Skip to content

Build/Test Tools: Add a scoped Composer exception for the WPCS security advisory to unblock CI on the 7.0 branch. - #12741

Open
lancewillett wants to merge 1 commit into
WordPress:7.0from
lancewillett:fix/wpcs-advisory-7.0
Open

Build/Test Tools: Add a scoped Composer exception for the WPCS security advisory to unblock CI on the 7.0 branch.#12741
lancewillett wants to merge 1 commit into
WordPress:7.0from
lancewillett:fix/wpcs-advisory-7.0

Conversation

@lancewillett

@lancewillett lancewillett commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Trac ticket: https://core.trac.wordpress.org/ticket/65739

This adds a scoped Composer audit exception for GHSA-3pwp-g2mj-5p3v to unblock dependency installation on the 7.0 branch.

It keeps WPCS at 3.3.0 and avoids introducing a broad coding-standards delta on the release branch.

Testing

  • composer validate passed, with the existing version-field warning.
  • A fresh composer install resolved WPCS 3.3.0.
  • composer lint:errors reported 35 existing errors. This change modifies only composer.json.

@lancewillett
Build/Test Tools: Add a scoped Composer exception for the WPCS securi…
ff80d54 
…ty advisory to unblock CI on the 7.0 branch.
@lancewillett
lancewillett requested a review from johnbillion July 28, 2026 17:38
@lancewillett lancewillett mentioned this pull request Jul 28, 2026
Closed
@github-actions

github-actions Bot commented Jul 28, 2026

Copy link
Copy Markdown

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

  • All changes will be lost when closing a tab with a Playground instance.
  • All changes will be lost when refreshing the page.
  • A fresh instance is created each time the link below is clicked.
  • Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
    it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

@lancewillett
lancewillett requested a review from aaronjorbin July 28, 2026 17:48
@lancewillett

lancewillett commented Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

This and #12742 are a draft because I don't know the core philosophy (yet) around dependencies with security advisories, when the action to update would trigger a whole range of new issues to fix (code sniffs).

@lancewillett lancewillett mentioned this pull request Jul 28, 2026
Open
@johnbillion

johnbillion commented Jul 28, 2026

Copy link
Copy Markdown
Member

In Slack @aaronjorbin and I discussed additionally excluding the EnqueuedResourceParameters rule, but this isn't necessary because it's not used in core:

@johnbillion
johnbillion marked this pull request as ready for review July 28, 2026 18:28
@github-actions

github-actions Bot commented Jul 28, 2026

Copy link
Copy Markdown

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props lancewillett, johnbillion.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

aaronjorbin
aaronjorbin approved these changes Jul 28, 2026
View reviewed changes

@aaronjorbin aaronjorbin left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This feels like the best route to getting things running on all older branches in the shortest amount of time

pento pushed a commit that referenced this pull request Jul 28, 2026
@lancewillett
Build/Test Tools: Ignore the WPCS security advisory to unblock 7.0 CI.
677e71f 
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so `composer install` resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch.

Developed in: #12741

Reviewed by: jorbin.
Props johnbillion.
See #65739.


git-svn-id: https://develop.svn.wordpress.org/branches/7.0@62876 602fd350-edb4-49c9-b593-d223f7449a82
markjaquith pushed a commit to markjaquith/WordPress that referenced this pull request Jul 28, 2026
@lancewillett
Build/Test Tools: Ignore the WPCS security advisory to unblock 7.0 CI.
9942010 
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so `composer install` resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch.

Developed in: WordPress/wordpress-develop#12741

Reviewed by: jorbin.
Props johnbillion.
See #65739.

Built from https://develop.svn.wordpress.org/branches/7.0@62876


git-svn-id: http://core.svn.wordpress.org/branches/7.0@62154 1a063a9b-81f0-0310-95a4-ce76da25c4cd
@lancewillett lancewillett mentioned this pull request Jul 28, 2026
Closed
pento pushed a commit that referenced this pull request Jul 28, 2026
@aaronjorbin
Build/Test Tools: Ignore the WPCS security advisory to unblock CI.
d26a068 
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so composer install resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch.

Trunk fix: [62874].

Developed in: #12741


Reviewed by: jorbin, lancewillett.
Merges [62876] to 6.9 branch.

Props johnbillion, jorbin, lancewillett.
See #65739.


git-svn-id: https://develop.svn.wordpress.org/branches/6.9@62879 602fd350-edb4-49c9-b593-d223f7449a82
pento pushed a commit that referenced this pull request Jul 28, 2026
@aaronjorbin
Build/Test Tools: Ignore the WPCS security advisory to unblock CI.
106701c 
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so composer install resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch.

Trunk fix: [62874].

Developed in: #12741

Reviewed by: jorbin, lancewillett.
Merges [62876] to 6.8 branch.

Props johnbillion, jorbin, lancewillett.
See #65739.


git-svn-id: https://develop.svn.wordpress.org/branches/6.8@62880 602fd350-edb4-49c9-b593-d223f7449a82
pento pushed a commit that referenced this pull request Jul 28, 2026
@aaronjorbin
Build/Test Tools: Ignore the WPCS security advisory to unblock CI.
d89f431 
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so composer install resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch.

Trunk fix: [62874].

Developed in: #12741

Reviewed by: jorbin, lancewillett.
Merges [62876] to 6.7 branch.

Props johnbillion, jorbin, lancewillett.
See #65739.


git-svn-id: https://develop.svn.wordpress.org/branches/6.7@62881 602fd350-edb4-49c9-b593-d223f7449a82
pento pushed a commit that referenced this pull request Jul 28, 2026
@aaronjorbin
Build/Test Tools: Ignore the WPCS security advisory to unblock CI.
c9b1d7a 
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so composer install resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch.

Trunk fix: [62874].

Developed in: #12741

Reviewed by: jorbin, lancewillett.
Merges [62876] to 6.6 branch.

Props johnbillion, jorbin, lancewillett.
See #65739.


git-svn-id: https://develop.svn.wordpress.org/branches/6.6@62882 602fd350-edb4-49c9-b593-d223f7449a82
pento pushed a commit that referenced this pull request Jul 28, 2026
@aaronjorbin
Build/Test Tools: Ignore the WPCS security advisory to unblock CI.
3b8510d 
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so composer install resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch.

Trunk fix: [62874].

Developed in: #12741

Reviewed by: jorbin, lancewillett.
Merges [62876] to 6.5 branch.

Props johnbillion, jorbin, lancewillett.
See #65739.


git-svn-id: https://develop.svn.wordpress.org/branches/6.5@62883 602fd350-edb4-49c9-b593-d223f7449a82
pento pushed a commit that referenced this pull request Jul 28, 2026
@aaronjorbin
Build/Test Tools: Ignore the WPCS security advisory to unblock CI.
8cac9a6 
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so composer install resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch.

Trunk fix: [62874].

Developed in: #12741

Reviewed by: jorbin, lancewillett.
Merges [62876] to 6.4 branch.

Props johnbillion, jorbin, lancewillett.
See #65739.


git-svn-id: https://develop.svn.wordpress.org/branches/6.4@62884 602fd350-edb4-49c9-b593-d223f7449a82
pento pushed a commit that referenced this pull request Jul 28, 2026
@aaronjorbin
Build/Test Tools: Ignore the WPCS security advisory to unblock CI.
67236bc 
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so composer install resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch.

Trunk fix: [62874].

Developed in: #12741

Reviewed by: jorbin, lancewillett.
Merges [62876] to 6.3 branch.

Props johnbillion, jorbin, lancewillett.
See #65739.


git-svn-id: https://develop.svn.wordpress.org/branches/6.3@62885 602fd350-edb4-49c9-b593-d223f7449a82
pento pushed a commit that referenced this pull request Jul 28, 2026
@aaronjorbin
Build/Test Tools: Ignore the WPCS security advisory to unblock CI.
56744b0 
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so composer install resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch.

Trunk fix: [62874].

Developed in: #12741

Reviewed by: jorbin, lancewillett.
Merges [62876] to 6.2 branch.

Props johnbillion, jorbin, lancewillett.
See #65739.


git-svn-id: https://develop.svn.wordpress.org/branches/6.2@62886 602fd350-edb4-49c9-b593-d223f7449a82
pento pushed a commit that referenced this pull request Jul 28, 2026
@aaronjorbin
Build/Test Tools: Ignore the WPCS security advisory to unblock CI.
f3fb45a 
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so composer install resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch.

Trunk fix: [62874].

Developed in: #12741

Reviewed by: jorbin, lancewillett.
Merges [62876] to 6.1 branch.

Props johnbillion, jorbin, lancewillett.
See #65739.


git-svn-id: https://develop.svn.wordpress.org/branches/6.1@62887 602fd350-edb4-49c9-b593-d223f7449a82
pento pushed a commit that referenced this pull request Jul 28, 2026
@aaronjorbin
Build/Test Tools: Ignore the WPCS security advisory to unblock CI.
bdc7b8b 
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so composer install resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch.

Trunk fix: [62874].

Developed in: #12741

Reviewed by: jorbin, lancewillett.
Merges [62876] to 6.0 branch.

Props johnbillion, jorbin, lancewillett.
See #65739.


git-svn-id: https://develop.svn.wordpress.org/branches/6.0@62888 602fd350-edb4-49c9-b593-d223f7449a82
pento pushed a commit that referenced this pull request Jul 28, 2026
@aaronjorbin
Build/Test Tools: Ignore the WPCS security advisory to unblock CI.
dcb65df 
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so composer install resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch.

Trunk fix: [62874].

Developed in: #12741

Reviewed by: jorbin, lancewillett.
Merges [62876] to 5.9 branch.

Props johnbillion, jorbin, lancewillett.
See #65739.


git-svn-id: https://develop.svn.wordpress.org/branches/5.9@62890 602fd350-edb4-49c9-b593-d223f7449a82
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aaronjorbin aaronjorbin aaronjorbin approved these changes
@johnbillion johnbillion Awaiting requested review from johnbillion

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@lancewillett @johnbillion @aaronjorbin