v3.1.2

Security

• Require squizlabs/php_codesniffer ^3.13.6 (was ^3.13.5) to fix
  GHSA-hmqg-cxww-wqhq
  / CVE-2026-67434 (high). The Gitblame, Hgblame and Svnblame
  reports built shell commands from file names without escaping, so
  scanning a file whose name contains shell metacharacters could
  execute attacker-controlled commands on the scanning host — CI
  pipelines over pull requests, or local review of third-party code.
  Runs using the default Full report or any other non-blame report
  are unaffected. The floor is raised rather than only the lockfile
  refreshed, so consuming projects cannot resolve back to a
  vulnerable version. No ruleset changes.

CI

• Add a Security Audit job running composer audit --locked on pull
  requests and pushes, plus a Monday cron so newly published
  advisories surface here rather than in a consuming project. The
  PHPCS advisory above was only caught downstream, because advisories
  are published against versions already in the lockfile and nothing
  ran without a code change to trigger it.
• Tune renovate.json so security updates raise the composer.json
  floor (rangeStrategy: bump) instead of only refreshing the
  lockfile, read advisories from OSV directly, bypass the Monday
  window, and keep commit subjects within the 50-character limit.
  Dev-dependency patch automerge now waits three days.
• Skip Check Version Bump and Check CHANGELOG Entry for Renovate
  pull requests; both expect a release decision that dependency PRs
  do not carry, and their failure blocked automerge.