Pull Request resolves # .

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

This pull request (PR) updates 2 direct composer dependencies (one development and one non development) in order to fix 2 severity vulnerabilities (one high and one uncategorized) reported by composer audit.

In detail following dependencies are updated:

1. Non development dependency "paragonie/sodium_compat" from 1.24.0 to 1.24.2
   https://github.com/paragonie/sodium_compat/releases/tag/v1.24.1
   https://github.com/paragonie/sodium_compat/releases/tag/v1.24.2
   paragonie/sodium_compat@v1.24.0...v1.24.2

2. Development dependency "squizlabs/php_codesniffer" from 3.13.5 to 3.13.6
   https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/4.x/CHANGELOG-3.x.md

See also the separate commits of this PR.

Equivalent for 5.4-dev is PR #48448 , but here we update "squizlabs/php_codesniffer" from 3.13.5 and not from 3.13.4 like in that PR.

Testing Instructions

1. Run composer install and then composer audit.
2. Verify that there are no breaking changes done with this update by checking the release information listed above in the summary of changes.
3. Check that all CI actions are successful.

Actual result BEFORE applying this Pull Request

1. Composer audit

Found 1 ignored security vulnerability advisory affecting 1 package:
+-------------------+----------------------------------------------------------------------------------+
| Package           | web-auth/webauthn-lib                                                            |
| Severity          | medium                                                                           |
| Advisory ID       | PKSA-3mms-4n3p-ym65                                                              |
| CVE               | CVE-2024-39912                                                                   |
| Title             | The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames  |
| URL               | https://github.com/advisories/GHSA-875x-g8p7-5w27                                |
| Affected versions | >=4.5.0,<4.9.0                                                                   |
| Reported at       | 2024-07-15T16:37:49+00:00                                                        |
| Ignore reason     | Temporary until Webauthn plugin has been updated.                                |
+-------------------+----------------------------------------------------------------------------------+
Found 2 security vulnerability advisories affecting 2 packages:
+-------------------+----------------------------------------------------------------------------------+
| Package           | paragonie/sodium_compat                                                          |
| Severity          |                                                                                  |
| Advisory ID       | PKSA-32g2-byr9-drtw                                                              |
| CVE               | NO CVE                                                                           |
| Title             | Incorrect Ed25519 public key validation                                          |
| URL               | https://github.com/paragonie/sodium_compat/pull/206                              |
| Affected versions | >=2,<2.5.1|<1.24.1                                                               |
| Reported at       | 2026-08-18T00:00:00+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | squizlabs/php_codesniffer                                                        |
| Severity          | high                                                                             |
| Advisory ID       | PKSA-rdkp-vv9z-mjkg                                                              |
| CVE               | CVE-2026-67434                                                                   |
| Title             | OS Command injection                                                             |
| URL               | https://github.com/PHPCSStandards/PHP_CodeSniffer/security/advisories/GHSA-hmqg- |
|                   | cxww-wqhq                                                                        |
| Affected versions | <3.13.6|>=4.0.0,<4.0.2                                                           |
| Reported at       | 2026-08-05T23:53:11+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
Found 1 abandoned package:
+---------------------------+----------------------------------------------------------------------------------+
| Abandoned Package         | Suggested Replacement                                                            |
+---------------------------+----------------------------------------------------------------------------------+
| web-auth/metadata-service | web-auth/webauthn-lib                                                            |
+---------------------------+----------------------------------------------------------------------------------+

2. Not applicable.
3. All CI actions are successful.

Expected result AFTER applying this Pull Request

1. Composer audit

Found 1 ignored security vulnerability advisory affecting 1 package:
+-------------------+----------------------------------------------------------------------------------+
| Package           | web-auth/webauthn-lib                                                            |
| Severity          | medium                                                                           |
| Advisory ID       | PKSA-3mms-4n3p-ym65                                                              |
| CVE               | CVE-2024-39912                                                                   |
| Title             | The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames  |
| URL               | https://github.com/advisories/GHSA-875x-g8p7-5w27                                |
| Affected versions | >=4.5.0,<4.9.0                                                                   |
| Reported at       | 2024-07-15T16:37:49+00:00                                                        |
| Ignore reason     | Temporary until Webauthn plugin has been updated.                                |
+-------------------+----------------------------------------------------------------------------------+
Found 1 abandoned package:
+---------------------------+----------------------------------------------------------------------------------+
| Abandoned Package         | Suggested Replacement                                                            |
+---------------------------+----------------------------------------------------------------------------------+
| web-auth/metadata-service | web-auth/webauthn-lib                                                            |
+---------------------------+----------------------------------------------------------------------------------+

2. No breaking changes.
3. All CI actions are successful.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed