/app/code/core/Mage/ImportExport/Model/Export.php
+++ b/app/code/core/Mage/ImportExport/Model/Export.php
@@ -299,6 +299,6 @@ public function getFileFormat()
      */
     public function getFileName()
     {
-        return $this->getEntity() . '_' . date('Ymd_His') .  '.' . $this->_getWriter()->getFileExtension();
+        return $this->getEntity() . '_' . date('Ymd_His') . '.' . $this->_getWriter()->getFileExtension();
     }
 }
diff --git a/app/code/core/Mage/Page/Block/Html/Header.php b/app/code/core/Mage/Page/Block/Html/Header.php
index dab05f44c1f9..1b251001f590 100644
--- a/app/code/core/Mage/Page/Block/Html/Header.php
+++ b/app/code/core/Mage/Page/Block/Html/Header.php
@@ -57,9 +57,7 @@ public function setLogo($logo_src, $logo_alt)
     public function getLogoSrc()
     {
         if (empty($this->_data['logo_src'])) {
-            $this->_data['logo_src'] =  new Mage_Core_Model_Security_HtmlEscapedString(
-                (string) Mage::getStoreConfig('design/header/logo_src')
-            );
+            $this->_data['logo_src'] = $this->escapeHtmlAsObject((string) Mage::getStoreConfig('design/header/logo_src'));
         }
         return $this->getSkinUrl($this->_data['logo_src']);
     }
@@ -70,9 +68,7 @@ public function getLogoSrc()
     public function getLogoSrcSmall()
     {
         if (empty($this->_data['logo_src_small'])) {
-            $this->_data['logo_src_small'] =  new Mage_Core_Model_Security_HtmlEscapedString(
-                (string) Mage::getStoreConfig('design/header/logo_src_small')
-            );
+            $this->_data['logo_src_small'] = $this->escapeHtmlAsObject((string) Mage::getStoreConfig('design/header/logo_src_small'));
         }
         return $this->getSkinUrl($this->_data['logo_src_small']);
     }
@@ -83,9 +79,7 @@ public function getLogoSrcSmall()
     public function getLogoAlt()
     {
         if (empty($this->_data['logo_alt'])) {
-            $this->_data['logo_alt'] = new Mage_Core_Model_Security_HtmlEscapedString(
-                (string) Mage::getStoreConfig('design/header/logo_alt')
-            );
+            $this->_data['logo_alt'] = $this->escapeHtmlAsObject((string) Mage::getStoreConfig('design/header/logo_alt'));
         }
         return $this->_data['logo_alt'];
     }
@@ -103,9 +97,7 @@ public function getWelcome()
             if (Mage::isInstalled() && Mage::getSingleton('customer/session')->isLoggedIn()) {
                 $this->_data['welcome'] = $this->__('Welcome, %s!', $this->escapeHtml(Mage::getSingleton('customer/session')->getCustomer()->getName()));
             } else {
-                $this->_data['welcome'] = new Mage_Core_Model_Security_HtmlEscapedString(
-                    (string) Mage::getStoreConfig('design/header/welcome')
-                );
+                $this->_data['welcome'] = $this->escapeHtmlAsObject((string) Mage::getStoreConfig('design/header/welcome'));
             }
         }
 
diff --git a/app/code/core/Mage/Page/Block/Html/Welcome.php b/app/code/core/Mage/Page/Block/Html/Welcome.php
index 2f1e1f982384..b8d4308488ee 100644
--- a/app/code/core/Mage/Page/Block/Html/Welcome.php
+++ b/app/code/core/Mage/Page/Block/Html/Welcome.php
@@ -44,9 +44,7 @@ protected function _toHtml()
             if (Mage::isInstalled() && $this->_getSession()->isLoggedIn()) {
                 $this->_data['welcome'] = $this->__('Welcome, %s!', $this->escapeHtml($this->_getSession()->getCustomer()->getName()));
             } else {
-                $this->_data['welcome'] = new Mage_Core_Model_Security_HtmlEscapedString(
-                    (string) Mage::getStoreConfig('design/header/welcome')
-                );
+                $this->_data['welcome'] = $this->escapeHtmlAsObject((string) Mage::getStoreConfig('design/header/welcome'));
             }
         }
 
diff --git a/app/code/core/Mage/Paypal/Block/Adminhtml/System/Config/Fieldset/Location.php b/app/code/core/Mage/Paypal/Block/Adminhtml/System/Config/Fieldset/Location.php
index 251a775bed6e..a29265e4ddc8 100644
--- a/app/code/core/Mage/Paypal/Block/Adminhtml/System/Config/Fieldset/Location.php
+++ b/app/code/core/Mage/Paypal/Block/Adminhtml/System/Config/Fieldset/Location.php
@@ -191,7 +191,7 @@ protected function _getExtraJs($element, $tooltipsExist = false)
 
                             if (conflict && !confirmationShowed && anotherEnabler.value == 1) {
                                 if (isEvent) {
-                                    confirmationApproved = confirm(\'' .  $this->helper('core')->jsQuoteEscape($this->__('There is already another PayPal solution enabled. Enable this solution instead?')) . '\');
+                                    confirmationApproved = confirm(\'' . $this->helper('core')->jsQuoteEscape($this->__('There is already another PayPal solution enabled. Enable this solution instead?')) . '\');
                                 } else {
                                     paypalConflictsObject.isConflict = true;
                                 }
@@ -320,14 +320,14 @@ protected function _getExtraJs($element, $tooltipsExist = false)
                     paypalConflictsObject.toggleBmlEnabler(enablerElement);
                 });
                 if (paypalConflictsObject.isConflict || paypalConflictsObject.ecMissed) {
-                    var notification = \'' .  $this->helper('core')->jsQuoteEscape($this->__('The following error(s) occured:')) . '\';
+                    var notification = \'' . $this->helper('core')->jsQuoteEscape($this->__('The following error(s) occured:')) . '\';
                     if (paypalConflictsObject.isConflict) {
-                        notification += "\\n  " + \'' .  $this->helper('core')->jsQuoteEscape($this->__('Some PayPal solutions conflict.')) . '\';
+                        notification += "\\n  " + \'' . $this->helper('core')->jsQuoteEscape($this->__('Some PayPal solutions conflict.')) . '\';
                     }
                     if (paypalConflictsObject.ecMissed) {
-                        notification += "\\n  " + \'' .  $this->helper('core')->jsQuoteEscape($this->__('PayPal Express Checkout is not enabled.')) . '\';
+                        notification += "\\n  " + \'' . $this->helper('core')->jsQuoteEscape($this->__('PayPal Express Checkout is not enabled.')) . '\';
                     }
-                    notification += "\\n" + \'' .  $this->helper('core')->jsQuoteEscape($this->__('Please re-enable the previously enabled payment solutions.')) . '\';
+                    notification += "\\n" + \'' . $this->helper('core')->jsQuoteEscape($this->__('Please re-enable the previously enabled payment solutions.')) . '\';
                     setTimeout(function() {
                         alert(notification);
                     }, 1);
diff --git a/app/code/core/Mage/Rule/Model/Resource/Abstract.php b/app/code/core/Mage/Rule/Model/Resource/Abstract.php
index 1cd51832763d..60af13dee3ee 100644
--- a/app/code/core/Mage/Rule/Model/Resource/Abstract.php
+++ b/app/code/core/Mage/Rule/Model/Resource/Abstract.php
@@ -162,7 +162,7 @@ public function bindRuleToEntity($ruleIds, $entityIds, $entityType, $deleteOldRe
             if ($deleteOldResults) {
                 $adapter->delete(
                     $this->getTable($entityInfo['associations_table']),
-                    $adapter->quoteInto($entityInfo['rule_id_field']   . ' IN (?) AND ', $ruleIds) .
+                    $adapter->quoteInto($entityInfo['rule_id_field'] . ' IN (?) AND ', $ruleIds) .
                     $adapter->quoteInto($entityInfo['entity_id_field'] . ' NOT IN (?)', $entityIds)
                 );
             }
diff --git a/app/code/core/Mage/Sales/sql/sales_setup/mysql4-upgrade-1.3.99-1.4.0.0.php b/app/code/core/Mage/Sales/sql/sales_setup/mysql4-upgrade-1.3.99-1.4.0.0.php
index 8d2686ffbfeb..32081b4db0c4 100644
--- a/app/code/core/Mage/Sales/sql/sales_setup/mysql4-upgrade-1.3.99-1.4.0.0.php
+++ b/app/code/core/Mage/Sales/sql/sales_setup/mysql4-upgrade-1.3.99-1.4.0.0.php
@@ -913,13 +913,13 @@
 
                 if ($joinCount > 60) { // If we have too much joins for mysql
                     $joinCount = 0;
-                    $sql .= $select->crossUpdateFromSelect(['e' => $installer->getTable($flatTablePrefix)])  . "; \n";
+                    $sql .= $select->crossUpdateFromSelect(['e' => $installer->getTable($flatTablePrefix)]) . "; \n";
                     $select->reset();
                 }
             }
 
             if ($joinCount > 0) {
-                $sql .= $select->crossUpdateFromSelect(['e' => $installer->getTable($flatTablePrefix)])  . "; \n";
+                $sql .= $select->crossUpdateFromSelect(['e' => $installer->getTable($flatTablePrefix)]) . "; \n";
             }
         }
     } else {
diff --git a/app/code/core/Mage/Sendfriend/Model/Resource/Sendfriend.php b/app/code/core/Mage/Sendfriend/Model/Resource/Sendfriend.php
index cea3d167fa2e..5dbf8ee1aadf 100644
--- a/app/code/core/Mage/Sendfriend/Model/Resource/Sendfriend.php
+++ b/app/code/core/Mage/Sendfriend/Model/Resource/Sendfriend.php
@@ -21,6 +21,9 @@
  */
 class Mage_Sendfriend_Model_Resource_Sendfriend extends Mage_Core_Model_Resource_Db_Abstract
 {
+    /**
+     * @return void
+     */
     protected function _construct()
     {
         $this->_init('sendfriend/sendfriend', 'log_id');
diff --git a/app/code/core/Mage/Sendfriend/Model/Sendfriend.php b/app/code/core/Mage/Sendfriend/Model/Sendfriend.php
index 3f9ff489fa55..a202f9acba61 100644
--- a/app/code/core/Mage/Sendfriend/Model/Sendfriend.php
+++ b/app/code/core/Mage/Sendfriend/Model/Sendfriend.php
@@ -233,7 +233,7 @@ public function getCookie()
     /**
      * Set Visitor Remote Address
      *
-     * @param int $ipAddr the IP address on Long Format
+     * @param string|false $ipAddr the IP address on Long Format
      * @return $this
      */
     public function setRemoteAddr($ipAddr)
@@ -255,7 +255,7 @@ public function getRemoteAddr()
     /**
      * Set Website Id
      *
-     * @param int $id - website id
+     * @param int|string|null $id - website id
      * @return $this
      */
     public function setWebsiteId($id)
diff --git a/app/code/core/Mage/Sendfriend/controllers/ProductController.php b/app/code/core/Mage/Sendfriend/controllers/ProductController.php
index 6a7380714044..42592be70910 100644
--- a/app/code/core/Mage/Sendfriend/controllers/ProductController.php
+++ b/app/code/core/Mage/Sendfriend/controllers/ProductController.php
@@ -96,6 +96,7 @@ protected function _initSendToFriendModel()
     /**
      * Show Send to a Friend Form
      *
+     * @return void
      */
     public function sendAction()
     {
@@ -132,6 +133,7 @@ public function sendAction()
     /**
      * Send Email Post Action
      *
+     * @return $this|void
      */
     public function sendmailAction()
     {
diff --git a/app/code/core/Mage/Usa/Model/Shipping/Carrier/Dhl/International.php b/app/code/core/Mage/Usa/Model/Shipping/Carrier/Dhl/International.php
index 0e3953c2a74c..84e3141da5db 100644
--- a/app/code/core/Mage/Usa/Model/Shipping/Carrier/Dhl/International.php
+++ b/app/code/core/Mage/Usa/Model/Shipping/Carrier/Dhl/International.php
@@ -1096,7 +1096,7 @@ protected function _getWeightUnit()
     protected function getCountryParams($countryCode)
     {
         if (empty($this->_countryParams)) {
-            $dhlConfigPath = Mage::getModuleDir('etc', 'Mage_Usa')  . DS . 'dhl' . DS;
+            $dhlConfigPath = Mage::getModuleDir('etc', 'Mage_Usa') . DS . 'dhl' . DS;
             $countriesXml = file_get_contents($dhlConfigPath . 'international' . DS . 'countries.xml');
             $this->_countryParams = new Varien_Simplexml_Element($countriesXml);
         }
diff --git a/app/code/core/Mage/Usa/Model/Shipping/Carrier/Fedex.php b/app/code/core/Mage/Usa/Model/Shipping/Carrier/Fedex.php
index fc52347002fd..a0812f9d6b80 100644
--- a/app/code/core/Mage/Usa/Model/Shipping/Carrier/Fedex.php
+++ b/app/code/core/Mage/Usa/Model/Shipping/Carrier/Fedex.php
@@ -101,7 +101,7 @@ class Mage_Usa_Model_Shipping_Carrier_Fedex extends Mage_Usa_Model_Shipping_Carr
     public function __construct()
     {
         parent::__construct();
-        $wsdlBasePath = Mage::getModuleDir('etc', 'Mage_Usa')  . DS . 'wsdl' . DS . 'FedEx' . DS;
+        $wsdlBasePath = Mage::getModuleDir('etc', 'Mage_Usa') . DS . 'wsdl' . DS . 'FedEx' . DS;
         $this->_shipServiceWsdl = $wsdlBasePath . 'ShipService_v10.wsdl';
         $this->_rateServiceWsdl = $wsdlBasePath . 'RateService_v10.wsdl';
         $this->_trackServiceWsdl = $wsdlBasePath . 'TrackService_v5.wsdl';
diff --git a/composer.json b/composer.json
index 43738cd7f4b1..078f224d5cf0 100644
--- a/composer.json
+++ b/composer.json
@@ -44,7 +44,7 @@
         "openmage/dev-meta-package": "^1.0",
         "phpcompatibility/php-compatibility": "^9.3",
         "phpmd/phpmd": "^2.13",
-        "phpstan/phpstan": "^1.11",
+        "phpstan/phpstan": "^1.12.1",
         "phpunit/phpunit": "^9.5",
         "squizlabs/php_codesniffer": "^3.7",
         "symplify/vendor-patches": "^11.1"
diff --git a/composer.lock b/composer.lock
index 1bdf9b2961e3..11ab57478058 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "7e17c6efe4bd2aa3abfa8dd3471d35f7",
+    "content-hash": "59d169c9f9fd98541d9af1b1f00dc20b",
     "packages": [
         {
             "name": "colinmollenhour/cache-backend-redis",
@@ -3486,16 +3486,16 @@
         },
         {
             "name": "phpstan/phpstan",
-            "version": "1.12.0",
+            "version": "1.12.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan.git",
-                "reference": "384af967d35b2162f69526c7276acadce534d0e1"
+                "reference": "d8ed7fffa66de1db0d2972267d8ed1d8fa0fe5a2"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/384af967d35b2162f69526c7276acadce534d0e1",
-                "reference": "384af967d35b2162f69526c7276acadce534d0e1",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/d8ed7fffa66de1db0d2972267d8ed1d8fa0fe5a2",
+                "reference": "d8ed7fffa66de1db0d2972267d8ed1d8fa0fe5a2",
                 "shasum": ""
             },
             "require": {
@@ -3540,7 +3540,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2024-08-27T09:18:05+00:00"
+            "time": "2024-09-03T19:55:22+00:00"
         },
         {
             "name": "phpunit/php-code-coverage",
diff --git a/lib/Varien/Data/Form/Element/Color.php b/lib/Varien/Data/Form/Element/Color.php
index 0563a573632b..3268e67f8cff 100644
--- a/lib/Varien/Data/Form/Element/Color.php
+++ b/lib/Varien/Data/Form/Element/Color.php
@@ -62,7 +62,7 @@ public function getElementHtml()
         }
 
         $html = '<input type="color" id="' . $id . ':html5" class="input-color-html5" '
-            . 'value="#' . trim($this->getEscapedValue(), '#') . '" oninput="' . $oninput .  '" '
+            . 'value="#' . trim($this->getEscapedValue(), '#') . '" oninput="' . $oninput . '" '
             . '/>' . "\n";
 
         $this->addClass('input-color');
diff --git a/lib/Varien/Db/Tree.php b/lib/Varien/Db/Tree.php
index 3f37f90fc385..5cc845d5e08d 100644
--- a/lib/Varien/Db/Tree.php
+++ b/lib/Varien/Db/Tree.php
@@ -496,7 +496,7 @@ public function getChildren($ID, $start_level = 0, $end_level = 0)
 
         $dbSelect = new Zend_Db_Select($this->_db);
         $dbSelect->from($this->_table)
-            ->where($this->_left  . ' >= :left')
+            ->where($this->_left . ' >= :left')
             ->where($this->_right . ' <= :right')
             ->order($this->_left);
 
@@ -524,7 +524,7 @@ public function getNode($nodeId)
     {
         $dbSelect = new Zend_Db_Select($this->_db);
         $dbSelect->from($this->_table)
-            ->where($this->_table . '.' . $this->_id  . ' >= :id');
+            ->where($this->_table . '.' . $this->_id . ' >= :id');
 
         $this->_addExtTablesToSelect($dbSelect);
 
diff --git a/lib/Varien/Filter/FormElementName.php b/lib/Varien/Filter/FormElementName.php
index 3161f74ecdc4..fe5d611d2a07 100644
--- a/lib/Varien/Filter/FormElementName.php
+++ b/lib/Varien/Filter/FormElementName.php
@@ -31,7 +31,7 @@ public function filter($value)
             $pattern = '/[^a-zA-Z0-9\[\];_\-' . $whiteSpace . ']/';
         } elseif (self::$_meansEnglishAlphabet) {
             //The Alphabet means english alphabet.
-            $pattern = '/[^a-zA-Z0-9\[\];_\-'  . $whiteSpace . ']/u';
+            $pattern = '/[^a-zA-Z0-9\[\];_\-' . $whiteSpace . ']/u';
         } else {
             //The Alphabet means each language's alphabet.
             $pattern = '/[^\p{L}\p{N}\[\];_\-' . $whiteSpace . ']/u';