Internal: Unblock PHPUnit composer install from security advisories [TMZ-1064]

[Ntnelbaba]

Summary

All 20 PHPUnit jobs are failing on main, not just on open PRs. The failure is in the Install Dependencies step, before any test runs.

Root cause

phpunit.yml runs composer update, which re-resolves dependencies. composer.json pins wp-coding-standards/wpcs to exactly 3.3.0, and that version is covered by CVE-2026-45293 (advisory PKSA-mh9b-91zm-m1gy, affects >=0.14.1,<3.4.1, reported 2026-07-27). Composer refuses to install packages under an advisory, and because the pin is exact there is no alternative to fall back to:

Root composer.json requires wp-coding-standards/wpcs 3.3.0 (exact version match: 3.3.0 or 3.3.0.0),
found wp-coding-standards/wpcs[3.3.0] but these were not loaded, because they are affected by
security advisories ("PKSA-mh9b-91zm-m1gy").

The Lint workflow stayed green because it runs composer install from the existing lock file, which does not re-resolve.

Changes

• Bump wp-coding-standards/wpcs to 3.4.1, the first release outside the advisory range
• Refresh squizlabs/php_codesniffer to 3.13.6 in the lock. composer audit flagged the locked 3.13.5 for CVE-2026-67434 (reported 2026-08-05); the ^3.6 constraint already allowed the fixed version, so only the lock needed updating

Testing

Reproduced the original failure locally, then after the fix:

• composer update --no-interaction (the exact PHPUnit workflow command) resolves successfully
• composer audit reports no advisories
• composer run lint:php (PHPCS) passes clean, so the wpcs minor bump introduces no new sniff violations

Jira

TMZ-1064

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}