feat(deps): accept pollora/wp-rest 2.0

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased](https://github.com/Pollora/framework/compare/v13.39.2...develop)
 
+### Changed
+- **`pollora/wp-rest` 2.0 is accepted, and `composer update` installs it: a REST route that declares no permission is refused** (`rest_forbidden`, 401 for a visitor, 403 for a logged-in user), where it used to stay public. Before updating, declare `permissionCallback: Everyone::class` on the routes that are public on purpose, or a permission such as `IsLoggedIn`. To keep the old behaviour for a while, return `false` from the `pollora/wp-rest/private_by_default` filter: WordPress then tells, with `WP_DEBUG`, which route to fix. To stay on the previous version, require `"pollora/wp-rest": "^0.2"` (there is no 1.x). The framework accepts `^0.1 || ^0.2 || ^1.0 || ^2.0`
+
 ## [v13.39.2](https://github.com/Pollora/framework/compare/v13.39.1...v13.39.2) - 2026-10-30
 
 ### Added

composer.json

@@ -43,7 +43,7 @@
         "pollora/roles": "^0.2",
         "pollora/schedule": "^1.0",
         "pollora/wp-cli": "^0.1 || ^1.0",
-        "pollora/wp-rest": "^0.1 || ^0.2 || ^1.0",
+        "pollora/wp-rest": "^0.1 || ^0.2 || ^1.0 || ^2.0",
         "watson/rememberable": "^7.1",
         "cweagans/composer-patches": "^2.0",
         "pollora/colt": "^11.0",

tests/e2e/fixtures/plugins/e2e-features/app/Endpoints/Undeclared.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Plugin\E2eFeatures\Endpoints;
+
+use Pollora\Attributes\WpRestRoute;
+use Pollora\Attributes\WpRestRoute\Method;
+
+/**
+ * No permission declared: the route is refused, whoever asks.
+ */
+#[WpRestRoute('e2e/v1', '/undeclared')]
+class Undeclared
+{
+    /** @return array{route: string} */
+    #[Method('GET')]
+    public function show(): array
+    {
+        return ['route' => 'undeclared'];
+    }
+}

tests/e2e/specs/features.spec.ts

@@ -72,6 +72,15 @@ test.describe('REST routes declared by #[WpRestRoute]', () => {
         await context.dispose();
     });
 
+    test('a route with no permission is refused', async () => {
+        const context = await visitor();
+        const response = await context.get(homeUrl('/wp-json/e2e/v1/undeclared'));
+
+        expect(response.status()).toBe(401);
+        expect((await response.json()).code).toBe('rest_forbidden');
+        await context.dispose();
+    });
+
     test('an IsAdmin route refuses a visitor', async () => {
         const context = await visitor();
         const response = await context.get(homeUrl('/wp-json/e2e/v1/admin/7'));