0.6.5

Fixes

• Security: raise the squizlabs/php_codesniffer floor to ^4.0.2 (#75). CVE-2026-67434, an OS command injection advisory published 2026-08-05, covers >=4.0.0,<4.0.2. The previous ^4.0.1 constraint allowed an affected version.

• Generic.PHP.DeprecatedFunctions was effectively disabled (#71). The ruleset set the sniff's forbiddenFunctions property, which replaces the list the sniff builds in its constructor from the Reflection API. The standard reported fewer deprecations than plain Generic did - utf8_encode() among them. Removed functions such as create_function() and each() moved to Generic.PHP.ForbiddenFunctions, where a property override is safe.

• VoidCast and PipeOperatorSpacing matched nothing on PHP 8.5 (#71). Both sniffs target PHP 8.5 syntax, and PHP 8.5 collapses each construct into a single token - T_VOID_CAST and T_PIPE. The sniffs registered only the pre-8.5 multi-token shapes, so on the version that introduced the syntax they silently passed everything. PHP 8.5 also joined the CI matrix.

• ConsistentIndent mis-indented PHP 8.4 property hooks (#76). Property hook braces are not modeled as scopes by PHP_CodeSniffer, so a hook block read as a single indent level and phpcbf dedented the second hook while leaving its body and braces in place.

• Attribute names are no longer rewritten as function calls (#78). An attribute name sits in front of a parenthesis just like a call, so an attribute sharing a name with a function alias was reported and auto-fixed - #[Pos(1)] became #[current(1)], which does not compile.

• DocComment emitted tab indentation (#79). Two fixes built indentation as str_repeat("\t", column - 1), so phpcbf wrote tabs that the standard's own Generic.WhiteSpace.DisallowTabIndent then reports, and used a column offset as a repeat count - four spaces of indent produced four tabs.

• DocBlockTagGrouping reported a fix it never applied (#74). NoExtraNewlineBeforeTags was listed as fixable, but an inverted guard meant phpcbf skipped the change every time.

Improvements

• RemoveFunctionAlias covers more aliases (#70). Added doubleval to floatval, alongside pos, show_source and user_error. The unreachable die and print entries are gone; die is handled by the Exit sniff.

• Fully-qualified global function calls are now detected (#72). Five sniffs - RemoveFunctionAlias, NoIsNull, PreferCastOverFunction, DisallowFunctions and PhpSapiConstant - matched only bare T_STRING names, so a leading-backslash call was invisible to all of them. Namespaced calls such as Foo\pos() remain untouched, and fixers that replace the name preserve the backslash.

Full Changelog: 0.6.4...0.6.5