fix(security): PHP_CodeSniffer 3.13.5 → 3.13.6 (CVE-2026-67434, OS command injection) - #755
Merged
Merged
Conversation
…ommand injection)
`quality / Security (composer)` is now red on every procest PR:
Advisory ID: PKSA-rdkp-vv9z-mjkg
CVE: CVE-2026-67434
Title: OS Command injection
Affected versions: <3.13.6|>=4.0.0,<4.0.2
Reported at: 2026-08-05T23:53:11+00:00
GHSA-hmqg-cxww-wqhq
Worth noting why development's last runs are green: the advisory was
published YESTERDAY, and roave/security-advisories is installed as
`dev-latest` on each run. So the same lockfile was clean on 2026-08-05 and is
vulnerable on 2026-08-06 with no commit in between. Those green runs are not
evidence the lockfile is fine — they are evidence of when they ran.
The `^3.9` constraint in composer.json already permits the fixed version, so
this is a lockfile move only: 1 update, 0 installs, 0 removals, and the diff
touches exactly one version string. No composer.json change is needed.
Verified after the bump: `phpcs --version` reports 3.13.6, and phpcs still
runs and still reports over lib/AppInfo — a linter that silently stopped
starting would look exactly like a clean run, which is the trap this repo has
hit before (exit 255 in platform_check.php printing no findings).
rubenvdlinde
requested review from
WilcoLouwerse,
bbrands02 and
rjzondervan
as code owners
August 6, 2026 11:29
Contributor
Quality Report — ConductionNL/procest @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| check-manifest | ✅ | ||||
| check-vue3-compile | ✅ | ||||
| test-l10n | ✅ | ||||
| composer | ✅ | ✅ 100/100 | |||
| npm | ✅ | ✅ 550/550 | |||
| PHPUnit | ✅ | ||||
| Newman | ⏭️ | ||||
| Playwright | ✅ | ||||
| Hydra gates | ✅ |
Quality workflow — 2026-08-06 11:45 UTC
Download the full PDF report from the workflow artifacts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
quality / Security (composer)is now red on every procest PR:GHSA-hmqg-cxww-wqhq
Why development's last runs are green
The advisory was published yesterday, and
roave/security-advisoriesis installed asdev-lateston each run. The same lockfile was clean on 2026-08-05 and is vulnerable on 2026-08-06 with no commit in between. Those green runs are not evidence the lockfile is fine — they are evidence of when they ran.The change
The
^3.9constraint incomposer.jsonalready permits the fixed version, so this is a lockfile move only — 1 update, 0 installs, 0 removals, and the diff touches exactly one version string. Nocomposer.jsonchange needed.Verified after the bump:
phpcs --versionreports 3.13.6, and phpcs still runs and still reports overlib/AppInfo. A linter that silently stopped starting would look exactly like a clean run — the trap this repo has hit before (exit 255 inplatform_check.php, printing no findings).