fig-r/psr2r-sniffer

Fixes

• Security: raise the squizlabs/php_codesniffer floor to ^4.0.2. CVE-2026-67434, an OS command injection advisory published 2026-08-05, covers >=4.0.0,<4.0.2. The previous constraint allowed an affected version.

• Generic.PHP.DeprecatedFunctions was effectively disabled (#45). The ruleset set the sniff's forbiddenFunctions property, which replaces the list the sniff builds in its constructor from the Reflection API rather than adding to it. The standard reported fewer deprecations than plain Generic did - utf8_encode() among them. Removed functions such as create_function() and each() moved to Generic.PHP.ForbiddenFunctions, where a property override is safe.

Improvements

• Duplicate reporting removed (#47). Four constructs were each flagged by two rules at once: inline assignment, method modifier order, double semicolons and Yoda conditions. In every case the rule with the wider coverage stays and the narrower one is silenced, so the same code is still caught - once instead of twice.

Removed sniffs

Both are fully covered by rules the standard already enables, so nothing stops being reported. Only the error codes change, which is why this is a minor rather than a patch - adjust any baseline or phpcs:ignore that names them.

• PSR2R.PHP.DuplicateSemicolon (#47), superseded by SlevomatCodingStandard.PHP.UselessSemicolon, which reports everything it did and also catches a stray ; after a block.

• PSR2R.WhiteSpace.UnaryOperatorSpacing, superseded by PhpCollective.WhiteSpace.ImplicitCastSpacing together with Generic.WhiteSpace.IncrementDecrementSpacing, both already enabled here. The reference operator was the last construct only the PSR2R sniff handled; php-collective/code-sniffer 0.6.7 covers it, and the floor moves to ^0.6.7 accordingly. The replacement also catches ! $b, which the PSR2R sniff missed.

Note

Most PSR2R rules come from php-collective/code-sniffer. Its 0.6.5 to 0.6.7 releases land here with this bump and carry several fixes to sniffs PSR2R enables, including ConsistentIndent on PHP 8.4 property hooks, attribute names being rewritten as function calls, and DocBlockTagGrouping reporting a fix it never applied.

Full Changelog: 2.8.1...2.9.0

Fixes

• Changed PSR2R.PHP.PreferStaticOverSelf to skip self:: usages inside final classes.
• This avoids a fixer conflict with Universal.CodeAnalysis.StaticInFinalClass, which correctly prefers self:: where late static binding cannot apply.

Full Changelog: 2.8.0...2.8.1

Fixes

• PSR2R.Commenting.DocBlock: skip fully-typed methods. Methods whose parameters and return type are all natively typed no longer require a docblock, reducing noise on modern PHP 8.1+ codebases.
• PSR2R.WhiteSpace.DocBlockAlignment: avoid a PHPCBF max-loop conflict with PSR2R.WhiteSpace.TabIndent when fixing over-indented docblocks. The fixer now keeps structural docblock indentation tab-based instead of alternating between spaces and tabs. #43

Improvements

• Bumped php-collective/code-sniffer to ^0.6.0, picking up its upstream fixes (including the DocBlockParamAllowDefaultValue positional-mismatch fix and additional type-safety improvements across sniffs).
• Enabled 22 additional sniffs to stay aligned with php-collective/code-sniffer 0.6:
  • Universal — AnonClassKeywordSpacing, FirstClassCallableSpacing, Operators.TypeSeparatorSpacing, Attributes.BracketSpacing, Attributes.DisallowAttributeParentheses, Attributes.TrailingComma, ControlStructures.DisallowAlternativeSyntax, CodeAnalysis.NoEchoSprintf, CodeAnalysis.ConstructorDestructorReturn, CodeAnalysis.ForeachUniqueAssignment, CodeAnalysis.StaticInFinalClass
  • SlevomatCodingStandard — Arrays.ArrayAccess, Attributes.AttributeAndTargetSpacing, Attributes.RequireAttributeAfterDocComment, Classes.BackedEnumTypeSpacing, Classes.EnumCaseSpacing, Classes.ClassMemberSpacing, Functions.NamedArgumentSpacing, ControlStructures.LanguageConstructWithParentheses, PHP.ForbiddenClasses
  • Squiz — PHP.DisallowSizeFunctionsInLoops, WhiteSpace.FunctionOpeningBraceSpace

Full Changelog: 2.7.1...2.8.0

Fixes

• Allow @link and @see as inline doc comment markers
• Relax docblocks when fully typed (as per parent lib)
• Improve DocBlockReturnSelfSniff and DocBlockParamNotJustNullSniff (as per parent lib)

Full Changelog: 2.7.0...2.7.1

Improvements

• Fix up new code-sniffer dependency v0.5 compatibility. Adds 1 sniff, removed 1.

Notable change: Attributes are now handled like classes, so no FQCN inside, but normal use statements.

Full Changelog: 2.6.1...2.7.0

Fixes

• Fixed up TabAndSpaceSniff issues

Full Changelog: 2.6.0...2.6.1

Improvements

• Cleaned up signatures.
• Added PSR2R.WhiteSpace.ArrayDeclarationSpacing sniff
• Added Squiz.WhiteSpace.ScopeClosingBrace sniff

Full Changelog: 2.5.0...2.6.0

Improvements

• Added Squiz.ControlStructures.ForLoopDeclaration sniff
• Improved PSR2R.ControlStructures.ControlStructureSpacing sniff

Full Changelog: 2.4.3...2.5.0

Fixes

• Fixed up UnneededElse sniff

Fixes

• Added missing if/else sniffs.