fix(security): bump php_codesniffer to 3.13.6 (CVE-2026-67434) — unblocks the skipped test tier - #291
Merged
Merged
Conversation
squizlabs/php_codesniffer <3.13.6 is affected by CVE-2026-67434 (OS command injection, GHSA-hmqg-cxww-wqhq), published 2026-08-05 23:53Z. composer audit queries the live advisory database, so the Security (composer) job started failing on every repo pinned to 3.13.5. That failure is not confined to the security tier: quality.yml gates PHPUnit, Newman, Playwright, journeydoc-capture and sbom on needs.security.result != 'failure', so a failing security job turns the entire test tier into skipped -- which renders as a grey tick, not a red X. The tests stop running and nothing looks broken. Dev-only formatter, no runtime exposure, but the lockfile bump is the correct fix; a waiver would leave the test tier gated.
Contributor
Quality Report — ConductionNL/scholiq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| check-specs | ✅ | ||||
| composer | ✅ | ✅ 100/100 | |||
| npm | ✅ | ✅ 750/750 | |||
| PHPUnit | ✅ | ||||
| Newman | ⏭️ | ||||
| Playwright | ⏭️ | ||||
| Hydra gates | ✅ |
Quality workflow — 2026-08-06 11:53 UTC
Download the full PDF report from the workflow artifacts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps
squizlabs/php_codesnifferfrom 3.13.5 to 3.13.6 incomposer.lock(dev dependency).Why
CVE-2026-67434 (OS command injection) affects
<3.13.6. Published 2026-08-05 23:53Z.composer auditqueries the live Packagist advisory database, soSecurity (composer)began failing on every repo pinned to 3.13.5 as the advisory propagated — regardless of theroave/security-advisorieslockfile pin, which is a separate mechanism.The part that matters more than the CVE
The CVE itself is low-stakes: a dev-only code formatter, no runtime exposure.
The impact is not low-stakes.
quality.ymlgates the test tier onneeds.security.result != 'failure':phpunitnewmanplaywrightjourneydoc-capturesbomSo a failing
Security (composer)turns PHPUnit, Newman and E2E intoskipped. A skipped job renders as a grey tick, not a red X — the run looks fine and the tests did not run. Measured on nldesign: the 08:49Z run executed 110 tests; the 11:18Z run executed zero and looked healthy.A skipped test job is not a pass — it is the absence of a verdict.
Fix shape
One-line lockfile bump. No waiver, no
continue-on-error, no ignore entry — those would make the security job green while leaving the test tier gated, which is the opposite of the goal.Reference
4c378e1a528ea066890fc2397cbdd2f94eb2fc91verified against the Packagist metadata API.Verification
Merged once
Security (composer)passes and the previously-gated jobs actually execute and report test counts.