Bump squizlabs/php_codesniffer from 3.6.0 to 3.13.6 in the composer group across 1 directory

[dependabot]

Bumps the composer group with 1 update in the / directory: squizlabs/php_codesniffer.

Updates squizlabs/php_codesniffer from 3.6.0 to 3.13.6

Release notes

Sourced from squizlabs/php_codesniffer's releases.

3.7.2

• Newer versions of Composer will now suggest installing PHPCS using require-dev instead of require
  • Thanks to Gary Jones (@​GaryJones) for the patch
• A custom Out Of Memory error will now be shown if PHPCS or PHPCBF run out of memory during a run
  • Error message provides actionable information about how to fix the problem and ensures the error is not silent
  • Thanks to Juliette Reinders Folmer (@​jrfnl) and Alain Schlesser (@​schlessera) for the patch
• Generic.PHP.LowerCaseType sniff now correctly examines types inside arrow functions
  • Thanks to Juliette Reinders Folmer (@​jrfnl) for the patch
• Squiz.Formatting.OperatorBracket no longer reports false positives in match() structures
• Fixed bug #3616 : Squiz.PHP.DisallowComparisonAssignment false positive for PHP 8 match expression
  • Thanks to Juliette Reinders Folmer (@​jrfnl) for the patch
• Fixed bug #3618 : Generic.WhiteSpace.ArbitraryParenthesesSpacing false positive for return new parent()
  • Thanks to Juliette Reinders Folmer (@​jrfnl) for the patch
• Fixed bug #3632 : Short list not tokenized correctly in control structures without braces
  • Thanks to Juliette Reinders Folmer (@​jrfnl) for the patch
• Fixed bug #3639 : Tokenizer not applying tab replacement to heredoc/nowdoc closers
  • Thanks to Juliette Reinders Folmer (@​jrfnl) for the patch
• Fixed bug #3640 : Generic.WhiteSpace.DisallowTabIndent not reporting errors for PHP 7.3 flexible heredoc/nowdoc syntax
  • Thanks to Juliette Reinders Folmer (@​jrfnl) for the patch
• Fixed bug #3645 : PHPCS can show 0 exit code when running in parallel even if child process has fatal error
  • Thanks to Alex Panshin (@​enl) for the patch
• Fixed bug #3653 : False positives for match() in OperatorSpacingSniff
  • Thanks to Jaroslav Hanslík (@​kukulich) for the patch
• Fixed bug #3666 : PEAR.Functions.FunctionCallSignature incorrect indent fix when checking mixed HTML/PHP files
• Fixed bug #3668 : PSR12.Classes.ClassInstantiation.MissingParentheses false positive when instantiating parent classes
  • Similar issues also fixed in Generic.Functions.FunctionCallArgumentSpacing and Squiz.Formatting.OperatorBracket
  • Thanks to Juliette Reinders Folmer (@​jrfnl) for the patch
• Fixed bug #3672 : Incorrect ScopeIndent.IncorrectExact report for match inside array literal
• Fixed bug #3694 : Generic.WhiteSpace.SpreadOperatorSpacingAfter does not ignore spread operator in PHP 8.1 first class callables
  • Thanks to Juliette Reinders Folmer (@​jrfnl) for the patch

3.7.1

• Fixed bug #3609: Methods/constants with name empty/isset/unset are always reported as error
  • Thanks to Juliette Reinders Folmer (@​jrfnl) for the patch

3.7.0

PHP 8.1 Language Feature Support

PHP_CodeSniffer has run correctly under PHP 8.1 since PHP 8 support was added, but it has not supported new 8.1 language features until this release. Version 3.7.0 adds support for the following PHP 8.1 language features:

• Enums
• Explicit octal notation
• Readonly properties
• Intersection types
• The never type

Note: Standards and sniffs included with PHP_CodeSniffer have been updated to support these language features, but external standards and sniffs may need updating before they are able to detect them correctly.

Changelog

• Added support for PHP 8.1 explicit octal notation

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Jira Tickets Resolved

• VUL-26724

CVE Table

Package	CVE	Severity	Description	Fixed in
squizlabs/php_codesniffer	CVE-2026-67434	High	PHP_CodeSniffer gitblame report command injection via crafted filename	3.13.6

[samwise-service]

Also resolves VUL-26724 (CVE-2026-67434) — this Dependabot PR bumps squizlabs/php_codesniffer to 3.13.6, the version that patches CVE-2026-67434 (PHP_CodeSniffer gitblame report command injection). Jira/CVE lists updated in the PR body.