Upgrade WPCS to 3.4.1 and PHPCS to 3.13 - #11
Merged
Conversation
WPCS 2.x is affected by CVE-2026-45293 (arbitrary code execution via eval() in the EnqueuedResourceParameters sniff). Upgrade to the fixed 3.4.1 release, which requires PHPCS >= 3.13 and PHP >= 8.0, so drop PHP 7.4 from the CI matrix. WPCS 3 moves the short-array sniff from Generic to Universal, so update the ruleset exclusion, and fix the new sniff violations surfaced by the upgraded standard (elseif, __DIR__, class closing brace). Composer lockfiles are not committed for composer/installers plugin projects; composer.lock stays gitignored. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
WPCS 3.4.1 pulls in phpcsstandards/phpcsextra and phpcsstandards/phpcsutils as dependencies for its Universal, NormalizedArrays, Modernize, and PHPCSUtils sniffs. The post-install-cmd/post-update-cmd scripts hardcoded PHPCS's installed_paths to only vendor/wp-coding-standards/wpcs, which overwrote the paths that dealerdirect/phpcodesniffer-composer-installer already auto-configures for every installed standard, so those sniffs could not be found and phpcs exited with code 3 in CI. Removing the scripts lets the installer plugin's auto-configuration take over, which includes all installed standards' paths.
WPCS 3.4.1 adds the Universal.NamingConventions.NoReservedKeywordParameterNames sniff, which flags $default in Access_Token::get_meta() since `default` is a reserved keyword. Renamed to $default_value. Also removed the unused $args parameter from Authorization_Code::validate() — Generic.CodeAnalysis.UnusedFunctionParameter flagged it, and grepping the codebase confirms no interface or caller relies on it. phpcs now exits 0 instead of 1, which was failing CI even though these were only warnings, not errors.
GitHub Actions runners now log a deprecation warning on every job because actions/checkout@v4 and actions/cache@v4 still target Node 20, which GitHub is retiring. Bumping to actions/checkout@v7 and actions/cache@v6 (both node24) removes the warning; no config changes were needed for either action.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upgrades dev tooling to clear the Composer security advisory that currently blocks every CI job.
Changes
wp-coding-standards/wpcs:^2.1.1→^3.4.1(fixes CVE-2026-45293, arbitrary code execution viaeval()in the EnqueuedResourceParameters sniff)squizlabs/php_codesniffer:^3.3.1→^3.13.1(required by WPCS 3)yoast/phpunit-polyfills:^1.1 || ^2.0→^2.0.phpcs.xml.distfor WPCS 3: short-array sniff movedGeneric.Arrays.DisallowShortArraySyntax→Universal.Arrays.DisallowShortArraySyntaxelseifinclass-base.php,__DIR__inadmin/namespace.php, class closing brace inclass-implicit.phpcomposer.lockgitignored (plugin project; lockfiles not committed)Validation
vendor/bin/phpcs: 0 errors (2 pre-existing warnings, unchanged behavior)