Commit 742a068

## [3.13.6] - 2026-08-06

**This is a security release and all users are advised to update their install(s) as soon as possible.**

### Changed

- Various housekeeping, including improvements to the tests and documentation.

- Thanks to [Sergei Morozov][@morozov] and [Juliette Reinders Folmer][@jrfnl] for their contributions.

### Fixed

- **SECURITY FIX**: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the `Gitblame`, `Hgblame` or `Svnblame` report(s) would process a file whose name contains shell metacharacters. [#1473]

- Users using the default `Full` report, or any of the other non-*blame reports, are not affected.

- For more details, see the [security advisory][sec-1].

- Thanks go to [Faze-up][@Faze-up] and [Volker Dusch][@edorian] for responsibly disclosing the vulnerability.

- Additionally, thanks go to [Volker Dusch][@edorian], [Rodrigo Primo][@rodrigoprimo], [Dan Wallis][@fredden] and [Juliette Reinders Folmer][@jrfnl] for creating and testing the fix.

### Other

- The GPG signature for the PHAR files has been rotated. The new fingerprint is: 5CB4F778BF9BC4FB67AE511D96E91A992CF22FF4.

[sec-1]: https://github.com/PHPCSStandards/PHP_CodeSniffer/security/advisories/GHSA-hmqg-cxww-wqhq

[#1473]: https://github.com/PHPCSStandards/PHP_CodeSniffer/pull/1473

[Unreleased]: https://github.com/PHPCSStandards/PHP_CodeSniffer/compare/3.13.6...3.x

[3.13.6]: https://github.com/PHPCSStandards/PHP_CodeSniffer/compare/3.13.5...3.13.6

[@Faze-up]: https://github.com/Faze-up