Skip to content

build(deps-dev): bump squizlabs/php_codesniffer from 4.0.1 to 4.0.2 - #77

Open
dependabot[bot] wants to merge 1 commit into
4.xfrom
dependabot/maintenance-186b4b21e5
Open

build(deps-dev): bump squizlabs/php_codesniffer from 4.0.1 to 4.0.2#77
dependabot[bot] wants to merge 1 commit into
4.xfrom
dependabot/maintenance-186b4b21e5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 8, 2026

Copy link
Copy Markdown
Contributor

Bumps squizlabs/php_codesniffer from 4.0.1 to 4.0.2.

Release notes

Sourced from squizlabs/php_codesniffer's releases.

4.0.2 - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible. The security issue only affects users of the Gitblame, Hgblame or Svnblame report(s).

Added

  • Tokenizer support for the PHP 8.5 (void) cast. #1325 The T_VOID_CAST token has been added to the Tokens::CAST_TOKENS array.
  • suggest section to the composer.json file to inform users about the recommended iconv and pcntl PHP extensions. #1388

Changed

  • Clarified that libxml is a required PHP extension. #1409
  • Squiz.Scope.StaticThisUsage: the sniff will now also search for the use of $this in static closures. #1377
  • The Generic.PHP.LowerCaseKeyword, Generic.WhiteSpace.LanguageConstructSpacing and Squiz.Functions.FunctionDeclarationArgumentSpacing sniffs no longer embed UTF-8 middot characters for spaces in error messages. #1379, #1389 Fixes [Squiz/#2652](squizlabs/PHP_CodeSniffer#2652).
  • PSR2.ControlStructures.SwitchDeclaration: the error message for the use of colon + curly braces (WrongOpener*) has been made more informative. #1358. Fixes #1322.
  • The error messages for the following sniffs have been improved by exposing more data placeholders:
    • PEAR.Functions.FunctionDeclaration #1445
      • The CloseBracketLine error message now exposes 1 data value (previously 0).
      • The EmptyLine error message now exposes 1 data value (previously 0).
      • The Indent error message now exposes 3 data values (previously 2).
      • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration and Squiz.Functions.MultiLineFunctionDeclaration sniffs.
    • PSR2.Classes.ClassDeclaration #1446
      • The ExtendsLine and ImplementsLine error messages now expose 3 data values (previously 1).
      • The SpaceBeforeExtends and SpaceBeforeImplements error messages now expose 2 data values (previously 1).
      • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration and Squiz.Classes.ClassDeclaration sniffs.
    • PSR2.ControlStructures.SwitchDeclaration #1447
      • The defaultNotLower and caseNotLower error messages now expose 3 data values (previously 2).
      • The SpaceBeforeColonDEFAULT and SpaceBeforeColonCASE error messages now expose 1 data value (previously 0).
      • The BodyOnNextLineDEFAULT and BodyOnNextLineCASE error messages now expose 1 data value (previously 0).
      • The WrongOpenerdefault and WrongOpenercase error messages now expose 1 data value (previously 0).
    • Squiz.ControlStructures.SwitchDeclaration #1449
      • The CaseNotLower and DefaultNotLower error messages now expose 3 data values (previously 2).
      • The CaseIndent and DefaultIndent error messages now expose 2 data values (previously 0).
      • The SpaceBeforeColonCase and SpaceBeforeColonDefault error messages now expose 1 data value (previously 0).
      • The BreakIndent error message now exposes 1 data value (previously 0).
      • The SpacingAfterCase and SpacingAfterDefault error messages now expose 1 data value (previously 0).
    • Squiz.Functions.FunctionDeclarationArgumentSpacing #1452
      • The SpaceBeforeEquals error message now exposes 3 data values (previously 2).
      • The SpaceAfterEquals error message now exposes 3 data values (previously 2).
    • Squiz.Functions.MultiLineFunctionDeclaration #1453
      • The FirstParamSpacing and UseFirstParamSpacing error messages now expose 1 data value (previously 0).
      • The OneParamPerLine and UseOneParamPerLine error messages now expose 1 data value (previously 0).
      • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration sniff.
    • If you have customised the error messages of these sniffs, please review your ruleset after upgrading.
    • Thanks to Zhang WenTao for these patches.
  • The following sniff(s) have received efficiency improvements:
    • PSR2.Classes.PropertyDeclaration
    • Thanks to Jonathan Champ for the patch.

... (truncated)

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

[4.0.2] - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible. The security issue only affects users of the Gitblame, Hgblame or Svnblame report(s).

Added

  • Tokenizer support for the PHP 8.5 (void) cast. #1325 The T_VOID_CAST token has been added to the Tokens::CAST_TOKENS array.
  • suggest section to the composer.json file to inform users about the recommended iconv and pcntl PHP extensions. #1388

Changed

  • Clarified that libxml is a required PHP extension. #1409
  • Squiz.Scope.StaticThisUsage: the sniff will now also search for the use of $this in static closures. #1377
  • The Generic.PHP.LowerCaseKeyword, Generic.WhiteSpace.LanguageConstructSpacing and Squiz.Functions.FunctionDeclarationArgumentSpacing sniffs no longer embed UTF-8 middot characters for spaces in error messages. #1379, #1389 Fixes [Squiz/#2652][sq-2652].
  • PSR2.ControlStructures.SwitchDeclaration: the error message for the use of colon + curly braces (WrongOpener*) has been made more informative. #1358. Fixes #1322.
  • The error messages for the following sniffs have been improved by exposing more data placeholders:
    • PEAR.Functions.FunctionDeclaration #1445
      • The CloseBracketLine error message now exposes 1 data value (previously 0).
      • The EmptyLine error message now exposes 1 data value (previously 0).
      • The Indent error message now exposes 3 data values (previously 2).
      • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration and Squiz.Functions.MultiLineFunctionDeclaration sniffs.
    • PSR2.Classes.ClassDeclaration #1446
      • The ExtendsLine and ImplementsLine error messages now expose 3 data values (previously 1).
      • The SpaceBeforeExtends and SpaceBeforeImplements error messages now expose 2 data values (previously 1).
      • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration and Squiz.Classes.ClassDeclaration sniffs.
    • PSR2.ControlStructures.SwitchDeclaration #1447
      • The defaultNotLower and caseNotLower error messages now expose 3 data values (previously 2).
      • The SpaceBeforeColonDEFAULT and SpaceBeforeColonCASE error messages now expose 1 data value (previously 0).
      • The BodyOnNextLineDEFAULT and BodyOnNextLineCASE error messages now expose 1 data value (previously 0).
      • The WrongOpenerdefault and WrongOpenercase error messages now expose 1 data value (previously 0).
    • Squiz.ControlStructures.SwitchDeclaration #1449
      • The CaseNotLower and DefaultNotLower error messages now expose 3 data values (previously 2).
      • The CaseIndent and DefaultIndent error messages now expose 2 data values (previously 0).
      • The SpaceBeforeColonCase and SpaceBeforeColonDefault error messages now expose 1 data value (previously 0).
      • The BreakIndent error message now exposes 1 data value (previously 0).
      • The SpacingAfterCase and SpacingAfterDefault error messages now expose 1 data value (previously 0).
    • Squiz.Functions.FunctionDeclarationArgumentSpacing #1452
      • The SpaceBeforeEquals error message now exposes 3 data values (previously 2).
      • The SpaceAfterEquals error message now exposes 3 data values (previously 2).
    • Squiz.Functions.MultiLineFunctionDeclaration #1453
      • The FirstParamSpacing and UseFirstParamSpacing error messages now expose 1 data value (previously 0).
      • The OneParamPerLine and UseOneParamPerLine error messages now expose 1 data value (previously 0).
      • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration sniff.
    • If you have customised the error messages of these sniffs, please review your ruleset after upgrading.
    • Thanks to [Zhang WenTao][@​ntdiary] for these patches.
  • The following sniff(s) have received efficiency improvements:
    • PSR2.Classes.PropertyDeclaration

... (truncated)

Commits
  • 74ee2d4 Merge pull request #1475 from PHPCSStandards/feature/changelog-4.0.2
  • 2f4a106 Changelog for the 4.0.2 release
  • 03d5368 Merge branch '3.x' into 4.x
  • 4c378e1 Merge pull request #1474 from PHPCSStandards/feature/changelog-3.13.6
  • f0e1ebb Merge branch '3.x' into 4.x
  • ddbf849 Merge pull request #1473 from PHPCSStandards/security/cve-2026-67434
  • 742a068 Changelog for the 3.13.6 release
  • 7a3a6bb Reports/*blame: properly escape file name
  • b90bca2 PSR2.Classes.PropertyDeclaration: add T_STATIC to tokens list
  • 278f994 Generic/MultipleStatementAlignment: fix multi-line chained assignment (#1444)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [squizlabs/php_codesniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer) from 4.0.1 to 4.0.2.
- [Release notes](https://github.com/PHPCSStandards/PHP_CodeSniffer/releases)
- [Changelog](https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/4.x/CHANGELOG-4.x.md)
- [Commits](PHPCSStandards/PHP_CodeSniffer@4.0.1...4.0.2)

---
updated-dependencies:
- dependency-name: squizlabs/php_codesniffer
  dependency-version: 4.0.2
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Project dependencies are updated php Pull requests that update php code labels Aug 8, 2026
@sonarqubecloud

sonarqubecloud Bot commented Aug 8, 2026

Copy link
Copy Markdown

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

License Issues

composer.json

PackageVersionLicenseIssue Type
php>= 8.5NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
composer/php >= 8.5 UnknownUnknown
composer/composer/pcre 3.4.0 🟢 5.2
Details
CheckScoreReason
Code-Review🟢 3Found 7/22 approved changesets -- score normalized to 3
Dangerous-Workflow⚠️ -1no workflows found
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ -1No tokens found
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 79 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7
Pinned-Dependencies⚠️ -1no dependencies found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
composer/infection/abstract-testframework-adapter 0.5.1 UnknownUnknown
composer/infection/include-interceptor 1.0.0 UnknownUnknown
composer/infection/infection 0.34.0 UnknownUnknown
composer/justinrainbow/json-schema 6.10.0 UnknownUnknown
composer/lion/exceptions 3.0.3 UnknownUnknown
composer/nikic/php-parser 5.7.0 🟢 4.5
Details
CheckScoreReason
Dangerous-Workflow⚠️ -1no workflows found
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ -1No tokens found
Code-Review🟢 4Found 12/29 approved changesets -- score normalized to 4
Maintained🟢 1013 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ -1no dependencies found
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
composer/overtrue/phplint 9.7.2 UnknownUnknown
composer/phpstan/phpstan 2.2.3 UnknownUnknown
composer/phpunit/php-code-coverage 14.1.10 UnknownUnknown
composer/phpunit/php-file-iterator 7.0.0 UnknownUnknown
composer/phpunit/php-invoker 7.0.0 UnknownUnknown
composer/phpunit/php-text-template 6.0.0 UnknownUnknown
composer/phpunit/php-timer 9.0.0 UnknownUnknown
composer/phpunit/phpunit 13.1.13 UnknownUnknown
composer/sanmai/di-container 0.1.17 UnknownUnknown
composer/sanmai/duoclock 0.1.3 UnknownUnknown
composer/sanmai/pipeline 7.9 UnknownUnknown
composer/sebastian/cli-parser 5.0.0 UnknownUnknown
composer/sebastian/comparator 8.2.1 UnknownUnknown
composer/sebastian/complexity 6.0.0 UnknownUnknown
composer/sebastian/diff 8.3.0 UnknownUnknown
composer/sebastian/environment 9.3.2 UnknownUnknown
composer/sebastian/exporter 8.1.0 UnknownUnknown
composer/sebastian/git-state 1.0.0 UnknownUnknown
composer/sebastian/global-state 9.0.1 UnknownUnknown
composer/sebastian/lines-of-code 5.0.1 UnknownUnknown
composer/sebastian/object-enumerator 8.0.0 UnknownUnknown
composer/sebastian/object-reflector 6.0.0 UnknownUnknown
composer/sebastian/recursion-context 8.0.0 UnknownUnknown
composer/sebastian/type 7.0.1 UnknownUnknown
composer/sebastian/version 7.0.0 UnknownUnknown
composer/squizlabs/php_codesniffer 4.0.2 UnknownUnknown
composer/symfony/cache 8.1.1 UnknownUnknown
composer/symfony/cache-contracts 3.7.1 UnknownUnknown
composer/symfony/console 8.1.1 UnknownUnknown
composer/symfony/deprecation-contracts 3.7.1 UnknownUnknown
composer/symfony/event-dispatcher 8.1.1 UnknownUnknown
composer/symfony/event-dispatcher-contracts 3.7.1 UnknownUnknown
composer/symfony/filesystem 8.1.0 UnknownUnknown
composer/symfony/finder 8.1.1 UnknownUnknown
composer/symfony/options-resolver 8.1.0 UnknownUnknown
composer/symfony/polyfill-ctype 1.37.0 🟢 3
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
SAST⚠️ 0no SAST tool detected
Token-Permissions⚠️ -1No tokens found
Dangerous-Workflow⚠️ -1no workflows found
Pinned-Dependencies⚠️ -1no dependencies found
Binary-Artifacts🟢 10no binaries found in the repo
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 10security policy file detected
composer/symfony/polyfill-deepclone 1.40.0 UnknownUnknown
composer/symfony/polyfill-intl-grapheme 1.38.1 🟢 4
Details
CheckScoreReason
SAST⚠️ 0no SAST tool detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Pinned-Dependencies⚠️ -1no dependencies found
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow⚠️ -1no workflows found
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ -1No tokens found
Maintained🟢 79 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 10security policy file detected
composer/symfony/polyfill-intl-normalizer 1.38.0 🟢 3
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
SAST⚠️ 0no SAST tool detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ -1No tokens found
Maintained⚠️ 01 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Dangerous-Workflow⚠️ -1no workflows found
Pinned-Dependencies⚠️ -1no dependencies found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 10security policy file detected
composer/symfony/polyfill-mbstring 1.38.2 🟢 4.2
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ -1No tokens found
Dangerous-Workflow⚠️ -1no workflows found
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0no SAST tool detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Pinned-Dependencies⚠️ -1no dependencies found
Maintained🟢 810 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 8
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 10security policy file detected
composer/symfony/polyfill-php85 1.38.1 UnknownUnknown
composer/symfony/process 8.1.0 UnknownUnknown
composer/symfony/service-contracts 3.7.1 UnknownUnknown
composer/symfony/string 8.1.0 🟢 4.5
Details
CheckScoreReason
Dangerous-Workflow⚠️ -1no workflows found
Maintained🟢 1027 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
SAST⚠️ 0no SAST tool detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ -1No tokens found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ -1no dependencies found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 10security policy file detected
composer/symfony/var-exporter 8.1.1 UnknownUnknown
composer/symfony/yaml 8.1.1 UnknownUnknown
composer/thecodingmachine/safe 3.4.0 UnknownUnknown
composer/theseer/tokenizer 2.0.1 UnknownUnknown
composer/webmozart/assert 2.4.1 🟢 4.6
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow⚠️ -1no workflows found
Maintained🟢 109 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 3Found 9/25 approved changesets -- score normalized to 3
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ -1no dependencies found
Token-Permissions⚠️ -1No tokens found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • composer.json
  • composer.lock

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Project dependencies are updated php Pull requests that update php code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants