build(deps-dev): update squizlabs/php_codesniffer requirement from 3.13.6 to 4.0.4

[dependabot]

Updates the requirements on squizlabs/php_codesniffer to permit the latest version.

Release notes

Sourced from squizlabs/php_codesniffer's releases.

4.0.4 - 2026-08-06

The 4.0.2 release, the 4.0.3 and the 4.0.4 release are 100% the same (aside from the version number), there was just a slight snafu in the release publication on GitHub (missing PHAR assets). Sorry for the confusion.

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

[4.0.4] - 2026-08-06

The 4.0.2 release, the 4.0.3 and the 4.0.4 release are 100% the same, there was just a slight snafu in the release publication on GitHub. Sorry for the confusion.

[4.0.3] - 2026-08-06

WITHDRAWN

[4.0.2] - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible. The security issue only affects users of the Gitblame, Hgblame or Svnblame report(s).

Added

• Tokenizer support for the PHP 8.5 (void) cast. #1325 The T_VOID_CAST token has been added to the Tokens::CAST_TOKENS array.
• suggest section to the composer.json file to inform users about the recommended iconv and pcntl PHP extensions. #1388
  • Thanks to [Rodrigo Primo][@​rodrigoprimo] for the patch.

Changed

• Clarified that libxml is a required PHP extension. #1409
• Squiz.Scope.StaticThisUsage: the sniff will now also search for the use of $this in static closures. #1377
• The Generic.PHP.LowerCaseKeyword, Generic.WhiteSpace.LanguageConstructSpacing and Squiz.Functions.FunctionDeclarationArgumentSpacing sniffs no longer embed UTF-8 middot characters for spaces in error messages. #1379, #1389 Fixes [Squiz/#2652][sq-2652].
  • Thanks to [Rodrigo Primo][@​rodrigoprimo] for the patches.
• PSR2.ControlStructures.SwitchDeclaration: the error message for the use of colon + curly braces (WrongOpener*) has been made more informative. #1358. Fixes #1322.
  • Thanks to [Sule-Balogun Olanrewaju][@​bigdevlarry] for the patch.
• The error messages for the following sniffs have been improved by exposing more data placeholders:
  • PEAR.Functions.FunctionDeclaration #1445
    • The CloseBracketLine error message now exposes 1 data value (previously 0).
    • The EmptyLine error message now exposes 1 data value (previously 0).
    • The Indent error message now exposes 3 data values (previously 2).
    • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration and Squiz.Functions.MultiLineFunctionDeclaration sniffs.
  • PSR2.Classes.ClassDeclaration #1446
    • The ExtendsLine and ImplementsLine error messages now expose 3 data values (previously 1).
    • The SpaceBeforeExtends and SpaceBeforeImplements error messages now expose 2 data values (previously 1).
    • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration and Squiz.Classes.ClassDeclaration sniffs.
  • PSR2.ControlStructures.SwitchDeclaration #1447
    • The defaultNotLower and caseNotLower error messages now expose 3 data values (previously 2).
    • The SpaceBeforeColonDEFAULT and SpaceBeforeColonCASE error messages now expose 1 data value (previously 0).
    • The BodyOnNextLineDEFAULT and BodyOnNextLineCASE error messages now expose 1 data value (previously 0).
    • The WrongOpenerdefault and WrongOpenercase error messages now expose 1 data value (previously 0).
  • Squiz.ControlStructures.SwitchDeclaration #1449
    • The CaseNotLower and DefaultNotLower error messages now expose 3 data values (previously 2).
    • The CaseIndent and DefaultIndent error messages now expose 2 data values (previously 0).
    • The SpaceBeforeColonCase and SpaceBeforeColonDefault error messages now expose 1 data value (previously 0).
    • The BreakIndent error message now exposes 1 data value (previously 0).
    • The SpacingAfterCase and SpacingAfterDefault error messages now expose 1 data value (previously 0).
  • Squiz.Functions.FunctionDeclarationArgumentSpacing #1452
    • The SpaceBeforeEquals error message now exposes 3 data values (previously 2).
    • The SpaceAfterEquals error message now exposes 3 data values (previously 2).

... (truncated)

Commits

• bbdc3d0 Merge branch '3.x' into 4.x
• 3d9e4c6 Merge pull request #1471 from PHPCSStandards/feature/update-gpg-key-info
• 0c3dc35 Changelog: add release links
• ddc0bf9 Changelog update for 4.0.3 + 4.0.4
• 09a2847 Config: update version nr to next
• aa43975 Merge branch '3.x' into 4.x
• 29a0859 Config: update version nr to next
• 305aebb Update for new GPG keys
• 74ee2d4 Merge pull request #1475 from PHPCSStandards/feature/changelog-4.0.2
• 2f4a106 Changelog for the 4.0.2 release
• Additional commits viewable in compare view

[Headgent]

Wird nicht einzeln gemergt: phpcs 4.x ist ein Major-Sprung; die QA-Tools sind fleetweit exakt und einheitlich gepinnt (Entscheid 2026-06-12). Der Umstieg kommt als koordinierter Fleet-Zug ueber alle Package-Repos (Bescheid Rolf 2026-08-13).

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.