fix(security): PHP_CodeSniffer 3.13.5 → 3.13.6 (CVE-2026-67434, OS command injection) - #236
Merged
Merged
Conversation
…ommand injection)
quality / Security (composer) is red on every PR here as of today:
Advisory ID: PKSA-rdkp-vv9z-mjkg
CVE: CVE-2026-67434 — OS Command injection
Affected versions: <3.13.6|>=4.0.0,<4.0.2
Reported at: 2026-08-05T23:53:11+00:00
The advisory was published YESTERDAY and roave/security-advisories installs
as dev-latest each run, so the same lockfile was clean on 2026-08-05 and is
vulnerable on 2026-08-06 with no commit in between. The last green run is
evidence of when it ran, not that the lockfile is safe.
composer.json's existing constraint already permits the fixed version, so
this is a lockfile move only: 1 update, 0 installs, 0 removals. Verified the
diff touches exactly two lines, both the version string, and no other file.
Part of a fleet sweep — 13 of 16 repos checked were on the affected 3.13.5.
Contributor
Quality Report — ConductionNL/nldesign @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| check-manifest | ✅ | ||||
| test-l10n | ✅ | ||||
| composer | ✅ | ✅ 100/100 | |||
| npm | ✅ | ✅ 2/2 | |||
| PHPUnit | ✅ | ||||
| Newman | ❌ | ||||
| Playwright | ❌ | ||||
| Hydra gates | ✅ |
Quality workflow — 2026-08-06 11:48 UTC
Download the full PDF report from the workflow artifacts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
quality / Security (composer)goes red on every PR in this repo as of today:GHSA-hmqg-cxww-wqhq
Why the last green runs are not evidence
The advisory was published yesterday, and
roave/security-advisoriesinstalls asdev-lateston each run. The same lockfile was clean on 2026-08-05 and is vulnerable on 2026-08-06 with no commit in between. A green run tells you when it ran, not that the lockfile is safe.The change
The existing
composer.jsonconstraint already permits the fixed version, so this is a lockfile move only: 1 update, 0 installs, 0 removals. Verified per repo that the diff touches exactly two lines, both theversionstring, and no other file.Part of a fleet sweep — 13 of 16 repos checked were on the affected 3.13.5.