Release 3.1.0 - #893
Merged
Merged
Conversation
Disable WordPress.Security.EscapeOutput.ExceptionNotEscaped
The last few builds were failing due to the below PHPStan error: ``` ------ --------------------------------- Line tests/RulesetTest.php ------ --------------------------------- 146 Left side of && is always true. ------ --------------------------------- ``` Fixed now. Note: the condition could possibly be removed, but I have a feeling I added it for a reason, so I left it in under the guise of "better safe than sorry".
This fixes up the `@return` type declarations for all `register()` methods.
This fixes up the `@var` type declarations for all `AbstractFunctionParameterSniff::$target_functions` properties.
This fixes up the `@return` type declarations for all `AbstractVariableRestrictionsSniff::getGroups()` methods.
This fixes up the `@return` type declarations for all `AbstractArrayAssignmentRestrictionsSniff::getGroups()` methods.
Miscellaneous other doc specificity fixes. Note: this doesn't fix everything throughout the codebase, but is an iteration to improve things nonetheless.
... to satisfy shellcheck rule SC2086: "Double quote to prevent globbing and word splitting". Ref: https://www.shellcheck.net/wiki/SC2086
Composer 1.10.0 introduced a `lock` config option, which, when set to `false` will prevent a `composer.lock` file from being created and will ignore it when one exists. This is a useful option for libraries such as this where the `lock` file has no meaning. It also makes life easier for contributors as they don't have to remember that for this repo they should use `composer update` instead of `composer install`. Both will now work the same. Refs: https://getcomposer.org/doc/06-config.md#lock
* Builds against PHP 8.4 are no longer allowed to fail. * Add _allowed to fail_ build against PHP 8.5. Ref: https://www.php.net/releases/8.4/en.php
…php-8.4-release
Instead of doing all the installation steps for xmllint validation in the workflow, use the ✨ new dedicated `phpcsstandards/xmllint-validate` action runner instead.
Notes:
* This does mean that the `bin/xml-lint` script is now no longer used in CI.
I've left the script in place as there may be contributors who want to run these checks locally and the script can help them with that, though happy to remove the script if nobody uses it.
Ref: https://github.com/marketplace/actions/xmllint-validate
... for dev tool files.
... now it is no longer used in CI.
…int-validation GH Actions: use the xmllint-validate action runner + add some extra checks
PHPCS now offers permalinks for the schema. Refs: * PHPCSStandards/PHP_CodeSniffer 1094 * https://github.com/PHPCSStandards/schema.phpcodesniffer.com
For the code in this repo, various rulesets from the WordPressCS project are used. One of those ruleset includes a sniff - `Generic.Functions.CallTimePassByReference` - which is (hard) deprecated since PHPCS 3.13.0 and which is kind of redundant anyhow as: 1. The sniff is looking for a syntax which was removed from PHP in PHP 5.4. 2. The PHPCompatibility standard safeguards against re-introduction of the removed PHP syntax anyhow. This will at some point need addressing in WordPressCS upstream, but for now, we can silence the deprecation notice by excluding the redundant sniff.
As of PHPCS 3.13.0, PHPCS will show deprecation notices for various features which will be removed in PHPCS 4.0.0.
However, in PHPCS 3.x, PHPCS sends all output to `STDOUT` (this will change in PHPCS 4.x), so if the output of an `exec` command which expects a `json` report is captured, this will now also include the deprecation notices in the output, which means the `json_decode()` command will fail as the captured output is not valid JSON.
This, in turn, is currently causing the Ruleset test runs to fail in CI for the VIPCS repo. The issue is locally reproducable.
This commit fixes this by:
* Changing the `--report=json` in the command being run to `--report-json=[filename]` and storing the JSON output to a file.
This way the report file will _only_ contain report output and will not include the deprecation notices (those will still go to `STDOUT`).
* Next, we read the report file to process the JSON report;
* And then delete the report file (and prevent it from being committed via the `.gitignore` file, just in case the file delete would fail at some point).
This solution is PHPCS cross-version compatible as the `--report-json=[filename]` CLI flag has been around for quite a while.
This solution should also improve the stability of the script for potential future changes in PHPCS.
Mostly to ensure the version installed will be compatible with all PHP version supported by this tool. (v1.4.0 added support for PHP 8.4) Ref: https://github.com/php-parallel-lint/PHP-Parallel-Lint/releases/tag/v1.4.0
... which has no longer been needed since support for PHPCS < 3.5.7 was dropped.
Tracking: DEVPROD-1072
…s-shas chore: pin third-party GitHub Actions to commit SHAs
Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.37.1 to 2.37.2. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@7c071df...f3e473d) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-version: 2.37.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…vammathur/setup-php-2.37.2 GH Actions: Bump shivammathur/setup-php from 2.37.1 to 2.37.2
Pin ramsey/composer-install to the 4.0.0 release SHA rather than the floating v4 branch tip. The previous pin tracked the v4 branch, so the version comment could only ever read "# v4" and a SHA bump carried no visible meaning in a diff. Pinning to the 4.0.0 tag gives an honest SHA-to-version mapping and lets Dependabot follow releases, matching the style already used for setup-php and xmllint-validate. Also pin actions/checkout to the 6.0.3 release SHA. It was previously left on the floating @v6 major tag; pinning it brings the first-party action in line with the SHA-and-version convention and makes future Dependabot bumps self-explanatory.
…rsion Pin composer-install to 4.0.0 and checkout to 6.0.3
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [phpcsstandards/xmllint-validate](https://github.com/phpcsstandards/xmllint-validate) from 1.0.1 to 2.0.0. - [Release notes](https://github.com/phpcsstandards/xmllint-validate/releases) - [Commits](PHPCSStandards/xmllint-validate@0fd9c4a...5189514) --- updated-dependencies: - dependency-name: phpcsstandards/xmllint-validate dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…csstandards/xmllint-validate-2.0.0 GH Actions: Bump phpcsstandards/xmllint-validate from 1.0.1 to 2.0.0
…ions/checkout-7.0.0 GH Actions: Bump actions/checkout from 6.0.3 to 7.0.0
…et to prevent changing the superfluous space check
The BOM sniff test relies on `ruleset-test-bom.inc` beginning with a UTF-8 byte order mark. The global `[*]` section sets `charset = utf-8`, which prompts EditorConfig-aware editors to strip that mark on save, silently invalidating the Generic.Files.ByteOrderMark ruleset test. A scoped `[*-bom.inc]` override with `charset = utf-8-bom` instructs those editors to keep the mark, protecting the fixture from accidental damage.
Guarding the success path with `$test->passes() && $bom_test->passes()` short-circuits: when the primary ruleset test fails, the BOM test's `passes()` never runs, so its discrepancy report is never printed. That hides half the picture from anyone debugging a failure. Evaluating both results into variables before the check lets each test report its own discrepancies independently.
Add BOM sniff
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…ions/checkout-7.0.1 GH Actions: Bump actions/checkout from 7.0.0 to 7.0.1
WordPressCS 3.4.1 is a security release, and 3.3.0-3.4.1 also improve the accuracy of several sniffs that VIPCS bundles, so requiring it passes both benefits on to VIPCS users. The other coding-standard floors are raised in step to match what WordPressCS 3.4.1 itself requires: PHP_CodeSniffer 3.13.5, PHPCSUtils 1.2.3, PHPCSExtra 1.5.1 and VariableAnalysis 2.13.0. The README requirements and the PHPCompatibility testVersion (now 7.4-, matching the existing PHP floor) are brought back into sync, as both had drifted from composer.json.
…ncy-341 Require WordPressCS 3.4.1 and align dependency floors
Assemble the 3.1.0 entry from all PRs merged since 3.0.1, following the project convention of compiling the changelog in one place at release time rather than per-PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR for tracking changes for the 3.1.0 release. Target release date: Monday 27 July 2026.
This release raises the minimum WordPressCS requirement to 3.4.1 (a security release) and reworks a large number of the VIPCS sniffs. The full, categorised list of changes is in the
CHANGELOG.mdentry added on this branch.main.