2.9.0

Fixes

• Security: raise the squizlabs/php_codesniffer floor to ^4.0.2. CVE-2026-67434, an OS command injection advisory published 2026-08-05, covers >=4.0.0,<4.0.2. The previous constraint allowed an affected version.

• Generic.PHP.DeprecatedFunctions was effectively disabled (#45). The ruleset set the sniff's forbiddenFunctions property, which replaces the list the sniff builds in its constructor from the Reflection API rather than adding to it. The standard reported fewer deprecations than plain Generic did - utf8_encode() among them. Removed functions such as create_function() and each() moved to Generic.PHP.ForbiddenFunctions, where a property override is safe.

Improvements

• Duplicate reporting removed (#47). Four constructs were each flagged by two rules at once: inline assignment, method modifier order, double semicolons and Yoda conditions. In every case the rule with the wider coverage stays and the narrower one is silenced, so the same code is still caught - once instead of twice.

Removed sniffs

Both are fully covered by rules the standard already enables, so nothing stops being reported. Only the error codes change, which is why this is a minor rather than a patch - adjust any baseline or phpcs:ignore that names them.

• PSR2R.PHP.DuplicateSemicolon (#47), superseded by SlevomatCodingStandard.PHP.UselessSemicolon, which reports everything it did and also catches a stray ; after a block.

• PSR2R.WhiteSpace.UnaryOperatorSpacing, superseded by PhpCollective.WhiteSpace.ImplicitCastSpacing together with Generic.WhiteSpace.IncrementDecrementSpacing, both already enabled here. The reference operator was the last construct only the PSR2R sniff handled; php-collective/code-sniffer 0.6.7 covers it, and the floor moves to ^0.6.7 accordingly. The replacement also catches ! $b, which the PSR2R sniff missed.

Note

Most PSR2R rules come from php-collective/code-sniffer. Its 0.6.5 to 0.6.7 releases land here with this bump and carry several fixes to sniffs PSR2R enables, including ConsistentIndent on PHP 8.4 property hooks, attribute names being rewritten as function calls, and DocBlockTagGrouping reporting a fix it never applied.

Full Changelog: 2.8.1...2.9.0