Bump the composer-minor-patch group across 1 directory with 4 updates

[dependabot]

Bumps the composer-minor-patch group with 3 updates in the / directory: wp-coding-standards/wpcs, phpcompatibility/phpcompatibility-wp and automattic/vipwpcs.

Updates wp-coding-standards/wpcs from 3.0.1 to 3.4.1

Release notes

Sourced from wp-coding-standards/wpcs's releases.

3.4.1 - 2026-07-27

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

• The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #2770
• The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #2770
• Various housekeeping, including documentation improvements.

Fixed

• SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #2771 This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. For more details, see the security advisory Thanks to @​FORIMOC for responsibly disclosing the vulnerability.

3.4.0

We're happy to welcome @​rodrigoprimo as co-maintainer of WordPressCS as of this release.

Added

• WordPress.Arrays.ArrayDeclarationSpacing: new allow_single_item_single_line_explicit_key_arrays property to replace the, now deprecated, allow_single_item_single_line_associative_arrays property. #2696
• End-user documentation to the following existing sniffs: WordPress.Arrays.ArrayDeclarationSpacing (props @​RafaelFunchal, @​mattgaldino and @​rodrigoprimo, #2489, #2593, #2682), WordPress.CodeAnalysis.AssignmentInTernaryCondition (props @​Nic-Sevic and @​rodrigoprimo, #2488, #2678), WordPress.DB.RestrictedClasses (props @​paulgibbs and @​rodrigoprimo, #2455, #2689), WordPress.DB.DirectDatabaseQuery (props @​jaymcp and @​rodrigoprimo, #2458, #2697), WordPress.DB.RestrictedFunctions (props @​paulgibbs and @​rodrigoprimo, #2453, #2676), WordPress.DB.SlowDBQuery (props @​petitphp and @​rodrigoprimo, #2464, #2699), WordPress.PHP.DevelopmentFunctions (props @​gogdzl and @​rodrigoprimo, #2490, #2690), WordPress.PHP.NoSilencedErrors (props @​gogdzl and @​rodrigoprimo, #2495, #2694), WordPress.PHP.PregQuoteDelimiter (props @​tikifez and @​rodrigoprimo, #2487, #2677), WordPress.PHP.RestrictedPHPFunctions (props @​gogdzl and @​rodrigoprimo, #2491, #2693), WordPress.Security.PluginMenuSlug (props @​jasonkenison, #2592), WordPress.WP.AlternativeFunctions (props @​pamprn09, @​bhubbard and @​rodrigoprimo, #2496, #2588, #2687), WordPress.WP.DiscouragedConstants (props @​RafaelFunchal, @​paulopmt1 and @​rodrigoprimo, #2493, #2589, #2680), WordPress.WP.GlobalVariablesOverride (props @​paulopmt1 and @​rodrigoprimo, #2586, #2679). This documentation can be exposed via the PHP_CodeSniffer --generator=... command-line argument.

Changed

• The minimum required PHP_CodeSniffer version to 3.13.5 (was 3.13.4). #2761
• The minimum required PHPCSUtils version to 1.2.2 (was 1.1.0). #2761
• The default value for minimum_wp_version, as used by a number of sniffs detecting usage of deprecated WP features, has been updated to 6.7. #2757
• WordPress.NamingConventions.PrefixAllGlobals has been updated to recognize pluggable functions introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.ClassNameCase has been updated to recognize classes introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.DeprecatedFunctions now detects functions deprecated in WordPress up to WP 7.0.0. #2747
• The ConstantsHelper::is_use_of_global_constant() method will no longer flag a constant alias created via an import use statement as it were the use of a global constant. #2579
• The ConstantsHelper::is_in_function_call() method will now act fully case-agnostic for the function names being checked. #2706 Previously, the $valid_functions parameter would need to be passed with the function names as keys in lowercase.
• WordPress.PHP.NoSilencedErrors: error silencing is no longer accepted for the parse_url() function. #2701
• Improved the wording of the error message for WordPress.Arrays.ArrayDeclarationSpacing.AssociativeArrayFound. #2688
• Improved the wording of the error message for WordPress.PHP.RestrictedPHPFunctions. #2702
• Various housekeeping, including documentation and test improvements. Includes a contribution by @​dd32.

Deprecated

• WordPress.Arrays.ArrayDeclarationSpacing: the allow_single_item_single_line_associative_arrays property has been deprecated in favor of the new allow_single_item_single_line_explicit_key_arrays property. #2696 This is a name change only. The functionality of these properties is the same.

Fixed

• WordPress.DB.PreparedSQL and WordPress.DB.PreparedSQLPlaceholders: false positive for static method calls to a non-global class named wpdb. #2753
• WordPress.Security.EscapeOutput: false positive for get_search_query() when the $escaped parameter was passed as fully qualified or non-lowercase true. #2618
• WordPress.Security.EscapeOutput: false negative for _deprecated_file() calls when the basename( __FILE__ ) pattern used non-standard casing for either basename() and/or __FILE__. #2729
• WordPress.WP.AlternativeFunctions: false negative when class functions/constants/properties use the same name as select global WP constants/functions. #2617
• WordPress.WP.AlternativeFunctions: false positive for fully qualified references to the global PHP stream constants \STDIN, \STDOUT, and \STDERR. #2617
• WordPress.WP.CronInterval: false positive when the callback function reference used a different case than the function declaration, even though they are in the same file. #2730

3.3.0

... (truncated)

Changelog

Sourced from wp-coding-standards/wpcs's changelog.

[3.4.1] - 2026-07-27

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

• The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #2770
• The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #2770
• Various housekeeping, including documentation improvements.

Fixed

• SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #2771 This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. For more details, see the security advisory. Thanks to [@​FORIMOC] for responsibly disclosing the vulnerability.

#2770: WordPress/WordPress-Coding-Standards#2770 #2771: WordPress/WordPress-Coding-Standards#2771

[3.4.0] - 2026-07-16

We're happy to welcome [@​rodrigoprimo] as co-maintainer of WordPressCS as of this release.

Added

• WordPress.Arrays.ArrayDeclarationSpacing: new allow_single_item_single_line_explicit_key_arrays property to replace the, now deprecated, allow_single_item_single_line_associative_arrays property. #2696
• End-user documentation to the following existing sniffs: WordPress.Arrays.ArrayDeclarationSpacing (props [@​RafaelFunchal], [@​mattgaldino] and [@​rodrigoprimo], #2489, #2593, #2682), WordPress.CodeAnalysis.AssignmentInTernaryCondition (props [@​Nic-Sevic] and [@​rodrigoprimo], #2488, #2678), WordPress.DB.RestrictedClasses (props [@​paulgibbs] and [@​rodrigoprimo], #2455, #2689), WordPress.DB.DirectDatabaseQuery (props [@​jaymcp] and [@​rodrigoprimo], #2458, #2697), WordPress.DB.RestrictedFunctions (props [@​paulgibbs] and [@​rodrigoprimo], #2453, #2676), WordPress.DB.SlowDBQuery (props [@​petitphp] and [@​rodrigoprimo], #2464, #2699), WordPress.PHP.DevelopmentFunctions (props [@​gogdzl] and [@​rodrigoprimo], #2490, #2690), WordPress.PHP.NoSilencedErrors (props [@​gogdzl] and [@​rodrigoprimo], #2495, #2694), WordPress.PHP.PregQuoteDelimiter (props [@​tikifez] and [@​rodrigoprimo], #2487, #2677), WordPress.PHP.RestrictedPHPFunctions (props [@​gogdzl] and [@​rodrigoprimo], #2491, #2693), WordPress.Security.PluginMenuSlug (props [@​jasonkenison], #2592), WordPress.WP.AlternativeFunctions (props [@​pamprn09], [@​bhubbard] and [@​rodrigoprimo], #2496, #2588, #2687), WordPress.WP.DiscouragedConstants (props [@​RafaelFunchal], [@​paulopmt1] and [@​rodrigoprimo], #2493, #2589, #2680), WordPress.WP.GlobalVariablesOverride (props [@​paulopmt1] and [@​rodrigoprimo], #2586, #2679). This documentation can be exposed via the PHP_CodeSniffer --generator=... command-line argument.

Changed

• The minimum required PHP_CodeSniffer version to 3.13.5 (was 3.13.4). #2761
• The minimum required PHPCSUtils version to 1.2.2 (was 1.1.0). #2761
• The default value for minimum_wp_version, as used by a number of sniffs detecting usage of deprecated WP features, has been updated to 6.7. #2757
• WordPress.NamingConventions.PrefixAllGlobals has been updated to recognize pluggable functions introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.ClassNameCase has been updated to recognize classes introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.DeprecatedFunctions now detects functions deprecated in WordPress up to WP 7.0.0. #2747
• The ConstantsHelper::is_use_of_global_constant() method will no longer flag a constant alias created via an import use statement as it were the use of a global constant. #2579
• The ConstantsHelper::is_in_function_call() method will now act fully case-agnostic for the function names being checked. #2706 Previously, the $valid_functions parameter would need to be passed with the function names as keys in lowercase.
• WordPress.PHP.NoSilencedErrors: error silencing is no longer accepted for the parse_url() function. #2701
• Improved the wording of the error message for WordPress.Arrays.ArrayDeclarationSpacing.AssociativeArrayFound. #2688
• Improved the wording of the error message for WordPress.PHP.RestrictedPHPFunctions. #2702
• Various housekeeping, including documentation and test improvements. Includes a contribution by [@​dd32].

Deprecated

• WordPress.Arrays.ArrayDeclarationSpacing: the allow_single_item_single_line_associative_arrays property has been deprecated in favor of the new allow_single_item_single_line_explicit_key_arrays property. #2696 This is a name change only. The functionality of these properties is the same.

Fixed

... (truncated)

Commits

• ec2ff94 Merge pull request #2773 from WordPress/develop
• b558639 Merge pull request #2772 from WordPress/feature/changelog-3.4.1
• 1696dc8 Changelog for the release of WordPressCS 3.4.1
• a29048d Merge pull request #2771 from WordPress/security/enqueuedresourceparams-fix-i...
• 7262444 WP/EnqueuedResourceParameters: remove eval() from is_falsy()
• 54719c0 Merge pull request #2770 from WordPress/feature/composer-update-versions
• 267d84e Composer: update minimum version PHPCSUtils + PHPCSExtra
• e8064a6 Add SECURITY.md file (#2766)
• 7ac8973 Merge pull request #2768 from WordPress/dependabot/github_actions/action-runn...
• 9466b4b GH Actions: Bump actions/checkout in the action-runners group
• Additional commits viewable in compare view

Updates phpcompatibility/phpcompatibility-wp from 2.1.4 to 2.1.8

Release notes

Sourced from phpcompatibility/phpcompatibility-wp's releases.

2.1.8 - 2025-10-18

This is a maintenance release.

• The ruleset now includes schema tags.
• General housekeeping and maintenance.

2.1.7 - 2025-05-12

• Composer: The minimum supported version of PHP_CodeSniffer has been raised to 3.3.0.
• Ruleset: Prevent deprecation notice on PHP_CodeSniffer 3.13.0+.

2.1.6 - 2025-01-16

This is a maintenance release.

• README: Fixed some broken badges.
• General housekeeping and documentation updates. Including a contribution by @​johnbillion.

2.1.5 - 2024-04-25

• Ruleset: Updated for compatibility with WordPress 6.5. Thanks @​swissspidy.
• The recommended version of the Composer PHPCS plugin is now ^1.0.
• Other housekeeping and documentation updates. Includes contributions from @​fredden and @​johnbillion.

Changelog

Sourced from phpcompatibility/phpcompatibility-wp's changelog.

[2.1.8] - 2025-10-18

This is a maintenance release.

• The ruleset now includes schema tags.
• General housekeeping and maintenance.

[2.1.7] - 2025-05-12

• Composer: The minimum supported version of PHP_CodeSniffer has been raised to 3.3.0.
• Ruleset: Prevent deprecation notice on PHP_CodeSniffer 3.13.0+.

[2.1.6] - 2025-01-16

• README: Fixed some broken badges.
• General housekeeping and documentation updates. Including a contribution by [@​johnbillion].

[2.1.5] - 2024-04-25

• Ruleset: Updated for compatibility with WordPress 6.5. Thanks [@​swissspidy]
• The recommended version of the [Composer PHPCS plugin] is now ^1.0.
• Other housekeeping and documentation updates. Includes contributions from [@​fredden] and [@​johnbillion].

Commits

• 7c8d18b Merge pull request #75 from PHPCompatibility/feature/changelog-2.1.8
• e44ab9d Changelog for the release of version 2.1.8
• 8cecb58 CHANGELOG: fix bullet consistency
• 0ce84af Merge pull request #73 from PHPCompatibility/feature/dependabot-fix-config
• 280daa4 Dependabot: remove cooldown
• 014f1ed Merge pull request #72 from PHPCompatibility/feature/ghactions-set-minimal-pe...
• 17206f5 GH Actions: set permissions for each workflow/job
• c3795e0 Merge pull request #71 from PHPCompatibility/feature/ghactions-do-not-persist...
• ced596b GH Actions: do not persist credentials
• c7146e4 Merge pull request #70 from PHPCompatibility/feature/ghactions-pin-action-run...
• Additional commits viewable in compare view

Updates squizlabs/php_codesniffer from 3.9.0 to 3.13.6

Release notes

Sourced from squizlabs/php_codesniffer's releases.

3.13.6 - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible.

Changed

• Various housekeeping, including improvements to the tests and documentation.
  • Thanks to Sergei Morozov and Juliette Reinders Folmer for their contributions.

Fixed

• SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters. #1473
  • Users using the default Full report, or any of the other non-*blame reports, are not affected.
  • For more details, see the security advisory.
  • Thanks go to Faze-up and Volker Dusch for responsibly disclosing the vulnerability.
  • Additionally, thanks go to Volker Dusch, Rodrigo Primo, Dan Wallis and Juliette Reinders Folmer for creating and testing the fix.

Other

• The GPG signature for the PHAR files has been rotated. The new fingerprint is: 5CB4F778BF9BC4FB67AE511D96E91A992CF22FF4.

---

Statistics

Closed: 0 issues Merged: 46 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

3.13.5 - 2025-11-04

Added

• Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
  • Syntax support for new PHP 8.5 features will follow in a future release.
  • If you find any PHP 8.5 deprecation notices which were missed, please report them.

Changed

• Various housekeeping, including improvements to the tests and documentation.
  • Thanks to Rodrigo Primo and Juliette Reinders Folmer for their contributions.

Fixed

• Fixed bug #1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Thanks to Andrew Lyons for the patch.
• Fixed bug #1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
  • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
  • Thanks to Juliette Reinders Folmer for the patch.

Other

• Please be aware that the master branch has been renamed to 3.x and the default branch has changed to the 4.x branch.
  • If you contribute to PHP_CodeSniffer, you will need to update your local git clone.
  • If you develop against PHP_CodeSniffer and run your tests against dev branches of PHPCS, you will need to update your workflows.

... (truncated)

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

[3.13.6] - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible.

Changed

• Various housekeeping, including improvements to the tests and documentation.
  • Thanks to [Sergei Morozov][@​morozov] and [Juliette Reinders Folmer][@​jrfnl] for their contributions.

Fixed

• SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters. #1473
  • Users using the default Full report, or any of the other non-*blame reports, are not affected.
  • For more details, see the security advisory.
  • Thanks go to [Faze-up][@​Faze-up] and [Volker Dusch][@​edorian] for responsibly disclosing the vulnerability.
  • Additionally, thanks go to [Volker Dusch][@​edorian], [Rodrigo Primo][@​rodrigoprimo], [Dan Wallis][@​fredden] and [Juliette Reinders Folmer][@​jrfnl] for creating and testing the fix.

Other

• The GPG signature for the PHAR files has been rotated. The new fingerprint is: 5CB4F778BF9BC4FB67AE511D96E91A992CF22FF4.

#1473: PHPCSStandards/PHP_CodeSniffer#1473

[3.13.5] - 2025-11-04

Added

• Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
  • Syntax support for new PHP 8.5 features will follow in a future release.
  • If you find any PHP 8.5 deprecation notices which were missed, please report them.

Changed

• Various housekeeping, including improvements to the tests and documentation.
  • Thanks to [Rodrigo Primo][@​rodrigoprimo] and [Juliette Reinders Folmer][@​jrfnl] for their contributions.

Fixed

• Fixed bug #1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Thanks to [Andrew Lyons][@​andrewnicols] for the patch.
• Fixed bug #1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
  • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
  • Thanks to Juliette Reinders Folmer for the patch.

Other

• Please be aware that the master branch has been renamed to 3.x and the default branch has changed to the 4.x branch.
  • If you contribute to PHP_CodeSniffer, you will need to update your local git clone.
  • If you develop against PHP_CodeSniffer and run your tests against dev branches of PHPCS, you will need to update your workflows.

#1216: PHPCSStandards/PHP_CodeSniffer#1216 #1279: PHPCSStandards/PHP_CodeSniffer#1279

... (truncated)

Commits

• 4c378e1 Merge pull request #1474 from PHPCSStandards/feature/changelog-3.13.6
• ddbf849 Merge pull request #1473 from PHPCSStandards/security/cve-2026-67434
• 742a068 Changelog for the 3.13.6 release
• 7a3a6bb Reports/*blame: properly escape file name
• b5ce04f Merge pull request #1470 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 5f72703 GH Actions: Bump the action-runners group with 2 updates
• 20d0f55 Merge pull request #1466 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 2a2ac29 Merge pull request #1469 from PHPCSStandards/feature/ghactions-setup-php-fail...
• 6df695f Merge pull request #1467 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 4da0184 GH Actions: fail "setup-php" if requested tooling could not be installed
• Additional commits viewable in compare view

Updates automattic/vipwpcs from 3.0.0 to 3.1.0

Release notes

Sourced from automattic/vipwpcs's releases.

VIP Coding Standards 3.1.0

This release raises the minimum requirements and reworks a large number of the VIPCS sniffs.

The minimum WordPressCS requirement is raised to 3.4.1 (from 3.2.0) — a security release which also brings numerous accuracy improvements to sniffs that VIPCS bundles — along with PHP_CodeSniffer 3.13.5, PHPCSUtils 1.2.3, PHPCSExtra 1.5.1 and VariableAnalysis 2.13.0. The minimum PHP version is now 7.4. Many sniffs have been reworked to fix false positives, add support for modern PHP syntaxes and adopt PHPCSUtils. The JavaScript-specific sniffs and the DynamicCalls sniff have been hard-deprecated ahead of their removal in 4.0.0, and the unused Security.Twig sniff has been removed.

Please ensure you run composer update automattic/vipwpcs --with-dependencies to benefit from this.

Added

• #882: Performance/NoPaging: flag posts_per_page and numberposts set to -1 (WordPress' "no limit" value), which previously slipped past the WPCS > 100 check.
• #883: Hooks/AlwaysReturnInFilter: exit, die or throw in a filter callback now raises a dedicated TerminatingInsteadOfReturn warning, instead of the generic MissingReturnStatement error.
• #890: Add a Byte Order Mark (BOM) check to the WordPressVIPMinimum ruleset.

Changed

• #824: Disable WordPress.Security.EscapeOutput.ExceptionNotEscaped in the WordPressVIPMinimum ruleset, as throwing an exception with a translated message triggered it and the check is considered controversial.
• #854: Functions/StripTags: always flag use of strip_tags(), as the function should never be used on the VIP platform.
• As VIPCS bundles a number of WordPressCS sniffs and the minimum WordPressCS version has been raised to 3.4.1, users will now receive more accurate results from the following WPCS sniffs (see the WordPressCS 3.3.0, 3.4.0 and 3.4.1 release notes for full details):
  • WordPress.DB.DirectDatabaseQuery: recognises more caching functions (such as the wp_cache_*_multiple() and wp_cache_*_salted() functions), and has fewer false positives when caching functions are called using a non-canonical function name.
  • WordPress.DB.PreparedSQL: fewer false positives for correctly escaped SQL called using a non-canonical function name, and for static method calls to a non-global class named wpdb.
  • WordPress.Security.EscapeOutput: adds support for attributes on anonymous classes (PHP 8.0), readonly anonymous classes (PHP 8.3) and exit as a function call (PHP 8.4); expands *::class false-positive protection; fixes false positives/negatives for get_search_query() and _deprecated_file() used with non-standard casing; and no longer treats wp_kses_allowed_html() as an escaping function, which may surface a new warning where that function's return value was being output directly.
  • WordPress.Security.NonceVerification: fewer false positives when the nonce-checking function is called using a non-canonical function name.
  • WordPress.Security.ValidatedSanitizedInput: clearer error message for the InputNotValidated error code.
  • WordPress.WP.AlternativeFunctions: fixes a false negative when class members share a name with select global WP functions/constants, and a false positive for the fully qualified stream constants \STDIN, \STDOUT and \STDERR.
  • WordPress.WP.CronInterval: fixes a false positive when the callback reference used a different case to the function declaration.

Deprecated

• #839: Hard-deprecate all JavaScript-specific sniffs (WordPressVIPMinimum.JS.*). They are excluded from the rulesets and will be removed in VIPCS 4.0.0.
• #865: Hard-deprecate the WordPressVIPMinimum.Functions.DynamicCalls sniff. It is excluded from the rulesets and will be removed in VIPCS 4.0.0.

Removed

• #864: Remove the unused WordPressVIPMinimum.Security.Twig sniff.

Fixed

• #840: Fix dangerous comparisons against the value of token constants.
• #842: Security/Mustache: fix potential false positives on a delimiter change, and examine double-quoted strings with interpolation and nowdocs which were previously skipped.
• #846, #848: Security/PHPFilterFunctions: fix false positives for method calls, namespaced function calls and attributes which share the function name.
• #847: Security/StaticStrreplace: fix flawed detection of str_replace() by extending the WordPressCS AbstractFunctionParameterSniff; method calls, namespaced calls, first-class callables and argument unpacking are no longer flagged.
• #850: Variables/ServerVariables: fix incorrect quote stripping and expand safeguards against false positives.
• #851: Constants/ConstantString: fix flawed detection of define()/defined() by extending AbstractFunctionParameterSniff, and clarify the error message.
• #852: Hooks/RestrictedHooks: fix false positives (method/namespaced calls, first-class callables, attributes) and disregard comments in the hook-name parameter.
• #853: Performance/LowExpiryCacheTime: avoid a possible fatal error when a PHP 7.4+ numeric literal or 8.1+ octal literal is used as the cache time.
• #855: Performance/FetchingRemoteData: fix flawed function-call detection by extending AbstractFunctionParameterSniff.
• #858: Classes/DeclarationCompatibility: modernise and fix the sniff.
• #861: Security/EscapingVoidReturnFunctions: fix flawed detection of esc_*()/wp_kses*() calls by extending AbstractFunctionParameterSniff; safeguard argument unpacking, attributes and first-class callables.
• #862: Functions/DynamicCalls: fix end-of-statement determination and other minor issues.
• #866: UserExperience/AdminBarRemoval: several fixes — case-insensitive function-name matching, recognise add_action() as an alias, disregard comments in parameters, and no longer treat a CSS file as PHP; plus PHP 8.0+ function-call and 8.1+ first-class-callable support.
• #867: Performance/CacheValueOverride: fix false negatives for fully qualified calls and false positives for PHP 8.1+ first-class callables and variables.
• #869: Constants/RestrictedConstants: fix a nonsensical comparison and use PHPCSUtils for quote stripping.
• #872: Performance/TaxonomyMetaInOptions: extend AbstractFunctionParameterSniff and add PHP 8.0+ function-call and nullsafe-operator support.
• #881: Hooks/AlwaysReturnInFilter: resolve bugs and adopt PHPCSUtils.

... (truncated)

Changelog

Sourced from automattic/vipwpcs's changelog.

[3.1.0] - 2026-07-27

Props: @​GaryJones, @​jrfnl, @​mahangu, @​mchanDev, @​mujuonly, @​rebeccahum

This release raises the minimum requirements and reworks a large number of the VIPCS sniffs.

The minimum WordPressCS requirement is raised to 3.4.1 (from 3.2.0) — a security release which also brings numerous accuracy improvements to sniffs that VIPCS bundles — along with PHP_CodeSniffer 3.13.5, PHPCSUtils 1.2.3, PHPCSExtra 1.5.1 and VariableAnalysis 2.13.0. The minimum PHP version is now 7.4. Many sniffs have been reworked to fix false positives, add support for modern PHP syntaxes and adopt PHPCSUtils. The JavaScript-specific sniffs and the DynamicCalls sniff have been hard-deprecated ahead of their removal in 4.0.0, and the unused Security.Twig sniff has been removed.

Please ensure you run composer update automattic/vipwpcs --with-dependencies to benefit from this.

Added

• #882: Performance/NoPaging: flag posts_per_page and numberposts set to -1 (WordPress' "no limit" value), which previously slipped past the WPCS > 100 check.
• #883: Hooks/AlwaysReturnInFilter: exit, die or throw in a filter callback now raises a dedicated TerminatingInsteadOfReturn warning, instead of the generic MissingReturnStatement error.
• #890: Add a Byte Order Mark (BOM) check to the WordPressVIPMinimum ruleset.

Changed

• #824: Disable WordPress.Security.EscapeOutput.ExceptionNotEscaped in the WordPressVIPMinimum ruleset, as throwing an exception with a translated message triggered it and the check is considered controversial.
• #854: Functions/StripTags: always flag use of strip_tags(), as the function should never be used on the VIP platform.
• As VIPCS bundles a number of WordPressCS sniffs and the minimum WordPressCS version has been raised to 3.4.1, users will now receive more accurate results from the following WPCS sniffs (see the WordPressCS 3.3.0, 3.4.0 and 3.4.1 release notes for full details):
  • WordPress.DB.DirectDatabaseQuery: recognises more caching functions (such as the wp_cache_*_multiple() and wp_cache_*_salted() functions), and has fewer false positives when caching functions are called using a non-canonical function name.
  • WordPress.DB.PreparedSQL: fewer false positives for correctly escaped SQL called using a non-canonical function name, and for static method calls to a non-global class named wpdb.
  • WordPress.Security.EscapeOutput: adds support for attributes on anonymous classes (PHP 8.0), readonly anonymous classes (PHP 8.3) and exit as a function call (PHP 8.4); expands *::class false-positive protection; fixes false positives/negatives for get_search_query() and _deprecated_file() used with non-standard casing; and no longer treats wp_kses_allowed_html() as an escaping function, which may surface a new warning where that function's return value was being output directly.
  • WordPress.Security.NonceVerification: fewer false positives when the nonce-checking function is called using a non-canonical function name.
  • WordPress.Security.ValidatedSanitizedInput: clearer error message for the InputNotValidated error code.
  • WordPress.WP.AlternativeFunctions: fixes a false negative when class members share a name with select global WP functions/constants, and a false positive for the fully qualified stream constants \STDIN, \STDOUT and \STDERR.
  • WordPress.WP.CronInterval: fixes a false positive when the callback reference used a different case to the function declaration.

Deprecated

• #839: Hard-deprecate all JavaScript-specific sniffs (WordPressVIPMinimum.JS.*). They are excluded from the rulesets and will be removed in VIPCS 4.0.0.
• #865: Hard-deprecate the WordPressVIPMinimum.Functions.DynamicCalls sniff. It is excluded from the rulesets and will be removed in VIPCS 4.0.0.

Removed

• #864: Remove the unused WordPressVIPMinimum.Security.Twig sniff.

Fixed

• #840: Fix dangerous comparisons against the value of token constants.
• #842: Security/Mustache: fix potential false positives on a delimiter change, and examine double-quoted strings with interpolation and nowdocs which were previously skipped.
• #846, #848: Security/PHPFilterFunctions: fix false positives for method calls, namespaced function calls and attributes which share the function name.
• #847: Security/StaticStrreplace: fix flawed detection of str_replace() by extending the WordPressCS AbstractFunctionParameterSniff; method calls, namespaced calls, first-class callables and argument unpacking are no longer flagged.
• #850: Variables/ServerVariables: fix incorrect quote stripping and expand safeguards against false positives.
• #851: Constants/ConstantString: fix flawed detection of define()/defined() by extending AbstractFunctionParameterSniff, and clarify the error message.