chore(deps-dev): bump squizlabs/php_codesniffer from 3.11.3 to 4.0.0

[dependabot]

Bumps squizlabs/php_codesniffer from 3.11.3 to 4.0.0.

Release notes

Sourced from squizlabs/php_codesniffer's releases.

4.0.0RC1 - 2025-06-18

This release includes all improvements and bugfixes from PHP_CodeSniffer 3.13.1 and 3.13.2.

Changed

• The error code Squiz.Functions.FunctionDeclarationArgumentSpacing.SpacingAfterVisbility has been changed to Squiz.Functions.FunctionDeclarationArgumentSpacing.SpacingAfterVisibility. #1136
  • Thanks to Juliette Reinders Folmer for the patch.
• The following sniff(s) have received efficiency improvements:
  • Generic.ControlStructures.InlineControlStructure #880
  • Thanks to Rodrigo Primo for the patch.

Fixed

• Fixed bug #3889 : A selective phpcs:enable could sometimes override a later selective phpcs:ignore.
  • Thanks to Brad Jorsch for the patch
• Fixed bug #1128 : missing 'parenthesis_owner' index for T_FUNCTION token on PHP < 7.4 when function is named "fn".
  • Thanks to Juliette Reinders Folmer for the patch.

Other

• The GPG signature for the PHAR files has been rotated. The new fingerprint is: D91D86963AF3A29B6520462297B02DD8E5071466.

Calling all testers!

Please help by testing the RC release and reporting any issues you run into. Upgrade guides for both ruleset maintainers/end-users, as well as for sniff developers and integrators, have been published to the Wiki to help smooth the transition.

---

Statistics

Closed: 2 issues Merged: 4 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

4.0.0beta1

Added

• Files without extension can now be scanned if the path is passed in directly. #2916
  • Previously, files without extension would always be ignored.
  • Now, files with no extension are checked if explicitly passed on the command line or specified in a ruleset.
  • Files without extension will still be ignored when scanning directories recursively.
• Support for extending a default value for an array property on a sniff from an XML ruleset file. #15
  • Previously, using extend="true" on an property tag for setting an array value could already extend a property value set elsewhere in an (inluded) ruleset.
  • Now, you can also add to (extend) a default value as set on the sniff itself.
  • Note: the property default value and the values set via the ruleset will be merged.
    • This also means that for associative arrays, you can redefine the value for a particular array key.
    • For numerically indexed arrays, this means the array will be renumbered. Keep this in mind if the numeric indexes hold meaning.
• Added support for PHP 8.4 properties in interfaces to File::getMemberProperties(). #2455

... (truncated)

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

Changelog

The file documents changes to the PHP_CodeSniffer project for the 3.x series of releases.

[3.13.4] - 2025-09-05

Fixed

• Fixed bug #1213: ability to run tests for external standards using the PHPCS native test framework was broken.
  • Thanks to [Juliette Reinders Folmer][@​jrfnl] for the patch.
• Fixed bug #1215: PHP 8.5 "Using null as an array offset" deprecation notices.
  • Thanks to [Juliette Reinders Folmer][@​jrfnl] for the patch.

#1213: PHPCSStandards/PHP_CodeSniffer#1213 #1215: PHPCSStandards/PHP_CodeSniffer#1215

[3.13.3] - 2025-09-04

Added

• Tokenizer support for PHP 8.4 dereferencing of new expressions without wrapping parentheses. #1160
  • Thanks to [Juliette Reinders Folmer][@​jrfnl] for the patch.
• Tokenizer support for PHP 8.4 abstract properties. #1183
  • The File::getMemberProperties() method now also supports abstract properties through a new is_abstract array index in the return value. #1184
  • Additionally, the following sniffs have been updated to support abstract properties:
    • Generic.PHP.LowerCaseConstant #1185
    • Generic.PHP.UpperCaseConstant #1185
    • PSR2.Classes.PropertyDeclaration #1188
    • Squiz.Commenting.VariableComment #1186
    • Squiz.WhiteSpace.MemberVarSpacing #1187
  • Thanks to [Juliette Reinders Folmer][@​jrfnl] for the patches
• Tokenizer support for the PHP 8.4 "exit as a function call" change. #1201
  • When exit/die is used as a fully qualified "function call", it will now be tokenized as T_NS_SEPARATOR + T_EXIT.
  • Additionally, the following sniff has been updated to handle fully qualified exit/die correctly:
    • Squiz.PHP.NonExecutableCode
  • Thanks to [Juliette Reinders Folmer][@​jrfnl] for the patches

Changed

• Tokenizer/PHP: fully qualified true/false/null will now be tokenized as T_NS_SEPARATOR + T_TRUE/T_FALSE/T_NULL. #1201
  • Previously, these were tokenized as T_NS_SEPARATOR + T_STRING.
  • Additionally, the following sniffs have been updated to handle fully qualified true/false/null correctly:
    • Generic.CodeAnalysis.UnconditionalIfStatement
    • Generic.ControlStructures.DisallowYodaConditions
    • PEAR.Functions.ValidDefaultValue
  • Thanks to [Juliette Reinders Folmer][@​jrfnl] for the patches.
• Generic.PHP.Syntax: the sniff is now able to scan input provided via STDIN on non-Windows OSes. #915
  • Thanks to [Rodrigo Primo][@​rodrigoprimo] for the patch.
• PSR2.ControlStructures.SwitchDeclaration: the WrongOpener* error code is now auto-fixable if the identified "wrong opener" is a semi-colon. #1161
  • Thanks to [Juliette Reinders Folmer][@​jrfnl] for the patch.
• The PSR2.Classes.PropertyDeclaration will now check that the abstract modifier keyword is placed before a visibility keyword. #1188
  • Errors will be reported via a new AbstractAfterVisibility error code.

... (truncated)

Commits

• 06113cf Merge pull request #1260 from PHPCSStandards/feature/changelog-4.0.0
• 7bb1928 Merge branch '3.x' into 4.x
• 8222a52 Merge pull request #1261 from PHPCSStandards/feature/release-checklist-fix-order
• 82f2cd8 Release checklist: fix order
• 68e414d Changelog for the 4.0.0 release
• 2f9900a Merge branch '3.x' into 4.x
• 38efc5d Merge pull request #1259 from PHPCSStandards/feature/update-release-checklist...
• 230c7c2 Update release checklist and document branch management
• c66fd3c Merge branch '3.x' into 4.x
• 3acd7ee Merge pull request #1258 from PHPCSStandards/feature/updates-for-branch-rename
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)