composer: update friendsofphp/php-cs-fixer requirement from ^3.87 to ^3.88

[dependabot]

Updates the requirements on friendsofphp/php-cs-fixer to permit the latest version.

Release notes

Sourced from friendsofphp/php-cs-fixer's releases.

v3.88.2 Folding Bike

What's Changed

• docs: describe command - allow to expand sets by @​keradus in PHP-CS-Fixer/PHP-CS-Fixer#9104
  • e.g. php-cs-fixer describe @auto --expand
• docs: describe command - allow to describe config in use by @​keradus in PHP-CS-Fixer/PHP-CS-Fixer#9103
  • e.g. php-cs-fixer describe [@] [--expand]

Full Changelog: PHP-CS-Fixer/PHP-CS-Fixer@v3.88.1...v3.88.2

Changelog

Sourced from friendsofphp/php-cs-fixer's changelog.

Changelog for v3.88.2

• docs: describe command - allow to describe config in use (#9103)
• docs: describe command - allow to expand sets (#9104)

Changelog for v3.88.1

• chore: use accidentally missing @auto:risky (#9102)
• deps: bump crate-ci/typos from 1.36.2 to 1.36.3 (#9099)
• deps: bump icanhazstring/composer-unused from 0.9.4 to 0.9.5 in /dev-tools (#9100)
• DX: Ability to run yamllint locally (#9093)

Changelog for v3.88.0

• feat: Support custom rulesets (#6083)
• feat: introduce @auto, @auto:risky sets (#9090)
• feat: introduce @autoPHPMigration, @autoPHPMigration:risky, @autoPHPUnitMigration:risky sets (#9068)
• feat: start using new defaults for rules under future mode (#9020)
• feat: rename rule sets from MAJORMINOR and MAJOR.MINOR into MAJORxMINOR (#9005)
• feat: rename visibility_required into modifier_keywords (#8995)
• feat: symfony ruleset: Add @const to phpdoc_no_alias_tag (#9016)
• fix: BlankLinesBeforeNamespaceFixer - handle namespace without newline before (#9059)
• docs: fix typo (#9060)
• docs: update CONTRIBUTING.md (#9074)
• docs: update README for updated PHP/PHPUnit set names (#9070)
• DX: Allow development on PHP 8.5 (#9092)
• chore: enforce list via array_values() (#9054)
• chore: ErrorOutput - line is optional (#9047)
• chore: fix cs in entry point file (#9064)
• chore: fix CS, somehow it missed the CI of .php-cs-fixer.well-defined-arrays.php (#8987)
• chore: fix some argument.type errors (#9056)
• chore: groom Automatic rulesets code (#9091)
• chore: phpstan - do not ignore all internal usage errors (#9063)
• chore: replace wrong class-string usages (#8968)
• chore: getcwd() - ignore false return value (#9057)
• chore: ReporterFactory - use class-string type (#9055)
• CI: check for typos (#9048)
• CI: don't prevent the build when remote coverage reporting service is down (#9095)
• CI: fix smoke tests after #9005 (#9061)
• CI: fix typos in CHANGELOG.md (#9052)
• CI: mutation tests - disable github annotations (#9062)
• CI: Test docs generation only once per CI pipeline (#9089)
• CI: push event only for master branch (#9046)
• CI: push event only for master branch (#9050)
• deps: bump box version (#9042)
• deps: bump ergebnis/composer-normalize from 2.48.1 to 2.48.2 in /dev-tools (#9045)
• deps: bump phpstan/phpstan from 2.1.25 to 2.1.28 in /dev-tools in the phpstan group (#9072)

... (truncated)

Commits

• a8d1558 prepared the 3.88.2 release
• ea80662 docs: describe command - allow to expand sets (#9104)
• 3040ad3 docs: describe command - allow to describe config in use (#9103)
• 43cc7a2 bumped version
• 1c2a98f prepared the 3.88.1 release
• dcb5ce1 chore: use accidentally missing @auto:risky (#9102)
• 01f2c56 deps: bump icanhazstring/composer-unused from 0.9.4 to 0.9.5 in /dev-tools (#...
• c7496f2 deps: bump crate-ci/typos from 1.36.2 to 1.36.3 (#9099)
• 8eb66af DX: Ability to run yamllint locally (#9093)
• a909299 bumped version
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Note

Free review on us!

CodeRabbit is offering free reviews until Wed Oct 08 2025 to showcase some of the refinements we've made.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}