You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters. #1473
Users using the default Full report, or any of the other non-*blame reports, are not affected.
Fixed bug #1197 : Squiz.Commenting.FunctionComment: return types containing a class name with underscores would be truncated leading to incorrect results.
Added support for PHP 8.4 properties with asymmetric visibility to File::getMemberProperties() through a new set_scope array index in the return value. #1116
Added support for PHP 8.4 (constructor promoted) properties with asymmetric visibility to File::getMethodParameters() through new set_visibility and set_visibility_token array indexes in the return value. #1116
The PSR2.Classes.PropertyDeclaration will now check that a set-visibility modifier keyword is placed after a potential general visibility keyword. #1119
Errors will be reported via a new AvizKeywordOrder error code.
The Squiz.Scope.MemberVarScope will now flag missing "read" visibility, when "write" visibility is set, under a separate error code AsymReadMissing. #1122
The latest PHP_CodeSniffer XSD file is now available via the following permalink: https://schema.phpcodesniffer.com/phpcs.xsd. #1094
Older XSD files can be referenced via permalinks based on their minor: https://schema.phpcodesniffer.com/#.#/phpcs.xsd.
The GPG signature for the PHAR files has been rotated. The new fingerprint is: D91D869.
The first beta release for PHP_CodeSniffer 4.0 has been tagged. Please help by testing the beta release and reporting any issues you run into.
Upgrade guides for both ruleset maintainers/end-users, as well as for sniff developers and integrators, have been published to the Wiki to help smooth the transition.
Tokenizer/PHP: a PHP open tag at the very end of a file will now always be tokenized as T_OPEN_TAG, independently of the PHP version. #937
Previously, a PHP open tag at the end of a file was not tokenized as an open tag on PHP < 7.4 and the tokenization would depend on the short_open_tag setting.
PHP_CodeSniffer 4.0 is coming soon! Interested in a sneak peek ? Join the live stream at any time on April 14, 15, 17 or 18.
Read the open invitation (#924) for all the details.
New Contributors
The PHP_CodeSniffer project is happy to welcome the following new contributors: @devfrey
PHP_CodeSniffer 4.0 is coming soon! Interested in a sneak peek ? Join the live stream at any time on April 14, 15, 17 or 18.
Read the open invitation (#924) for all the details.
New Contributors
The PHP_CodeSniffer project is happy to welcome the following new contributors: @costdev
Squiz.Functions.FunctionDeclarationArgumentSpacing: incorrect spacing after a comma followed by a promoted property has an improved error message and will now be flagged with the SpacingBeforePropertyModifier or NoSpaceBeforePropertyModifier error codes. #792
This was previously already flagged, but using either the SpacingBeforeHint or NoSpaceBeforeHint error code, which was misleading.
Squiz.Functions.FunctionDeclarationArgumentSpacing: the sniff will now also check the spacing after property modifiers for promoted properties in constructor methods. #792
Fixed bug #833 : Squiz.PHP.EmbeddedPhp: fixer conflict when a PHP open tag for a multi-line snippet is found on the same line as a single-line embedded PHP snippet.
Fixed bug #838 : Squiz.PHP.EmbeddedPhp: no new line before close tag was incorrectly enforced when a preceding OO construct or function had a trailing comment after the close curly.
Fixed bug #620 : Squiz.Functions.FunctionDeclarationArgumentSpacing: newlines after type will now be handled by the fixer. This also prevents a potential fixer conflict.
Fixed bug #783 : Squiz.Functions.FunctionDeclarationArgumentSpacing: new line before/after the equal sign for default values was not flagged nor fixed when equalsSpacing was set to 0.
Fixed bug #783 : Squiz.Functions.FunctionDeclarationArgumentSpacing: fixer conflict when a new line is found before/after the equal sign for default values and equalsSpacing was set to 1.
Fixed bug #783 : Squiz.Functions.FunctionDeclarationArgumentSpacing: fixer will now handle comments between the end of a parameter and a comma more cleanly.
Fixed bug #784 : Squiz.WhiteSpace.FunctionSpacing: prevent fixer conflict when a multi-line docblock would start on the same line as the function close curly being examined.
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: composer.lock
Command failed: composer update squizlabs/php_codesniffer:3.9.2 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.
Problem 1
- guzzlehttp/guzzle is locked to version 7.0.1 and an update of this package was not requested.
- guzzlehttp/guzzle 7.0.1 requires php ^7.2.5 -> your php version (8.3.6) does not satisfy that requirement.
Problem 2
- phpspec/prophecy 1.14.0 requires php ^7.2 || ~8.0, <8.2 -> your php version (8.3.6) does not satisfy that requirement.
- phpunit/phpunit 9.5.10 requires phpspec/prophecy ^1.12.1 -> satisfiable by phpspec/prophecy[1.14.0].
- phpunit/phpunit is locked to version 9.5.10 and an update of this package was not requested.
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.7.1
chore(deps): update dependency squizlabs/php_codesniffer to v3.7.2
Mar 17, 2023
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.7.2
chore(deps): update dependency squizlabs/php_codesniffer to v3.8.0
Dec 8, 2023
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.8.0
chore(deps): update dependency squizlabs/php_codesniffer to v3.8.1
Jan 11, 2024
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.8.1
chore(deps): update dependency squizlabs/php_codesniffer to v3.9.0
Feb 16, 2024
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.9.0
chore(deps): update dependency squizlabs/php_codesniffer to v3.9.1
Mar 31, 2024
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.9.1
chore(deps): update dependency squizlabs/php_codesniffer to v3.9.2
Apr 23, 2024
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.9.2
chore(deps): update dependency squizlabs/php_codesniffer to v3.10.0
May 20, 2024
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: composer.lock
Command failed: composer update squizlabs/php_codesniffer:3.13.6 --with-dependencies --ignore-platform-req=ext-* --ignore-platform-req=lib-* --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.
Problem 1
- guzzlehttp/guzzle is locked to version 7.0.1 and an update of this package was not requested.
- guzzlehttp/guzzle 7.0.1 requires php ^7.2.5 -> your php version (8.5.9) does not satisfy that requirement.
Problem 2
- phpunit/phpunit is locked to version 9.5.10 and an update of this package was not requested.
- phpspec/prophecy 1.14.0 requires php ^7.2 || ~8.0, <8.2 -> your php version (8.5.9) does not satisfy that requirement.
- phpunit/phpunit 9.5.10 requires phpspec/prophecy ^1.12.1 -> satisfiable by phpspec/prophecy[1.14.0].
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.10.0
chore(deps): update dependency squizlabs/php_codesniffer to v3.10.1
May 22, 2024
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.10.1
chore(deps): update dependency squizlabs/php_codesniffer to v3.10.2
Jul 22, 2024
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.10.2
chore(deps): update dependency squizlabs/php_codesniffer to v3.10.3
Sep 18, 2024
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.10.3
chore(deps): update dependency squizlabs/php_codesniffer to v3.11.0
Nov 12, 2024
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.11.0
chore(deps): update dependency squizlabs/php_codesniffer to v3.11.1
Nov 16, 2024
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.11.1
chore(deps): update dependency squizlabs/php_codesniffer to v3.11.2
Dec 11, 2024
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.11.2
chore(deps): update dependency squizlabs/php_codesniffer to v3.11.3
Jan 23, 2025
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.11.3
chore(deps): update dependency squizlabs/php_codesniffer to v3.12.0
Mar 18, 2025
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.12.0
chore(deps): update dependency squizlabs/php_codesniffer to v3.12.1
Apr 4, 2025
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.12.1
chore(deps): update dependency squizlabs/php_codesniffer to v3.12.2
Apr 13, 2025
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.12.2
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.0
May 11, 2025
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.0
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.1
Jun 12, 2025
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.1
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.2
Jun 17, 2025
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.2
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.3
Sep 4, 2025
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.3
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.4
Sep 5, 2025
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.4
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.5
Nov 4, 2025
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.5
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.6
Aug 6, 2026
renovateBot
changed the title
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.6
chore(deps): update dependency squizlabs/php_codesniffer to v3.13.6 - autoclosed
Aug 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.6.2→3.13.6Release Notes
PHPCSStandards/PHP_CodeSniffer (squizlabs/php_codesniffer)
v3.13.6: - 2026-08-06Compare Source
This is a security release and all users are advised to update their install(s) as soon as possible.
Changed
Fixed
Gitblame,HgblameorSvnblamereport(s) would process a file whose name contains shell metacharacters. #1473Fullreport, or any of the other non-*blame reports, are not affected.Other
5CB4F77.Statistics
Closed: 0 issues
Merged: 46 pull requests
Follow @phpcs on Mastodon or @PHP_CodeSniffer on X to stay informed.
Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!
v3.13.5: - 2025-11-04Compare Source
Added
Changed
Fixed
Other
masterbranch has been renamed to3.xand the default branch has changed to the4.xbranch.New Contributors
The PHP_CodeSniffer project is happy to welcome the following new contributors:
@andrewnicols
Statistics
Closed: 2 issues
Merged: 36 pull requests
Follow @phpcs on Mastodon or @PHP_CodeSniffer on X to stay informed.
Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!
v3.13.4: - 2025-09-05Compare Source
Fixed
Statistics
Closed: 0 issues
Merged: 3 pull requests
If you like to stay informed about releases and more, follow @phpcs on Mastodon or @PHP_CodeSniffer on X.
Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!
v3.13.3: - 2025-09-04Compare Source
Added
abstractproperties. #1183File::getMemberProperties()method now also supportsabstractproperties through a newis_abstractarray index in the return value. #1184abstractproperties:exit/dieis used as a fully qualified "function call", it will now be tokenized asT_NS_SEPARATOR+T_EXIT.Changed
true/false/nullwill now be tokenized asT_NS_SEPARATOR+T_TRUE/T_FALSE/T_NULL. #1201T_NS_SEPARATOR+T_STRING.WrongOpener*error code is now auto-fixable if the identified "wrong opener" is a semi-colon. #1161AbstractAfterVisibilityerror code.Fixed
--paralleloption fails if PHP_CodeSniffer is invoked via bash and the invokation creates a non-PHPCS-managed process.--parallelscanning was enabled.Other
Contributions welcome !
New Contributors
The PHP_CodeSniffer project is happy to welcome the following new contributors:
@benno5020, @NanoSector
Statistics
Closed: 11 issues
Merged: 40 pull requests
Follow @phpcs on Mastodon or @PHP_CodeSniffer on X to stay informed.
Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!
v3.13.2: - 2025-06-18Compare Source
Changed
Fixed
SpacingAfterSetVis[i]bility.Statistics
Closed: 0 issues
Merged: 6 pull requests
Follow @phpcs on Mastodon or @PHP_CodeSniffer on X to stay informed.
Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!
v3.13.1: - 2025-06-13Compare Source
Added
set_scopearray index in the return value. #1116set_visibilityandset_visibility_tokenarray indexes in the return value. #1116Changed
AvizKeywordOrdererror code.SpacingAfterSetVisibilityerror code.AsymReadMissing. #1122Other
Older XSD files can be referenced via permalinks based on their minor:
https://schema.phpcodesniffer.com/#.#/phpcs.xsd.D91D869.Statistics
Closed: 3 issues
Merged: 24 pull requests
Follow @phpcs on Mastodon or @PHP_CodeSniffer on X to stay informed.
Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!
v3.13.0: - 2025-05-11Compare Source
Added
finalproperties to the following sniffs:Changed
gotolanguage construct keyword. #917finalmodifier keyword is placed before a visibility keyword. #950FinalAfterVisibilityerror code.--reportsCLI flag. #1078Deprecated
PHP_CodeSniffer\Sniffs\Sniffinterface. #891-q(=quiet) CLI flag.Fixed
Other
Calling all testers!
The first beta release for PHP_CodeSniffer 4.0 has been tagged. Please help by testing the beta release and reporting any issues you run into.
Upgrade guides for both ruleset maintainers/end-users, as well as for sniff developers and integrators, have been published to the Wiki to help smooth the transition.
Statistics
Closed: 3 issues
Merged: 29 pull requests
Follow @phpcs on Mastodon or @PHP_CodeSniffer on X to stay informed.
Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!
v3.12.2: - 2025-04-13Compare Source
Added
finalproperties to the following sniffs:Changed
short_open_tagsetting.Fixed
@paramtags.finalclasses.Diff+ theCodereports are requested and caching is on.Other
Read the open invitation (#924) for all the details.
New Contributors
The PHP_CodeSniffer project is happy to welcome the following new contributors:
@devfrey
Statistics
Closed: 1 issues
Merged: 36 pull requests
Follow @phpcs on Mastodon or @PHP_CodeSniffer on X to stay informed.
Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!
v3.12.1: - 2025-04-04Compare Source
Added
Changed
Deprecated
Generic.Functions.CallTimePassByReferencesniff. See #921.Fixed
InvalidArgumentExceptions when displaying verbose information.?in nullable types for readonly properties.gotowas not recognized as a terminating statement for a case/default in a switch control structure.Other
Read the open invitation (#924) for all the details.
New Contributors
The PHP_CodeSniffer project is happy to welcome the following new contributors:
@costdev
Statistics
Closed: 0 issues
Merged: 24 pull requests
Follow @phpcs on Mastodon or @PHP_CodeSniffer on X to stay informed.
Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!
v3.12.0: - 2025-03-18Compare Source
Added
is_finalarray index in the return value. #834Changed
-h(Help) option now contains a more extensive list of "config" options which can be set. #809--sniffsor--excludecommand line arguments. #344--generatorcommand line argument. #709, #771titleattribute is missing, the documentation generation will now fall back to the sniff name as the title. #820SpacingBeforePropertyModifierorNoSpaceBeforePropertyModifiererror codes. #792SpacingBeforeHintorNoSpaceBeforeHinterror code, which was misleading.finalandabstractmodifier keywords. #604Internal.PropertyDoesNotExisterror code.Deprecated
All deprecation are slated for removal in PHP_CodeSniffer 4.0.
Sniffinterface. See #694.PHP_CodeSniffer\Generators\Text::printTitle()in favour ofPHP_CodeSniffer\Generators\Text::getFormattedTitle()PHP_CodeSniffer\Generators\Text::printTextBlock()in favour ofPHP_CodeSniffer\Generators\Text::getFormattedTextBlock()PHP_CodeSniffer\Generators\Text::printCodeComparisonBlock()in favour ofPHP_CodeSniffer\Generators\Text::getFormattedCodeComparisonBlock()PHP_CodeSniffer\Generators\Markdown::printHeader()in favour ofPHP_CodeSniffer\Generators\Markdown::getFormattedHeader()PHP_CodeSniffer\Generators\Markdown::printFooter()in favour ofPHP_CodeSniffer\Generators\Markdown::getFormattedFooter()PHP_CodeSniffer\Generators\Markdown::printTextBlock()in favour ofPHP_CodeSniffer\Generators\Markdown::getFormattedTextBlock()PHP_CodeSniffer\Generators\Markdown::printCodeComparisonBlock()in favour ofPHP_CodeSniffer\Generators\Markdown::getFormattedCodeComparisonBlock()PHP_CodeSniffer\Generators\HTML::printHeader()in favour ofPHP_CodeSniffer\Generators\HTML::getFormattedHeader()PHP_CodeSniffer\Generators\HTML::printToc()in favour ofPHP_CodeSniffer\Generators\HTML::getFormattedToc()PHP_CodeSniffer\Generators\HTML::printFooter()in favour ofPHP_CodeSniffer\Generators\HTML::getFormattedFooter()PHP_CodeSniffer\Generators\HTML::printTextBlock()in favour ofPHP_CodeSniffer\Generators\HTML::getFormattedTextBlock()PHP_CodeSniffer\Generators\HTML::printCodeComparisonBlock()in favour ofPHP_CodeSniffer\Generators\HTML::getFormattedCodeComparisonBlock()Fixed
readonlyproperties.[0 => ''].Other
New Contributors
The PHP_CodeSniffer project is happy to welcome the following new contributors:
@asispts, @braindawg, @DanielEScherzer, @peterwilsoncc
Statistics
Closed: 5 issues
Merged: 74 pull requests
Follow @phpcs on Mastodon or @PHP_CodeSniffer on X to stay informed.
Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!
v3.11.3: - 2025-01-23Compare Source
Changed
SpaceBeforeCommaerror. #783Fixed
equalsSpacingwas set to0.equalsSpacingwas set to1.Statistics
Closed: 0 issues
Merged: 14 pull requests
If you like to stay informed about releases and more, follow @phpcs on Mastodon or @PHP_CodeSniffer on X.
Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!
v3.11.2: - 2024-12-11Compare Source
Changed
<standard>blocks. #723Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.