fix(security): bump phpcsstandards/phpcsutils to 1.2.3 for CVE-2026-65954

[rubenvdlinde]

What

Bumps phpcsstandards/phpcsutils 1.2.2 → 1.2.3. Lock-only change: 0 installs, 1 update, 0 removals.

Why

phpcsstandards/phpcsutils < 1.2.3 carries CVE-2026-65954 (arbitrary code execution, GHSA-r6hr-vr92-vv28, affected >=1.0.0-alpha1,<1.2.3). The advisory was published today, so composer audit turns red on a lock file that has not changed. The Security (composer) job in run 31520758535 passed at 18:10Z only because it ran before the advisory landed — the next run on this branch would have gone red without any diff to explain it.

Evidence

Negative control first, on this tree:

composer audit --locked
-> Found 1 security vulnerability advisory affecting 1 package:
   phpcsstandards/phpcsutils / CVE-2026-65954 / exit 1

After composer update phpcsstandards/phpcsutils --no-install --no-scripts:

composer audit --locked
-> No security vulnerability advisories found / exit 0

The bump is exercised, not merely locked. phpcs was run against the new library on PHP 8.4:

A TOTAL OF 0 ERRORS AND 87 WARNINGS WERE FOUND IN 50 FILES
exit 0

so no sniff regressed on the upgrade.

Scope

This does not address this repo's remaining Hydra Gates failure. gate-19 (e2e-coverage) is still 112 against origin/beta, and it is the only other red cell — the development → beta run has 61 of 64 declared gates reported a result (61 of 61 applicable gates ran) with gate-19 the sole FAIL. That work is separate and is not affected by this lock bump.

[github-actions]

Quality Report — ConductionNL/softwarecatalog @ 2fcb38d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
composer			✅	✅ 128/128
npm			✅	✅ 718/718
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-11 21:12 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

CI settled: 29 checks, 0 pending, 0 failures

The four skipping cells (SBOM, Features Extract, Integration Tests (Newman), Journeydoc Capture) are all pre-existing and unrelated to this change. The Newman skip in particular is already verified as correctly reasoned — the only collection under the configured path is an OpenRegister one whose base_url the shared workflow overrides without the API suffix.

The two cells that matter for this PR are green:

• quality / Security (composer) — pass. This is the CVE-2026-65954 fix verified by CI rather than only locally.
• quality / PHP Quality (phpcs) — pass, which is the bump being exercised rather than merely locked.

⚠️ Do not read the green Hydra Gates cell as gate-19 being closed

Pulled from this PR's own gates job (93929365209):

[hydra-gates] COVERAGE: 25 of 64 declared gates reported a result
              (39 not applicable to this repo/diff; 25 of 25 applicable gates ran).

[gate-19] e2e-coverage: NOT APPLICABLE — the diff against 'origin/development'
          touched NO spec file, so no scenario was inspected.

This PR changes composer.lock and nothing else, so gate-19 was diff-scoped out and inspected nothing. Its silence here is not evidence.

gate-19 remains at 112 against origin/beta, and it is still the only red gate on the development → beta run (61 of 64 reported; 61 of 61 applicable ran). Closing it is separate work and is untouched by this PR.