build(deps-dev): bump phpcsstandards/phpcsutils from 1.2.2 to 1.2.3

[dependabot]

Bumps phpcsstandards/phpcsutils from 1.2.2 to 1.2.3.

Release notes

Sourced from phpcsstandards/phpcsutils's releases.

1.2.3 - 2026-07-27

This is a security release and all users are advised to update their install(s) as soon as possible.

Changed

Other

• Various housekeeping.

Fixed

Abstract Sniffs

• SECURITY FIX: Running a sniff which uses the AbstractArrayDeclarationSniff::getActualArrayKey() method over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #774 For more details, see the security advisory. Thanks go to @​rodrigoprimo for responsibly disclosing the vulnerability.
• The AbstractArrayDeclarationSniff::getActualArrayKey() method now handles exceptions seen when evaluating array keys more gracefully. #775

Utils

• The Arrays::getDoubleArrowPtr() method did not recognize that, while rare, an array key can contain a (nested) array. #771

Changelog

Sourced from phpcsstandards/phpcsutils's changelog.

[1.2.3] - 2026-07-27

This is a security release and all users are advised to update their install(s) as soon as possible.

Changed

Other

• Various housekeeping.

Fixed

Abstract Sniffs

• SECURITY FIX: Running a sniff which uses the AbstractArrayDeclarationSniff::getActualArrayKey() method over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #774 For more details, see the security advisory. Thanks go to [@​rodrigoprimo] for responsibly disclosing the vulnerability.
• The AbstractArrayDeclarationSniff::getActualArrayKey() method now handles exceptions seen when evaluating array keys more gracefully. #775

Utils

• The Arrays::getDoubleArrowPtr() method did not recognize that, while rare, an array key can contain a (nested) array. #771

#771: PHPCSStandards/PHPCSUtils#771 #774: PHPCSStandards/PHPCSUtils#774 #775: PHPCSStandards/PHPCSUtils#775

Commits

• 5f35d94 Merge pull request #778 from PHPCSStandards/develop
• 6a72cf8 Merge pull request #777 from PHPCSStandards/feature/changelog-1.2.3
• d3ef062 Changelog for PHPCSUtils 1.2.3
• f1bb4ee Merge pull request #776 from PHPCSStandards/feature/remark-config-update
• 33328b4 Remark: selectively skip URL patterns [update]
• 533d077 Merge pull request #775 from PHPCSStandards/feature/abstractarraydeclarations...
• 9f596b5 AbstractArrayDeclarationSniff::getActualArrayKey(): catch catchable exceptions
• 90dab1d Merge pull request #774 from PHPCSStandards/security/CVE-2026-65954-getactual...
• e864863 AbstractArrayDeclarationSniff::getActualArrayKey(): prevent executing arbitra...
• 85990cb Merge pull request #773 from PHPCSStandards/feature/ghactions-setup-php-fail-...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.