Minimal reproduction for the SonarSource community report: https://community.sonarsource.com/t/false-positive-php-s1172-on-constructor-parameter-promoted-with-readonly-only-no-visibility-modif/182021

PHP 8.4 allows constructor property promotion using readonly alone, without an explicit visibility modifier:

class Foo {
    // PHP 8.4: readonly without public/protected/private still promotes $name to a property
    public function __construct(readonly string $name) {}
}

SonarQube / SonarCloud raises S1172 ("Remove this unused method parameter $name") on such parameters even though they are promoted properties and are not unused.

The same class written with an explicit visibility modifier (public readonly) does not trigger the false positive.

S1172 should not be raised on any constructor parameter that carries the readonly modifier, since readonly alone is a valid promotion modifier in PHP 8.4.

S1172 is raised on every readonly-only promoted parameter.

• PHP 8.4
• SonarQube / SonarCloud with the PHP analyser