diff --git a/.travis.yml b/.travis.yml
index e3fa2aa..943f96b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -29,9 +29,9 @@ before_install:
     - phpenv config-rm xdebug.ini || echo "xdebug not available"
 
 install:
-  - if [ -z "$dependencies" ];          then composer install                  --no-progress --no-scripts --no-suggest -n; fi;
-  - if [ "$dependencies" = "lowest" ];  then composer update                   --no-progress --no-scripts --no-suggest -n --prefer-lowest; fi;
-  - if [ "$dependencies" = "highest" ]; then composer require phpro/grumphp:*  --no-progress --no-scripts --no-suggest -n; fi;
+  - if [ -z "$dependencies" ];          then composer install                  --no-progress --no-scripts -n; fi;
+  - if [ "$dependencies" = "lowest" ];  then composer update                   --no-progress --no-scripts -n --prefer-lowest; fi;
+  - if [ "$dependencies" = "highest" ]; then composer require phpro/grumphp:*  --no-progress --no-scripts -n; fi;
 
 script:
    - ./vendor/bin/grumphp run
diff --git a/README.md b/README.md
index 6c1fede..62cbcd4 100644
--- a/README.md
+++ b/README.md
@@ -31,6 +31,7 @@ imports:
 
 
 parameters:
+  convention.phpstan_level: 1
   convention.xmllint_ignore_pattern:
     - "typo3conf/ext/extension/Resources/Private/Templates/List.xml"
 ````
@@ -47,3 +48,11 @@ There you can override some convention:
 | convention.yamllint_ignore_pattern  | []                            |
 | convention.phpcslint_ignore_pattern | []                            |
 | convention.xlifflint_ignore_pattern | ["#typo3conf/l10n/(.*)#"]     |
+| convention.phpstan_level            | max                           |
+
+
+### Upgrade to grumphp-config 5
+
+if you upgrade and not start a new Project you should set the `convention.phpstan_level` to `0` or `1`  
+so the upgrade is not that painfull for now  
+you should gradually increase the phpstan level until you reach the `max` level
diff --git a/composer.json b/composer.json
index 330a9d5..b813d46 100644
--- a/composer.json
+++ b/composer.json
@@ -2,7 +2,7 @@
     "name": "pluswerk/grumphp-config",
     "description": "GrumPHP config for php projects(mainly TYPO3)",
     "type": "composer-plugin",
-    "license": "LGPL-3.0",
+    "license": "LGPL-3.0-or-later",
     "authors": [
         {
             "name": "Matthias Vogel",
@@ -12,7 +12,12 @@
     ],
     "config": {
         "platform": {
-            "php": "7.2"
+            "php": "7.3"
+        },
+        "preferred-install": {
+          "pluswerk/grumphp-bom-task": "source",
+          "pluswerk/grumphp-xliff-task": "source",
+          "*": "dist"
         }
     },
     "support": {
@@ -24,16 +29,20 @@
         }
     },
     "require": {
-        "php": ">=7.2",
-        "composer-plugin-api": "1.* || 2.*",
-        "phpro/grumphp": "0.19.*",
-        "pluswerk/grumphp-bom-task": "6.*",
-        "pluswerk/grumphp-xliff-task": "4.*",
-        "squizlabs/php_codesniffer": ">=3.5.0 <4.0.0",
-        "enlightn/security-checker": "^1.3",
-        "php-parallel-lint/php-parallel-lint": "1.*"
+        "php": ">=7.3",
+        "composer-plugin-api": "^1.0.0 || ^2.0.0",
+        "phpro/grumphp": "^1.3.1",
+        "pluswerk/grumphp-bom-task": "^7.0.0",
+        "pluswerk/grumphp-xliff-task": "^5.0.0",
+        "squizlabs/php_codesniffer": "^3.5.0",
+        "enlightn/security-checker": "^1.3.0",
+        "php-parallel-lint/php-parallel-lint": "^1.0.0",
+        "phpstan/phpstan": "^0.12.87"
     },
     "extra": {
         "class": "PLUS\\Composer\\Plugin"
+    },
+    "require-dev": {
+        "composer/composer": "^1.10.22 || ^2.0.13"
     }
 }
diff --git a/grumphp.yml b/grumphp.yml
index 15eab4a..1792ff6 100644
--- a/grumphp.yml
+++ b/grumphp.yml
@@ -6,6 +6,7 @@ parameters:
   convention.yamllint_ignore_pattern: []
   convention.phpcslint_ignore_pattern: []
   convention.xlifflint_ignore_pattern: ["#typo3conf/l10n/(.*)#"]
+  convention.phpstan_level: max
 grumphp:
   stop_on_failure: false
   hide_circumvention_tip: true
@@ -31,6 +32,8 @@ grumphp:
       warning_severity: 900000
       tab_width: 4
       ignore_patterns: "%convention.phpcslint_ignore_pattern%"
+    phpstan:
+      level: "%convention.phpstan_level%"
     phplint: ~
     xmllint:
       ignore_patterns: "%convention.xmllint_ignore_pattern%"
@@ -38,9 +41,10 @@ grumphp:
       ignore_patterns: "%convention.yamllint_ignore_pattern%"
     xlifflint:
       ignore_patterns: "%convention.xlifflint_ignore_pattern%"
-    securitychecker:
+    securitychecker_enlightn:
       metadata:
         blocking: "%convention.security_checker_blocking%"
+      run_always: true
     plus_bom_fixer:
       metadata:
         priority: 1
diff --git a/src/Composer/Plugin.php b/src/Composer/Plugin.php
index 7e9b6b6..97a10c6 100644
--- a/src/Composer/Plugin.php
+++ b/src/Composer/Plugin.php
@@ -31,7 +31,7 @@ class Plugin implements PluginInterface, EventSubscriberInterface
     protected $consoleIo;
 
     /**
-     * @var array
+     * @var array<string, mixed>
      */
     protected $extra;
 
@@ -40,14 +40,22 @@ class Plugin implements PluginInterface, EventSubscriberInterface
      */
     protected $shouldSetConfigPath = false;
 
-    public function activate(Composer $composer, IOInterface $consoleIo)
+    /**
+     * @param \Composer\Composer $composer
+     * @param \Composer\IO\IOInterface $consoleIo
+     * @retrun void
+     */
+    public function activate(Composer $composer, IOInterface $consoleIo): void
     {
         $this->composer = $composer;
         $this->consoleIo = $consoleIo;
         $this->extra = $this->composer->getPackage()->getExtra();
     }
 
-    public static function getSubscribedEvents()
+    /**
+     * @return array<string, string>
+     */
+    public static function getSubscribedEvents(): array
     {
         return [
             PackageEvents::POST_PACKAGE_UPDATE => 'postPackageUpdate',
@@ -59,7 +67,7 @@ public static function getSubscribedEvents()
         ];
     }
 
-    public function postPackageUpdate(PackageEvent $event)
+    public function postPackageUpdate(PackageEvent $event): void
     {
         $operation = $event->getOperation();
         if ($operation instanceof UpdateOperation && $operation->getTargetPackage()->getName() === self::PACKAGE_NAME) {
@@ -67,7 +75,7 @@ public function postPackageUpdate(PackageEvent $event)
         }
     }
 
-    public function postPackageInstall(PackageEvent $event)
+    public function postPackageInstall(PackageEvent $event): void
     {
         $operation = $event->getOperation();
         if ($operation instanceof InstallOperation && $operation->getPackage()->getName() === self::PACKAGE_NAME) {
@@ -75,7 +83,7 @@ public function postPackageInstall(PackageEvent $event)
         }
     }
 
-    public function prePackageUninstall(PackageEvent $event)
+    public function prePackageUninstall(PackageEvent $event): void
     {
         $operation = $event->getOperation();
         if ($operation instanceof UninstallOperation && $operation->getPackage()->getName() === self::PACKAGE_NAME) {
@@ -83,7 +91,7 @@ public function prePackageUninstall(PackageEvent $event)
         }
     }
 
-    public function runScheduledTasks()
+    public function runScheduledTasks(): void
     {
         if ($this->shouldSetConfigPath) {
             $this->setConfigPath();
@@ -92,7 +100,7 @@ public function runScheduledTasks()
 
     //ACTIONS:
 
-    public function setConfigPath()
+    public function setConfigPath(): void
     {
         if ($this->getExtra(self::PACKAGE_NAME . '.auto-setting') === false) {
             $this->message('not setting config path, extra.' . self::PACKAGE_NAME . '.auto-setting is false', 'yellow');
@@ -105,7 +113,7 @@ public function setConfigPath()
         }
     }
 
-    public function removeConfigPath()
+    public function removeConfigPath(): void
     {
         if ($this->getExtra(self::PACKAGE_NAME . '.auto-setting') === false) {
             $this->message('not removing config path, extra.' . self::PACKAGE_NAME . '.auto-setting is false', 'yellow');
@@ -116,7 +124,7 @@ public function removeConfigPath()
 
         $key = null;
         if (count($this->getExtra('grumphp')) > 1) {
-            $key  = 'grumphp.config-default-path';
+            $key = 'grumphp.config-default-path';
         } elseif (count($this->getExtra()) > 1) {
             $key = 'grumphp';
         }
@@ -126,7 +134,11 @@ public function removeConfigPath()
 
     // HELPER:
 
-    public function getExtra($name = null)
+    /**
+     * @param string|null $name
+     * @return mixed
+     */
+    public function getExtra(string $name = null)
     {
         if ($name === null) {
             return $this->extra;
@@ -146,27 +158,31 @@ public function getExtra($name = null)
         return null;
     }
 
-    public function setExtra($name, $value)
+    /**
+     * @param string $name
+     * @param mixed $value
+     */
+    public function setExtra(string $name, $value): void
     {
         $configSource = $this->composer->getConfig()->getConfigSource();
-        return $configSource->addProperty('extra.' . $name, $value);
+        $configSource->addProperty('extra.' . $name, $value);
     }
 
-    public function removeExtra($name = null)
+    public function removeExtra(string $name = null): void
     {
         $key = 'extra';
         if ($name !== null) {
             $key .= '.' . $name;
         }
         $configSource = $this->composer->getConfig()->getConfigSource();
-        return $configSource->removeProperty($key);
+        $configSource->removeProperty($key);
     }
 
-    public function message($message, $color = null)
+    public function message(string $message, string $color = null): void
     {
         $colorStart = '';
         $colorEnd = '';
-        if (is_string($color)) {
+        if ($color) {
             $colorStart = '<fg=' . $color . '>';
             $colorEnd = '</fg=' . $color . '>';
         }
@@ -176,14 +192,14 @@ public function message($message, $color = null)
     /**
      * {@inheritdoc}
      */
-    public function deactivate(Composer $composer, IOInterface $io)
+    public function deactivate(Composer $composer, IOInterface $io): void
     {
     }
 
     /**
      * {@inheritdoc}
      */
-    public function uninstall(Composer $composer, IOInterface $io)
+    public function uninstall(Composer $composer, IOInterface $io): void
     {
     }
 }