Skip to content

fix(deps): update dependency squizlabs/php_codesniffer to v3.13.6 [security] - #18

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/packagist-squizlabs-php_codesniffer-vulnerability
Open

fix(deps): update dependency squizlabs/php_codesniffer to v3.13.6 [security]#18
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/packagist-squizlabs-php_codesniffer-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Aug 16, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
squizlabs/php_codesniffer 3.12.2 → 3.13.6 age confidence

PHP_CodeSniffer gitblame report command injection via crafted filename

CVE-2026-67434 / GHSA-hmqg-cxww-wqhq

More information

Details

Impact

PHP_CodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame report(s).

As a result, running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters.

  • Users using the default Full report, or any of the other non-*blame reports, are not affected.
  • Users on a runtime platform which does not allow filenames to contain shell metacharacters, such as " and ;, are not affected.
Patched versions

The issue has been fixed in PHP_CodeSniffer v3.13.6 and v4.0.2. We recommend all users upgrade to these versions at their earliest convenience.

Workaround

Users of PHP_CodeSniffer who cannot upgrade immediately should ensure they do not use the Gitblame, Hgblame or the Svnblame reports when scanning untrusted code.

This is especially relevant for CI jobs, pre-commit or review tooling, automated review services, and any service that scans untrusted repositories or uploaded source trees.

Credits

Many thanks to both @​Faze-up and @​edorian for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHP_CodeSniffer repository.

Severity

  • CVSS Score: 7.3 / 10 (High)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

PHPCSStandards/PHP_CodeSniffer (squizlabs/php_codesniffer)

v3.13.6: - 2026-08-06

Compare Source

This is a security release and all users are advised to update their install(s) as soon as possible.

Changed
Fixed
  • SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters. #​1473
Other
  • The GPG signature for the PHAR files has been rotated. The new fingerprint is: 5CB4F77.
Statistics

Closed: 0 issues
Merged: 46 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

v3.13.5: - 2025-11-04

Compare Source

Added
  • Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
    • Syntax support for new PHP 8.5 features will follow in a future release.
    • If you find any PHP 8.5 deprecation notices which were missed, please report them.
Changed
Fixed
  • Fixed bug #​1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Fixed bug #​1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
    • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
    • Thanks to Juliette Reinders Folmer for the patch.
Other
  • Please be aware that the master branch has been renamed to 3.x and the default branch has changed to the 4.x branch.
    • If you contribute to PHP_CodeSniffer, you will need to update your local git clone.
    • If you develop against PHP_CodeSniffer and run your tests against dev branches of PHPCS, you will need to update your workflows.
New Contributors

The PHP_CodeSniffer project is happy to welcome the following new contributors:
@​andrewnicols

Statistics

Closed: 2 issues
Merged: 36 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

v3.13.4: - 2025-09-05

Compare Source

Fixed
Statistics

Closed: 0 issues
Merged: 3 pull requests

If you like to stay informed about releases and more, follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

v3.13.3: - 2025-09-04

Compare Source

Added
  • Tokenizer support for PHP 8.4 dereferencing of new expressions without wrapping parentheses. #​1160
  • Tokenizer support for PHP 8.4 abstract properties. #​1183
    • The File::getMemberProperties() method now also supports abstract properties through a new is_abstract array index in the return value. #​1184
    • Additionally, the following sniffs have been updated to support abstract properties:
      • Generic.PHP.LowerCaseConstant #​1185
      • Generic.PHP.UpperCaseConstant #​1185
      • PSR2.Classes.PropertyDeclaration #​1188
      • Squiz.Commenting.VariableComment #​1186
      • Squiz.WhiteSpace.MemberVarSpacing #​1187
    • Thanks to Juliette Reinders Folmer for the patches
  • Tokenizer support for the PHP 8.4 "exit as a function call" change. #​1201
    • When exit/die is used as a fully qualified "function call", it will now be tokenized as T_NS_SEPARATOR + T_EXIT.
    • Additionally, the following sniff has been updated to handle fully qualified exit/die correctly:
      • Squiz.PHP.NonExecutableCode
    • Thanks to Juliette Reinders Folmer for the patches
Changed
  • Tokenizer/PHP: fully qualified true/false/null will now be tokenized as T_NS_SEPARATOR + T_TRUE/T_FALSE/T_NULL. #​1201
    • Previously, these were tokenized as T_NS_SEPARATOR + T_STRING.
    • Additionally, the following sniffs have been updated to handle fully qualified true/false/null correctly:
      • Generic.CodeAnalysis.UnconditionalIfStatement
      • Generic.ControlStructures.DisallowYodaConditions
      • PEAR.Functions.ValidDefaultValue
    • Thanks to Juliette Reinders Folmer for the patches.
  • Generic.PHP.Syntax: the sniff is now able to scan input provided via STDIN on non-Windows OSes. #​915
  • PSR2.ControlStructures.SwitchDeclaration: the WrongOpener* error code is now auto-fixable if the identified "wrong opener" is a semi-colon. #​1161
  • The PSR2.Classes.PropertyDeclaration will now check that the abstract modifier keyword is placed before a visibility keyword. #​1188
    • Errors will be reported via a new AbstractAfterVisibility error code.
    • Thanks to Juliette Reinders Folmer for the patch.
  • Various housekeeping, including improvements to the tests and documentation.
Fixed
  • Fixed bug #​1112 : --parallel option fails if PHP_CodeSniffer is invoked via bash and the invokation creates a non-PHPCS-managed process.
  • Fixed bug #​1113 : fatal error when the specified "files to scan" would result in the same file being added multiple times to the queue.
    • This error only occured when --parallel scanning was enabled.
    • Thanks to Rodrigo Primo for the patch.
  • Fixed bug #​1154 : PEAR.WhiteSpace.ObjectOperatorIndent: false positive when checking multiple chained method calls in a multidimensional array.
  • Fixed bug #​1193 : edge case inconsistency in how empty string array keys for sniff properties are handled.
  • Fixed bug #​1197 : Squiz.Commenting.FunctionComment: return types containing a class name with underscores would be truncated leading to incorrect results.
Other
New Contributors

The PHP_CodeSniffer project is happy to welcome the following new contributors:
@​benno5020, @​NanoSector

Statistics

Closed: 11 issues
Merged: 40 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

v3.13.2: - 2025-06-18

Compare Source

Changed
  • The documentation for the following sniffs has been improved:
    • Squiz.Classes.SelfMemberReference
    • Thanks to Rodrigo Primo for the patch.
  • Various housekeeping, including improvements to the tests and documentation.
Fixed
  • Fixed bug #​1135 : Squiz.Functions.FunctionDeclarationArgumentSpacing: typo in new error code SpacingAfterSetVis[i]bility.
Statistics

Closed: 0 issues
Merged: 6 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

v3.13.1: - 2025-06-13

Compare Source

Added
  • Added support for PHP 8.4 properties with asymmetric visibility to File::getMemberProperties() through a new set_scope array index in the return value. #​1116
  • Added support for PHP 8.4 (constructor promoted) properties with asymmetric visibility to File::getMethodParameters() through new set_visibility and set_visibility_token array indexes in the return value. #​1116
  • Added support for PHP 8.4 asymmetric visibility modifiers to the following sniffs:
Changed
  • The PSR2.Classes.PropertyDeclaration will now check that a set-visibility modifier keyword is placed after a potential general visibility keyword. #​1119
  • The Squiz.Functions.FunctionDeclarationArgumentSpacing will now check spacing after a set-visibility modifier keyword. #​1121
    • Errors will be reported via a new SpacingAfterSetVisibility error code.
    • Thanks to Juliette Reinders Folmer for the patch.
  • The Squiz.Scope.MemberVarScope will now flag missing "read" visibility, when "write" visibility is set, under a separate error code AsymReadMissing. #​1122
  • The documentation for the following sniffs has been improved:
    • PEAR.Classes.ClassDeclaration
    • Squiz.WhiteSpace.FunctionOpeningBraceSpace
    • Thanks to Brian Dunne and Rodrigo Primo for the patches.
  • Various housekeeping, including improvements to the tests and documentation.
Other
  • The latest PHP_CodeSniffer XSD file is now available via the following permalink: https://schema.phpcodesniffer.com/phpcs.xsd. #​1094
    Older XSD files can be referenced via permalinks based on their minor: https://schema.phpcodesniffer.com/#.#/phpcs.xsd.
  • The GPG signature for the PHAR files has been rotated. The new fingerprint is: D91D869.
Statistics

Closed: 3 issues
Merged: 24 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

v3.13.0: - 2025-05-11

Compare Source

Added
  • Added support for PHP 8.4 asymmetric visibility modifiers to the tokenizer. #​871
  • Added support for PHP 8.4 final properties to the following sniffs:
Changed
  • Generic.WhiteSpace.LanguageConstructSpacing: will now also check the spacing after the goto language construct keyword. #​917
  • The PSR2.Classes.PropertyDeclaration will now check that the final modifier keyword is placed before a visibility keyword. #​950
  • Improved Help information about the --reports CLI flag. #​1078
  • The documentation for the following sniffs has been improved:
    • PSR1.Files.SideEffects
    • PSR2.ControlStructures.SwitchDeclaration
    • PSR2.Namespaces.NamespaceDeclaration
    • Thanks to Rodrigo Primo for the patches.
  • Various housekeeping, including improvements to the tests and documentation.
Deprecated
  • Nearly everything which was soft deprecated before is now hard deprecated and will show deprecation notices:
    • This applies to:
      • All sniffs which will be removed in 4.0. #​888
      • The deprecated Generator methods. #​889
      • The old array property setting format (via comma separated strings). #​890
      • Sniffs not implementing the PHP_CodeSniffer\Sniffs\Sniff interface. #​891
      • Sniffs not following the naming conventions. #​892
      • Standards called Internal. #​893
      • Sniffs which don't listen for PHP, like JS/CSS specific sniffs. #​894
    • The deprecation notices can be silenced by using the -q (=quiet) CLI flag.
    • Thanks to Juliette Reinders Folmer for the patches.
Fixed
  • Fixed bug #​1040 : Generic.Strings.UnnecessaryHeredoc - false positive for heredocs containing escape sequences.
  • Fixed bug #​1040 : Generic.Strings.UnnecessaryHeredoc - fixer would not clean up escape sequences which aren't necessary in nowdocs.
  • Fixed bug #​1048 : A file under scan would sometimes be updated with partial fixes, even though the file "failed to fix".
Other

Calling all testers!

The first beta release for PHP_CodeSniffer 4.0 has been tagged. Please help by testing the beta release and reporting any issues you run into.
Upgrade guides for both ruleset maintainers/end-users, as well as for sniff developers and integrators, have been published to the Wiki to help smooth the transition.

Statistics

Closed: 3 issues
Merged: 29 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

Configuration

📅 Schedule: (in timezone Europe/Belgrade)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • "before 8am on Monday through Thursday"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@private-packagist

private-packagist Bot commented Aug 16, 2026

Copy link
Copy Markdown

composer.lock

Package changes

Package Operation From To About
squizlabs/php_codesniffer upgrade 3.12.2 ⚠️ 3.13.6 ✅ diff

Settings · Docs · Powered by Private Packagist

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies 📦 security 🔒

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants