build(deps-dev): bump squizlabs/php_codesniffer from 3.13.5 to 4.0.1

[dependabot]

Bumps squizlabs/php_codesniffer from 3.13.5 to 4.0.1.

Release notes

Sourced from squizlabs/php_codesniffer's releases.

4.0.1 - 2025-11-10

This release includes all improvements and bugfixes from PHP_CodeSniffer 3.13.5.

Added

• Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
  • Syntax support for new PHP 8.5 features will follow in a future release.
  • If you find any PHP 8.5 deprecation notices which were missed, please report them.

Changed

• The Squiz.ControlStructures.SwitchDeclaration sniff will now flag a PHP close tag as a "wrong opener" and will auto-fix this by inserting a colon. #1316
• Various housekeeping, including improvements to the tests and documentation.

Fixed

• 4.x regression #1277: bring back whitespace tolerance in phpcs:ignore comma-separated rule reference lists.
  • Note: this bug did not affect phpcs:disable/phpcs:enable ignore annotations.
• Fixed bug #968: Generic.WhiteSpace.ScopeIndent was reporting false positives - and making incorrect fixes - for lines following a line containing an arrow function.
  • Thanks to Soichi Sato for the patch.
• Fixed bug #1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Thanks to Andrew Lyons for the patch.
• Fixed bug #1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
  • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
• Fixed bug #1315: Squiz.ControlStructures.SwitchDeclaration: a number of the fixers would get into fixer conflicts with each other if the code under scan contained multiple statements on a line within a switch.
  • The sniff will now forbid - and auto-fix - multiple statements on one line for case/default and "case breaking" statements.
• Fixed bug #1316: Tokenizer/PHP: a PHP close tag after a switch case condition or after a default keyword, was not regarded as a "scope_opener" for the case/default body.
• Fixed bug #1316: PSR2.ControlStructures.SwitchDeclaration: the WrongOpener error is now also auto-fixable if the wrong opener is a PHP close tag.
• Fixed bug #1316: Squiz.PHP.NonExecutableCode would throw false positives when code within a switch control structure would move in and out of PHP.

---

New Contributors

The PHP_CodeSniffer project is happy to welcome the following new contributors: @​andrewnicols, @​Soh1121

Statistics

Closed: 2 issues Merged: 8 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

4.0.0 - 2025-09-16

This release contains breaking changes.

Upgrade guides for both ruleset maintainers/end-users, as well as for sniff developers and integrators, have been published to the Wiki.

You are strongly encouraged to read the upgrade guide applicable to your situation before upgrading.

... (truncated)

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

Changelog

The file documents changes to the PHP_CodeSniffer project for the 3.x series of releases.

Commits

• 0525c73 Merge pull request #1318 from PHPCSStandards/feature/changelog-4.0.1
• 4c09fb4 Changelog for the 4.0.1 release
• 7ed8ea2 Merge pull request #1316 from PHPCSStandards/feature/tokenizer-php-switch-cas...
• b80dc24 Various sniffs: update tests to safeguard handling of case/default with P...
• 6bd0af6 Squiz/NonExecutableCode: bug fix - false positive with PHP close tag after ca...
• 6d61496 Squiz/SwitchDeclaration: make implied semicolon via close tag auto-fixable
• 21c0e80 PSR2/SwitchDeclaration: make implied semicolon via close tag auto-fixable
• 6327f77 Tokenizer/PHP: PHP close tag should be regarded as scope opener for switch ca...
• 9397930 Squiz/SwitchDeclaration: bug fix - fixer conflict for single line code (#1315)
• 2c13a90 Merge pull request #1308 from Soh1121/issue-968/fix-wrong-indentation-with-ar...
• Additional commits viewable in compare view