Upgrading squizlabs/php_codesniffer 3 to 4
Breaking3.13.6 → 4.0.4Breaking59Security1Platform2Deprecated21New8Changed53Fixed27Other9
SecurityHighSecurity release: Gitblame, Hgblame and Svnblame reports could execute attacker-controlled shell commands on untrusted file names.GHSA-hmqg-cxww-wqhq · CVE-2026-67434 ↗
BreakingUpgrade verdict
56 breaking changes and 2 platform requirement changes and a security fix.
In plain terms
- A misspelled error code used in ruleset configurations and ignore comments has been corrected, so any references to the old spelling must be updated.
- Instead of writing module/php to check .module files as PHP, you now write just module.
- File::getDeclarationName() no longer accepts T_ANON_CLASS or T_CLOSURE tokens and throws a RuntimeException for them.
- Sniffs stop flagging possible parse errors, which improves live coding in editors.
Must act Top 5 of 75 that need code or config changes
squizlabs/php_codesniffer publishes official migration guides for versions 4, 4. They cover more than the release notes do.
Ruleset maintainers/end-users ↗Sniff developers and integrators ↗PHP requirement changed in 4.0.0beta1: >=5.4.0 → >=7.2.0.
What you must change
Breaking56
Renames the error code Squiz.Functions.FunctionDeclarationArgumentSpacing.SpacingAfterVisbility to SpacingAfterVisibility.
Squiz.Functions.FunctionDeclarationArgumentSpacing.SpacingAfterVisbilitySquiz.Functions.FunctionDeclarationArgumentSpacing.SpacingAfterVisibilityThe --extensions argument no longer accepts a tokenizer alongside the extension.
--extensionsFile::getDeclarationName() no longer accepts T_ANON_CLASS or T_CLOSURE tokens and throws a RuntimeException for them.
File::getDeclarationName()T_ANON_CLASST_CLOSURERuntimeExceptionIncluded sniffs no longer warn about possible parse errors.
Renames error code Squiz.Classes.ValidClassName.NotCamelCaps to Squiz.Classes.ValidClassName.NotPascalCase.
Squiz.Classes.ValidClassName.NotCamelCapsSquiz.Classes.ValidClassName.NotPascalCaseThese sniffs no longer listen to non-variable tokens or variables outside OO context; extending sniffs may need adjustment.
Config::setConfigData() is no longer static.PHP_CodeSniffer\Config::setConfigData()The private
Config::$overriddenDefaults property is no longer static.PHP_CodeSniffer\Config::$overriddenDefaultsHTML::STYLESHEET, Timing::MINUTE_IN_MS and Timing::SECOND_IN_MS constants are no longer public.PHP_CodeSniffer\Generators\HTML::STYLESHEETPHP_CodeSniffer\Util\Timing::MINUTE_IN_MSPHP_CodeSniffer\Util\Timing::SECOND_IN_MSRemoves support for checking CSS and JS files, along with the JS/CSS tokenizers and their tokens.
Removes support for sniffs that do not implement the Sniff interface.
PHP_CodeSniffer\Sniffs\SniffRemoves support for sniffs that do not follow the naming conventions.
Removes the deprecated @codingStandard annotation syntax in favor of phpcs: or @phpcs: syntax.
@codingStandardsIgnoreFile@codingStandardsIgnoreStart@codingStandardsIgnoreEnd@codingStandardsIgnoreLine@codingStandardsChangeSettingphpcs:ignoreFilephpcs:disablephpcs:enableRemoves the deprecated ruleset.xml comma-delimited array property syntax in favor of element tags.
elementkeyvalueRemoves the unused T_ARRAY_HINT token.
T_ARRAY_HINTRemoves the unused T_RETURN_TYPE token.
T_RETURN_TYPERemoves the Generic.Debug.ClosureLinter sniff.
Generic.Debug.ClosureLinterRemoves the Generic.Debug.CSSLint sniff.
Generic.Debug.CSSLintRemoves the Generic.Debug.ESLint sniff.
Generic.Debug.ESLintRemoves the Generic.Debug.JSHint sniff.
Generic.Debug.JSHintRemoves the Generic.Formatting.NoSpaceAfterCast sniff in favour of SpaceAfterCast with $spacing set to 0.
Generic.Formatting.NoSpaceAfterCastGeneric.Formatting.SpaceAfterCast$spacingRemoves the Generic.Functions.CallTimePassByReference sniff.
Generic.Functions.CallTimePassByReferenceRemoves the entire MySource standard and all sniffs within it.
MySourceRemoves the Squiz.Classes.DuplicateProperty sniff.
Squiz.Classes.DuplicatePropertyRemoves the entire Squiz.CSS category and all sniffs within it.
Squiz.CSSRemoves the Squiz.Debug.JavaScriptLint sniff.
Squiz.Debug.JavaScriptLintRemoves the Squiz.Debug.JSLint sniff.
Squiz.Debug.JSLintRemoves the Squiz.Objects.DisallowObjectStringIndex sniff.
Squiz.Objects.DisallowObjectStringIndexRemoves the Squiz.Objects.ObjectMemberComment sniff.
Squiz.Objects.ObjectMemberCommentRemoves the Squiz.WhiteSpace.LanguageConstructSpacing sniff in favour of the Generic equivalent.
Squiz.WhiteSpace.LanguageConstructSpacingGeneric.WhiteSpace.LanguageConstructSpacingRemoves the Squiz.WhiteSpace.PropertyLabelSpacing sniff.
Squiz.WhiteSpace.PropertyLabelSpacingRemoves the Zend.Debug.CodeAnalyzer sniff.
Zend.Debug.CodeAnalyzerRemoves the error property of Generic.Strings.UnnecessaryStringConcat; the sniff now always produces errors.
Generic.Strings.UnnecessaryStringConcaterrorGeneric.Formatting.MultipleStatementAlignmentGeneric.Formatting.MultipleStatementAlignment.IncorrectWarningGeneric.Formatting.MultipleStatementAlignment.IncorrectGeneric.Formatting.MultipleStatementAlignment.NotSameWarningGeneric.Formatting.MultipleStatementAlignment.NotSameRemoves the $ignoreComments parameter for AbstractPatternSniff::__construct().
AbstractPatternSniff::__construct()$ignoreCommentsRemoves Ruleset::setSniffProperty() support for the old $settings parameter format.
Ruleset::setSniffProperty()$settingsRemoves use of the deprecated auto_detect_line_endings ini setting, dropping support for files with \r line endings.
auto_detect_line_endingsRemoves the abstract ExactMatch::getBlacklist() and ExactMatch::getWhitelist() methods, replaced by getDisallowedFiles() and getAllowedFiles().
PHP_CodeSniffer\Filters\ExactMatch::getBlacklist()PHP_CodeSniffer\Filters\ExactMatch::getWhitelist()ExactMatch::getDisallowedFiles()ExactMatch::getAllowedFiles()Removes the deprecated print*() methods from the HTML, Markdown and Text generators.
PHP_CodeSniffer\Generators\HTML::print*()PHP_CodeSniffer\Generators\Markdown::print*()PHP_CodeSniffer\Generators\Text::print*()Removes the unused static Reporter::$startTime property.
PHP_CodeSniffer\Reporter::$startTimeFully qualified exit/die/true/false/null are tokenized as keyword tokens, with the leading backslash included in the token content.
exitdietruefalsenullAdds parameter types to all methods wherever possible based on the PHP 7.2 minimum version.
File::getDeclarationName() now always returns a string, returning an empty string instead of null when the name cannot be determined.
File::getDeclarationName()File::getMemberProperties() no longer adds parse error warnings and removes two Internal.ParseError error codes.
File::getMemberProperties()Internal.ParseError.InterfaceHasMemberVarInternal.ParseError.EnumHasMemberVargetMemberProperties() throws a "$stackPtr is not a class member var" RuntimeException for properties declared in enums.
RuntimeExceptionReplaces Squiz.PHP.Heredoc.NotAllowed with HeredocNotAllowed and NowdocNotAllowed error codes.
Squiz.PHP.Heredoc.NotAllowedSquiz.PHP.Heredoc.HeredocNotAllowedSquiz.PHP.Heredoc.NowdocNotAllowedPSR12.Files.FileHeader gains more modular error codes for selective rule application.
PSR12.Files.FileHeaderReplaces PSR12.Files.FileHeader.SpacingAfterBlock with seven block-specific error codes.
PSR12.Files.FileHeader.SpacingAfterBlockPSR12.Files.FileHeader.SpacingAfterTagBlockPSR12.Files.FileHeader.SpacingAfterDocblockBlockPSR12.Files.FileHeader.SpacingAfterDeclareBlockPSR12.Files.FileHeader.SpacingAfterNamespaceBlockPSR12.Files.FileHeader.SpacingAfterUseBlockPSR12.Files.FileHeader.SpacingAfterUseFunctionBlockPSR12.Files.FileHeader.SpacingAfterUseConstBlockReplaces PSR12.Files.FileHeader.SpacingInsideBlock with three use-block-specific error codes.
PSR12.Files.FileHeader.SpacingInsideBlockPSR12.Files.FileHeader.SpacingInsideUseBlockPSR12.Files.FileHeader.SpacingInsideUseFunctionBlockPSR12.Files.FileHeader.SpacingInsideUseConstBlockReplaces Squiz.Commenting.VariableComment.TagNotAllowed with a dynamic per-tag error code.
Squiz.Commenting.VariableComment.TagNotAllowedSquiz.Commenting.VariableComment.[TagName]TagNotAllowedPHPCS now uses PHP 8.0 native tokens for namespaced identifier names regardless of the PHP version running PHPCS.
Custom sniffs using T_STRING and T_NS_SEPARATOR to find namespaced names must be modified.
T_STRINGT_NS_SEPARATORConfig::setSettings() is now a void method.PHP_CodeSniffer\Config::setSettings()DummyFile::setErrorCounts() signature changed to expect six count parameters.DummyFile::setErrorCounts()$errorCount$warningCount$fixableErrorCount$fixableWarningCount$fixedErrorCount$fixedWarningCountThe two abstract base test cases are renamed to
AbstractSniffTestCase and AbstractMethodTestCase.PHP_CodeSniffer\Tests\Standards\AbstractSniffUnitTestPHP_CodeSniffer\Tests\Standards\AbstractSniffTestCasePHP_CodeSniffer\Tests\Core\AbstractMethodUnitTestPHP_CodeSniffer\Tests\Core\AbstractMethodTestCaseRemoves support for external standards named "Internal".
Util\Timing class is now final and marked as internal.PHP_CodeSniffer\Util\TimingSecurity1
Security release: Gitblame, Hgblame and Svnblame reports could execute attacker-controlled shell commands on untrusted file names.
GitblameHgblameSvnblameHighPlatform2
Adds runtime support for PHP 8.5 and fixes all known PHP 8.5 deprecation notices.
Raises the minimum required PHP version from 5.4.0 to 7.2.0.
Deprecations to plan for
Deprecated16
Static token array properties in the
Tokens class are deprecated in favour of class constants.TokensCommon::$allowedTypes is deprecated in favour of Common::ALLOWED_TYPES.PHP_CodeSniffer\Util\Common::$allowedTypesPHP_CodeSniffer\Util\Common::ALLOWED_TYPESTokenizers\PHP::$tstringContexts is deprecated in favour of PHP::T_STRING_CONTEXTS.PHP_CodeSniffer\Tokenizers\PHP::$tstringContextsPHP_CodeSniffer\Tokenizers\PHP::T_STRING_CONTEXTSAbstractVariableSniff::$phpReservedVars is deprecated in favour of PHP_RESERVED_VARS.PHP_CodeSniffer\Sniffs\AbstractVariableSniff::$phpReservedVarsPHP_CodeSniffer\Sniffs\AbstractVariableSniff::PHP_RESERVED_VARSCamelCapsFunctionNameSniff::$magicMethods is deprecated in favour of MAGIC_METHODS.PHP_CodeSniffer\Standards\Generic\Sniffs\NamingConventions\CamelCapsFunctionNameSniff::$magicMethodsPHP_CodeSniffer\Standards\Generic\Sniffs\NamingConventions\CamelCapsFunctionNameSniff::MAGIC_METHODSThe
$magicMethods deprecation also affects PSR1\CamelCapsMethodNameSniff.PHP_CodeSniffer\Standards\PSR1\Sniffs\Methods\CamelCapsMethodNameSniffCamelCapsFunctionNameSniffCamelCapsFunctionNameSniff::$methodsDoubleUnderscore is deprecated in favour of DOUBLE_UNDERSCORE_METHODS.PHP_CodeSniffer\Standards\Generic\Sniffs\NamingConventions\CamelCapsFunctionNameSniff::$methodsDoubleUnderscorePHP_CodeSniffer\Standards\Generic\Sniffs\NamingConventions\CamelCapsFunctionNameSniff::DOUBLE_UNDERSCORE_METHODSCamelCapsFunctionNameSniff::$magicFunctions is deprecated in favour of MAGIC_FUNCTIONS.PHP_CodeSniffer\Standards\Generic\Sniffs\NamingConventions\CamelCapsFunctionNameSniff::$magicFunctionsPHP_CodeSniffer\Standards\Generic\Sniffs\NamingConventions\CamelCapsFunctionNameSniff::MAGIC_FUNCTIONSDeprecates ByteOrderMarkSniff::$bomDefinitions in favor of the BOM_DEFINITIONS constant.
PHP_CodeSniffer\Standards\Generic\Sniffs\Files\ByteOrderMarkSniff::$bomDefinitionsPHP_CodeSniffer\Standards\Generic\Sniffs\Files\ByteOrderMarkSniff::BOM_DEFINITIONSPHP_CodeSniffer\Standards\Generic\Sniffs\Files\InlineHTMLSniff::$bomDefinitionsPHP_CodeSniffer\Standards\Generic\Sniffs\Files\InlineHTMLSniff::BOM_DEFINITIONSPHP_CodeSniffer\Standards\Generic\Sniffs\PHP\CharacterBeforePHPOpeningTagSniff::$bomDefinitionsPHP_CodeSniffer\Standards\Generic\Sniffs\PHP\CharacterBeforePHPOpeningTagSniff::BOM_DEFINITIONSDeprecates SubversionPropertiesSniff::$properties in favor of the REQUIRED_PROPERTIES constant.
PHP_CodeSniffer\Standards\Generic\Sniffs\VersionControl\SubversionPropertiesSniff::$propertiesPHP_CodeSniffer\Standards\Generic\Sniffs\VersionControl\SubversionPropertiesSniff::REQUIRED_PROPERTIESDeprecates PEAR FileCommentSniff::$tags in favor of the EXPECTED_TAGS constant, also affecting ClassCommentSniff.
PHP_CodeSniffer\Standards\PEAR\Sniffs\Commenting\FileCommentSniff::$tagsPHP_CodeSniffer\Standards\PEAR\Sniffs\Commenting\FileCommentSniff::EXPECTED_TAGSPHP_CodeSniffer\Standards\PEAR\Sniffs\Commenting\ClassCommentSniffDeprecates PEAR ValidFunctionNameSniff::$magicMethods in favor of the MAGIC_METHODS constant, also affecting the Squiz subclass.
PHP_CodeSniffer\Standards\PEAR\Sniffs\NamingConventions\ValidFunctionNameSniff::$magicMethodsPHP_CodeSniffer\Standards\PEAR\Sniffs\NamingConventions\ValidFunctionNameSniff::MAGIC_METHODSPHP_CodeSniffer\Standards\Squiz\Sniffs\NamingConventions\ValidFunctionNameSniffPHP_CodeSniffer\Standards\PEAR\Sniffs\NamingConventions\ValidFunctionNameSniff::$magicFunctionsPHP_CodeSniffer\Standards\PEAR\Sniffs\NamingConventions\ValidFunctionNameSniff::MAGIC_FUNCTIONSDeprecates Squiz DisallowSizeFunctionsInLoopsSniff::$forbiddenFunctions in favor of the FORBIDDEN_FUNCTIONS constant.
PHP_CodeSniffer\Standards\Squiz\Sniffs\PHP\DisallowSizeFunctionsInLoopsSniff::$forbiddenFunctionsPHP_CodeSniffer\Standards\Squiz\Sniffs\PHP\DisallowSizeFunctionsInLoopsSniff::FORBIDDEN_FUNCTIONSDeprecates Standards::printInstalledStandards() in favor of echoing Standards::prepareInstalledStandardsForDisplay().
PHP_CodeSniffer\Util\Standards::printInstalledStandards()PHP_CodeSniffer\Util\Standards::prepareInstalledStandardsForDisplay()Deprecates Config::printConfigData() in favor of echoing Config::prepareConfigDataForDisplay().
PHP_CodeSniffer\Config::printConfigData()PHP_CodeSniffer\Config::prepareConfigDataForDisplay()Deprecates Reporter::$totalFixable and Reporter::$totalFixed in favor of summing the error and warning counters.
Reporter::$totalFixableReporter::$totalFixedReporter::$totalFixableErrorsReporter::$totalFixableWarningsReporter::$totalFixedErrorsReporter::$totalFixedWarnings