From 6ac6d27368a4db8a639f913c09ce25f09c2d9d2e Mon Sep 17 00:00:00 2001 From: Taco Verdonschot Date: Fri, 14 Aug 2026 12:01:00 +0200 Subject: [PATCH] Bump squizlabs/php_codesniffer to 3.13.6 (CVE-2026-67434) 3.13.5 has a known OS command injection vulnerability (GHSA-hmqg-cxww-wqhq), which makes the Security workflow fail on every PR. Dev dependency only; composer check-cs verified working on 3.13.6. Co-Authored-By: Claude Fable 5 --- composer.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/composer.lock b/composer.lock index 2ea31f9ee..f1e4112d8 100644 --- a/composer.lock +++ b/composer.lock @@ -5234,16 +5234,16 @@ }, { "name": "squizlabs/php_codesniffer", - "version": "3.13.5", + "version": "3.13.6", "source": { "type": "git", "url": "https://github.com/PHPCSStandards/PHP_CodeSniffer.git", - "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4" + "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/0ca86845ce43291e8f5692c7356fccf3bcf02bf4", - "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4", + "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/4c378e1a528ea066890fc2397cbdd2f94eb2fc91", + "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91", "shasum": "" }, "require": { @@ -5309,7 +5309,7 @@ "type": "thanks_dev" } ], - "time": "2025-11-04T16:30:35+00:00" + "time": "2026-08-06T00:17:32+00:00" }, { "name": "symfony/console",