build(deps-dev): bump squizlabs/php_codesniffer from 3.13.5 to 3.13.6

[dependabot]

Bumps squizlabs/php_codesniffer from 3.13.5 to 3.13.6.

Release notes

Sourced from squizlabs/php_codesniffer's releases.

3.13.6 - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible.

Changed

• Various housekeeping, including improvements to the tests and documentation.
  • Thanks to Sergei Morozov and Juliette Reinders Folmer for their contributions.

Fixed

• SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters. #1473
  • Users using the default Full report, or any of the other non-*blame reports, are not affected.
  • For more details, see the security advisory.
  • Thanks go to Faze-up and Volker Dusch for responsibly disclosing the vulnerability.
  • Additionally, thanks go to Volker Dusch, Rodrigo Primo, Dan Wallis and Juliette Reinders Folmer for creating and testing the fix.

Other

• The GPG signature for the PHAR files has been rotated. The new fingerprint is: 5CB4F778BF9BC4FB67AE511D96E91A992CF22FF4.

---

Statistics

Closed: 0 issues Merged: 46 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

[3.13.6] - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible.

Changed

• Various housekeeping, including improvements to the tests and documentation.
  • Thanks to [Sergei Morozov][@​morozov] and [Juliette Reinders Folmer][@​jrfnl] for their contributions.

Fixed

• SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters. #1473
  • Users using the default Full report, or any of the other non-*blame reports, are not affected.
  • For more details, see the security advisory.
  • Thanks go to [Faze-up][@​Faze-up] and [Volker Dusch][@​edorian] for responsibly disclosing the vulnerability.
  • Additionally, thanks go to [Volker Dusch][@​edorian], [Rodrigo Primo][@​rodrigoprimo], [Dan Wallis][@​fredden] and [Juliette Reinders Folmer][@​jrfnl] for creating and testing the fix.

Other

• The GPG signature for the PHAR files has been rotated. The new fingerprint is: 5CB4F778BF9BC4FB67AE511D96E91A992CF22FF4.

#1473: PHPCSStandards/PHP_CodeSniffer#1473

Commits

• 4c378e1 Merge pull request #1474 from PHPCSStandards/feature/changelog-3.13.6
• ddbf849 Merge pull request #1473 from PHPCSStandards/security/cve-2026-67434
• 742a068 Changelog for the 3.13.6 release
• 7a3a6bb Reports/*blame: properly escape file name
• b5ce04f Merge pull request #1470 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 5f72703 GH Actions: Bump the action-runners group with 2 updates
• 20d0f55 Merge pull request #1466 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 2a2ac29 Merge pull request #1469 from PHPCSStandards/feature/ghactions-setup-php-fail...
• 6df695f Merge pull request #1467 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 4da0184 GH Actions: fail "setup-php" if requested tooling could not be installed
• Additional commits viewable in compare view

[changeset-bot]

⚠️ No Changeset found

Latest commit: f571b07

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR