chore(deps-dev): bump the composer group with 3 updates by dependabot[bot] · Pull Request #81 · rtCamp/wp-framework

dependabot · 2026-07-29T04:44:01Z

Bumps the composer group with 3 updates: wp-coding-standards/wpcs, automattic/vipwpcs and phpstan/phpstan.

Updates wp-coding-standards/wpcs from 3.4.0 to 3.4.1

Release notes

Sourced from wp-coding-standards/wpcs's releases.

3.4.1 - 2026-07-27

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #2770

The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #2770

Various housekeeping, including documentation improvements.

Fixed

SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #2771 This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. For more details, see the security advisory Thanks to @FORIMOC for responsibly disclosing the vulnerability.

Changelog

Sourced from wp-coding-standards/wpcs's changelog.

[3.4.1] - 2026-07-27

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #2770

The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #2770

Various housekeeping, including documentation improvements.

Fixed

SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #2771 This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. For more details, see the security advisory. Thanks to [@FORIMOC] for responsibly disclosing the vulnerability.

#2770: WordPress/WordPress-Coding-Standards#2770 #2771: WordPress/WordPress-Coding-Standards#2771

Commits

ec2ff94 Merge pull request #2773 from WordPress/develop
b558639 Merge pull request #2772 from WordPress/feature/changelog-3.4.1
1696dc8 Changelog for the release of WordPressCS 3.4.1
a29048d Merge pull request #2771 from WordPress/security/enqueuedresourceparams-fix-i...
7262444 WP/EnqueuedResourceParameters: remove eval() from is_falsy()
54719c0 Merge pull request #2770 from WordPress/feature/composer-update-versions
267d84e Composer: update minimum version PHPCSUtils + PHPCSExtra
e8064a6 Add SECURITY.md file (#2766)
7ac8973 Merge pull request #2768 from WordPress/dependabot/github_actions/action-runn...
9466b4b GH Actions: Bump actions/checkout in the action-runners group
Additional commits viewable in compare view

Updates automattic/vipwpcs from 3.0.1 to 3.1.0

Release notes

Sourced from automattic/vipwpcs's releases.

VIP Coding Standards 3.1.0

This release raises the minimum requirements and reworks a large number of the VIPCS sniffs.

The minimum WordPressCS requirement is raised to 3.4.1 (from 3.2.0) — a security release which also brings numerous accuracy improvements to sniffs that VIPCS bundles — along with PHP_CodeSniffer 3.13.5, PHPCSUtils 1.2.3, PHPCSExtra 1.5.1 and VariableAnalysis 2.13.0. The minimum PHP version is now 7.4. Many sniffs have been reworked to fix false positives, add support for modern PHP syntaxes and adopt PHPCSUtils. The JavaScript-specific sniffs and the DynamicCalls sniff have been hard-deprecated ahead of their removal in 4.0.0, and the unused Security.Twig sniff has been removed.

Please ensure you run composer update automattic/vipwpcs --with-dependencies to benefit from this.

Added

#882: Performance/NoPaging: flag posts_per_page and numberposts set to -1 (WordPress' "no limit" value), which previously slipped past the WPCS > 100 check.

#883: Hooks/AlwaysReturnInFilter: exit, die or throw in a filter callback now raises a dedicated TerminatingInsteadOfReturn warning, instead of the generic MissingReturnStatement error.

#890: Add a Byte Order Mark (BOM) check to the WordPressVIPMinimum ruleset.

Changed

#824: Disable WordPress.Security.EscapeOutput.ExceptionNotEscaped in the WordPressVIPMinimum ruleset, as throwing an exception with a translated message triggered it and the check is considered controversial.

#854: Functions/StripTags: always flag use of strip_tags(), as the function should never be used on the VIP platform.

As VIPCS bundles a number of WordPressCS sniffs and the minimum WordPressCS version has been raised to 3.4.1, users will now receive more accurate results from the following WPCS sniffs (see the WordPressCS 3.3.0, 3.4.0 and 3.4.1 release notes for full details):

WordPress.DB.DirectDatabaseQuery: recognises more caching functions (such as the wp_cache_*_multiple() and wp_cache_*_salted() functions), and has fewer false positives when caching functions are called using a non-canonical function name.

WordPress.DB.PreparedSQL: fewer false positives for correctly escaped SQL called using a non-canonical function name, and for static method calls to a non-global class named wpdb.

WordPress.Security.EscapeOutput: adds support for attributes on anonymous classes (PHP 8.0), readonly anonymous classes (PHP 8.3) and exit as a function call (PHP 8.4); expands *::class false-positive protection; fixes false positives/negatives for get_search_query() and _deprecated_file() used with non-standard casing; and no longer treats wp_kses_allowed_html() as an escaping function, which may surface a new warning where that function's return value was being output directly.

WordPress.Security.NonceVerification: fewer false positives when the nonce-checking function is called using a non-canonical function name.

WordPress.Security.ValidatedSanitizedInput: clearer error message for the InputNotValidated error code.

WordPress.WP.AlternativeFunctions: fixes a false negative when class members share a name with select global WP functions/constants, and a false positive for the fully qualified stream constants \STDIN, \STDOUT and \STDERR.

WordPress.WP.CronInterval: fixes a false positive when the callback reference used a different case to the function declaration.

Deprecated

#839: Hard-deprecate all JavaScript-specific sniffs (WordPressVIPMinimum.JS.*). They are excluded from the rulesets and will be removed in VIPCS 4.0.0.

#865: Hard-deprecate the WordPressVIPMinimum.Functions.DynamicCalls sniff. It is excluded from the rulesets and will be removed in VIPCS 4.0.0.

Removed

#864: Remove the unused WordPressVIPMinimum.Security.Twig sniff.

Fixed

#840: Fix dangerous comparisons against the value of token constants.

#842: Security/Mustache: fix potential false positives on a delimiter change, and examine double-quoted strings with interpolation and nowdocs which were previously skipped.

#846, #848: Security/PHPFilterFunctions: fix false positives for method calls, namespaced function calls and attributes which share the function name.

#847: Security/StaticStrreplace: fix flawed detection of str_replace() by extending the WordPressCS AbstractFunctionParameterSniff; method calls, namespaced calls, first-class callables and argument unpacking are no longer flagged.

#850: Variables/ServerVariables: fix incorrect quote stripping and expand safeguards against false positives.

#851: Constants/ConstantString: fix flawed detection of define()/defined() by extending AbstractFunctionParameterSniff, and clarify the error message.

#852: Hooks/RestrictedHooks: fix false positives (method/namespaced calls, first-class callables, attributes) and disregard comments in the hook-name parameter.

#853: Performance/LowExpiryCacheTime: avoid a possible fatal error when a PHP 7.4+ numeric literal or 8.1+ octal literal is used as the cache time.

#855: Performance/FetchingRemoteData: fix flawed function-call detection by extending AbstractFunctionParameterSniff.

#858: Classes/DeclarationCompatibility: modernise and fix the sniff.

#861: Security/EscapingVoidReturnFunctions: fix flawed detection of esc_*()/wp_kses*() calls by extending AbstractFunctionParameterSniff; safeguard argument unpacking, attributes and first-class callables.

#862: Functions/DynamicCalls: fix end-of-statement determination and other minor issues.

#866: UserExperience/AdminBarRemoval: several fixes — case-insensitive function-name matching, recognise add_action() as an alias, disregard comments in parameters, and no longer treat a CSS file as PHP; plus PHP 8.0+ function-call and 8.1+ first-class-callable support.

#867: Performance/CacheValueOverride: fix false negatives for fully qualified calls and false positives for PHP 8.1+ first-class callables and variables.

#869: Constants/RestrictedConstants: fix a nonsensical comparison and use PHPCSUtils for quote stripping.

#872: Performance/TaxonomyMetaInOptions: extend AbstractFunctionParameterSniff and add PHP 8.0+ function-call and nullsafe-operator support.

#881: Hooks/AlwaysReturnInFilter: resolve bugs and adopt PHPCSUtils.

... (truncated)

Changelog

Sourced from automattic/vipwpcs's changelog.

[3.1.0] - 2026-07-27

Props: @GaryJones, @jrfnl, @mahangu, @mchanDev, @mujuonly, @rebeccahum

This release raises the minimum requirements and reworks a large number of the VIPCS sniffs.

The minimum WordPressCS requirement is raised to 3.4.1 (from 3.2.0) — a security release which also brings numerous accuracy improvements to sniffs that VIPCS bundles — along with PHP_CodeSniffer 3.13.5, PHPCSUtils 1.2.3, PHPCSExtra 1.5.1 and VariableAnalysis 2.13.0. The minimum PHP version is now 7.4. Many sniffs have been reworked to fix false positives, add support for modern PHP syntaxes and adopt PHPCSUtils. The JavaScript-specific sniffs and the DynamicCalls sniff have been hard-deprecated ahead of their removal in 4.0.0, and the unused Security.Twig sniff has been removed.

Please ensure you run composer update automattic/vipwpcs --with-dependencies to benefit from this.

Added

#882: Performance/NoPaging: flag posts_per_page and numberposts set to -1 (WordPress' "no limit" value), which previously slipped past the WPCS > 100 check.

#883: Hooks/AlwaysReturnInFilter: exit, die or throw in a filter callback now raises a dedicated TerminatingInsteadOfReturn warning, instead of the generic MissingReturnStatement error.

#890: Add a Byte Order Mark (BOM) check to the WordPressVIPMinimum ruleset.

Changed

#824: Disable WordPress.Security.EscapeOutput.ExceptionNotEscaped in the WordPressVIPMinimum ruleset, as throwing an exception with a translated message triggered it and the check is considered controversial.

#854: Functions/StripTags: always flag use of strip_tags(), as the function should never be used on the VIP platform.

As VIPCS bundles a number of WordPressCS sniffs and the minimum WordPressCS version has been raised to 3.4.1, users will now receive more accurate results from the following WPCS sniffs (see the WordPressCS 3.3.0, 3.4.0 and 3.4.1 release notes for full details):

WordPress.DB.DirectDatabaseQuery: recognises more caching functions (such as the wp_cache_*_multiple() and wp_cache_*_salted() functions), and has fewer false positives when caching functions are called using a non-canonical function name.

WordPress.DB.PreparedSQL: fewer false positives for correctly escaped SQL called using a non-canonical function name, and for static method calls to a non-global class named wpdb.

WordPress.Security.EscapeOutput: adds support for attributes on anonymous classes (PHP 8.0), readonly anonymous classes (PHP 8.3) and exit as a function call (PHP 8.4); expands *::class false-positive protection; fixes false positives/negatives for get_search_query() and _deprecated_file() used with non-standard casing; and no longer treats wp_kses_allowed_html() as an escaping function, which may surface a new warning where that function's return value was being output directly.

WordPress.Security.NonceVerification: fewer false positives when the nonce-checking function is called using a non-canonical function name.

WordPress.Security.ValidatedSanitizedInput: clearer error message for the InputNotValidated error code.

WordPress.WP.AlternativeFunctions: fixes a false negative when class members share a name with select global WP functions/constants, and a false positive for the fully qualified stream constants \STDIN, \STDOUT and \STDERR.

WordPress.WP.CronInterval: fixes a false positive when the callback reference used a different case to the function declaration.

Deprecated

#839: Hard-deprecate all JavaScript-specific sniffs (WordPressVIPMinimum.JS.*). They are excluded from the rulesets and will be removed in VIPCS 4.0.0.

#865: Hard-deprecate the WordPressVIPMinimum.Functions.DynamicCalls sniff. It is excluded from the rulesets and will be removed in VIPCS 4.0.0.

Removed

#864: Remove the unused WordPressVIPMinimum.Security.Twig sniff.

Fixed

#840: Fix dangerous comparisons against the value of token constants.

#842: Security/Mustache: fix potential false positives on a delimiter change, and examine double-quoted strings with interpolation and nowdocs which were previously skipped.

#846, #848: Security/PHPFilterFunctions: fix false positives for method calls, namespaced function calls and attributes which share the function name.

#847: Security/StaticStrreplace: fix flawed detection of str_replace() by extending the WordPressCS AbstractFunctionParameterSniff; method calls, namespaced calls, first-class callables and argument unpacking are no longer flagged.

#850: Variables/ServerVariables: fix incorrect quote stripping and expand safeguards against false positives.

#851: Constants/ConstantString: fix flawed detection of define()/defined() by extending AbstractFunctionParameterSniff, and clarify the error message.

#852: Hooks/RestrictedHooks: fix false positives (method/namespaced calls, first-class callables, attributes) and disregard comments in the hook-name parameter.

#853: Performance/LowExpiryCacheTime: avoid a possible fatal error when a PHP 7.4+ numeric literal or 8.1+ octal literal is used as the cache time.

#855: Performance/FetchingRemoteData: fix flawed function-call detection by extending AbstractFunctionParameterSniff.

#858: Classes/DeclarationCompatibility: modernise and fix the sniff.

#861: Security/EscapingVoidReturnFunctions: fix flawed detection of esc_*()/wp_kses*() calls by extending AbstractFunctionParameterSniff; safeguard argument unpacking, attributes and first-class callables.

#862: Functions/DynamicCalls: fix end-of-statement determination and other minor issues.

#866: UserExperience/AdminBarRemoval: several fixes — case-insensitive function-name matching, recognise add_action() as an alias, disregard comments in parameters, and no longer treat a CSS file as PHP; plus PHP 8.0+ function-call and 8.1+ first-class-callable support.

#867: Performance/CacheValueOverride: fix false negatives for fully qualified calls and false positives for PHP 8.1+ first-class callables and variables.

#869: Constants/RestrictedConstants: fix a nonsensical comparison and use PHPCSUtils for quote stripping.

... (truncated)

Commits

9c47cd0 Merge pull request #893 from Automattic/release/3.1.0
e9b8992 docs: add changelog for 3.1.0 release
0ecf92e Merge pull request #892 from Automattic/GaryJones/update-wpcs-dependency-341
c198d3e build: raise minimum WordPressCS to 3.4.1
0152175 Merge pull request #891 from Automattic/dependabot/github_actions/actions/che...
7b2e08d GH Actions: Bump actions/checkout from 7.0.0 to 7.0.1
c4531d7 Merge pull request #890 from Automattic/add/BOM-sniff
7592044 test: report discrepancies from both ruleset tests
06c8983 test: preserve BOM in ruleset test fixtures via EditorConfig
ad57653 Refactor tests and test runner, add BOM sniff, add bom specific ruleset to pr...
Additional commits viewable in compare view

Updates phpstan/phpstan from 2.2.5 to 2.2.6

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the composer group with 3 updates: [wp-coding-standards/wpcs](https://github.com/WordPress/WordPress-Coding-Standards), [automattic/vipwpcs](https://github.com/Automattic/VIP-Coding-Standards) and [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source). Updates `wp-coding-standards/wpcs` from 3.4.0 to 3.4.1 - [Release notes](https://github.com/WordPress/WordPress-Coding-Standards/releases) - [Changelog](https://github.com/WordPress/WordPress-Coding-Standards/blob/develop/CHANGELOG.md) - [Commits](WordPress/WordPress-Coding-Standards@3.4.0...3.4.1) Updates `automattic/vipwpcs` from 3.0.1 to 3.1.0 - [Release notes](https://github.com/Automattic/VIP-Coding-Standards/releases) - [Changelog](https://github.com/Automattic/VIP-Coding-Standards/blob/develop/CHANGELOG.md) - [Commits](Automattic/VIP-Coding-Standards@3.0.1...3.1.0) Updates `phpstan/phpstan` from 2.2.5 to 2.2.6 - [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits) --- updated-dependencies: - dependency-name: wp-coding-standards/wpcs dependency-version: 3.4.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: composer - dependency-name: automattic/vipwpcs dependency-version: 3.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: composer - dependency-name: phpstan/phpstan dependency-version: 2.2.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: composer ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 29, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps-dev): bump the composer group with 3 updates - #81

chore(deps-dev): bump the composer group with 3 updates#81
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-2a128e8dc7

dependabot Bot commented on behalf of github Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 29, 2026

3.4.1 - 2026-07-27

Changed

Fixed

[3.4.1] - 2026-07-27

Changed

Fixed

VIP Coding Standards 3.1.0

Added

Changed

Deprecated

Removed

Fixed

[3.1.0] - 2026-07-27

Added

Changed

Deprecated

Removed

Fixed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants