diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index 5a2d32c..b08d6e6 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -34,7 +34,7 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php }}
-          extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick, fileinfo
+          extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick, fileinfo, sodium
           coverage: pcov
 
       - name: Setup problem matchers
diff --git a/composer.json b/composer.json
index 8aaf315..2d72fed 100644
--- a/composer.json
+++ b/composer.json
@@ -20,7 +20,7 @@
     },
     "require": {
         "php": "^8.3",
-        "phpstan/phpstan": "^2.1",
+        "phpstan/phpstan": "^2.1.13",
         "php-standard-library/php-standard-library": "^4.0 || ^5.0 || ^6.0"
     },
     "require-dev": {
diff --git a/src/Rules/RestrictImplicitDependencyUsage.php b/src/Rules/RestrictImplicitDependencyUsage.php
index 11fe50a..cd1fc23 100644
--- a/src/Rules/RestrictImplicitDependencyUsage.php
+++ b/src/Rules/RestrictImplicitDependencyUsage.php
@@ -233,10 +233,10 @@ private function getInstalledJson(): array
                 'name' => Type\string(),
                 'autoload' => Type\optional(Type\shape([
                     'psr-4' => Type\optional(Type\dict(Type\string(), Type\union(Type\string(), Type\vec(Type\string())))),
-                ], allowUnknownFields: true)),
+                ], true)),
                 'replace' => Type\optional(Type\dict(Type\string(), Type\string())),
-            ], allowUnknownFields: true)),
-        ], allowUnknownFields: true)->assert(decode(read(basepath() . '/vendor/composer/installed.json')));
+            ], true)),
+        ], true)->assert(decode(read(basepath() . '/vendor/composer/installed.json')));
     }
 
     /**
@@ -249,7 +249,7 @@ private function getComposerJson(): array
             'require-dev' => Type\optional(Type\dict(Type\string(), Type\string())),
             'autoload' => Type\optional(Type\shape([
                 'psr-4' => Type\optional(Type\dict(Type\string(), Type\union(Type\string(), Type\vec(Type\string())))),
-            ], allowUnknownFields: true)),
-        ], allowUnknownFields: true)->assert(decode(read('composer.json')));
+            ], true)),
+        ], true)->assert(decode(read('composer.json')));
     }
 }
diff --git a/src/Rules/StrictComparisonOfObjectsRule.php b/src/Rules/StrictComparisonOfObjectsRule.php
index 97ee567..87cb6ed 100644
--- a/src/Rules/StrictComparisonOfObjectsRule.php
+++ b/src/Rules/StrictComparisonOfObjectsRule.php
@@ -54,6 +54,7 @@ public function processNode(Node $node, Scope $scope): array
                             $rightTypeDescription,
                             $expectedType->describe(VerbosityLevel::typeOnly())
                         ))
+                            ->identifier('superscript.strictComparisonOfObjects')
                             ->build(),
                     ];
                 }
diff --git a/src/basepath.php b/src/basepath.php
index 45e2806..5c55ba1 100644
--- a/src/basepath.php
+++ b/src/basepath.php
@@ -7,6 +7,10 @@ function basepath(): ?string
 {
     $real_path = realpath(__DIR__);
 
+    if ($real_path === false) {
+        return null;
+    }
+
     preg_match(
         "/.+\b(vendor\/.+)/",
         $real_path,
@@ -30,7 +34,7 @@ function basepath(): ?string
 
     $project_path = realpath(__DIR__ . DIRECTORY_SEPARATOR . $out);
 
-    if ( !file_exists($project_path . DIRECTORY_SEPARATOR . "composer.json") ) {
+    if ( $project_path === false || !file_exists($project_path . DIRECTORY_SEPARATOR . "composer.json") ) {
         return null;
     }
 
diff --git a/tests/Rules/RestrictImplicitDepndencyUsage/RestrictImplicitDependencyUsageTest.php b/tests/Rules/RestrictImplicitDepndencyUsage/RestrictImplicitDependencyUsageTest.php
index 041dd00..d0c3795 100644
--- a/tests/Rules/RestrictImplicitDepndencyUsage/RestrictImplicitDependencyUsageTest.php
+++ b/tests/Rules/RestrictImplicitDepndencyUsage/RestrictImplicitDependencyUsageTest.php
@@ -16,7 +16,6 @@
 use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\TestCase;
-use Psl\Collection\Vector;
 use Superscript\PHPStanRules\Rules\RestrictImplicitDependencyUsage;
 
 final class RestrictImplicitDependencyUsageTest extends PHPStanTestCase
@@ -65,6 +64,9 @@ public function it_can_be_restricted(string $class): void
 
     public static function restrictedCases(): \Generator
     {
-        yield 'class from undefined package' => [\Psl\Collection\Vector::class];
+        // sebastian/diff is installed transitively (via phpunit) but not
+        // declared in this package's composer.json, so a class from its
+        // namespace must be flagged as an implicit-dependency usage.
+        yield 'class from undefined package' => [\SebastianBergmann\Diff\Differ::class];
     }
 }