Unsupervised/unsupervised-scheduler
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 19 Wiki Activity

Pin the Composer platform to PHP 8.1 and clear the PHPCS security advisories #192

Merged
thatguygriff merged 2 commits from fix/187-composer-platform-pin into main 2026-08-25 02:08:07 +00:00
Conversation 0 Commits 2 Files Changed 2
+36 -30
2 Commits
Author SHA1 Message Date
thatguygriffandClaude Opus 5 908b7fcd1f Update the coding-standards tooling off three security advisories
CI / Coding Standards (pull_request) Successful in 16s
Details
CI / No Debug Code (pull_request) Successful in 4s
Details
CI / Tests (PHP 8.3) (pull_request) Successful in 21s
Details
CI / Tests (PHP 8.5) (pull_request) Successful in 22s
Details
CI / Tests (PHP 8.2) (pull_request) Successful in 48s
Details
CI / Tests (PHP 8.1) (pull_request) Successful in 49s
Details
CI / Static Analysis (pull_request) Successful in 57s
Details
CI / Build Plugin Zip (pull_request) Skipped
Details 
composer audit reported three advisories against the PHPCS stack, two rated
high:

  squizlabs/php_codesniffer  3.13.5 -> 3.13.6  CVE-2026-67434, OS command injection
  wp-coding-standards/wpcs   3.3.0  -> 3.4.1   CVE-2026-45293, arbitrary code execution
  phpcsstandards/phpcsutils  1.2.2  -> 1.2.3   CVE-2026-65954, arbitrary code execution

All three are dev-only and none ship in the plugin — bin/build-zip.sh installs
--no-dev — but they execute against repository content on every CI run.

The existing ^3.7 and ^3.0 constraints already allowed the fixed releases, so
composer.json is unchanged. phpcsextra and the codesniffer installer come
along as transitive dependencies. Five packages move, none are added or
removed, and the updated standards report no new violations.

composer audit is now clean.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01D9acV1mHktGAb1uyvNmrR2
 2026-08-24 22:50:34 -03:00
thatguygriffandClaude Opus 5 b17adf02ff Pin the Composer platform to PHP 8.1
CI / Tests (PHP 8.2) (pull_request) Successful in 26s
Details
CI / No Debug Code (pull_request) Successful in 3s
Details
CI / Tests (PHP 8.3) (pull_request) Successful in 29s
Details
CI / Tests (PHP 8.5) (pull_request) Successful in 30s
Details
CI / Coding Standards (pull_request) Successful in 36s
Details
CI / Tests (PHP 8.1) (pull_request) Successful in 46s
Details
CI / Static Analysis (pull_request) Successful in 49s
Details
CI / Build Plugin Zip (pull_request) Skipped
Details 
composer.json declares "php": ">=8.1", but resolution ran against whatever
PHP the machine doing the update happened to have. Running composer update
on 8.5 could therefore produce a lock containing a package that requires 8.2
or newer, which installs fine locally and fails on the 8.1 leg of the test
matrix — a lock that is only discovered to be wrong in CI.

config.platform.php makes resolution always target the declared minimum, so
a lock that resolves at all is a lock that installs everywhere the plugin
claims to run.

No package versions change: nothing currently locked requires a PHP newer
than 8.1, so this only records platform-overrides and the new content hash.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01D9acV1mHktGAb1uyvNmrR2
 2026-08-24 22:46:11 -03:00