Update squizlabs/php_codesniffer requirement from ^3.11 to ^4.0

[dependabot]

Updates the requirements on squizlabs/php_codesniffer to permit the latest version.

Release notes

Sourced from squizlabs/php_codesniffer's releases.

4.0.1 - 2025-11-10

This release includes all improvements and bugfixes from PHP_CodeSniffer 3.13.5.

Added

• Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
  • Syntax support for new PHP 8.5 features will follow in a future release.
  • If you find any PHP 8.5 deprecation notices which were missed, please report them.

Changed

• The Squiz.ControlStructures.SwitchDeclaration sniff will now flag a PHP close tag as a "wrong opener" and will auto-fix this by inserting a colon. #1316
• Various housekeeping, including improvements to the tests and documentation.

Fixed

• 4.x regression #1277: bring back whitespace tolerance in phpcs:ignore comma-separated rule reference lists.
  • Note: this bug did not affect phpcs:disable/phpcs:enable ignore annotations.
• Fixed bug #968: Generic.WhiteSpace.ScopeIndent was reporting false positives - and making incorrect fixes - for lines following a line containing an arrow function.
  • Thanks to Soichi Sato for the patch.
• Fixed bug #1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Thanks to Andrew Lyons for the patch.
• Fixed bug #1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
  • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
• Fixed bug #1315: Squiz.ControlStructures.SwitchDeclaration: a number of the fixers would get into fixer conflicts with each other if the code under scan contained multiple statements on a line within a switch.
  • The sniff will now forbid - and auto-fix - multiple statements on one line for case/default and "case breaking" statements.
• Fixed bug #1316: Tokenizer/PHP: a PHP close tag after a switch case condition or after a default keyword, was not regarded as a "scope_opener" for the case/default body.
• Fixed bug #1316: PSR2.ControlStructures.SwitchDeclaration: the WrongOpener error is now also auto-fixable if the wrong opener is a PHP close tag.
• Fixed bug #1316: Squiz.PHP.NonExecutableCode would throw false positives when code within a switch control structure would move in and out of PHP.

---

New Contributors

The PHP_CodeSniffer project is happy to welcome the following new contributors: @​andrewnicols, @​Soh1121

Statistics

Closed: 2 issues Merged: 8 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

[4.0.1] - 2025-11-10

This release includes all improvements and bugfixes from PHP_CodeSniffer 3.13.5.

Added

• Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
  • Syntax support for new PHP 8.5 features will follow in a future release.
  • If you find any PHP 8.5 deprecation notices which were missed, please report them.

Changed

• The Squiz.ControlStructures.SwitchDeclaration sniff will now flag a PHP close tag as a "wrong opener" and will auto-fix this by inserting a colon. #1316
• Various housekeeping, including improvements to the tests and documentation.

Fixed

• 4.x regression #1277: bring back whitespace tolerance in phpcs:ignore comma-separated rule reference lists.
  • Note: this bug did not affect phpcs:disable/phpcs:enable ignore annotations.
• Fixed bug #968: Generic.WhiteSpace.ScopeIndent was reporting false positives - and making incorrect fixes - for lines following a line containing an arrow function.
  • Thanks to [Soichi Sato][@​Soh1121] for the patch.
• Fixed bug #1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Thanks to [Andrew Lyons][@​andrewnicols] for the patch.
• Fixed bug #1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
  • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
• Fixed bug #1315: Squiz.ControlStructures.SwitchDeclaration: a number of the fixers would get into fixer conflicts with each other if the code under scan contained multiple statements on a line within a switch.
  • The sniff will now forbid - and auto-fix - multiple statements on one line for case/default and "case breaking" statements.
• Fixed bug #1316: Tokenizer/PHP: a PHP close tag after a switch case condition or after a default keyword, was not regarded as a "scope_opener" for the case/default body.
• Fixed bug #1316: PSR2.ControlStructures.SwitchDeclaration: the WrongOpener error is now also auto-fixable if the wrong opener is a PHP close tag.
• Fixed bug #1316: Squiz.PHP.NonExecutableCode would throw false positives when code within a switch control structure would move in and out of PHP.

#968: PHPCSStandards/PHP_CodeSniffer#968 #1216: PHPCSStandards/PHP_CodeSniffer#1216 #1277: PHPCSStandards/PHP_CodeSniffer#1277 #1279: PHPCSStandards/PHP_CodeSniffer#1279 #1315: PHPCSStandards/PHP_CodeSniffer#1315 #1316: PHPCSStandards/PHP_CodeSniffer#1316

[4.0.0] - 2025-09-16

This release contains breaking changes.

Upgrade guides for both [ruleset maintainers/end-users][wiki-upgrade-4.0-end-users], as well as for [sniff developers and integrators][wiki-upgrade-4.0-extenders], have been published to the Wiki.

You are strongly encouraged to read the upgrade guide applicable to your situation before upgrading.

This release includes all improvements and bugfixes from PHP_CodeSniffer [4.0.0-beta1], [4.0.0-RC1], [3.13.3] and [3.13.4].

Changed

• Tokenizer/PHP: fully qualified exit/die/true/false/null will be tokenized as the keyword token and the token 'content' will include the leading backslash. #1201

... (truncated)

Commits

• 0525c73 Merge pull request #1318 from PHPCSStandards/feature/changelog-4.0.1
• 4c09fb4 Changelog for the 4.0.1 release
• 7ed8ea2 Merge pull request #1316 from PHPCSStandards/feature/tokenizer-php-switch-cas...
• b80dc24 Various sniffs: update tests to safeguard handling of case/default with P...
• 6bd0af6 Squiz/NonExecutableCode: bug fix - false positive with PHP close tag after ca...
• 6d61496 Squiz/SwitchDeclaration: make implied semicolon via close tag auto-fixable
• 21c0e80 PSR2/SwitchDeclaration: make implied semicolon via close tag auto-fixable
• 6327f77 Tokenizer/PHP: PHP close tag should be regarded as scope opener for switch ca...
• 9397930 Squiz/SwitchDeclaration: bug fix - fixer conflict for single line code (#1315)
• 2c13a90 Merge pull request #1308 from Soh1121/issue-968/fix-wrong-indentation-with-ar...
• Additional commits viewable in compare view

[ricardofiorani]

@dependabot recreate

[ricardofiorani]

/gemini review and help me to fix this

[gemini-code-assist]

Code Review

This pull request updates the squizlabs/php_codesniffer dependency to version 4.0. The review feedback recommends switching to the community-maintained phpcsstandards/php_codesniffer fork, as the original package is abandoned, and adjusting the alphabetical sorting of the package list.

[gemini-code-assist]

The squizlabs/php_codesniffer package has been officially abandoned in favor of phpcsstandards/php_codesniffer. Since you are performing a major version upgrade to 4.0, this is the ideal time to switch to the new vendor name to ensure long-term maintainability and alignment with the community standard.

Note that because your configuration has "sort-packages": true, you should also move this entry to its correct alphabetical position (between php-http/guzzle7-adapter and phpstan/phpstan) to maintain consistency.

Suggested change

	"squizlabs/php_codesniffer": "^4.0"
	"phpcsstandards/php_codesniffer": "^4.0"

[dependabot]

Looks like squizlabs/php_codesniffer is no longer updatable, so this is no longer needed.