Bump the composer-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the composer-dependencies group with 5 updates in the / directory:

Package	From	To
wp-coding-standards/wpcs	3.2.0	3.4.1
phpstan/phpstan	2.1.29	2.2.6
szepeviktor/phpstan-wordpress	2.0.2	2.0.3
php-stubs/woocommerce-stubs	10.2.0	10.9.4
wp-cli/php-cli-tools	0.12.6	0.13.0

Updates wp-coding-standards/wpcs from 3.2.0 to 3.4.1

Release notes

Sourced from wp-coding-standards/wpcs's releases.

3.4.1 - 2026-07-27

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

• The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #2770
• The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #2770
• Various housekeeping, including documentation improvements.

Fixed

• SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #2771 This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. For more details, see the security advisory Thanks to @​FORIMOC for responsibly disclosing the vulnerability.

3.4.0

We're happy to welcome @​rodrigoprimo as co-maintainer of WordPressCS as of this release.

Added

• WordPress.Arrays.ArrayDeclarationSpacing: new allow_single_item_single_line_explicit_key_arrays property to replace the, now deprecated, allow_single_item_single_line_associative_arrays property. #2696
• End-user documentation to the following existing sniffs: WordPress.Arrays.ArrayDeclarationSpacing (props @​RafaelFunchal, @​mattgaldino and @​rodrigoprimo, #2489, #2593, #2682), WordPress.CodeAnalysis.AssignmentInTernaryCondition (props @​Nic-Sevic and @​rodrigoprimo, #2488, #2678), WordPress.DB.RestrictedClasses (props @​paulgibbs and @​rodrigoprimo, #2455, #2689), WordPress.DB.DirectDatabaseQuery (props @​jaymcp and @​rodrigoprimo, #2458, #2697), WordPress.DB.RestrictedFunctions (props @​paulgibbs and @​rodrigoprimo, #2453, #2676), WordPress.DB.SlowDBQuery (props @​petitphp and @​rodrigoprimo, #2464, #2699), WordPress.PHP.DevelopmentFunctions (props @​gogdzl and @​rodrigoprimo, #2490, #2690), WordPress.PHP.NoSilencedErrors (props @​gogdzl and @​rodrigoprimo, #2495, #2694), WordPress.PHP.PregQuoteDelimiter (props @​tikifez and @​rodrigoprimo, #2487, #2677), WordPress.PHP.RestrictedPHPFunctions (props @​gogdzl and @​rodrigoprimo, #2491, #2693), WordPress.Security.PluginMenuSlug (props @​jasonkenison, #2592), WordPress.WP.AlternativeFunctions (props @​pamprn09, @​bhubbard and @​rodrigoprimo, #2496, #2588, #2687), WordPress.WP.DiscouragedConstants (props @​RafaelFunchal, @​paulopmt1 and @​rodrigoprimo, #2493, #2589, #2680), WordPress.WP.GlobalVariablesOverride (props @​paulopmt1 and @​rodrigoprimo, #2586, #2679). This documentation can be exposed via the PHP_CodeSniffer --generator=... command-line argument.

Changed

• The minimum required PHP_CodeSniffer version to 3.13.5 (was 3.13.4). #2761
• The minimum required PHPCSUtils version to 1.2.2 (was 1.1.0). #2761
• The default value for minimum_wp_version, as used by a number of sniffs detecting usage of deprecated WP features, has been updated to 6.7. #2757
• WordPress.NamingConventions.PrefixAllGlobals has been updated to recognize pluggable functions introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.ClassNameCase has been updated to recognize classes introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.DeprecatedFunctions now detects functions deprecated in WordPress up to WP 7.0.0. #2747
• The ConstantsHelper::is_use_of_global_constant() method will no longer flag a constant alias created via an import use statement as it were the use of a global constant. #2579
• The ConstantsHelper::is_in_function_call() method will now act fully case-agnostic for the function names being checked. #2706 Previously, the $valid_functions parameter would need to be passed with the function names as keys in lowercase.
• WordPress.PHP.NoSilencedErrors: error silencing is no longer accepted for the parse_url() function. #2701
• Improved the wording of the error message for WordPress.Arrays.ArrayDeclarationSpacing.AssociativeArrayFound. #2688
• Improved the wording of the error message for WordPress.PHP.RestrictedPHPFunctions. #2702
• Various housekeeping, including documentation and test improvements. Includes a contribution by @​dd32.

Deprecated

• WordPress.Arrays.ArrayDeclarationSpacing: the allow_single_item_single_line_associative_arrays property has been deprecated in favor of the new allow_single_item_single_line_explicit_key_arrays property. #2696 This is a name change only. The functionality of these properties is the same.

Fixed

• WordPress.DB.PreparedSQL and WordPress.DB.PreparedSQLPlaceholders: false positive for static method calls to a non-global class named wpdb. #2753
• WordPress.Security.EscapeOutput: false positive for get_search_query() when the $escaped parameter was passed as fully qualified or non-lowercase true. #2618
• WordPress.Security.EscapeOutput: false negative for _deprecated_file() calls when the basename( __FILE__ ) pattern used non-standard casing for either basename() and/or __FILE__. #2729
• WordPress.WP.AlternativeFunctions: false negative when class functions/constants/properties use the same name as select global WP constants/functions. #2617
• WordPress.WP.AlternativeFunctions: false positive for fully qualified references to the global PHP stream constants \STDIN, \STDOUT, and \STDERR. #2617
• WordPress.WP.CronInterval: false positive when the callback function reference used a different case than the function declaration, even though they are in the same file. #2730

3.3.0

... (truncated)

Changelog

Sourced from wp-coding-standards/wpcs's changelog.

[3.4.1] - 2026-07-27

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

• The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #2770
• The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #2770
• Various housekeeping, including documentation improvements.

Fixed

• SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #2771 This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. For more details, see the security advisory. Thanks to [@​FORIMOC] for responsibly disclosing the vulnerability.

#2770: WordPress/WordPress-Coding-Standards#2770 #2771: WordPress/WordPress-Coding-Standards#2771

[3.4.0] - 2026-07-16

We're happy to welcome [@​rodrigoprimo] as co-maintainer of WordPressCS as of this release.

Added

• WordPress.Arrays.ArrayDeclarationSpacing: new allow_single_item_single_line_explicit_key_arrays property to replace the, now deprecated, allow_single_item_single_line_associative_arrays property. #2696
• End-user documentation to the following existing sniffs: WordPress.Arrays.ArrayDeclarationSpacing (props [@​RafaelFunchal], [@​mattgaldino] and [@​rodrigoprimo], #2489, #2593, #2682), WordPress.CodeAnalysis.AssignmentInTernaryCondition (props [@​Nic-Sevic] and [@​rodrigoprimo], #2488, #2678), WordPress.DB.RestrictedClasses (props [@​paulgibbs] and [@​rodrigoprimo], #2455, #2689), WordPress.DB.DirectDatabaseQuery (props [@​jaymcp] and [@​rodrigoprimo], #2458, #2697), WordPress.DB.RestrictedFunctions (props [@​paulgibbs] and [@​rodrigoprimo], #2453, #2676), WordPress.DB.SlowDBQuery (props [@​petitphp] and [@​rodrigoprimo], #2464, #2699), WordPress.PHP.DevelopmentFunctions (props [@​gogdzl] and [@​rodrigoprimo], #2490, #2690), WordPress.PHP.NoSilencedErrors (props [@​gogdzl] and [@​rodrigoprimo], #2495, #2694), WordPress.PHP.PregQuoteDelimiter (props [@​tikifez] and [@​rodrigoprimo], #2487, #2677), WordPress.PHP.RestrictedPHPFunctions (props [@​gogdzl] and [@​rodrigoprimo], #2491, #2693), WordPress.Security.PluginMenuSlug (props [@​jasonkenison], #2592), WordPress.WP.AlternativeFunctions (props [@​pamprn09], [@​bhubbard] and [@​rodrigoprimo], #2496, #2588, #2687), WordPress.WP.DiscouragedConstants (props [@​RafaelFunchal], [@​paulopmt1] and [@​rodrigoprimo], #2493, #2589, #2680), WordPress.WP.GlobalVariablesOverride (props [@​paulopmt1] and [@​rodrigoprimo], #2586, #2679). This documentation can be exposed via the PHP_CodeSniffer --generator=... command-line argument.

Changed

• The minimum required PHP_CodeSniffer version to 3.13.5 (was 3.13.4). #2761
• The minimum required PHPCSUtils version to 1.2.2 (was 1.1.0). #2761
• The default value for minimum_wp_version, as used by a number of sniffs detecting usage of deprecated WP features, has been updated to 6.7. #2757
• WordPress.NamingConventions.PrefixAllGlobals has been updated to recognize pluggable functions introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.ClassNameCase has been updated to recognize classes introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.DeprecatedFunctions now detects functions deprecated in WordPress up to WP 7.0.0. #2747
• The ConstantsHelper::is_use_of_global_constant() method will no longer flag a constant alias created via an import use statement as it were the use of a global constant. #2579
• The ConstantsHelper::is_in_function_call() method will now act fully case-agnostic for the function names being checked. #2706 Previously, the $valid_functions parameter would need to be passed with the function names as keys in lowercase.
• WordPress.PHP.NoSilencedErrors: error silencing is no longer accepted for the parse_url() function. #2701
• Improved the wording of the error message for WordPress.Arrays.ArrayDeclarationSpacing.AssociativeArrayFound. #2688
• Improved the wording of the error message for WordPress.PHP.RestrictedPHPFunctions. #2702
• Various housekeeping, including documentation and test improvements. Includes a contribution by [@​dd32].

Deprecated

• WordPress.Arrays.ArrayDeclarationSpacing: the allow_single_item_single_line_associative_arrays property has been deprecated in favor of the new allow_single_item_single_line_explicit_key_arrays property. #2696 This is a name change only. The functionality of these properties is the same.

Fixed

... (truncated)

Commits

• ec2ff94 Merge pull request #2773 from WordPress/develop
• b558639 Merge pull request #2772 from WordPress/feature/changelog-3.4.1
• 1696dc8 Changelog for the release of WordPressCS 3.4.1
• a29048d Merge pull request #2771 from WordPress/security/enqueuedresourceparams-fix-i...
• 7262444 WP/EnqueuedResourceParameters: remove eval() from is_falsy()
• 54719c0 Merge pull request #2770 from WordPress/feature/composer-update-versions
• 267d84e Composer: update minimum version PHPCSUtils + PHPCSExtra
• e8064a6 Add SECURITY.md file (#2766)
• 7ac8973 Merge pull request #2768 from WordPress/dependabot/github_actions/action-runn...
• 9466b4b GH Actions: Bump actions/checkout in the action-runners group
• Additional commits viewable in compare view

Updates phpstan/phpstan from 2.1.29 to 2.2.6

Commits

• See full diff in compare view

Updates szepeviktor/phpstan-wordpress from 2.0.2 to 2.0.3

Release notes

Sourced from szepeviktor/phpstan-wordpress's releases.

v2.0.3

What's Changed

• -SlevomatCodingStandard.Namespaces.ReferenceUsedNamesOnly by @​szepeviktor in szepeviktor/phpstan-wordpress#285
• Remove WP_CLI::error from earlyTerminatingMethodCalls config by @​lipemat in szepeviktor/phpstan-wordpress#284
• Remove SAVEQUERIES from the dynamicConstantNames list by @​IanDelMar in szepeviktor/phpstan-wordpress#287
• Remove WP_CLI from the dynamicConstantNames list by @​IanDelMar in szepeviktor/phpstan-wordpress#288
• Remove WP_CLI::halt from earlyTerminatingMethodCalls by @​IanDelMar in szepeviktor/phpstan-wordpress#289
• Remove STYLESHEETPATH and TEMPLATEPATH from bootstrap.php by @​IanDelMar in szepeviktor/phpstan-wordpress#290
• Merge AssertNotWpErrorTypeSpecifyingExtension into AssertWpErrorTypeSpecifyingExtension by @​IanDelMar in szepeviktor/phpstan-wordpress#291
• Fix handling of dynamic constants by @​IanDelMar in szepeviktor/phpstan-wordpress#286
• Add return type extension for stripslashes_from_strings_only() by @​IanDelMar in szepeviktor/phpstan-wordpress#294
• Fix StripslashesFromStringsOnlyDynamicFunctionReturnTypeExtension by @​IanDelMar in szepeviktor/phpstan-wordpress#295
• Add return type extension for wp_slash() by @​IanDelMar in szepeviktor/phpstan-wordpress#296
• Add return type extension for normalize_whitespace by @​IanDelMar in szepeviktor/phpstan-wordpress#298
• Add slashit functions extension & fix stripslashes extension by @​IanDelMar in szepeviktor/phpstan-wordpress#299
• Add PHP 8.4 to travis config by @​IanDelMar in szepeviktor/phpstan-wordpress#300
• Gather assert types conditional on installed PHPStan version by @​IanDelMar in szepeviktor/phpstan-wordpress#301

Full Changelog: szepeviktor/phpstan-wordpress@v2.0.2...v2.0.3

Commits

• aa722f0 Gather assert types conditional on installed PHPStan version (#301)
• 1cdb6d5 Add PHP 8.4 to travis config (#300)
• 4143d06 Add slashit functions extension & fix stripslashes extension (#299)
• 49b833d Update TYPOS_VERSION to 1.36.2
• 585afd4 Add return type extension for normalize_whitespace (#298)
• 4a2cffe Add return type extension for wp_slash() (#296)
• 703f4bc Fix StripslashesFromStringsOnlyDynamicFunctionReturnTypeExtension (#295)
• 9edf798 Add return type extension for stripslashes_from_strings_only() (#294)
• 4d060f7 Remove stubs generator scripts
• 1d6d3f3 Fix handling of dynamic constants (#286)
• Additional commits viewable in compare view

Updates php-stubs/woocommerce-stubs from 10.2.0 to 10.9.4

Commits

• a569e43 Generate stubs for WooCommerce 10.9.4
• 0c37ae3 Bump the WP stubs requirement (#32)
• 8e52e5b Generate stubs for WooCommerce 10.9.2
• e6d583b Generate stubs for WooCommerce 10.9.1
• f30f88b Generate stubs for WooCommerce 10.9.0
• d89f073 Generate stubs for WooCommerce 10.8.1
• 9d59e65 Generate stubs for WooCommerce 10.8.0
• 7251902 Generate stubs for WooCommerce 10.7.0
• 2cc4a2e Generate stubs for WooCommerce 10.6.2
• ef96143 Generate stubs for WooCommerce 10.6.1
• Additional commits viewable in compare view

Updates wp-cli/php-cli-tools from 0.12.6 to 0.13.0

Release notes

Sourced from wp-cli/php-cli-tools's releases.

Version 0.13.0

• Add initial PHPStan configuration [#201]

Version 0.12.9

• Tests: Improve Windows compatibility [#200]

Version 0.12.8

• Fix progress bar wrapping to new line on Windows [#198]
• Fix sprintf(): Too few arguments when color tokens appear in a sprintf format string [#197]
• Add format customization and step-based progress display to Bar [#196]
• Add configurable wrapping modes for table columns [#195]

Version 0.12.7

• Add column alignment support for tables [#192]
• Fix line wrapping issue with colorized table output [#191]
• Add ability to add row in a loop to existing table [#190]

Commits

• 4a04ffb Add initial PHPStan configuration (#201)
• c3d2513 Tests: Improve Windows compatibility (#200)
• b9b72f0 Update file(s) from wp-cli/.github
• 9cbf994 Add .gitattributes file
• f758005 Update file(s) from wp-cli/.github
• 8f97f8f Update file(s) from wp-cli/.github
• c8d0d9a Update file(s) from wp-cli/.github
• 4f0d089 Fix progress bar wrapping to new line on Windows (#198)
• 3fef69c Update file(s) from wp-cli/.github
• aff2be3 Fix sprintf(): Too few arguments when color tokens appear in a sprintf format...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions