From e159c2c33da0a0a6a040313c4a0bef162ad570db Mon Sep 17 00:00:00 2001
From: Joe Huss <detain@interserver.net>
Date: Thu, 6 Aug 2026 21:13:27 -0400
Subject: [PATCH] chore(security): bump squizlabs/php_codesniffer to 4.0.4
 (CVE-2026-67434)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

New HIGH advisory: CVE-2026-67434 — OS Command injection — GHSA-hmqg-cxww-wqhq
Affects <3.13.6 and >=4.0.0,<4.0.2. This repo was locked at 4.0.1.

composer.json already allows ^4.0, so only the lock moves.

Produced with `composer update squizlabs/php_codesniffer --no-install` so
vendor/ is untouched — file count identical before and after.

⚠ This repo has NO composer audit gate in CI, so nothing here would ever have
reported this. Found only because phlix-server's custom audit script went red on
the same advisory. The missing gate is filed as its own step.
---
 composer.lock | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/composer.lock b/composer.lock
index 081bf5c..df69f3c 100644
--- a/composer.lock
+++ b/composer.lock
@@ -1944,19 +1944,20 @@
         },
         {
             "name": "squizlabs/php_codesniffer",
-            "version": "4.0.1",
+            "version": "4.0.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/PHPCSStandards/PHP_CodeSniffer.git",
-                "reference": "0525c73950de35ded110cffafb9892946d7771b5"
+                "reference": "bbdc3d0532623e21838b7041a4364383a8126f96"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/0525c73950de35ded110cffafb9892946d7771b5",
-                "reference": "0525c73950de35ded110cffafb9892946d7771b5",
+                "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/bbdc3d0532623e21838b7041a4364383a8126f96",
+                "reference": "bbdc3d0532623e21838b7041a4364383a8126f96",
                 "shasum": ""
             },
             "require": {
+                "ext-libxml": "*",
                 "ext-simplexml": "*",
                 "ext-tokenizer": "*",
                 "ext-xmlwriter": "*",
@@ -1965,6 +1966,10 @@
             "require-dev": {
                 "phpunit/phpunit": "^8.4.0 || ^9.3.4 || ^10.5.32 || 11.3.3 - 11.5.28 || ^11.5.31"
             },
+            "suggest": {
+                "ext-iconv": "For accurate character length calculation when the checked files contain multi-byte characters.",
+                "ext-pcntl": "For parallel processing support via the --parallel CLI option."
+            },
             "bin": [
                 "bin/phpcbf",
                 "bin/phpcs"
@@ -2019,7 +2024,7 @@
                     "type": "thanks_dev"
                 }
             ],
-            "time": "2025-11-10T16:43:36+00:00"
+            "time": "2026-08-06T02:45:27+00:00"
         },
         {
             "name": "theseer/tokenizer",