From e47a466b2fd23bc0ee6e85e06ce16078576918ac Mon Sep 17 00:00:00 2001 From: Mark Scherer Date: Thu, 6 Aug 2026 13:29:24 +0200 Subject: [PATCH] Raise php_codesniffer minimum to 4.0.2 for CVE-2026-67434 PHP_CodeSniffer published an OS command injection advisory on 2026-08-05, covering everything below 3.13.6 and 4.0.0 up to but not including 4.0.2. The constraint here allowed 4.0.1, so a fresh install could pull an affected version. This is also what turned the prefer-lowest job red. Composer refuses to resolve packages under an active advisory, so it could not pick the declared 4.0.1 minimum and settled on 4.0.2, which validate-prefer-lowest then reported as a mismatch between the declared minimum and the installed one. Verified locally against 4.0.4: composer audit is clean and the suite passes on 8.4 and 8.5, so nothing between 4.0.1 and 4.0.4 affects a sniff here. --- composer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/composer.json b/composer.json index 21eab3c..6adbbe2 100644 --- a/composer.json +++ b/composer.json @@ -21,7 +21,7 @@ "php": ">=8.1", "phpcsstandards/phpcsextra": "^1.5.0", "slevomat/coding-standard": "^8.23.0", - "squizlabs/php_codesniffer": "^4.0.1" + "squizlabs/php_codesniffer": "^4.0.2" }, "require-dev": { "phpstan/phpstan": "^2.0.0",