diff --git a/composer.json b/composer.json
index c47be13991f..2cf27dc40e3 100644
--- a/composer.json
+++ b/composer.json
@@ -116,7 +116,7 @@
 		"policy": {
 			"advisories": {
 				"ignore-id": [
-					"PKSA-rdkp-vv9z-mjkg"
+					"GHSA-3pwp-g2mj-5p3v"
 				]
 			}
 		}
diff --git a/composer.lock b/composer.lock
index c7c45561d08..6b0a5893119 100644
--- a/composer.lock
+++ b/composer.lock
@@ -63,17 +63,17 @@
             "dist": {
                 "type": "path",
                 "url": "projects/packages/codesniffer",
-                "reference": "0f1e6c789c704afeb9533643e1f41b52ec687a27"
+                "reference": "0fafab50710c2510e7fc6daba3ea52c6b41dd884"
             },
             "require": {
                 "automattic/vipwpcs": "^3.0",
                 "dealerdirect/phpcodesniffer-composer-installer": "^1.0",
-                "mediawiki/mediawiki-codesniffer": "^51.0",
-                "php": ">=8.2",
+                "mediawiki/mediawiki-codesniffer": "^52.0",
+                "php": ">=8.3",
                 "phpcompatibility/phpcompatibility-wp": "^2.1",
                 "phpcsstandards/phpcsutils": "^1.0",
                 "sirbrillig/phpcs-variable-analysis": "^2.10",
-                "wp-coding-standards/wpcs": "<3.4.2"
+                "wp-coding-standards/wpcs": "^3.0"
             },
             "require-dev": {
                 "automattic/phpunit-select-config": "@dev",
@@ -785,25 +785,25 @@
         },
         {
             "name": "mediawiki/mediawiki-codesniffer",
-            "version": "v51.0.0",
+            "version": "v52.0.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/wikimedia/mediawiki-tools-codesniffer.git",
-                "reference": "d9f3595b7e9c73b1f725b0074ac04670c707211e"
+                "reference": "bf16d45cb62ecd614e3d565e3b883a268aeba988"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/wikimedia/mediawiki-tools-codesniffer/zipball/d9f3595b7e9c73b1f725b0074ac04670c707211e",
-                "reference": "d9f3595b7e9c73b1f725b0074ac04670c707211e",
+                "url": "https://api.github.com/repos/wikimedia/mediawiki-tools-codesniffer/zipball/bf16d45cb62ecd614e3d565e3b883a268aeba988",
+                "reference": "bf16d45cb62ecd614e3d565e3b883a268aeba988",
                 "shasum": ""
             },
             "require": {
                 "composer/semver": "^3.4.2",
-                "composer/spdx-licenses": "~1.5.2 || ~1.6.0",
+                "composer/spdx-licenses": "~1.6.0",
                 "ext-mbstring": "*",
-                "php": ">=8.2.0",
+                "php": ">=8.3.0",
                 "phpcsstandards/phpcsextra": "1.5.0",
-                "squizlabs/php_codesniffer": "3.13.5"
+                "squizlabs/php_codesniffer": "3.13.6"
             },
             "require-dev": {
                 "ext-dom": "*",
@@ -830,9 +830,9 @@
                 "mediawiki"
             ],
             "support": {
-                "source": "https://github.com/wikimedia/mediawiki-tools-codesniffer/tree/v51.0.0"
+                "source": "https://github.com/wikimedia/mediawiki-tools-codesniffer/tree/v52.0.0"
             },
-            "time": "2026-05-03T06:29:24+00:00"
+            "time": "2026-08-06T12:11:22+00:00"
         },
         {
             "name": "microsoft/tolerant-php-parser",
@@ -1548,16 +1548,16 @@
         },
         {
             "name": "phpcsstandards/phpcsutils",
-            "version": "1.2.2",
+            "version": "1.2.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/PHPCSStandards/PHPCSUtils.git",
-                "reference": "c216317e96c8b3f5932808f9b0f1f7a14e3bbf55"
+                "reference": "5f35d9408c54d7b529501f3c688b6eae562aea1f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/c216317e96c8b3f5932808f9b0f1f7a14e3bbf55",
-                "reference": "c216317e96c8b3f5932808f9b0f1f7a14e3bbf55",
+                "url": "https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/5f35d9408c54d7b529501f3c688b6eae562aea1f",
+                "reference": "5f35d9408c54d7b529501f3c688b6eae562aea1f",
                 "shasum": ""
             },
             "require": {
@@ -1637,7 +1637,7 @@
                     "type": "thanks_dev"
                 }
             ],
-            "time": "2025-12-08T14:27:58+00:00"
+            "time": "2026-07-27T10:28:41+00:00"
         },
         {
             "name": "phpdocumentor/reflection-common",
@@ -2142,16 +2142,16 @@
         },
         {
             "name": "squizlabs/php_codesniffer",
-            "version": "3.13.5",
+            "version": "3.13.6",
             "source": {
                 "type": "git",
                 "url": "https://github.com/Automattic/PHP_CodeSniffer",
-                "reference": "1a2115fcee6d666b8b6489bb4044c5d8dcdc7fb3"
+                "reference": "205fef6a823fb0669870839cc5e24a7b4a925040"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Automattic/PHP_CodeSniffer/zipball/1a2115fcee6d666b8b6489bb4044c5d8dcdc7fb3",
-                "reference": "1a2115fcee6d666b8b6489bb4044c5d8dcdc7fb3",
+                "url": "https://api.github.com/repos/Automattic/PHP_CodeSniffer/zipball/205fef6a823fb0669870839cc5e24a7b4a925040",
+                "reference": "205fef6a823fb0669870839cc5e24a7b4a925040",
                 "shasum": ""
             },
             "require": {
@@ -3123,16 +3123,16 @@
         },
         {
             "name": "wp-coding-standards/wpcs",
-            "version": "3.3.0",
+            "version": "3.4.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/WordPress/WordPress-Coding-Standards.git",
-                "reference": "7795ec6fa05663d716a549d0b44e47ffc8b0d4a6"
+                "reference": "469c18ceab4d642b15bad4c65ebf3b307bfd55ab"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/WordPress/WordPress-Coding-Standards/zipball/7795ec6fa05663d716a549d0b44e47ffc8b0d4a6",
-                "reference": "7795ec6fa05663d716a549d0b44e47ffc8b0d4a6",
+                "url": "https://api.github.com/repos/WordPress/WordPress-Coding-Standards/zipball/469c18ceab4d642b15bad4c65ebf3b307bfd55ab",
+                "reference": "469c18ceab4d642b15bad4c65ebf3b307bfd55ab",
                 "shasum": ""
             },
             "require": {
@@ -3142,8 +3142,8 @@
                 "ext-xmlreader": "*",
                 "php": ">=7.2",
                 "phpcsstandards/phpcsextra": "^1.5.0",
-                "phpcsstandards/phpcsutils": "^1.1.0",
-                "squizlabs/php_codesniffer": "^3.13.4"
+                "phpcsstandards/phpcsutils": "^1.2.2",
+                "squizlabs/php_codesniffer": "^3.13.5"
             },
             "require-dev": {
                 "php-parallel-lint/php-console-highlighter": "^1.0.0",
@@ -3185,7 +3185,7 @@
                     "type": "custom"
                 }
             ],
-            "time": "2025-11-25T12:08:04+00:00"
+            "time": "2026-07-16T13:05:29+00:00"
         }
     ],
     "aliases": [],
diff --git a/projects/packages/codesniffer/changelog/fix-packagist-squizlabs-php_codesniffer-vulnerability b/projects/packages/codesniffer/changelog/fix-packagist-squizlabs-php_codesniffer-vulnerability
new file mode 100644
index 00000000000..daeffedf3a5
--- /dev/null
+++ b/projects/packages/codesniffer/changelog/fix-packagist-squizlabs-php_codesniffer-vulnerability
@@ -0,0 +1,4 @@
+Significance: major
+Type: changed
+
+Update mediawiki/mediawiki-codesniffer ruleset to v52.
diff --git a/projects/packages/codesniffer/changelog/fix-packagist-squizlabs-php_codesniffer-vulnerability#2 b/projects/packages/codesniffer/changelog/fix-packagist-squizlabs-php_codesniffer-vulnerability#2
new file mode 100644
index 00000000000..e7bc1862217
--- /dev/null
+++ b/projects/packages/codesniffer/changelog/fix-packagist-squizlabs-php_codesniffer-vulnerability#2
@@ -0,0 +1,4 @@
+Significance: major
+Type: removed
+
+Drop support for PHP 8.2, following upstream dependencies.
diff --git a/projects/packages/codesniffer/composer.json b/projects/packages/codesniffer/composer.json
index e8c017a2845..3f5561d05ca 100644
--- a/projects/packages/codesniffer/composer.json
+++ b/projects/packages/codesniffer/composer.json
@@ -12,12 +12,12 @@
 		"testing"
 	],
 	"require": {
-		"php": ">=8.2",
+		"php": ">=8.3",
 		"dealerdirect/phpcodesniffer-composer-installer": "^1.0",
-		"mediawiki/mediawiki-codesniffer": "^51.0",
+		"mediawiki/mediawiki-codesniffer": "^52.0",
 		"phpcompatibility/phpcompatibility-wp": "^2.1",
 		"sirbrillig/phpcs-variable-analysis": "^2.10",
-		"wp-coding-standards/wpcs": "<3.4.2",
+		"wp-coding-standards/wpcs": "^3.0",
 		"automattic/vipwpcs": "^3.0",
 		"phpcsstandards/phpcsutils": "^1.0"
 	},