Fedora 43 Update: chromium-151.0.7922.137-1.fc43
Fedora 43 Update: pdns-5.0.7-1.fc43
Fedora 43 Update: php-pear-PHP-CodeSniffer-4.0.4-1.fc43
Fedora 43 Update: perl-Archive-Tar-3.12-1.fc43
Fedora 44 Update: libsoup3-3.6.6-9.fc44
Fedora 44 Update: chromium-151.0.7922.137-1.fc44
Fedora 44 Update: pdns-5.0.7-1.fc44
Fedora 44 Update: php-pear-PHP-CodeSniffer-4.0.4-1.fc44
[SECURITY] Fedora 43 Update: chromium-151.0.7922.137-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-51e9d3c767
2026-08-15 01:15:27.187384+00:00
--------------------------------------------------------------------------------
Name : chromium
Product : Fedora 43
Version : 151.0.7922.137
Release : 1.fc43
URL : http://www.chromium.org/Home
Summary : A WebKit (Blink) powered web browser that Google doesn't want you to use
Description :
Chromium is an open-source web browser, powered by WebKit (Blink).
--------------------------------------------------------------------------------
Update Information:
chromium security release 151.0.7922.137 inludes fixes for:
* CVE-2026-19556: Use after free in V8
* CVE-2026-19557: Use after free in TabStrip
* CVE-2026-19558: Use after free in Extensions
* CVE-2026-19559: Use after free in HTML
* CVE-2026-19560: Use after free in Blink
--------------------------------------------------------------------------------
ChangeLog:
* Wed Aug 12 2026 Than Ngo [than@redhat.com] - 151.0.7922.137-1
- Update to 151.0.7922.137
* CVE-2026-19556: Use after free in V8
* CVE-2026-19557: Use after free in TabStrip
* CVE-2026-19558: Use after free in Extensions
* CVE-2026-19559: Use after free in HTML
* CVE-2026-19560: Use after free in Blink
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-51e9d3c767' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: pdns-5.0.7-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-8aaf6f724b
2026-08-15 01:15:27.187366+00:00
--------------------------------------------------------------------------------
Name : pdns
Product : Fedora 43
Version : 5.0.7
Release : 1.fc43
URL : http://powerdns.com
Summary : A modern, advanced and high performance authoritative-only name server
Description :
The PowerDNS Nameserver is a modern, advanced and high performance
authoritative-only name server. It is written from scratch and conforms
to all relevant DNS standards documents.
Furthermore, PowerDNS interfaces with almost any database.
--------------------------------------------------------------------------------
Update Information:
Update to 5.0.7
Release notes:
https://docs.powerdns.com/authoritative/changelog/5.0.html#change-5.0.7
Security Advisory: https://doc.powerdns.com/recursor/security-
advisories/powerdns-advisory-2026-11.html
--------------------------------------------------------------------------------
ChangeLog:
* Thu Aug 6 2026 Morten Stevens [mstevens@fedoraproject.org] - 5.0.7-1
- Update to 5.0.7
* Tue Jul 28 2026 Yaakov Selkowitz [yselkowi@redhat.com] - 5.0.6-3
- Use sysusers.d config file for RHEL 11
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 5.0.6-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-8aaf6f724b' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: php-pear-PHP-CodeSniffer-4.0.4-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-fdc77dd5f5
2026-08-15 01:15:27.187355+00:00
--------------------------------------------------------------------------------
Name : php-pear-PHP-CodeSniffer
Product : Fedora 43
Version : 4.0.4
Release : 1.fc43
URL : https://github.com/PHPCSStandards/PHP_CodeSniffer
Summary : PHP coding standards enforcement tool
Description :
PHP_CodeSniffer provides functionality to verify that code conforms to
certain standards, such as PEAR, or user-defined.
--------------------------------------------------------------------------------
Update Information:
Version 4.0.4 - 2026-08-06
This is a security release and all users are advised to update their install(s)
as soon as possible.
The security issue only affects users of the Gitblame, Hgblame or Svnblame
report(s).
Added
Tokenizer support for the PHP 8.5 (void) cast. [#1325]
The T_VOID_CAST token has been added to the Tokens::CAST_TOKENS array.
suggest section to the composer.json file to inform users about the recommended
iconv and pcntl PHP extensions. [#1388]
Thanks to [Rodrigo Primo][@rodrigoprimo] for the patch.
Changed
Clarified that libxml is a required PHP extension. [#1409]
Squiz.Scope.StaticThisUsage: the sniff will now also search for the use of $this
in static closures. [#1377]
The Generic.PHP.LowerCaseKeyword, Generic.WhiteSpace.LanguageConstructSpacing
and Squiz.Functions.FunctionDeclarationArgumentSpacing sniffs no longer embed
UTF-8 middot characters for spaces in error messages. [#1379], [#1389] Fixes
[Squiz/#2652][sq-2652].
Thanks to [Rodrigo Primo][@rodrigoprimo] for the patches.
PSR2.ControlStructures.SwitchDeclaration: the error message for the use of colon
+ curly braces (WrongOpener*) has been made more informative. [#1358]. Fixes
[#1322].
Thanks to [Sule-Balogun Olanrewaju][@bigdevlarry] for the patch.
The error messages for the following sniffs have been improved by exposing more
data placeholders:
PEAR.Functions.FunctionDeclaration [#1445]
The CloseBracketLine error message now exposes 1 data value (previously 0).
The EmptyLine error message now exposes 1 data value (previously 0).
The Indent error message now exposes 3 data values (previously 2).
These changes also affect the same error codes for the
PSR12.Classes.AnonClassDeclaration and
Squiz.Functions.MultiLineFunctionDeclaration sniffs.
PSR2.Classes.ClassDeclaration [#1446]
The ExtendsLine and ImplementsLine error messages now expose 3 data values
(previously 1).
The SpaceBeforeExtends and SpaceBeforeImplements error messages now expose 2
data values (previously 1).
These changes also affect the same error codes for the
PSR12.Classes.AnonClassDeclaration and Squiz.Classes.ClassDeclaration sniffs.
PSR2.ControlStructures.SwitchDeclaration [#1447]
The defaultNotLower and caseNotLower error messages now expose 3 data values
(previously 2).
The SpaceBeforeColonDEFAULT and SpaceBeforeColonCASE error messages now expose 1
data value (previously 0).
The BodyOnNextLineDEFAULT and BodyOnNextLineCASE error messages now expose 1
data value (previously 0).
The WrongOpenerdefault and WrongOpenercase error messages now expose 1 data
value (previously 0).
Squiz.ControlStructures.SwitchDeclaration [#1449]
The CaseNotLower and DefaultNotLower error messages now expose 3 data values
(previously 2).
The CaseIndent and DefaultIndent error messages now expose 2 data values
(previously 0).
The SpaceBeforeColonCase and SpaceBeforeColonDefault error messages now expose 1
data value (previously 0).
The BreakIndent error message now exposes 1 data value (previously 0).
The SpacingAfterCase and SpacingAfterDefault error messages now expose 1 data
value (previously 0).
Squiz.Functions.FunctionDeclarationArgumentSpacing [#1452]
The SpaceBeforeEquals error message now exposes 3 data values (previously 2).
The SpaceAfterEquals error message now exposes 3 data values (previously 2).
Squiz.Functions.MultiLineFunctionDeclaration [#1453]
The FirstParamSpacing and UseFirstParamSpacing error messages now expose 1 data
value (previously 0).
The OneParamPerLine and UseOneParamPerLine error messages now expose 1 data
value (previously 0).
These changes also affect the same error codes for the
PSR12.Classes.AnonClassDeclaration sniff.
If you have customised the error messages of these sniffs, please review your
ruleset after upgrading.
Thanks to [Zhang WenTao][@ntdiary] for these patches.
The following sniff(s) have received efficiency improvements:
PSR2.Classes.PropertyDeclaration
Thanks to [Jonathan Champ][@jrchamp] for the patch.
The test suite is now more contributor friendly for contributors on MacOS.
[#1437]
Thanks to [Sergei Morozov][@morozov] for the patch.
Various housekeeping, including improvements to the tests and documentation.
Thanks to [Dan Wallis][@fredden], [Rodrigo Primo][@rodrigoprimo], [Sergei
Morozov][@morozov] and [Juliette Reinders Folmer][@jrfnl] for their
contributions.
Fixed
SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI
pipeline that scans pull requests, or on a developer machine reviewing third-
party code, could result in attacker-controlled shell commands being executed
when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name
contains shell metacharacters. [#1473]
Users using the default Full report, or any of the other non-*blame reports, are
not affected.
For more details, see the [security advisory][sec-1].
Thanks go to [Faze-up][@Faze-up] and [Volker Dusch][@edorian] for responsibly
disclosing the vulnerability.
Additionally, thanks go to [Volker Dusch][@edorian], [Rodrigo
Primo][@rodrigoprimo], [Dan Wallis][@fredden] and [Juliette Reinders
Folmer][@jrfnl] for creating and testing the fix.
Fixed bug [#1320]: Generic.Strings.UnnecessaryHeredoc: the fixer could
incidentally change tab indentation to space indentation in select lines in the
heredoc body.
Fixed bug [#1354]: PSR12.Functions.ReturnTypeDeclaration: prevent an "Undefined
array key" warning if the code under scan contains a parse error.
Thanks to [Dan Wallis][@fredden] for the patch.
Fixed bug [#1357]: Squiz.Scope.StaticThisUsage: false positive for usage of
$this in non-static closures nested in OO methods.
Fixed bug [#1368]: PEAR.Functions.FunctionDeclaration: the indentation for
subsequent lines in multi-line block comments within a multi-line function
signature, would be incorrectly determined, leading to false positives and
resulting in a fixer conflict when running phpcbf.
This also fixes, by extension, the same issue in the
Squiz.Functions.MultiLineFunctionDeclaration sniff.
Fixed bug [#1418]: Tokenizer/PHP: tokenization of an inline else colon after an
inline comment could fail and/or throw a "Trying to access array offset on null"
warning.
Thanks to [Lazizbek Ergashev][@lazerg] for the patch.
Fixed bug [#1435]: Generic.Formatting.MultipleStatementAlignment would get into
a fixer conflict for multiple assignments within a single statement spanning
multiple lines.
Same as when the statement would be single-line, alignment of subsequent
assignment operators within the same multi-line statement will now be ignored.
Thanks to [Sergei Morozov][@morozov] for the patch.
Fixed bug [#1451]: Tokenizer/PHP: prevent an "Undefined array key" warning
during live coding when a file ends on the name in a constant declaration.
Thanks to [Lazizbek Ergashev][@lazerg] and [Sai Asish Y][@SAY-5] for the patch.
Fixed bug [#1463]: Squiz.Functions.FunctionDuplicateArgument: prevent an
"Undefined array key" PHP warning when the sniff encounters a function
declaration without parentheses (parse error / live coding).
Thanks to [Rodrigo Primo][@rodrigoprimo] for the patch.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Aug 6 2026 Remi Collet [remi@remirepo.net] - 4.0.4-1
- update to 4.0.4
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-fdc77dd5f5' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: perl-Archive-Tar-3.12-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-030f3f2029
2026-08-15 01:15:27.187320+00:00
--------------------------------------------------------------------------------
Name : perl-Archive-Tar
Product : Fedora 43
Version : 3.12
Release : 1.fc43
URL : https://metacpan.org/release/Archive-Tar
Summary : A module for Perl manipulation of .tar files
Description :
Archive::Tar provides an object oriented mechanism for handling tar
files. It provides class methods for quick and easy files handling
while also allowing for the creation of tar file objects for custom
manipulation. If you have the IO::Zlib module installed, Archive::Tar
will also support compressed or gzipped tar files.
--------------------------------------------------------------------------------
Update Information:
The update is required for update Perl to 5.42.3
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jul 29 2026 Jitka Plesnikova [jplesnik@redhat.com] - 3.12-1
- 3.12 bump (rhbz#2484188)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2496665 - CVE-2026-9538 perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2496665
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-030f3f2029' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: libsoup3-3.6.6-9.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-c8cfd2f2f9
2026-08-15 01:04:52.520568+00:00
--------------------------------------------------------------------------------
Name : libsoup3
Product : Fedora 44
Version : 3.6.6
Release : 9.fc44
URL : https://wiki.gnome.org/Projects/libsoup
Summary : Soup, an HTTP library implementation
Description :
Libsoup is an HTTP library implementation in C. It was originally part
of a SOAP (Simple Object Access Protocol) implementation called Soup, but
the SOAP and non-SOAP parts have now been split into separate packages.
libsoup uses the Glib main loop and is designed to work well with GTK
applications. This enables GNOME applications to access HTTP servers
on the network in a completely asynchronous fashion, very similar to
the Gtk+ programming model (a synchronous operation mode is also
supported for those who want it), but the SOAP parts were removed
long ago.
--------------------------------------------------------------------------------
Update Information:
Patches for several CVEs
--------------------------------------------------------------------------------
ChangeLog:
* Thu Aug 13 2026 Luigi Pavan [lpavan@redhat.com] - 3.6.6-9
- Fix CVE-2026-0719, CVE-2026-4271, CVE-2026-12478
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2448046 - CVE-2026-4271 libsoup3: libsoup: Denial of Service via Use-After-Free in HTTP/2 server [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2448046
[ 2 ] Bug #2499921 - CVE-2026-12478 libsoup3: Incomplete fix for CVE-2026-0716: Out-of-bounds read in libsoup WebSocket frame processing (unmasked path) [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2499921
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-c8cfd2f2f9' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: chromium-151.0.7922.137-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-c374680c6a
2026-08-15 01:04:52.520565+00:00
--------------------------------------------------------------------------------
Name : chromium
Product : Fedora 44
Version : 151.0.7922.137
Release : 1.fc44
URL : http://www.chromium.org/Home
Summary : A WebKit (Blink) powered web browser that Google doesn't want you to use
Description :
Chromium is an open-source web browser, powered by WebKit (Blink).
--------------------------------------------------------------------------------
Update Information:
chromium security release 151.0.7922.137 inludes fixes for:
* CVE-2026-19556: Use after free in V8
* CVE-2026-19557: Use after free in TabStrip
* CVE-2026-19558: Use after free in Extensions
* CVE-2026-19559: Use after free in HTML
* CVE-2026-19560: Use after free in Blink
--------------------------------------------------------------------------------
ChangeLog:
* Wed Aug 12 2026 Than Ngo [than@redhat.com] - 151.0.7922.137-1
- Update to 151.0.7922.137
* CVE-2026-19556: Use after free in V8
* CVE-2026-19557: Use after free in TabStrip
* CVE-2026-19558: Use after free in Extensions
* CVE-2026-19559: Use after free in HTML
* CVE-2026-19560: Use after free in Blink
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-c374680c6a' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: pdns-5.0.7-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-706965c440
2026-08-15 01:04:52.520527+00:00
--------------------------------------------------------------------------------
Name : pdns
Product : Fedora 44
Version : 5.0.7
Release : 1.fc44
URL : http://powerdns.com
Summary : A modern, advanced and high performance authoritative-only name server
Description :
The PowerDNS Nameserver is a modern, advanced and high performance
authoritative-only name server. It is written from scratch and conforms
to all relevant DNS standards documents.
Furthermore, PowerDNS interfaces with almost any database.
--------------------------------------------------------------------------------
Update Information:
Update to 5.0.7
Release notes:
https://docs.powerdns.com/authoritative/changelog/5.0.html#change-5.0.7
Security Advisory: https://doc.powerdns.com/recursor/security-
advisories/powerdns-advisory-2026-11.html
--------------------------------------------------------------------------------
ChangeLog:
* Thu Aug 6 2026 Morten Stevens [mstevens@fedoraproject.org] - 5.0.7-1
- Update to 5.0.7
* Tue Jul 28 2026 Yaakov Selkowitz [yselkowi@redhat.com] - 5.0.6-3
- Use sysusers.d config file for RHEL 11
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 5.0.6-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-706965c440' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: php-pear-PHP-CodeSniffer-4.0.4-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-d536e7004b
2026-08-15 01:04:52.520513+00:00
--------------------------------------------------------------------------------
Name : php-pear-PHP-CodeSniffer
Product : Fedora 44
Version : 4.0.4
Release : 1.fc44
URL : https://github.com/PHPCSStandards/PHP_CodeSniffer
Summary : PHP coding standards enforcement tool
Description :
PHP_CodeSniffer provides functionality to verify that code conforms to
certain standards, such as PEAR, or user-defined.
--------------------------------------------------------------------------------
Update Information:
Version 4.0.4 - 2026-08-06
This is a security release and all users are advised to update their install(s)
as soon as possible.
The security issue only affects users of the Gitblame, Hgblame or Svnblame
report(s).
Added
Tokenizer support for the PHP 8.5 (void) cast. [#1325]
The T_VOID_CAST token has been added to the Tokens::CAST_TOKENS array.
suggest section to the composer.json file to inform users about the recommended
iconv and pcntl PHP extensions. [#1388]
Thanks to [Rodrigo Primo][@rodrigoprimo] for the patch.
Changed
Clarified that libxml is a required PHP extension. [#1409]
Squiz.Scope.StaticThisUsage: the sniff will now also search for the use of $this
in static closures. [#1377]
The Generic.PHP.LowerCaseKeyword, Generic.WhiteSpace.LanguageConstructSpacing
and Squiz.Functions.FunctionDeclarationArgumentSpacing sniffs no longer embed
UTF-8 middot characters for spaces in error messages. [#1379], [#1389] Fixes
[Squiz/#2652][sq-2652].
Thanks to [Rodrigo Primo][@rodrigoprimo] for the patches.
PSR2.ControlStructures.SwitchDeclaration: the error message for the use of colon
+ curly braces (WrongOpener*) has been made more informative. [#1358]. Fixes
[#1322].
Thanks to [Sule-Balogun Olanrewaju][@bigdevlarry] for the patch.
The error messages for the following sniffs have been improved by exposing more
data placeholders:
PEAR.Functions.FunctionDeclaration [#1445]
The CloseBracketLine error message now exposes 1 data value (previously 0).
The EmptyLine error message now exposes 1 data value (previously 0).
The Indent error message now exposes 3 data values (previously 2).
These changes also affect the same error codes for the
PSR12.Classes.AnonClassDeclaration and
Squiz.Functions.MultiLineFunctionDeclaration sniffs.
PSR2.Classes.ClassDeclaration [#1446]
The ExtendsLine and ImplementsLine error messages now expose 3 data values
(previously 1).
The SpaceBeforeExtends and SpaceBeforeImplements error messages now expose 2
data values (previously 1).
These changes also affect the same error codes for the
PSR12.Classes.AnonClassDeclaration and Squiz.Classes.ClassDeclaration sniffs.
PSR2.ControlStructures.SwitchDeclaration [#1447]
The defaultNotLower and caseNotLower error messages now expose 3 data values
(previously 2).
The SpaceBeforeColonDEFAULT and SpaceBeforeColonCASE error messages now expose 1
data value (previously 0).
The BodyOnNextLineDEFAULT and BodyOnNextLineCASE error messages now expose 1
data value (previously 0).
The WrongOpenerdefault and WrongOpenercase error messages now expose 1 data
value (previously 0).
Squiz.ControlStructures.SwitchDeclaration [#1449]
The CaseNotLower and DefaultNotLower error messages now expose 3 data values
(previously 2).
The CaseIndent and DefaultIndent error messages now expose 2 data values
(previously 0).
The SpaceBeforeColonCase and SpaceBeforeColonDefault error messages now expose 1
data value (previously 0).
The BreakIndent error message now exposes 1 data value (previously 0).
The SpacingAfterCase and SpacingAfterDefault error messages now expose 1 data
value (previously 0).
Squiz.Functions.FunctionDeclarationArgumentSpacing [#1452]
The SpaceBeforeEquals error message now exposes 3 data values (previously 2).
The SpaceAfterEquals error message now exposes 3 data values (previously 2).
Squiz.Functions.MultiLineFunctionDeclaration [#1453]
The FirstParamSpacing and UseFirstParamSpacing error messages now expose 1 data
value (previously 0).
The OneParamPerLine and UseOneParamPerLine error messages now expose 1 data
value (previously 0).
These changes also affect the same error codes for the
PSR12.Classes.AnonClassDeclaration sniff.
If you have customised the error messages of these sniffs, please review your
ruleset after upgrading.
Thanks to [Zhang WenTao][@ntdiary] for these patches.
The following sniff(s) have received efficiency improvements:
PSR2.Classes.PropertyDeclaration
Thanks to [Jonathan Champ][@jrchamp] for the patch.
The test suite is now more contributor friendly for contributors on MacOS.
[#1437]
Thanks to [Sergei Morozov][@morozov] for the patch.
Various housekeeping, including improvements to the tests and documentation.
Thanks to [Dan Wallis][@fredden], [Rodrigo Primo][@rodrigoprimo], [Sergei
Morozov][@morozov] and [Juliette Reinders Folmer][@jrfnl] for their
contributions.
Fixed
SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI
pipeline that scans pull requests, or on a developer machine reviewing third-
party code, could result in attacker-controlled shell commands being executed
when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name
contains shell metacharacters. [#1473]
Users using the default Full report, or any of the other non-*blame reports, are
not affected.
For more details, see the [security advisory][sec-1].
Thanks go to [Faze-up][@Faze-up] and [Volker Dusch][@edorian] for responsibly
disclosing the vulnerability.
Additionally, thanks go to [Volker Dusch][@edorian], [Rodrigo
Primo][@rodrigoprimo], [Dan Wallis][@fredden] and [Juliette Reinders
Folmer][@jrfnl] for creating and testing the fix.
Fixed bug [#1320]: Generic.Strings.UnnecessaryHeredoc: the fixer could
incidentally change tab indentation to space indentation in select lines in the
heredoc body.
Fixed bug [#1354]: PSR12.Functions.ReturnTypeDeclaration: prevent an "Undefined
array key" warning if the code under scan contains a parse error.
Thanks to [Dan Wallis][@fredden] for the patch.
Fixed bug [#1357]: Squiz.Scope.StaticThisUsage: false positive for usage of
$this in non-static closures nested in OO methods.
Fixed bug [#1368]: PEAR.Functions.FunctionDeclaration: the indentation for
subsequent lines in multi-line block comments within a multi-line function
signature, would be incorrectly determined, leading to false positives and
resulting in a fixer conflict when running phpcbf.
This also fixes, by extension, the same issue in the
Squiz.Functions.MultiLineFunctionDeclaration sniff.
Fixed bug [#1418]: Tokenizer/PHP: tokenization of an inline else colon after an
inline comment could fail and/or throw a "Trying to access array offset on null"
warning.
Thanks to [Lazizbek Ergashev][@lazerg] for the patch.
Fixed bug [#1435]: Generic.Formatting.MultipleStatementAlignment would get into
a fixer conflict for multiple assignments within a single statement spanning
multiple lines.
Same as when the statement would be single-line, alignment of subsequent
assignment operators within the same multi-line statement will now be ignored.
Thanks to [Sergei Morozov][@morozov] for the patch.
Fixed bug [#1451]: Tokenizer/PHP: prevent an "Undefined array key" warning
during live coding when a file ends on the name in a constant declaration.
Thanks to [Lazizbek Ergashev][@lazerg] and [Sai Asish Y][@SAY-5] for the patch.
Fixed bug [#1463]: Squiz.Functions.FunctionDuplicateArgument: prevent an
"Undefined array key" PHP warning when the sniff encounters a function
declaration without parentheses (parse error / live coding).
Thanks to [Rodrigo Primo][@rodrigoprimo] for the patch.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Aug 6 2026 Remi Collet [remi@remirepo.net] - 4.0.4-1
- update to 4.0.4
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-d536e7004b' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
