Bump squizlabs/php_codesniffer from 3.11.2 to 3.13.6

[dependabot]

Bumps squizlabs/php_codesniffer from 3.11.2 to 3.13.6.

Release notes

Sourced from squizlabs/php_codesniffer's releases.

3.13.6 - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible.

Changed

• Various housekeeping, including improvements to the tests and documentation.
  • Thanks to Sergei Morozov and Juliette Reinders Folmer for their contributions.

Fixed

• SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters. #1473
  • Users using the default Full report, or any of the other non-*blame reports, are not affected.
  • For more details, see the security advisory.
  • Thanks go to Faze-up and Volker Dusch for responsibly disclosing the vulnerability.
  • Additionally, thanks go to Volker Dusch, Rodrigo Primo, Dan Wallis and Juliette Reinders Folmer for creating and testing the fix.

Other

• The GPG signature for the PHAR files has been rotated. The new fingerprint is: 5CB4F778BF9BC4FB67AE511D96E91A992CF22FF4.

---

Statistics

Closed: 0 issues Merged: 46 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

3.13.5 - 2025-11-04

Added

• Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
  • Syntax support for new PHP 8.5 features will follow in a future release.
  • If you find any PHP 8.5 deprecation notices which were missed, please report them.

Changed

• Various housekeeping, including improvements to the tests and documentation.
  • Thanks to Rodrigo Primo and Juliette Reinders Folmer for their contributions.

Fixed

• Fixed bug #1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Thanks to Andrew Lyons for the patch.
• Fixed bug #1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
  • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
  • Thanks to Juliette Reinders Folmer for the patch.

Other

• Please be aware that the master branch has been renamed to 3.x and the default branch has changed to the 4.x branch.
  • If you contribute to PHP_CodeSniffer, you will need to update your local git clone.
  • If you develop against PHP_CodeSniffer and run your tests against dev branches of PHPCS, you will need to update your workflows.

... (truncated)

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

[3.13.6] - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible.

Changed

• Various housekeeping, including improvements to the tests and documentation.
  • Thanks to [Sergei Morozov][@​morozov] and [Juliette Reinders Folmer][@​jrfnl] for their contributions.

Fixed

• SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters. #1473
  • Users using the default Full report, or any of the other non-*blame reports, are not affected.
  • For more details, see the security advisory.
  • Thanks go to [Faze-up][@​Faze-up] and [Volker Dusch][@​edorian] for responsibly disclosing the vulnerability.
  • Additionally, thanks go to [Volker Dusch][@​edorian], [Rodrigo Primo][@​rodrigoprimo], [Dan Wallis][@​fredden] and [Juliette Reinders Folmer][@​jrfnl] for creating and testing the fix.

Other

• The GPG signature for the PHAR files has been rotated. The new fingerprint is: 5CB4F778BF9BC4FB67AE511D96E91A992CF22FF4.

#1473: PHPCSStandards/PHP_CodeSniffer#1473

[3.13.5] - 2025-11-04

Added

• Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
  • Syntax support for new PHP 8.5 features will follow in a future release.
  • If you find any PHP 8.5 deprecation notices which were missed, please report them.

Changed

• Various housekeeping, including improvements to the tests and documentation.
  • Thanks to [Rodrigo Primo][@​rodrigoprimo] and [Juliette Reinders Folmer][@​jrfnl] for their contributions.

Fixed

• Fixed bug #1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Thanks to [Andrew Lyons][@​andrewnicols] for the patch.
• Fixed bug #1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
  • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
  • Thanks to Juliette Reinders Folmer for the patch.

Other

• Please be aware that the master branch has been renamed to 3.x and the default branch has changed to the 4.x branch.
  • If you contribute to PHP_CodeSniffer, you will need to update your local git clone.
  • If you develop against PHP_CodeSniffer and run your tests against dev branches of PHPCS, you will need to update your workflows.

#1216: PHPCSStandards/PHP_CodeSniffer#1216 #1279: PHPCSStandards/PHP_CodeSniffer#1279

... (truncated)

Commits

• 4c378e1 Merge pull request #1474 from PHPCSStandards/feature/changelog-3.13.6
• ddbf849 Merge pull request #1473 from PHPCSStandards/security/cve-2026-67434
• 742a068 Changelog for the 3.13.6 release
• 7a3a6bb Reports/*blame: properly escape file name
• b5ce04f Merge pull request #1470 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 5f72703 GH Actions: Bump the action-runners group with 2 updates
• 20d0f55 Merge pull request #1466 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 2a2ac29 Merge pull request #1469 from PHPCSStandards/feature/ghactions-setup-php-fail...
• 6df695f Merge pull request #1467 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 4da0184 GH Actions: fail "setup-php" if requested tooling could not be installed
• Additional commits viewable in compare view