fix(CMS-3070): bump php_codesniffer to 3.13.6 to close CVE-2026-67434

[fabianwgl]

Summary

Bumps squizlabs/php_codesniffer from 3.6.2 to 3.13.6 to clear CVE-2026-67434 (OS command injection in the Gitblame/Hgblame/Svnblame report formats).

JIRA: CMS-3070

Not actually exploitable in our configuration

Advisory says only blame-report users are affected. Our .phpcs.xml uses the default sp report, no blame report anywhere in the repo or CI. Clean hygiene bump, no live exposure, but cheap to clear the Apiiro finding.

What changed

• tests/composer.lock only. No composer.json edit needed, the existing ^3.6 constraint already permits 3.13.6.
• wpcs stays at 2.3.0, phpunit stays at 9.5.20.

Why land this first

This lands ahead of #378 (CMS-3069, WPCS 3.4.1 upgrade), which requires php_codesniffer ^3.13.5 anyway. Landing this first keeps #378 a clean single-concern diff instead of dragging this bump along with it. #378 will rebase once this merges.

Test plan

• Verified against the unmodified ruleset with wpcs still at 2.3.0: scans all 236 files, 0 violations
• CI stays green

Also applies to

Bitbucket usercentricscode/wordpress-plugin has the identical tests/composer.lock and needs the same fix. Not covered by this PR.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	cc5167e	Sep 21, 2026 · 19:15	19:15

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[qodo-code-review]

PR Summary by Qodo

Bump PHP_CodeSniffer to 3.13.6 for CVE-2026-67434

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Upgrades PHP_CodeSniffer to 3.13.6, resolving CVE-2026-67434.
• Retains existing WPCS and PHPUnit versions while refreshing lock metadata.
• Preserves the current ruleset and default non-blame reporting configuration.

High-Level Assessment

Updating only the lockfile is optimal because the existing ^3.6 constraint already permits 3.13.6. Changing composer.json or combining this with the planned WPCS upgrade would add unnecessary scope.

Files changed (1) +47 / -24

Other (1) +47 / -24

composer.lockLock PHP_CodeSniffer at security-fixed version 3.13.6 +47/-24

Lock PHP_CodeSniffer at security-fixed version 3.13.6

• Upgrades squizlabs/php_codesniffer from 3.6.2 to 3.13.6 and updates its repository, package metadata, and development compatibility information. Refreshes Composer-generated root metadata without changing the locked WPCS or PHPUnit versions.

tests/composer.lock

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[apinto-uc]

Looks good to me.