deps-dev(deps-dev): update squizlabs/php_codesniffer requirement from ^3.7 to ^4.0

[dependabot]

Updates the requirements on squizlabs/php_codesniffer to permit the latest version.

Release notes

Sourced from squizlabs/php_codesniffer's releases.

4.0.0 - 2025-09-16

This release contains breaking changes.

Upgrade guides for both ruleset maintainers/end-users, as well as for sniff developers and integrators, have been published to the Wiki.

You are strongly encouraged to read the upgrade guide applicable to your situation before upgrading.

This release includes all improvements and bugfixes from PHP_CodeSniffer 4.0.0-beta1, 4.0.0-RC1, 3.13.3 and 3.13.4.

Changed

• Tokenizer/PHP: fully qualified exit/die/true/false/null will be tokenized as the keyword token and the token 'content' will include the leading backslash. #1201
• Wherever possible based on the PHP 7.2 minimum version, parameter types have been added to all methods. #1237
• The supported PHPUnit version constraints have been updated to ^8.4.0 || ^9.3.4 || ^10.5.32 || 11.3.3 - 11.5.28 || ^11.5.31. #1247
  • External standards using the PHP_CodeSniffer native framework may need to update their own PHPUnit version constraints.
• Various housekeeping, including improvements to the tests and documentation.

Fixed

• Fixed bug #1082: new exit codes weren't applied when running phpcbf on code provided via STDIN.
  • Thanks to Dan Wallis for the patch.
• Fixed bug #1172: // phpcs:set for inline array properties did not handle a single item array with the value true, false or null correctly.
• Fixed bug #1174: progress bar wasn't showing files as fixed when running phpcbf in parallel mode.
• Fixed bug #1226: PHP 8.5 "Using null as an array offset" deprecation notice.

Other

• Please be aware that the master branch has been renamed to 3.x and the default branch has changed to the 4.x branch.
  • If you contribute to PHP_CodeSniffer, you will need to update your local git clone.
  • If you develop against PHP_CodeSniffer and run your tests against dev branches of PHPCS, you will need to update your workflows.

---

Statistics

Closed: 5 issues Merged: 35 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

[4.0.0] - 2025-09-16

This release contains breaking changes.

Upgrade guides for both [ruleset maintainers/end-users][wiki-upgrade-4.0-end-users], as well as for [sniff developers and integrators][wiki-upgrade-4.0-extenders], have been published to the Wiki.

You are strongly encouraged to read the upgrade guide applicable to your situation before upgrading.

This release includes all improvements and bugfixes from PHP_CodeSniffer [4.0.0-beta1], 4.0.0-RC1, 3.13.3 and 3.13.4.

Changed

• Tokenizer/PHP: fully qualified exit/die/true/false/null will be tokenized as the keyword token and the token 'content' will include the leading backslash. #1201
• Wherever possible based on the PHP 7.2 minimum version, parameter types have been added to all methods. #1237
• The supported PHPUnit version constraints have been updated to ^8.4.0 || ^9.3.4 || ^10.5.32 || 11.3.3 - 11.5.28 || ^11.5.31. #1247
  • External standards using the PHP_CodeSniffer native framework may need to update their own PHPUnit version constraints.
• Various housekeeping, including improvements to the tests and documentation.

Fixed

• Fixed bug #1082: new exit codes weren't applied when running phpcbf on code provided via STDIN.
  • Thanks to [Dan Wallis][@​fredden] for the patch.
• Fixed bug #1172: // phpcs:set for inline array properties did not handle a single item array with the value true, false or null correctly.
• Fixed bug #1174: progress bar wasn't showing files as fixed when running phpcbf in parallel mode.
• Fixed bug #1226: PHP 8.5 "Using null as an array offset" deprecation notice.

Other

• Please be aware that the master branch has been renamed to 3.x and the default branch has changed to the 4.x branch.
  • If you contribute to PHP_CodeSniffer, you will need to update your local git clone.
  • If you develop against PHP_CodeSniffer and run your tests against dev branches of PHPCS, you will need to update your workflows.

#1082: PHPCSStandards/PHP_CodeSniffer#1082 #1172: PHPCSStandards/PHP_CodeSniffer#1172 #1174: PHPCSStandards/PHP_CodeSniffer#1174 #1201: PHPCSStandards/PHP_CodeSniffer#1201 #1226: PHPCSStandards/PHP_CodeSniffer#1226 #1237: PHPCSStandards/PHP_CodeSniffer#1237 #1247: PHPCSStandards/PHP_CodeSniffer#1247

[4.0.0RC1] - 2025-06-18

This release includes all improvements and bugfixes from PHP_CodeSniffer [4.0.0-beta1], [3.13.1] and [3.13.2].

Changed

• The error code Squiz.Functions.FunctionDeclarationArgumentSpacing.SpacingAfterVisbility has been changed to Squiz.Functions.FunctionDeclarationArgumentSpacing.SpacingAfterVisibility. #1136
• The following sniff(s) have received efficiency improvements:
  • Generic.ControlStructures.InlineControlStructure

... (truncated)

Commits

• 06113cf Merge pull request #1260 from PHPCSStandards/feature/changelog-4.0.0
• 7bb1928 Merge branch '3.x' into 4.x
• 8222a52 Merge pull request #1261 from PHPCSStandards/feature/release-checklist-fix-order
• 82f2cd8 Release checklist: fix order
• 68e414d Changelog for the 4.0.0 release
• 2f9900a Merge branch '3.x' into 4.x
• 38efc5d Merge pull request #1259 from PHPCSStandards/feature/update-release-checklist...
• 230c7c2 Update release checklist and document branch management
• c66fd3c Merge branch '3.x' into 4.x
• 3acd7ee Merge pull request #1258 from PHPCSStandards/feature/updates-for-branch-rename
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Assignees

The following users could not be added as assignees: valkey-io/php-maintainers. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

This PR is inactive for 60 days, hence marked as stale, if the PR is still relevant please perform some activity

[github-actions]

Since PR was marked as stale and no activity perfomed for 10 days after it was mark, this PR is closed automatically

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.