Psr2R Sniffer Laravel Package

Fixes

• Security: raise the squizlabs/php_codesniffer floor to ^4.0.2. CVE-2026-67434, an OS command injection advisory published 2026-08-05, covers >=4.0.0,<4.0.2. The previous constraint allowed an affected version.

• Generic.PHP.DeprecatedFunctions was effectively disabled (#45). The ruleset set the sniff's forbiddenFunctions property, which replaces the list the sniff builds in its constructor from the Reflection API rather than adding to it. The standard reported fewer deprecations than plain Generic did - utf8_encode() among them. Removed functions such as create_function() and each() moved to Generic.PHP.ForbiddenFunctions, where a property override is safe.

Improvements

• Duplicate reporting removed (#47). Four constructs were each flagged by two rules at once: inline assignment, method modifier order, double semicolons and Yoda conditions. In every case the rule with the wider coverage stays and the narrower one is silenced, so the same code is still caught - once instead of twice.

Removed sniffs

Both are fully covered by rules the standard already enables, so nothing stops being reported. Only the error codes change, which is why this is a minor rather than a patch - adjust any baseline or phpcs:ignore that names them.

• PSR2R.PHP.DuplicateSemicolon (#47), superseded by SlevomatCodingStandard.PHP.UselessSemicolon, which reports everything it did and also catches a stray ; after a block.

• PSR2R.WhiteSpace.UnaryOperatorSpacing, superseded by PhpCollective.WhiteSpace.ImplicitCastSpacing together with Generic.WhiteSpace.IncrementDecrementSpacing, both already enabled here. The reference operator was the last construct only the PSR2R sniff handled; php-collective/code-sniffer 0.6.7 covers it, and the floor moves to ^0.6.7 accordingly. The replacement also catches ! $b, which the PSR2R sniff missed.

Note

Most PSR2R rules come from php-collective/code-sniffer. Its 0.6.5 to 0.6.7 releases land here with this bump and carry several fixes to sniffs PSR2R enables, including ConsistentIndent on PHP 8.4 property hooks, attribute names being rewritten as function calls, and DocBlockTagGrouping reporting a fix it never applied.

Full Changelog: https://github.com/php-fig-rectified/psr2r-sniffer/compare/2.8.1...2.9.0

Fixes

• Changed PSR2R.PHP.PreferStaticOverSelf to skip self:: usages inside final classes.
• This avoids a fixer conflict with Universal.CodeAnalysis.StaticInFinalClass, which correctly prefers self:: where late static binding cannot apply.

Full Changelog: https://github.com/php-fig-rectified/psr2r-sniffer/compare/2.8.0...2.8.1

Fixes

• PSR2R.Commenting.DocBlock: skip fully-typed methods. Methods whose parameters and return type are all natively typed no longer require a docblock, reducing noise on modern PHP 8.1+ codebases.
• PSR2R.WhiteSpace.DocBlockAlignment: avoid a PHPCBF max-loop conflict with PSR2R.WhiteSpace.TabIndent when fixing over-indented docblocks. The fixer now keeps structural docblock indentation tab-based instead of alternating between spaces and tabs. #43

Improvements

• Bumped php-collective/code-sniffer to ^0.6.0, picking up its upstream fixes (including the DocBlockParamAllowDefaultValue positional-mismatch fix and additional type-safety improvements across sniffs).
• Enabled 22 additional sniffs to stay aligned with php-collective/code-sniffer 0.6:
  • Universal — AnonClassKeywordSpacing, FirstClassCallableSpacing, Operators.TypeSeparatorSpacing, Attributes.BracketSpacing, Attributes.DisallowAttributeParentheses, Attributes.TrailingComma, ControlStructures.DisallowAlternativeSyntax, CodeAnalysis.NoEchoSprintf, CodeAnalysis.ConstructorDestructorReturn, CodeAnalysis.ForeachUniqueAssignment, CodeAnalysis.StaticInFinalClass
  • SlevomatCodingStandard — Arrays.ArrayAccess, Attributes.AttributeAndTargetSpacing, Attributes.RequireAttributeAfterDocComment, Classes.BackedEnumTypeSpacing, Classes.EnumCaseSpacing, Classes.ClassMemberSpacing, Functions.NamedArgumentSpacing, ControlStructures.LanguageConstructWithParentheses, PHP.ForbiddenClasses
  • Squiz — PHP.DisallowSizeFunctionsInLoops, WhiteSpace.FunctionOpeningBraceSpace

Full Changelog: https://github.com/php-fig-rectified/psr2r-sniffer/compare/2.7.1...2.8.0

Fixes

• Allow [@link](https://github.com/link) and [@see](https://github.com/see) as inline doc comment markers
• Relax docblocks when fully typed (as per parent lib)
• Improve DocBlockReturnSelfSniff and DocBlockParamNotJustNullSniff (as per parent lib)

Full Changelog: https://github.com/php-fig-rectified/psr2r-sniffer/compare/2.7.0...2.7.1

Improvements

• Fix up new code-sniffer dependency v0.5 compatibility. Adds 1 sniff, removed 1.

Notable change: Attributes are now handled like classes, so no FQCN inside, but normal use statements.

Full Changelog: https://github.com/php-fig-rectified/psr2r-sniffer/compare/2.6.1...2.7.0

Fixes

• Fixed up TabAndSpaceSniff issues

Full Changelog: https://github.com/php-fig-rectified/psr2r-sniffer/compare/2.6.0...2.6.1

Improvements

• Cleaned up signatures.
• Added PSR2R.WhiteSpace.ArrayDeclarationSpacing sniff
• Added Squiz.WhiteSpace.ScopeClosingBrace sniff

Full Changelog: https://github.com/php-fig-rectified/psr2r-sniffer/compare/2.5.0...2.6.0

Improvements

• Added Squiz.ControlStructures.ForLoopDeclaration sniff
• Improved PSR2R.ControlStructures.ControlStructureSpacing sniff

Full Changelog: https://github.com/php-fig-rectified/psr2r-sniffer/compare/2.4.3...2.5.0

Fixes

• Fixed up UnneededElse sniff

Fixes

• Added missing if/else sniffs.

Fixes

• Fixed bug in UnneededElse.

Improvements

• Update sniffs to PHPCS v4

Improvements

• Requires now https://github.com/php-collective/code-sniffer/releases/tag/0.3.0

This improvement ships with 14 new sniffs, many of them making array notation more consistent and reliable.

Improvements

• Removed deprecations

Improvements

• Removed deprecations

Fixes

• Fix broken unused uses sniff.
• Fix ternary spacing sniff.

Fixes

• Skip FQCN to use statement refactor requirement for attributes

Improvements

• Added new PSR4 sniff

Full Changelog: https://github.com/php-fig-rectified/psr2r-sniffer/compare/2.0.0...2.1.0

PHP 8.1+ release

Includes quite a few improvements including type safety. Currently, PSR2R ships with over 190 sniffs.

Fixes

Reverted "silence removal of SlevomatCodingStandard.Namespaces.ReferenceUsedNamesOnly.ReferenceViaFullyQualifiedName" for now as there is no way to ignore Attributes for now.

Improvements

• Remove silencing of SlevomatCodingStandard.Namespaces.ReferenceUsedNamesOnly
• Fix up DisallowTrailingComma sniffs

Improvements

Allow for new slevomat/coding-standard 8.x. This is to allow for all new fixes of that series to be used by everyone.

Please note You need to add the php_version config in your root phpcs.xml file before upgrading.

E.g. if you are using >= 7.4 in composer as PHP min requirement:

<config name="php_version" value="70400"/>

The reason is that it would otherwise execute your local PHP version (e.g. 8.1) and modify the code according to "too new language features".

Fixes

• Fixed DocBlockReturnSelfSniff handling of self

Improvements

• Added enum support
• Updated whitelisted tags to be consistent with PHPUnit 9

Fixes

Re-added fixed TabIndent sniff.

Fixes

Replace faulty sniff with working one.

Fixes

• Resolved problem of tab indentation breaking for certain sniffs
• Removed superfluous sniff

Fixes

Removed invalid sniff, added some more useful ones.

Improvements

Generics syntax instead of legacy array syntax

The old string[] syntax is deprecated and replaced by generics, as it can now also focus on key instead of just value:

• array<string> (list) vs array<string, string> (assoc array)
• It is recommended not to upgrade object collections outside of \ArrayObject and \ArrayAccess etc, as IDEs do not yet understand those. Here we can keep \MyCollection|\MyObject[] as legacy typehint in place. Custom [@phpstan-](https://github.com/phpstan-)* tags on top can be "clean" already.

PHP 7.3+

With PHP 7.3 being already EOL soon, it only makes sense to drop the already very long EOL 7.2 version. It is already PHP 8.1 tested, however, as well.

More quality sniffs

Quite a few more sniffs to make sure the code is also semantically checked even before any static analyzer like PHPStan/Psalm look at it.

Improvements

Upgrade to new slevomat/coding-standard v7

Previous releases were a bit wonky (1.1.0 was released on a wrong branch it seems), please use this one moving forward.

Fixes

• Allowed phpstan-* and psalm-* tags to work.
• Fixed conflict on class opening lines

Release of PHP 7.2+ version (LTS)

Note: This version recommends changing code as per PHP 7.2+. If your code needs to run also on lower versions, please use the previous version and the corresponding ^0.6 constraint here.

This sniffer is now a combination of

• https://github.com/slevomat/coding-standard
• https://github.com/spryker/code-sniffer
• and a few own extras for PSR2R and beyond

creating a best practice bundle of ~180 sniffs.

Beta Release of PHP 7.2+ version (LTS)

This sniffer is now a combination of

• https://github.com/slevomat/coding-standard
• https://github.com/spryker/code-sniffer
• and a few own extras for PSR2R and beyond

creating a best practice bundle of ~180 sniffs.

Improvements

• Added NamespaceSpacingSniff to assert a newline before namespace statements as per PSR-12.