Upgrading squizlabs/php_codesniffer 2 to 3

Installation of PHP_CodeSniffer via PEAR is no longer supported.

Removes support for installation via PEAR.

Generic.Functions.FunctionCallArgumentSpacing no longer checks spacing around assignment operators inside function calls.

Squiz.ControlStructures.ForLoopDeclaration improves whitespace, closure and empty expression support and removes the SpacingAfterSecondNoThird error code.

Squiz.Objects.ObjectMemberComma.Missing is renamed to Squiz.Objects.ObjectMemberComma.Found.

Removes Squiz.PHP.DisallowObEndFlush from the Squiz standard.

Removes Squiz.PHP.ForbiddenFunctions from the Squiz standard, replaced by Generic.PHP.ForbiddenFunctions with different error codes.

Removes the SpacingAfterOpenHint error message, replaced by the existing SpacingAfterOpen message.

Removes the is_closure index from the return value of File::getMethodProperties().

Removes the File::isAnonymousFunction() method.

Removes the indent property of PEAR.Classes.ClassDeclaration; the sniff now only ensures the brace aligns with the class keyword.

Adds support for ES6 method declarations without the function keyword, now tokenized as T_FUNCTION; custom JS sniffs listening for T_FUNCTION can no longer assume the token is the word "function".

PHPCBF no longer uses patch, always overwrites files, and the --no-patch option has been removed.

Removes the included PHPCS standard; all rules now live in the phpcs.xml.dist file.

Removes the included SVN pre-commit hook; version control hooks will no longer be maintained in the project.

Incorrectly set inline properties in test case files are silently ignored again, removing the Internal.PropertyDoesNotExist error code.

Common::getSniffCode() now throws InvalidArgumentException when passed an invalid $sniffClass.

Squiz.ControlStructures.ForEachLoopDeclaration replaces the SpacingAfterOpen error code with the pre-existing SpaceAfterOpen code.

The squizlabs/PHP_CodeSniffer repository is abandoned; PHPCSStandards/PHP_CodeSniffer continues the project.

PHIVE users may need to clear the PHIVE URL cache and update the package URL to phars.phpcodesniffer.com.

Users downloading PHAR files with curl or wget must update the download URL to phars.phpcodesniffer.com.

Git clone users must update the clone address to the PHPCSStandards repository.

Invalid sniff properties set for individual sniffs now result in an error and halt PHPCS execution.

The third parameter for Ruleset::setSniffProperty() now expects an array, with existing code throwing a deprecation error.

Changes the value of the T_FN_ARROW token from "T_FN_ARROW" to "PHPCS_T_FN_ARROW" to avoid package conflicts.

Reverts the change to how include/exclude patterns are processed for STDIN content; the change will return in 3.6.0.

Notes that the reverted STDIN include/exclude pattern change is not backwards compatible and will be re-introduced in 3.6.0.

All helper methods in the File class now throw RuntimeException instead of TokenizerException.

PSR12.Classes.ClassInstantiation changes its error code from MissingParenthesis to MissingParentheses.

Squiz standard now forbids underscores for visibility of private member vars and methods, reversing the previous rule.

Changes the error message format for SpacingAfterOpen and SpacingBeforeClose from 3 pieces of data to 2.

Include patterns for sniffs now use OR logic instead of AND logic, so a file only needs to match at least one pattern.

Code that previously exited now throws DeepExitException; catch it for the message and exit code.

Breaks backwards compatibility for all custom sniffs and custom reports in the 3.0 branch refactoring.

Refactors the code base and breaks backwards compatibility for all custom sniffs and custom reports.

Exit code 2 now indicates fixable errors were found; exit code 3 is used for general script execution errors.

Requires passing "-" on the command line for PHPCS to wait for STDIN.

Makes sniff codes no longer optional; sniffs must specify an internal code for each error or warning.

The custom PHP_CodeSniffer test runner now requires a bootstrap file, affecting developers with custom standards using it.

Fixes a security issue where the Gitblame, Hgblame or Svnblame reports could execute attacker-controlled shell commands for files with shell metacharacters in their names.

Arbitrary shell execution

Fixes a security advisory where shell_exec() and exec() did not escape filenames and configuration settings, allowing arbitrary code execution.

Notes that uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases.

A properly crafted filename or configuration option would allow arbitrary code execution when using some features.

All users are encouraged to upgrade, especially those checking 3rd-party code, running PHPCS as a web service, or allowing user-defined tool paths.

If unable to upgrade while checking 3rd-party code, avoid the diff report, notify-send report, and the listed Debug and Syntax sniffs.

Adds runtime support for PHP 8.5 and fixes all known PHP 8.5 deprecation notices.

Adds runtime support for PHP 8.4 and fixes all known PHP 8.4 deprecation notices.

Raises the minimum PHP version from 5.1.2 to 5.4.0.

Hard deprecates nearly everything previously soft deprecated, now showing deprecation notices.

Hard deprecates all sniffs which will be removed in 4.0.

Hard deprecates the deprecated Generator methods.

Hard deprecates the old array property setting format using comma separated strings.

Hard deprecates sniffs not implementing the PHP_CodeSniffer\Sniffs\Sniff interface.

Hard deprecates sniffs not following the naming conventions.

Hard deprecates standards called Internal.

Hard deprecates sniffs which don't listen for PHP, like JS/CSS specific sniffs.

Deprecates the Generic.Functions.CallTimePassByReference sniff, which will be removed in version 4.0.0.

Deprecates support for sniffs not implementing the PHPCS Sniff interface, slated for removal in 4.0.

Deprecates support for including sniffs that don't comply with PHPCS naming conventions by referencing the sniff file directly.

Deprecates support for external standards named "Internal".

Soft-deprecates several Generator print methods in favour of getFormatted equivalents.

Deprecates Markdown::printFooter() in favour of Markdown::getFormattedFooter().

Deprecates Markdown::printTextBlock() in favour of Markdown::getFormattedTextBlock().

Deprecates Markdown::printCodeComparisonBlock() in favour of Markdown::getFormattedCodeComparisonBlock().

Deprecates HTML::printHeader() in favour of HTML::getFormattedHeader().

Deprecates HTML::printToc() in favour of HTML::getFormattedToc().

Deprecates HTML::printFooter() in favour of HTML::getFormattedFooter().

Deprecates HTML::printTextBlock() in favour of HTML::getFormattedTextBlock().

Deprecates HTML::printCodeComparisonBlock() in favour of HTML::getFormattedCodeComparisonBlock().

Deprecates support for scanning JavaScript and CSS files, to be removed in version 4.0.0.

Deprecates all sniffs aimed only at JavaScript or CSS files, to be removed in version 4.0.0.

Deprecates the JavaScript and CSS Tokenizers and JS/CSS support in multi-file-type sniffs, to be removed in version 4.0.0.

Deprecates the abstract ExactMatch::getBlacklist() and ExactMatch::getWhitelist() methods, to be removed in 4.0.

Deprecates the MySource standard and all sniffs in it, to be removed in version 4.0.0.

Deprecates the Zend.Debug.CodeAnalyzer sniff, to be removed in version 4.0.0.

Existing code using the old setSniffProperty() third parameter continues to work but throws a deprecation error.

The backwards compatibility layer for the setSniffProperty() third parameter will be removed in PHPCS 4.0.

Notes the namespaced name tokenizing revert will be removed in PHPCS 4.0 as the PHP 8.0 method is backported to pre 8.0.

Deprecates the Generic.Formatting.NoSpaceAfterCast sniff, to be removed in version 4.

Deprecates the Squiz.WhiteSpace.LanguageConstructSpacing sniff, moved to Generic.WhiteSpace.LanguageConstructSpacing and removed in version 4.

Deprecates the string syntax for setting array properties in rulesets in favor of element tags with key and value attributes, removed in version 4.

Deprecates the T_ARRAY_HINT token, removed in version 4; array type hints now use T_STRING.

Deprecates the T_RETURN_TYPE token, removed in version 4; use File::getMethodProperties() return_type index instead.

Deprecates the @codingStandards comment syntax; it keeps working in all version 3 releases but will be removed in version 4.