Skip to content

chore(deps-dev): bump wp-coding-standards/wpcs from 3.4.0 to 3.4.1 in the composer group across 1 directory - #64

Merged
guibranco merged 1 commit into
mainfrom
dependabot/composer/composer-0fc88b6ec5
Oct 29, 2026
Merged

guibranco merged 1 commit into
mainfrom
dependabot/composer/composer-0fc88b6ec5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the composer group with 1 update in the / directory: wp-coding-standards/wpcs.

Updates wp-coding-standards/wpcs from 3.4.0 to 3.4.1

Release notes

Sourced from wp-coding-standards/wpcs's releases.

3.4.1 - 2026-07-27

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

  • The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #2770
  • The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #2770
  • Various housekeeping, including documentation improvements.

Fixed

  • SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #2771 This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. For more details, see the security advisory Thanks to @​FORIMOC for responsibly disclosing the vulnerability.
Changelog

Sourced from wp-coding-standards/wpcs's changelog.

[3.4.1] - 2026-07-27

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

  • The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #2770
  • The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #2770
  • Various housekeeping, including documentation improvements.

Fixed

  • SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #2771 This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. For more details, see the security advisory. Thanks to [@​FORIMOC] for responsibly disclosing the vulnerability.

#2770: WordPress/WordPress-Coding-Standards#2770 #2771: WordPress/WordPress-Coding-Standards#2771

Commits
  • ec2ff94 Merge pull request #2773 from WordPress/develop
  • b558639 Merge pull request #2772 from WordPress/feature/changelog-3.4.1
  • 1696dc8 Changelog for the release of WordPressCS 3.4.1
  • a29048d Merge pull request #2771 from WordPress/security/enqueuedresourceparams-fix-i...
  • 7262444 WP/EnqueuedResourceParameters: remove eval() from is_falsy()
  • 54719c0 Merge pull request #2770 from WordPress/feature/composer-update-versions
  • 267d84e Composer: update minimum version PHPCSUtils + PHPCSExtra
  • e8064a6 Add SECURITY.md file (#2766)
  • 7ac8973 Merge pull request #2768 from WordPress/dependabot/github_actions/action-runn...
  • 9466b4b GH Actions: Bump actions/checkout in the action-runners group
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps the composer group with 1 update in the / directory: [wp-coding-standards/wpcs](https://github.com/WordPress/WordPress-Coding-Standards).


Updates `wp-coding-standards/wpcs` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/WordPress/WordPress-Coding-Standards/releases)
- [Changelog](https://github.com/WordPress/WordPress-Coding-Standards/blob/develop/CHANGELOG.md)
- [Commits](WordPress/WordPress-Coding-Standards@3.4.0...3.4.1)

---
updated-dependencies:
- dependency-name: wp-coding-standards/wpcs
  dependency-version: 3.4.1
  dependency-type: direct:development
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, php. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@sonarqubecloud

Copy link
Copy Markdown

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedwp-coding-standards/​wpcs@​3.4.0.0 ⏵ 3.4.1.0N/AN/AN/AN/AN/A

View full report

@guibranco
guibranco enabled auto-merge (squash) October 27, 2026 19:18
@gstraccini gstraccini Bot added the ☑️ auto-merge Automatic merging of pull requests (gstraccini-bot) label Oct 27, 2026

@guibranco guibranco left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automatically approved by gstraccini[bot]

@gstraccini gstraccini Bot added the 🤖 bot Automated processes or integrations label Oct 27, 2026
@guibranco

Copy link
Copy Markdown
Owner

@gstraccini review

@gstraccini

gstraccini Bot commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

Reviewing this pull request! 👀
Mergeable state: blocked

Commits included:
SHA: a6ac01eb19acb1e38fb1e5e73f902a22c0772569

@guibranco
guibranco merged commit 46df5be into main Oct 29, 2026
15 checks passed
@guibranco
guibranco deleted the dependabot/composer/composer-0fc88b6ec5 branch October 29, 2026 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

☑️ auto-merge Automatic merging of pull requests (gstraccini-bot) 🤖 bot Automated processes or integrations

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant