chore(deps): bump the composer-all group across 1 directory with 3 updates

[dependabot]

Bumps the composer-all group with 3 updates in the / directory: yahnis-elsts/plugin-update-checker, dealerdirect/phpcodesniffer-composer-installer and wp-coding-standards/wpcs.

Updates yahnis-elsts/plugin-update-checker from 5.6 to 5.7

Release notes

Sourced from yahnis-elsts/plugin-update-checker's releases.

5.7

• Added optional support for the "autoupdate" field that allows triggering unattended plugin updates. To enable it, you need to both set autoupdate to true in plugin update metadata and call $updateChceker->allowAutoupdateField() in your plugin. Props to @​hisman for part of the implementation.
• BitBucket: Added support for basic auth with API tokens. Props to @​cristianozanca for part of the implementation.
• BitBucket: Removed OAuth 1 support since it's no longer supported by BitBucket.
• Replaced all htmlentities() calls with esc_html(). This takes advantage of automatic character set detection in WP core, and should eliminate some static analysis warnings. See #597.
• Replaced all wp_redirect() calls with wp_safe_redirect(). This shouldn't matter in practice since PUC only ever does internal redirects, but it pacifies some static analysis tools. See #597.
• Added and updated translations:
  • Persian (@​aljvdi)
  • Simplified Chinese (zh_CN, @​seatonjiang)
  • Traditional Chinese (zh_TW, @​alexclassroom)

Commits

• 275a96a Bump version number to 5.7
• 8b2396f Minor: Update year in the license block
• 299a869 Minor: Update docs for BitBucket auth
• c31b762 Remove OAuth 1 support for the BitBucket integration.
• eceb677 BitBucket support: Support basic auth with API tokens.
• 3ceae95 Don't allow autoupdate = true unless you call $checked->allowAutoupdateField(...
• b0acf15 Minor: Typo
• 9c044de Update README with regex filtering for GitHub release assets
• 68a70bf Merge pull request #602 from hisman/add-autoupdate-field-to-plugininfo
• 36f3c2b Add default value to the autoupdate field
• Additional commits viewable in compare view

Updates dealerdirect/phpcodesniffer-composer-installer from 1.2.0 to 1.2.1

Release notes

Sourced from dealerdirect/phpcodesniffer-composer-installer's releases.

v1.2.1

Changed

• Various housekeeping, including improvements to CI.

Fixed

• Fix potential error when running composer install with an open_basedir restriction in effect. Thanks @​srebb ! #271, #272

New Contributors

• @​srebb made their first contribution

Full Changelog: PHPCSStandards/composer-installer@v1.2.0...v1.2.1

Changelog

Sourced from dealerdirect/phpcodesniffer-composer-installer's changelog.

[v1.2.1] - 2026-05-06

Changed

• Various housekeeping, including improvements to CI.

Fixed

• Fix potential error when running composer install with an open_basedir restriction in effect. Thanks [@​srebb] ! #271, #272

#271: PHPCSStandards/composer-installer#271 #272: PHPCSStandards/composer-installer#272

Commits

• 963f0c6 Merge pull request #284 from PHPCSStandards/feature/changelog-for-release-1.2.1
• b1bf91e Changelog for the 1.2.1 release
• 0ded545 Resolve relative paths to absolute before validation to avoid open_basedir wa...
• 467286b Merge pull request #283 from PHPCSStandards/dependabot/github_actions/ramsey/...
• 83c65e6 Merge pull request #282 from PHPCSStandards/dependabot/github_actions/action-...
• d384a67 GH Actions: Bump ramsey/composer-install from 3.1.1 to 4.0.0
• c3f9878 GH Actions: Bump shivammathur/setup-php in the action-runners group
• 7e6a7a3 Merge pull request #275 from PHPCSStandards/feature/tests-phpcsversions-updat...
• 4a03570 Merge pull request #274 from PHPCSStandards/feature/dependabot-every-two-weeks
• 375c41d Merge pull request #276 from PHPCSStandards/dependabot/github_actions/action-...
• Additional commits viewable in compare view

Updates wp-coding-standards/wpcs from 3.3.0 to 3.4.1

Release notes

Sourced from wp-coding-standards/wpcs's releases.

3.4.1 - 2026-07-27

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

• The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #2770
• The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #2770
• Various housekeeping, including documentation improvements.

Fixed

• SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #2771 This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. For more details, see the security advisory Thanks to @​FORIMOC for responsibly disclosing the vulnerability.

3.4.0

We're happy to welcome @​rodrigoprimo as co-maintainer of WordPressCS as of this release.

Added

• WordPress.Arrays.ArrayDeclarationSpacing: new allow_single_item_single_line_explicit_key_arrays property to replace the, now deprecated, allow_single_item_single_line_associative_arrays property. #2696
• End-user documentation to the following existing sniffs: WordPress.Arrays.ArrayDeclarationSpacing (props @​RafaelFunchal, @​mattgaldino and @​rodrigoprimo, #2489, #2593, #2682), WordPress.CodeAnalysis.AssignmentInTernaryCondition (props @​Nic-Sevic and @​rodrigoprimo, #2488, #2678), WordPress.DB.RestrictedClasses (props @​paulgibbs and @​rodrigoprimo, #2455, #2689), WordPress.DB.DirectDatabaseQuery (props @​jaymcp and @​rodrigoprimo, #2458, #2697), WordPress.DB.RestrictedFunctions (props @​paulgibbs and @​rodrigoprimo, #2453, #2676), WordPress.DB.SlowDBQuery (props @​petitphp and @​rodrigoprimo, #2464, #2699), WordPress.PHP.DevelopmentFunctions (props @​gogdzl and @​rodrigoprimo, #2490, #2690), WordPress.PHP.NoSilencedErrors (props @​gogdzl and @​rodrigoprimo, #2495, #2694), WordPress.PHP.PregQuoteDelimiter (props @​tikifez and @​rodrigoprimo, #2487, #2677), WordPress.PHP.RestrictedPHPFunctions (props @​gogdzl and @​rodrigoprimo, #2491, #2693), WordPress.Security.PluginMenuSlug (props @​jasonkenison, #2592), WordPress.WP.AlternativeFunctions (props @​pamprn09, @​bhubbard and @​rodrigoprimo, #2496, #2588, #2687), WordPress.WP.DiscouragedConstants (props @​RafaelFunchal, @​paulopmt1 and @​rodrigoprimo, #2493, #2589, #2680), WordPress.WP.GlobalVariablesOverride (props @​paulopmt1 and @​rodrigoprimo, #2586, #2679). This documentation can be exposed via the PHP_CodeSniffer --generator=... command-line argument.

Changed

• The minimum required PHP_CodeSniffer version to 3.13.5 (was 3.13.4). #2761
• The minimum required PHPCSUtils version to 1.2.2 (was 1.1.0). #2761
• The default value for minimum_wp_version, as used by a number of sniffs detecting usage of deprecated WP features, has been updated to 6.7. #2757
• WordPress.NamingConventions.PrefixAllGlobals has been updated to recognize pluggable functions introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.ClassNameCase has been updated to recognize classes introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.DeprecatedFunctions now detects functions deprecated in WordPress up to WP 7.0.0. #2747
• The ConstantsHelper::is_use_of_global_constant() method will no longer flag a constant alias created via an import use statement as it were the use of a global constant. #2579
• The ConstantsHelper::is_in_function_call() method will now act fully case-agnostic for the function names being checked. #2706 Previously, the $valid_functions parameter would need to be passed with the function names as keys in lowercase.
• WordPress.PHP.NoSilencedErrors: error silencing is no longer accepted for the parse_url() function. #2701
• Improved the wording of the error message for WordPress.Arrays.ArrayDeclarationSpacing.AssociativeArrayFound. #2688
• Improved the wording of the error message for WordPress.PHP.RestrictedPHPFunctions. #2702
• Various housekeeping, including documentation and test improvements. Includes a contribution by @​dd32.

Deprecated

• WordPress.Arrays.ArrayDeclarationSpacing: the allow_single_item_single_line_associative_arrays property has been deprecated in favor of the new allow_single_item_single_line_explicit_key_arrays property. #2696 This is a name change only. The functionality of these properties is the same.

Fixed

• WordPress.DB.PreparedSQL and WordPress.DB.PreparedSQLPlaceholders: false positive for static method calls to a non-global class named wpdb. #2753
• WordPress.Security.EscapeOutput: false positive for get_search_query() when the $escaped parameter was passed as fully qualified or non-lowercase true. #2618
• WordPress.Security.EscapeOutput: false negative for _deprecated_file() calls when the basename( __FILE__ ) pattern used non-standard casing for either basename() and/or __FILE__. #2729
• WordPress.WP.AlternativeFunctions: false negative when class functions/constants/properties use the same name as select global WP constants/functions. #2617
• WordPress.WP.AlternativeFunctions: false positive for fully qualified references to the global PHP stream constants \STDIN, \STDOUT, and \STDERR. #2617
• WordPress.WP.CronInterval: false positive when the callback function reference used a different case than the function declaration, even though they are in the same file. #2730

Changelog

Sourced from wp-coding-standards/wpcs's changelog.

[3.4.1] - 2026-07-27

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

• The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #2770
• The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #2770
• Various housekeeping, including documentation improvements.

Fixed

• SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #2771 This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. For more details, see the security advisory. Thanks to [@​FORIMOC] for responsibly disclosing the vulnerability.

#2770: WordPress/WordPress-Coding-Standards#2770 #2771: WordPress/WordPress-Coding-Standards#2771

[3.4.0] - 2026-07-16

We're happy to welcome [@​rodrigoprimo] as co-maintainer of WordPressCS as of this release.

Added

• WordPress.Arrays.ArrayDeclarationSpacing: new allow_single_item_single_line_explicit_key_arrays property to replace the, now deprecated, allow_single_item_single_line_associative_arrays property. #2696
• End-user documentation to the following existing sniffs: WordPress.Arrays.ArrayDeclarationSpacing (props [@​RafaelFunchal], [@​mattgaldino] and [@​rodrigoprimo], #2489, #2593, #2682), WordPress.CodeAnalysis.AssignmentInTernaryCondition (props [@​Nic-Sevic] and [@​rodrigoprimo], #2488, #2678), WordPress.DB.RestrictedClasses (props [@​paulgibbs] and [@​rodrigoprimo], #2455, #2689), WordPress.DB.DirectDatabaseQuery (props [@​jaymcp] and [@​rodrigoprimo], #2458, #2697), WordPress.DB.RestrictedFunctions (props [@​paulgibbs] and [@​rodrigoprimo], #2453, #2676), WordPress.DB.SlowDBQuery (props [@​petitphp] and [@​rodrigoprimo], #2464, #2699), WordPress.PHP.DevelopmentFunctions (props [@​gogdzl] and [@​rodrigoprimo], #2490, #2690), WordPress.PHP.NoSilencedErrors (props [@​gogdzl] and [@​rodrigoprimo], #2495, #2694), WordPress.PHP.PregQuoteDelimiter (props [@​tikifez] and [@​rodrigoprimo], #2487, #2677), WordPress.PHP.RestrictedPHPFunctions (props [@​gogdzl] and [@​rodrigoprimo], #2491, #2693), WordPress.Security.PluginMenuSlug (props [@​jasonkenison], #2592), WordPress.WP.AlternativeFunctions (props [@​pamprn09], [@​bhubbard] and [@​rodrigoprimo], #2496, #2588, #2687), WordPress.WP.DiscouragedConstants (props [@​RafaelFunchal], [@​paulopmt1] and [@​rodrigoprimo], #2493, #2589, #2680), WordPress.WP.GlobalVariablesOverride (props [@​paulopmt1] and [@​rodrigoprimo], #2586, #2679). This documentation can be exposed via the PHP_CodeSniffer --generator=... command-line argument.

Changed

• The minimum required PHP_CodeSniffer version to 3.13.5 (was 3.13.4). #2761
• The minimum required PHPCSUtils version to 1.2.2 (was 1.1.0). #2761
• The default value for minimum_wp_version, as used by a number of sniffs detecting usage of deprecated WP features, has been updated to 6.7. #2757
• WordPress.NamingConventions.PrefixAllGlobals has been updated to recognize pluggable functions introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.ClassNameCase has been updated to recognize classes introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.DeprecatedFunctions now detects functions deprecated in WordPress up to WP 7.0.0. #2747
• The ConstantsHelper::is_use_of_global_constant() method will no longer flag a constant alias created via an import use statement as it were the use of a global constant. #2579
• The ConstantsHelper::is_in_function_call() method will now act fully case-agnostic for the function names being checked. #2706 Previously, the $valid_functions parameter would need to be passed with the function names as keys in lowercase.
• WordPress.PHP.NoSilencedErrors: error silencing is no longer accepted for the parse_url() function. #2701
• Improved the wording of the error message for WordPress.Arrays.ArrayDeclarationSpacing.AssociativeArrayFound. #2688
• Improved the wording of the error message for WordPress.PHP.RestrictedPHPFunctions. #2702
• Various housekeeping, including documentation and test improvements. Includes a contribution by [@​dd32].

Deprecated

• WordPress.Arrays.ArrayDeclarationSpacing: the allow_single_item_single_line_associative_arrays property has been deprecated in favor of the new allow_single_item_single_line_explicit_key_arrays property. #2696 This is a name change only. The functionality of these properties is the same.

Fixed

... (truncated)

Commits

• ec2ff94 Merge pull request #2773 from WordPress/develop
• b558639 Merge pull request #2772 from WordPress/feature/changelog-3.4.1
• 1696dc8 Changelog for the release of WordPressCS 3.4.1
• a29048d Merge pull request #2771 from WordPress/security/enqueuedresourceparams-fix-i...
• 7262444 WP/EnqueuedResourceParameters: remove eval() from is_falsy()
• 54719c0 Merge pull request #2770 from WordPress/feature/composer-update-versions
• 267d84e Composer: update minimum version PHPCSUtils + PHPCSExtra
• e8064a6 Add SECURITY.md file (#2766)
• 7ac8973 Merge pull request #2768 from WordPress/dependabot/github_actions/action-runn...
• 9466b4b GH Actions: Bump actions/checkout in the action-runners group
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	composer/​yahnis-elsts/​plugin-update-checker@​5.6.0.0 ⏵ 5.7.0.0
	composer/​dealerdirect/​phpcodesniffer-composer-installer@​1.2.0.0 ⏵ 1.2.1.0
	composer/​wp-coding-standards/​wpcs@​3.3.0.0 ⏵ 3.4.1.0	N/A	N/A	N/A	N/A	N/A

View full report