chore(deps-dev): bump squizlabs/php_codesniffer from 3.13.6 to 4.0.4

[dependabot]

Bumps squizlabs/php_codesniffer from 3.13.6 to 4.0.4.

Release notes

Sourced from squizlabs/php_codesniffer's releases.

4.0.4 - 2026-08-06

The 4.0.2 release, the 4.0.3 and the 4.0.4 release are 100% the same (aside from the version number), there was just a slight snafu in the release publication on GitHub (missing PHAR assets). Sorry for the confusion.

4.0.2 - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible. The security issue only affects users of the Gitblame, Hgblame or Svnblame report(s).

Added

• Tokenizer support for the PHP 8.5 (void) cast. #1325 The T_VOID_CAST token has been added to the Tokens::CAST_TOKENS array.
• suggest section to the composer.json file to inform users about the recommended iconv and pcntl PHP extensions. #1388
  • Thanks to Rodrigo Primo for the patch.

Changed

• Clarified that libxml is a required PHP extension. #1409
• Squiz.Scope.StaticThisUsage: the sniff will now also search for the use of $this in static closures. #1377
• The Generic.PHP.LowerCaseKeyword, Generic.WhiteSpace.LanguageConstructSpacing and Squiz.Functions.FunctionDeclarationArgumentSpacing sniffs no longer embed UTF-8 middot characters for spaces in error messages. #1379, #1389 Fixes [Squiz/#2652](squizlabs/PHP_CodeSniffer#2652).
  • Thanks to Rodrigo Primo for the patches.
• PSR2.ControlStructures.SwitchDeclaration: the error message for the use of colon + curly braces (WrongOpener*) has been made more informative. #1358. Fixes #1322.
  • Thanks to Sule-Balogun Olanrewaju for the patch.
• The error messages for the following sniffs have been improved by exposing more data placeholders:
  • PEAR.Functions.FunctionDeclaration #1445
    • The CloseBracketLine error message now exposes 1 data value (previously 0).
    • The EmptyLine error message now exposes 1 data value (previously 0).
    • The Indent error message now exposes 3 data values (previously 2).
    • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration and Squiz.Functions.MultiLineFunctionDeclaration sniffs.
  • PSR2.Classes.ClassDeclaration #1446
    • The ExtendsLine and ImplementsLine error messages now expose 3 data values (previously 1).
    • The SpaceBeforeExtends and SpaceBeforeImplements error messages now expose 2 data values (previously 1).
    • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration and Squiz.Classes.ClassDeclaration sniffs.
  • PSR2.ControlStructures.SwitchDeclaration #1447
    • The defaultNotLower and caseNotLower error messages now expose 3 data values (previously 2).
    • The SpaceBeforeColonDEFAULT and SpaceBeforeColonCASE error messages now expose 1 data value (previously 0).
    • The BodyOnNextLineDEFAULT and BodyOnNextLineCASE error messages now expose 1 data value (previously 0).
    • The WrongOpenerdefault and WrongOpenercase error messages now expose 1 data value (previously 0).
  • Squiz.ControlStructures.SwitchDeclaration #1449
    • The CaseNotLower and DefaultNotLower error messages now expose 3 data values (previously 2).
    • The CaseIndent and DefaultIndent error messages now expose 2 data values (previously 0).
    • The SpaceBeforeColonCase and SpaceBeforeColonDefault error messages now expose 1 data value (previously 0).
    • The BreakIndent error message now exposes 1 data value (previously 0).
    • The SpacingAfterCase and SpacingAfterDefault error messages now expose 1 data value (previously 0).
  • Squiz.Functions.FunctionDeclarationArgumentSpacing #1452
    • The SpaceBeforeEquals error message now exposes 3 data values (previously 2).
    • The SpaceAfterEquals error message now exposes 3 data values (previously 2).
  • Squiz.Functions.MultiLineFunctionDeclaration #1453
    • The FirstParamSpacing and UseFirstParamSpacing error messages now expose 1 data value (previously 0).
    • The OneParamPerLine and UseOneParamPerLine error messages now expose 1 data value (previously 0).
    • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration sniff.
  • If you have customised the error messages of these sniffs, please review your ruleset after upgrading.
  • Thanks to Zhang WenTao for these patches.

... (truncated)

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

Changelog

The file documents changes to the PHP_CodeSniffer project for the 3.x series of releases.

Commits

• bbdc3d0 Merge branch '3.x' into 4.x
• 3d9e4c6 Merge pull request #1471 from PHPCSStandards/feature/update-gpg-key-info
• 0c3dc35 Changelog: add release links
• ddc0bf9 Changelog update for 4.0.3 + 4.0.4
• 09a2847 Config: update version nr to next
• aa43975 Merge branch '3.x' into 4.x
• 29a0859 Config: update version nr to next
• 305aebb Update for new GPG keys
• 74ee2d4 Merge pull request #1475 from PHPCSStandards/feature/changelog-4.0.2
• 2f4a106 Changelog for the 4.0.2 release
• Additional commits viewable in compare view

[github-actions]

Quality Report — ConductionNL/openregister @ 5212447

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 174/174
npm			✅	✅ 547/547
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					❌
Newman					❌
Playwright					🚨 NO VERDICT — enabled but never ran
Hydra gates					❌

---

Quality workflow — 2026-08-30 22:57 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openregister @ fb4368c

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 174/174
npm			✅	✅ 541/541
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					🚨 NO VERDICT — enabled but never ran
Hydra gates					✅

---

Quality workflow — 2026-08-31 00:03 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Closing: this major installs but breaks the code, verified by CI rather than assumed.

The dependency resolves cleanly (checked in a PHP container), so this is not a lockfile problem. What fails is the tooling the bump itself changes:

• quality / PHP Quality (phpcs) / (phpstan) / (psalm) — the analysers report against the new major
• Quality Report fails behind them

A new major of a static-analysis or parser package changes what it accepts, so the findings are real work rather than a version-pick. Adopting it means fixing what the new version reports, in its own change where the diff can be read.

Measured tonight across the fleet: of 51 npm majors, 24 could not install at all and several more installed and then failed at runtime. This one is in the second group — which is exactly what CI is for, and why it was not closed on resolution evidence alone.

Dependabot will reopen this when the work is done.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.