Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 1, 2025

Bumps squizlabs/php_codesniffer from 4.0.0 to 4.0.1.

Release notes

Sourced from squizlabs/php_codesniffer's releases.

4.0.1 - 2025-11-10

This release includes all improvements and bugfixes from PHP_CodeSniffer 3.13.5.

Added

  • Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
    • Syntax support for new PHP 8.5 features will follow in a future release.
    • If you find any PHP 8.5 deprecation notices which were missed, please report them.

Changed

  • The Squiz.ControlStructures.SwitchDeclaration sniff will now flag a PHP close tag as a "wrong opener" and will auto-fix this by inserting a colon. #1316
  • Various housekeeping, including improvements to the tests and documentation.

Fixed

  • 4.x regression #1277: bring back whitespace tolerance in phpcs:ignore comma-separated rule reference lists.
    • Note: this bug did not affect phpcs:disable/phpcs:enable ignore annotations.
  • Fixed bug #968: Generic.WhiteSpace.ScopeIndent was reporting false positives - and making incorrect fixes - for lines following a line containing an arrow function.
  • Fixed bug #1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Fixed bug #1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
    • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
  • Fixed bug #1315: Squiz.ControlStructures.SwitchDeclaration: a number of the fixers would get into fixer conflicts with each other if the code under scan contained multiple statements on a line within a switch.
    • The sniff will now forbid - and auto-fix - multiple statements on one line for case/default and "case breaking" statements.
  • Fixed bug #1316: Tokenizer/PHP: a PHP close tag after a switch case condition or after a default keyword, was not regarded as a "scope_opener" for the case/default body.
  • Fixed bug #1316: PSR2.ControlStructures.SwitchDeclaration: the WrongOpener error is now also auto-fixable if the wrong opener is a PHP close tag.
  • Fixed bug #1316: Squiz.PHP.NonExecutableCode would throw false positives when code within a switch control structure would move in and out of PHP.

New Contributors

The PHP_CodeSniffer project is happy to welcome the following new contributors: @​andrewnicols, @​Soh1121

Statistics

Closed: 2 issues Merged: 8 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

[4.0.1] - 2025-11-10

This release includes all improvements and bugfixes from PHP_CodeSniffer 3.13.5.

Added

  • Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
    • Syntax support for new PHP 8.5 features will follow in a future release.
    • If you find any PHP 8.5 deprecation notices which were missed, please report them.

Changed

  • The Squiz.ControlStructures.SwitchDeclaration sniff will now flag a PHP close tag as a "wrong opener" and will auto-fix this by inserting a colon. #1316
  • Various housekeeping, including improvements to the tests and documentation.

Fixed

  • 4.x regression #1277: bring back whitespace tolerance in phpcs:ignore comma-separated rule reference lists.
    • Note: this bug did not affect phpcs:disable/phpcs:enable ignore annotations.
  • Fixed bug #968: Generic.WhiteSpace.ScopeIndent was reporting false positives - and making incorrect fixes - for lines following a line containing an arrow function.
  • Fixed bug #1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Fixed bug #1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
    • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
  • Fixed bug #1315: Squiz.ControlStructures.SwitchDeclaration: a number of the fixers would get into fixer conflicts with each other if the code under scan contained multiple statements on a line within a switch.
    • The sniff will now forbid - and auto-fix - multiple statements on one line for case/default and "case breaking" statements.
  • Fixed bug #1316: Tokenizer/PHP: a PHP close tag after a switch case condition or after a default keyword, was not regarded as a "scope_opener" for the case/default body.
  • Fixed bug #1316: PSR2.ControlStructures.SwitchDeclaration: the WrongOpener error is now also auto-fixable if the wrong opener is a PHP close tag.
  • Fixed bug #1316: Squiz.PHP.NonExecutableCode would throw false positives when code within a switch control structure would move in and out of PHP.

#968: PHPCSStandards/PHP_CodeSniffer#968 #1216: PHPCSStandards/PHP_CodeSniffer#1216 #1277: PHPCSStandards/PHP_CodeSniffer#1277 #1279: PHPCSStandards/PHP_CodeSniffer#1279 #1315: PHPCSStandards/PHP_CodeSniffer#1315 #1316: PHPCSStandards/PHP_CodeSniffer#1316

Commits
  • 0525c73 Merge pull request #1318 from PHPCSStandards/feature/changelog-4.0.1
  • 4c09fb4 Changelog for the 4.0.1 release
  • 7ed8ea2 Merge pull request #1316 from PHPCSStandards/feature/tokenizer-php-switch-cas...
  • b80dc24 Various sniffs: update tests to safeguard handling of case/default with P...
  • 6bd0af6 Squiz/NonExecutableCode: bug fix - false positive with PHP close tag after ca...
  • 6d61496 Squiz/SwitchDeclaration: make implied semicolon via close tag auto-fixable
  • 21c0e80 PSR2/SwitchDeclaration: make implied semicolon via close tag auto-fixable
  • 6327f77 Tokenizer/PHP: PHP close tag should be regarded as scope opener for switch ca...
  • 9397930 Squiz/SwitchDeclaration: bug fix - fixer conflict for single line code (#1315)
  • 2c13a90 Merge pull request #1308 from Soh1121/issue-968/fix-wrong-indentation-with-ar...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [squizlabs/php_codesniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer) from 4.0.0 to 4.0.1.
- [Release notes](https://github.com/PHPCSStandards/PHP_CodeSniffer/releases)
- [Changelog](https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/4.x/CHANGELOG-4.x.md)
- [Commits](PHPCSStandards/PHP_CodeSniffer@4.0.0...4.0.1)

---
updated-dependencies:
- dependency-name: squizlabs/php_codesniffer
  dependency-version: 4.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Project dependencies are updated php Pull requests that update php code labels Dec 1, 2025
@github-actions
Copy link

github-actions bot commented Dec 1, 2025

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
composer/squizlabs/php_codesniffer 4.0.1 UnknownUnknown

Scanned Files

  • composer.lock

@sonarqubecloud
Copy link

sonarqubecloud bot commented Dec 1, 2025

@Sleon4 Sleon4 self-requested a review December 2, 2025 13:58
@Sleon4 Sleon4 added this to the Support and maintenance milestone Dec 2, 2025
@Sleon4 Sleon4 enabled auto-merge December 2, 2025 13:58
@Sleon4 Sleon4 merged commit b80a5ac into 11.x Dec 2, 2025
8 checks passed
@Sleon4 Sleon4 deleted the dependabot/composer/squizlabs/php_codesniffer-4.0.1 branch December 2, 2025 13:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Project dependencies are updated php Pull requests that update php code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant