Bump squizlabs/php_codesniffer from 3.13.5 to 4.0.1

[dependabot]

Bumps squizlabs/php_codesniffer from 3.13.5 to 4.0.1.

Release notes

Sourced from squizlabs/php_codesniffer's releases.

4.0.1 - 2025-11-10

This release includes all improvements and bugfixes from PHP_CodeSniffer 3.13.5.

Added

• Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
  • Syntax support for new PHP 8.5 features will follow in a future release.
  • If you find any PHP 8.5 deprecation notices which were missed, please report them.

Changed

• The Squiz.ControlStructures.SwitchDeclaration sniff will now flag a PHP close tag as a "wrong opener" and will auto-fix this by inserting a colon. #1316
• Various housekeeping, including improvements to the tests and documentation.

Fixed

• 4.x regression #1277: bring back whitespace tolerance in phpcs:ignore comma-separated rule reference lists.
  • Note: this bug did not affect phpcs:disable/phpcs:enable ignore annotations.
• Fixed bug #968: Generic.WhiteSpace.ScopeIndent was reporting false positives - and making incorrect fixes - for lines following a line containing an arrow function.
  • Thanks to Soichi Sato for the patch.
• Fixed bug #1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Thanks to Andrew Lyons for the patch.
• Fixed bug #1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
  • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
• Fixed bug #1315: Squiz.ControlStructures.SwitchDeclaration: a number of the fixers would get into fixer conflicts with each other if the code under scan contained multiple statements on a line within a switch.
  • The sniff will now forbid - and auto-fix - multiple statements on one line for case/default and "case breaking" statements.
• Fixed bug #1316: Tokenizer/PHP: a PHP close tag after a switch case condition or after a default keyword, was not regarded as a "scope_opener" for the case/default body.
• Fixed bug #1316: PSR2.ControlStructures.SwitchDeclaration: the WrongOpener error is now also auto-fixable if the wrong opener is a PHP close tag.
• Fixed bug #1316: Squiz.PHP.NonExecutableCode would throw false positives when code within a switch control structure would move in and out of PHP.

---

New Contributors

The PHP_CodeSniffer project is happy to welcome the following new contributors: @​andrewnicols, @​Soh1121

Statistics

Closed: 2 issues Merged: 8 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

4.0.0 - 2025-09-16

This release contains breaking changes.

Upgrade guides for both ruleset maintainers/end-users, as well as for sniff developers and integrators, have been published to the Wiki.

You are strongly encouraged to read the upgrade guide applicable to your situation before upgrading.

... (truncated)

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

Changelog

The file documents changes to the PHP_CodeSniffer project for the 3.x series of releases.

Commits

• 0525c73 Merge pull request #1318 from PHPCSStandards/feature/changelog-4.0.1
• 4c09fb4 Changelog for the 4.0.1 release
• 7ed8ea2 Merge pull request #1316 from PHPCSStandards/feature/tokenizer-php-switch-cas...
• b80dc24 Various sniffs: update tests to safeguard handling of case/default with P...
• 6bd0af6 Squiz/NonExecutableCode: bug fix - false positive with PHP close tag after ca...
• 6d61496 Squiz/SwitchDeclaration: make implied semicolon via close tag auto-fixable
• 21c0e80 PSR2/SwitchDeclaration: make implied semicolon via close tag auto-fixable
• 6327f77 Tokenizer/PHP: PHP close tag should be regarded as scope opener for switch ca...
• 9397930 Squiz/SwitchDeclaration: bug fix - fixer conflict for single line code (#1315)
• 2c13a90 Merge pull request #1308 from Soh1121/issue-968/fix-wrong-indentation-with-ar...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codacy-production]

Pull Request Overview

This PR aims to upgrade squizlabs/php_codesniffer from version 3.13.5 to 4.0.1. While the intention is clear, the current state of the PR is problematic as no file changes are actually present in the diff, meaning the manifest update has not been implemented. Furthermore, moving from v3 to v4 is a major version jump that introduces breaking changes. These changes must be validated against the current project configuration and codebase to ensure that the linting suite does not fail in CI environments.

About this PR

• The pull request does not contain any file changes. The actual upgrade of squizlabs/php_codesniffer in the project manifest (e.g., composer.json or lock files) is missing.
• Upgrading a core linting tool across a major version (v3 to v4) without accompanying configuration updates or evidence of local testing poses a high risk of CI failure due to deprecated sniffs or breaking changes in the tokenizer.

Test suggestions

• Run phpcs on PHP 8.5 to verify the fix for deprecation notices.
• Execute the linting suite against the current codebase to check for regressions or breaking changes from the v4.0.0 upgrade.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Run phpcs on PHP 8.5 to verify the fix for deprecation notices.
2. Execute the linting suite against the current codebase to check for regressions or breaking changes from the v4.0.0 upgrade.

Low confidence findings

• The PR description is truncated. This may hide important migration steps or specific breaking change details necessary for the v4.0.0 upgrade.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}