From 302f0d799243b5b0dea1d36c6461304af4669383 Mon Sep 17 00:00:00 2001 From: Robert O'Rourke Date: Tue, 1 Sep 2026 14:26:15 +0100 Subject: [PATCH 1/4] Upgrade WPCS to 3.4.1 and PHPCS to 3.13 WPCS 2.x is affected by CVE-2026-45293 (arbitrary code execution via eval() in the EnqueuedResourceParameters sniff). Upgrade to the fixed 3.4.1 release, which requires PHPCS >= 3.13 and PHP >= 8.0, so drop PHP 7.4 from the CI matrix. WPCS 3 moves the short-array sniff from Generic to Universal, so update the ruleset exclusion, and fix the new sniff violations surfaced by the upgraded standard (elseif, __DIR__, class closing brace). Composer lockfiles are not committed for composer/installers plugin projects; composer.lock stays gitignored. Co-authored-by: CommandCodeBot --- .github/workflows/tests.yml | 2 +- .gitignore | 3 +++ .phpcs.xml.dist | 2 +- composer.json | 6 +++--- inc/admin/namespace.php | 2 +- inc/types/class-base.php | 12 +++++------- inc/types/class-implicit.php | 1 - 7 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index e01d8db..9ff2d29 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -27,7 +27,7 @@ jobs: strategy: fail-fast: false matrix: - php: ['7.4', '8.0', '8.1', '8.2', '8.3'] + php: ['8.0', '8.1', '8.2', '8.3'] wp: ['6.5', '6.6', '6.7', '6.8', '6.9'] steps: diff --git a/.gitignore b/.gitignore index 7b3dea9..4a9b0e3 100644 --- a/.gitignore +++ b/.gitignore @@ -7,6 +7,9 @@ ## https://docs.npmjs.com/misc/faq#should-i-check-my-node_modules-folder-into-git node_modules +# Composer-generated lock file +composer.lock + # Book build output _book diff --git a/.phpcs.xml.dist b/.phpcs.xml.dist index a018a4e..ab5e57d 100644 --- a/.phpcs.xml.dist +++ b/.phpcs.xml.dist @@ -23,8 +23,8 @@ - + diff --git a/composer.json b/composer.json index afec5a4..f79eada 100644 --- a/composer.json +++ b/composer.json @@ -14,12 +14,12 @@ "php": ">=7.4" }, "require-dev": { - "squizlabs/php_codesniffer": "^3.3.1", - "wp-coding-standards/wpcs": "^2.1.1", + "squizlabs/php_codesniffer": "^3.13.1", + "wp-coding-standards/wpcs": "^3.4.1", "dealerdirect/phpcodesniffer-composer-installer": "^1.0", "phpcompatibility/phpcompatibility-wp": "^2.0", "phpunit/phpunit": "^9.6", - "yoast/phpunit-polyfills": "^1.1 || ^2.0" + "yoast/phpunit-polyfills": "^2.0" }, "config": { "allow-plugins": { diff --git a/inc/admin/namespace.php b/inc/admin/namespace.php index d1375b6..f72af1b 100644 --- a/inc/admin/namespace.php +++ b/inc/admin/namespace.php @@ -19,7 +19,7 @@ function register() { /** * Include anything we need that relies on admin classes/functions */ - include_once dirname( __FILE__ ) . '/class-listtable.php'; + include_once __DIR__ . '/class-listtable.php'; $hook = add_users_page( __( 'Registered OAuth Applications', 'oauth2' ), diff --git a/inc/types/class-base.php b/inc/types/class-base.php index 733e8d4..d04031f 100644 --- a/inc/types/class-base.php +++ b/inc/types/class-base.php @@ -128,13 +128,11 @@ protected function validate_redirect_uri( Client $client, $redirect_uri = null ) } $redirect_uri = $registered[0]; - } else { - if ( ! $client->check_redirect_uri( $redirect_uri ) ) { - return new WP_Error( - 'oauth2.types.authorization_code.handle_authorisation.invalid_redirect_uri', - __( 'Specified redirect URI is not valid for this client.', 'oauth2' ) - ); - } + } elseif ( ! $client->check_redirect_uri( $redirect_uri ) ) { + return new WP_Error( + 'oauth2.types.authorization_code.handle_authorisation.invalid_redirect_uri', + __( 'Specified redirect URI is not valid for this client.', 'oauth2' ) + ); } return $redirect_uri; diff --git a/inc/types/class-implicit.php b/inc/types/class-implicit.php index a14781e..35151f5 100644 --- a/inc/types/class-implicit.php +++ b/inc/types/class-implicit.php @@ -78,5 +78,4 @@ protected function handle_authorization_submission( $submit, Client $client, $da wp_safe_redirect( $generated_redirect ); exit; } - } From dd72e8369763674a2ecaa063c792beb0d107156d Mon Sep 17 00:00:00 2001 From: Robert O'Rourke Date: Tue, 1 Sep 2026 14:44:26 +0100 Subject: [PATCH 2/4] Remove installed_paths override that broke PHPCS 3.x sniffs WPCS 3.4.1 pulls in phpcsstandards/phpcsextra and phpcsstandards/phpcsutils as dependencies for its Universal, NormalizedArrays, Modernize, and PHPCSUtils sniffs. The post-install-cmd/post-update-cmd scripts hardcoded PHPCS's installed_paths to only vendor/wp-coding-standards/wpcs, which overwrote the paths that dealerdirect/phpcodesniffer-composer-installer already auto-configures for every installed standard, so those sniffs could not be found and phpcs exited with code 3 in CI. Removing the scripts lets the installer plugin's auto-configuration take over, which includes all installed standards' paths. --- composer.json | 4 ---- 1 file changed, 4 deletions(-) diff --git a/composer.json b/composer.json index f79eada..c6c9661 100644 --- a/composer.json +++ b/composer.json @@ -26,9 +26,5 @@ "composer/installers": true, "dealerdirect/phpcodesniffer-composer-installer": true } - }, - "scripts": { - "post-install-cmd": "\"vendor/bin/phpcs\" --config-set installed_paths vendor/wp-coding-standards/wpcs", - "post-update-cmd" : "\"vendor/bin/phpcs\" --config-set installed_paths vendor/wp-coding-standards/wpcs" } } From 9e0a45b211b2d34a2beff766bf947ae0cd64365e Mon Sep 17 00:00:00 2001 From: Robert O'Rourke Date: Tue, 1 Sep 2026 14:48:29 +0100 Subject: [PATCH 3/4] Fix PHPCS warnings surfaced by WPCS 3.4.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit WPCS 3.4.1 adds the Universal.NamingConventions.NoReservedKeywordParameterNames sniff, which flags $default in Access_Token::get_meta() since `default` is a reserved keyword. Renamed to $default_value. Also removed the unused $args parameter from Authorization_Code::validate() — Generic.CodeAnalysis.UnusedFunctionParameter flagged it, and grepping the codebase confirms no interface or caller relies on it. phpcs now exits 0 instead of 1, which was failing CI even though these were only warnings, not errors. --- inc/tokens/class-access-token.php | 8 ++++---- inc/tokens/class-authorization-code.php | 3 +-- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/inc/tokens/class-access-token.php b/inc/tokens/class-access-token.php index 188bc53..cdb76d8 100644 --- a/inc/tokens/class-access-token.php +++ b/inc/tokens/class-access-token.php @@ -53,12 +53,12 @@ public function get_creation_time() { * This is used to store additional information on the token itself, such * as a description for the token. * - * @param string $key Meta key to fetch. - * @param mixed $default Value to return if key is unavailable. + * @param string $key Meta key to fetch. + * @param mixed $default_value Value to return if key is unavailable. * - * @return mixed Value if available, or value of `$default` if not found. + * @return mixed Value if available, or value of `$default_value` if not found. */ - public function get_meta( $key, $default = null ) { + public function get_meta( $key, $default_value = null ) { if ( empty( $this->value['meta'] ) || ! isset( $this->value['meta'][ $key ] ) ) { return null; } diff --git a/inc/tokens/class-authorization-code.php b/inc/tokens/class-authorization-code.php index ac2e41f..111ee15 100644 --- a/inc/tokens/class-authorization-code.php +++ b/inc/tokens/class-authorization-code.php @@ -116,10 +116,9 @@ public function get_expiration() { /** * Validate the code for use. * - * @param array $args Other request arguments to validate. * @return bool|WP_Error True if valid, error describing problem otherwise. */ - public function validate( $args = [] ) { + public function validate() { $expiration = $this->get_expiration(); $now = time(); if ( $expiration <= $now ) { From 7082bc88531f2072cecbccb9f0060b4a5da1f5dc Mon Sep 17 00:00:00 2001 From: Robert O'Rourke Date: Tue, 1 Sep 2026 14:48:37 +0100 Subject: [PATCH 4/4] Bump actions/checkout and actions/cache to Node 24 releases GitHub Actions runners now log a deprecation warning on every job because actions/checkout@v4 and actions/cache@v4 still target Node 20, which GitHub is retiring. Bumping to actions/checkout@v7 and actions/cache@v6 (both node24) removes the warning; no config changes were needed for either action. --- .github/workflows/tests.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 9ff2d29..8be219f 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -31,7 +31,7 @@ jobs: wp: ['6.5', '6.6', '6.7', '6.8', '6.9'] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install SVN run: sudo apt-get update -q && sudo apt-get install -y subversion @@ -44,7 +44,7 @@ jobs: coverage: none - name: Cache Composer packages - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: vendor key: ${{ runner.os }}-php-${{ matrix.php }}-${{ hashFiles('composer.json') }} @@ -67,7 +67,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up PHP uses: shivammathur/setup-php@v2