chore(deps-dev): bump squizlabs/php_codesniffer from 3.13.5 to 3.13.6

[dependabot]

Bumps squizlabs/php_codesniffer from 3.13.5 to 3.13.6.

Release notes

Sourced from squizlabs/php_codesniffer's releases.

3.13.6 - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible.

Changed

• Various housekeeping, including improvements to the tests and documentation.
  • Thanks to Sergei Morozov and Juliette Reinders Folmer for their contributions.

Fixed

• SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters. #1473
  • Users using the default Full report, or any of the other non-*blame reports, are not affected.
  • For more details, see the security advisory.
  • Thanks go to Faze-up and Volker Dusch for responsibly disclosing the vulnerability.
  • Additionally, thanks go to Volker Dusch, Rodrigo Primo, Dan Wallis and Juliette Reinders Folmer for creating and testing the fix.

Other

• The GPG signature for the PHAR files has been rotated. The new fingerprint is: 5CB4F778BF9BC4FB67AE511D96E91A992CF22FF4.

---

Statistics

Closed: 0 issues Merged: 46 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

[3.13.6] - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible.

Changed

• Various housekeeping, including improvements to the tests and documentation.
  • Thanks to [Sergei Morozov][@​morozov] and [Juliette Reinders Folmer][@​jrfnl] for their contributions.

Fixed

• SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters. #1473
  • Users using the default Full report, or any of the other non-*blame reports, are not affected.
  • For more details, see the security advisory.
  • Thanks go to [Faze-up][@​Faze-up] and [Volker Dusch][@​edorian] for responsibly disclosing the vulnerability.
  • Additionally, thanks go to [Volker Dusch][@​edorian], [Rodrigo Primo][@​rodrigoprimo], [Dan Wallis][@​fredden] and [Juliette Reinders Folmer][@​jrfnl] for creating and testing the fix.

Other

• The GPG signature for the PHAR files has been rotated. The new fingerprint is: 5CB4F778BF9BC4FB67AE511D96E91A992CF22FF4.

#1473: PHPCSStandards/PHP_CodeSniffer#1473

Commits

• 4c378e1 Merge pull request #1474 from PHPCSStandards/feature/changelog-3.13.6
• ddbf849 Merge pull request #1473 from PHPCSStandards/security/cve-2026-67434
• 742a068 Changelog for the 3.13.6 release
• 7a3a6bb Reports/*blame: properly escape file name
• b5ce04f Merge pull request #1470 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 5f72703 GH Actions: Bump the action-runners group with 2 updates
• 20d0f55 Merge pull request #1466 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 2a2ac29 Merge pull request #1469 from PHPCSStandards/feature/ghactions-setup-php-fail...
• 6df695f Merge pull request #1467 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 4da0184 GH Actions: fail "setup-php" if requested tooling could not be installed
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[rafaucau]

@dependabot rebase

[dependabot]

The dependabot.yml entry that created this PR has been deleted so this PR can't be rebased. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.