fix: preserve subclass types in route group callbacks

system/Router/RouteCollection.php

@@ -656,8 +656,8 @@ public function getRedirectCode(string $routeKey): int
      *            $route->resource('users');
      *     });
      *
-     * @param string                                      $name      The name to group/prefix the routes with.
-     * @param array<string, mixed>|(callable(self): void) ...$params
+     * @param string                                        $name      The name to group/prefix the routes with.
+     * @param array<string, mixed>|(callable(static): void) ...$params
      *
      * @return void
      */

tests/_support/Router/RouteCollectionSubclass.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * This file is part of CodeIgniter 4 framework.
+ *
+ * (c) CodeIgniter Foundation <admin@codeigniter.com>
+ *
+ * For the full copyright and license information, please view
+ * the LICENSE file that was distributed with this source code.
+ */
+
+namespace Tests\Support\Router;
+
+use CodeIgniter\Router\RouteCollection;
+
+final class RouteCollectionSubclass extends RouteCollection
+{
+}

tests/system/Router/RouteCollectionTest.php

@@ -27,6 +27,7 @@
 use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\Attributes\Group;
 use Tests\Support\Controllers\Hello;
+use Tests\Support\Router\RouteCollectionSubclass;
 
 /**
  * @internal
@@ -314,6 +315,38 @@ static function ($routes): void {
         $this->assertSame($expected, $routes->getRoutes());
     }
 
+    public function testGroupingPassesSubclassToNestedCallbacks(): void
+    {
+        $modules                  = new Modules();
+        $modules->enabled         = false;
+        $config                   = new Routing();
+        $config->defaultNamespace = '\\';
+        $routes                   = new RouteCollectionSubclass(service('locator'), $modules, $config);
+        $routes->setHTTPVerb(Method::GET);
+
+        $routes->group('admin', ['namespace' => 'Admin', 'filter' => ['csrf']], function (RouteCollectionSubclass $group) use ($routes): void {
+            $this->assertSame($routes, $group);
+
+            $group->group('profile', ['filter' => ['honeypot']], function (RouteCollectionSubclass $nested) use ($routes): void {
+                $this->assertSame($routes, $nested);
+                $nested->get('show', 'Profile::show');
+            });
+
+            $group->get('dashboard', 'Dashboard::index');
+        });
+
+        $routes->get('home', 'Home::index');
+
+        $this->assertSame([
+            'admin/profile/show' => '\\Admin\\Profile::show',
+            'admin/dashboard'    => '\\Admin\\Dashboard::index',
+            'home'               => '\\Home::index',
+        ], $routes->getRoutes(Method::GET));
+        $this->assertSame(['csrf', 'honeypot'], $routes->getFiltersForRoute('admin/profile/show'));
+        $this->assertSame(['csrf'], $routes->getFiltersForRoute('admin/dashboard'));
+        $this->assertFalse($routes->isFiltered('home'));
+    }
+
     public function testGroupGetsSanitized(): void
     {
         $routes = $this->getCollector();

user_guide_src/source/changelogs/v4.7.6.rst

@@ -52,6 +52,7 @@ Bugs Fixed
 - **HTTP:** Fixed a bug where ``Negotiate`` could select a value that the request header excluded with ``q=0`` through a wildcard or a broader range. A ``q=0`` range now excludes every value it matches, such as ``text/html`` and ``text/html;charset=utf-8`` for ``text/*;q=0``, or ``en-US`` for ``en;q=0``, unless a more specific range in the header accepts the value. For example, ``Accept-Encoding: gzip;q=0, *`` no longer selects ``gzip``.
 - **HTTP:** Fixed stale ``$_REQUEST`` values after ``SiteURIFactory`` normalizes GET parameters, so ``Validation::withRequest()`` reads the normalized values while unrelated REQUEST entries are preserved.
 - **I18n:** Fixed a regression in v4.7.1 where ``Time`` and ``TimeLegacy`` lost their timezone, locale and ``__toString()`` format after ``unserialize()``, so methods such as ``difference()`` and ``getTimezoneName()`` threw an ``Error``.
+- **Routing:** Corrected the PHPDoc callback type of ``RouteCollection::group()`` to preserve the concrete collection type, allowing callbacks typed to a ``RouteCollection`` subclass to pass static analysis.
 - **Security:** Fixed a bug where a valid JSON request body that is not an object (for example a JSON array) was corrupted after CSRF verification when the token was sent via the ``X-CSRF-TOKEN`` header.
 
 See the repo's