chore(deps): bump the php-deps group across 1 directory with 8 updates by dependabot[bot] · Pull Request #34 · ahegyes/wordpress-configs

dependabot · 2026-09-07T06:11:55Z

Bumps the php-deps group with 8 updates in the / directory:

Package	From	To
wp-coding-standards/wpcs	`3.3.0`	`3.4.1`
phpstan/phpstan	`2.2.5`	`2.2.10`
phpstan/phpstan-deprecation-rules	`2.0.4`	`2.0.5`
phpstan/phpstan-strict-rules	`2.0.11`	`2.0.12`
johnbillion/wp-compat	`1.5.0`	`2.0.1`
composer/composer	`2.10.2`	`2.10.3`
infection/infection	`0.34.0`	`0.35.3`
phpunit/phpunit	`13.2.2`	`13.3.2`

Updates wp-coding-standards/wpcs from 3.3.0 to 3.4.1

Release notes

Sourced from wp-coding-standards/wpcs's releases.

3.4.1 - 2026-07-27

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #2770

The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #2770

Various housekeeping, including documentation improvements.

Fixed

SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #2771 This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. For more details, see the security advisory Thanks to @FORIMOC for responsibly disclosing the vulnerability.

3.4.0

We're happy to welcome @rodrigoprimo as co-maintainer of WordPressCS as of this release.

Added

WordPress.Arrays.ArrayDeclarationSpacing: new allow_single_item_single_line_explicit_key_arrays property to replace the, now deprecated, allow_single_item_single_line_associative_arrays property. #2696

End-user documentation to the following existing sniffs: WordPress.Arrays.ArrayDeclarationSpacing (props @RafaelFunchal, @mattgaldino and @rodrigoprimo, #2489, #2593, #2682), WordPress.CodeAnalysis.AssignmentInTernaryCondition (props @Nic-Sevic and @rodrigoprimo, #2488, #2678), WordPress.DB.RestrictedClasses (props @paulgibbs and @rodrigoprimo, #2455, #2689), WordPress.DB.DirectDatabaseQuery (props @jaymcp and @rodrigoprimo, #2458, #2697), WordPress.DB.RestrictedFunctions (props @paulgibbs and @rodrigoprimo, #2453, #2676), WordPress.DB.SlowDBQuery (props @petitphp and @rodrigoprimo, #2464, #2699), WordPress.PHP.DevelopmentFunctions (props @gogdzl and @rodrigoprimo, #2490, #2690), WordPress.PHP.NoSilencedErrors (props @gogdzl and @rodrigoprimo, #2495, #2694), WordPress.PHP.PregQuoteDelimiter (props @tikifez and @rodrigoprimo, #2487, #2677), WordPress.PHP.RestrictedPHPFunctions (props @gogdzl and @rodrigoprimo, #2491, #2693), WordPress.Security.PluginMenuSlug (props @jasonkenison, #2592), WordPress.WP.AlternativeFunctions (props @pamprn09, @bhubbard and @rodrigoprimo, #2496, #2588, #2687), WordPress.WP.DiscouragedConstants (props @RafaelFunchal, @paulopmt1 and @rodrigoprimo, #2493, #2589, #2680), WordPress.WP.GlobalVariablesOverride (props @paulopmt1 and @rodrigoprimo, #2586, #2679). This documentation can be exposed via the PHP_CodeSniffer --generator=... command-line argument.

Changed

The minimum required PHP_CodeSniffer version to 3.13.5 (was 3.13.4). #2761

The minimum required PHPCSUtils version to 1.2.2 (was 1.1.0). #2761

The default value for minimum_wp_version, as used by a number of sniffs detecting usage of deprecated WP features, has been updated to 6.7. #2757

WordPress.NamingConventions.PrefixAllGlobals has been updated to recognize pluggable functions introduced in WP up to WP 7.0.0. #2747

WordPress.WP.ClassNameCase has been updated to recognize classes introduced in WP up to WP 7.0.0. #2747

WordPress.WP.DeprecatedFunctions now detects functions deprecated in WordPress up to WP 7.0.0. #2747

The ConstantsHelper::is_use_of_global_constant() method will no longer flag a constant alias created via an import use statement as it were the use of a global constant. #2579

The ConstantsHelper::is_in_function_call() method will now act fully case-agnostic for the function names being checked. #2706 Previously, the $valid_functions parameter would need to be passed with the function names as keys in lowercase.

WordPress.PHP.NoSilencedErrors: error silencing is no longer accepted for the parse_url() function. #2701

Improved the wording of the error message for WordPress.Arrays.ArrayDeclarationSpacing.AssociativeArrayFound. #2688

Improved the wording of the error message for WordPress.PHP.RestrictedPHPFunctions. #2702

Various housekeeping, including documentation and test improvements. Includes a contribution by @dd32.

Deprecated

WordPress.Arrays.ArrayDeclarationSpacing: the allow_single_item_single_line_associative_arrays property has been deprecated in favor of the new allow_single_item_single_line_explicit_key_arrays property. #2696 This is a name change only. The functionality of these properties is the same.

Fixed

WordPress.DB.PreparedSQL and WordPress.DB.PreparedSQLPlaceholders: false positive for static method calls to a non-global class named wpdb. #2753

WordPress.Security.EscapeOutput: false positive for get_search_query() when the $escaped parameter was passed as fully qualified or non-lowercase true. #2618

WordPress.Security.EscapeOutput: false negative for _deprecated_file() calls when the basename( __FILE__ ) pattern used non-standard casing for either basename() and/or __FILE__. #2729

WordPress.WP.AlternativeFunctions: false negative when class functions/constants/properties use the same name as select global WP constants/functions. #2617

WordPress.WP.AlternativeFunctions: false positive for fully qualified references to the global PHP stream constants \STDIN, \STDOUT, and \STDERR. #2617

WordPress.WP.CronInterval: false positive when the callback function reference used a different case than the function declaration, even though they are in the same file. #2730

Changelog

Sourced from wp-coding-standards/wpcs's changelog.

[3.4.1] - 2026-07-27

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #2770

The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #2770

Various housekeeping, including documentation improvements.

Fixed

SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #2771 This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. For more details, see the security advisory. Thanks to [@FORIMOC] for responsibly disclosing the vulnerability.

#2770: WordPress/WordPress-Coding-Standards#2770 #2771: WordPress/WordPress-Coding-Standards#2771

[3.4.0] - 2026-07-16

We're happy to welcome [@rodrigoprimo] as co-maintainer of WordPressCS as of this release.

Added

WordPress.Arrays.ArrayDeclarationSpacing: new allow_single_item_single_line_explicit_key_arrays property to replace the, now deprecated, allow_single_item_single_line_associative_arrays property. #2696

End-user documentation to the following existing sniffs: WordPress.Arrays.ArrayDeclarationSpacing (props [@RafaelFunchal], [@mattgaldino] and [@rodrigoprimo], #2489, #2593, #2682), WordPress.CodeAnalysis.AssignmentInTernaryCondition (props [@Nic-Sevic] and [@rodrigoprimo], #2488, #2678), WordPress.DB.RestrictedClasses (props [@paulgibbs] and [@rodrigoprimo], #2455, #2689), WordPress.DB.DirectDatabaseQuery (props [@jaymcp] and [@rodrigoprimo], #2458, #2697), WordPress.DB.RestrictedFunctions (props [@paulgibbs] and [@rodrigoprimo], #2453, #2676), WordPress.DB.SlowDBQuery (props [@petitphp] and [@rodrigoprimo], #2464, #2699), WordPress.PHP.DevelopmentFunctions (props [@gogdzl] and [@rodrigoprimo], #2490, #2690), WordPress.PHP.NoSilencedErrors (props [@gogdzl] and [@rodrigoprimo], #2495, #2694), WordPress.PHP.PregQuoteDelimiter (props [@tikifez] and [@rodrigoprimo], #2487, #2677), WordPress.PHP.RestrictedPHPFunctions (props [@gogdzl] and [@rodrigoprimo], #2491, #2693), WordPress.Security.PluginMenuSlug (props [@jasonkenison], #2592), WordPress.WP.AlternativeFunctions (props [@pamprn09], [@bhubbard] and [@rodrigoprimo], #2496, #2588, #2687), WordPress.WP.DiscouragedConstants (props [@RafaelFunchal], [@paulopmt1] and [@rodrigoprimo], #2493, #2589, #2680), WordPress.WP.GlobalVariablesOverride (props [@paulopmt1] and [@rodrigoprimo], #2586, #2679). This documentation can be exposed via the PHP_CodeSniffer --generator=... command-line argument.

Changed

The minimum required PHP_CodeSniffer version to 3.13.5 (was 3.13.4). #2761

The minimum required PHPCSUtils version to 1.2.2 (was 1.1.0). #2761

The default value for minimum_wp_version, as used by a number of sniffs detecting usage of deprecated WP features, has been updated to 6.7. #2757

WordPress.NamingConventions.PrefixAllGlobals has been updated to recognize pluggable functions introduced in WP up to WP 7.0.0. #2747

WordPress.WP.ClassNameCase has been updated to recognize classes introduced in WP up to WP 7.0.0. #2747

WordPress.WP.DeprecatedFunctions now detects functions deprecated in WordPress up to WP 7.0.0. #2747

The ConstantsHelper::is_use_of_global_constant() method will no longer flag a constant alias created via an import use statement as it were the use of a global constant. #2579

The ConstantsHelper::is_in_function_call() method will now act fully case-agnostic for the function names being checked. #2706 Previously, the $valid_functions parameter would need to be passed with the function names as keys in lowercase.

WordPress.PHP.NoSilencedErrors: error silencing is no longer accepted for the parse_url() function. #2701

Improved the wording of the error message for WordPress.Arrays.ArrayDeclarationSpacing.AssociativeArrayFound. #2688

Improved the wording of the error message for WordPress.PHP.RestrictedPHPFunctions. #2702

Various housekeeping, including documentation and test improvements. Includes a contribution by [@dd32].

Deprecated

WordPress.Arrays.ArrayDeclarationSpacing: the allow_single_item_single_line_associative_arrays property has been deprecated in favor of the new allow_single_item_single_line_explicit_key_arrays property. #2696 This is a name change only. The functionality of these properties is the same.

Fixed

... (truncated)

Commits

ec2ff94 Merge pull request #2773 from WordPress/develop
b558639 Merge pull request #2772 from WordPress/feature/changelog-3.4.1
1696dc8 Changelog for the release of WordPressCS 3.4.1
a29048d Merge pull request #2771 from WordPress/security/enqueuedresourceparams-fix-i...
7262444 WP/EnqueuedResourceParameters: remove eval() from is_falsy()
54719c0 Merge pull request #2770 from WordPress/feature/composer-update-versions
267d84e Composer: update minimum version PHPCSUtils + PHPCSExtra
e8064a6 Add SECURITY.md file (#2766)
7ac8973 Merge pull request #2768 from WordPress/dependabot/github_actions/action-runn...
9466b4b GH Actions: Bump actions/checkout in the action-runners group
Additional commits viewable in compare view

Updates phpstan/phpstan from 2.2.5 to 2.2.10

Commits

See full diff in compare view

Updates phpstan/phpstan-deprecation-rules from 2.0.4 to 2.0.5

Release notes

Sourced from phpstan/phpstan-deprecation-rules's releases.

2.0.5

67bedd6 - Update github-actions (#197)

6be8bd3 - Update actions/cache action to v6 (#198)

0b310ec - Update github-actions to v3.0.1 (#195)

782d848 - Update github-actions to v7 (#196)

85fff9d - Update github-actions to f3e473d (#194)

54db580 - Update github-actions (#193)

99aff1a - Replace deprecated actions/create-release with softprops/action-gh-release

971f8e1 - Bump GitHub Actions across major versions

89fef35 - Bump GitHub Actions within their current majors

0652358 - Update github-actions

02119cc - Update github-actions

389c78c - latest infection does not support PHP 8.2 (#189)

899202d - Update release-toot.yml (#188)

016d677 - name-collision-detector (#187)

945df12 - Delete .github/workflows/claude-react-on-comment.yml

a70b8b1 - Remove default branch determination from workflow

1faeb2e - Lint workflows

534891e - [StepSecurity] ci: Harden GitHub Actions

3acc664 - Remove PHPSTAN_BOT_TOKEN from checkout step

49efeb2 - React on issues opened and fall back to issue body

319c3f6 - Add PHP 8.5 to CI matrix for lint, tests, and static analysis

73feeba - Add missing export-ignore entries to .gitattributes

c6d73e5 - Add CLAUDE.md with project documentation

f9f68eb - Add Claude React on Comment workflow

Commits

67bedd6 Update github-actions (#197)
6be8bd3 Update actions/cache action to v6 (#198)
0b310ec Update github-actions to v3.0.1 (#195)
782d848 Update github-actions to v7 (#196)
85fff9d Update github-actions to f3e473d (#194)
54db580 Update github-actions (#193)
99aff1a Replace deprecated actions/create-release with softprops/action-gh-release
971f8e1 Bump GitHub Actions across major versions
89fef35 Bump GitHub Actions within their current majors
0652358 Update github-actions
Additional commits viewable in compare view

Updates phpstan/phpstan-strict-rules from 2.0.11 to 2.0.12

Release notes

Sourced from phpstan/phpstan-strict-rules's releases.

2.0.12

2bc5ae1 - Allow GMP and BCMath\Number in arithmetic operations (#311)

70e3081 - Update github-actions (#324)

07a17dd - Update github-actions to v7 (#325)

de9bdda - Update github-actions (#322)

80870ec - Replace deprecated actions/create-release with softprops/action-gh-release

109c14f - Bump GitHub Actions across major versions

ebf31ff - Bump GitHub Actions within their current majors

727c193 - Update github-actions

cc56619 - Update github-actions

1e72841 - Update release-toot.yml (#319)

ada7e60 - CI: move name-collision job into build.yml (#318)

470946d - Add missing export-ignore entries to .gitattributes (#315)

8b14a8e - name-collision-detector (#314)

Commits

2bc5ae1 Allow GMP and BCMath\Number in arithmetic operations (#311)
70e3081 Update github-actions (#324)
07a17dd Update github-actions to v7 (#325)
de9bdda Update github-actions (#322)
80870ec Replace deprecated actions/create-release with softprops/action-gh-release
109c14f Bump GitHub Actions across major versions
ebf31ff Bump GitHub Actions within their current majors
727c193 Update github-actions
cc56619 Update github-actions
1e72841 Update release-toot.yml (#319)
Additional commits viewable in compare view

Updates johnbillion/wp-compat from 1.5.0 to 2.0.1

Release notes

Sourced from johnbillion/wp-compat's releases.

2.0.1

What's Changed

Correct some of the parameter change entries by @johnbillion in johnbillion/wp-compat#29

Full Changelog: johnbillion/wp-compat@2.0.0...2.0.1

2.0.0

What's Changed

Support PHP 7.2 / PHPStan 1.x & 2.x by @swissspidy in johnbillion/wp-compat#21

Check function and hook parameters that were added later by @swissspidy in johnbillion/wp-compat#22

Updated symbols for WordPress 7.1 by @johnbillion in johnbillion/wp-compat#25

Test on PHP 8.5 by @johnbillion in johnbillion/wp-compat#24

New Contributors

@swissspidy made their first contribution in johnbillion/wp-compat#21

Full Changelog: johnbillion/wp-compat@1.5.0...2.0.0

Commits

b2e32bd This isn't needed.
deb4d68 Add schema validation.
b42fa0a Add automatic milestone management after each release.
7f00453 Update the parameter change detection and add tests.
cff396f Introduce our own minimal stubs only where they are needed.
11398ae Override the WordPress package with our own.
1f95920 Use the latest available WordPress version.
1b1fdab Extract the symbol extraction into something testable, and add tests.
c1c5255 Agent files.
6876564 Docs.
Additional commits viewable in compare view

Updates composer/composer from 2.10.2 to 2.10.3

Release notes

Sourced from composer/composer's releases.

2.10.3

Security: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944)

Security: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3, CVE-2026-84361)

Security: Sanitize URL-embedded usernames/token in a few more places (#13044)

Security: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#12988)

Fixed PHP 8.6 deprecation warnings (#12967, #13028)

Fixed error output when a policy blocks a package version to be clearer (#12993)

Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)

Fixed possible race condition while creating directories like the cache dir when running multiple Composer processes in parallel (#12977)

Fixed forgejo support to handle empty repositories better (#12968)

Fixed FilterListApiClient not forwarding transport options (#13040)

Full Changelog: composer/composer@2.10.2...2.10.3

Changelog

Sourced from composer/composer's changelog.

[2.10.3] 2026-08-27

Security: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944)

Security: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)

Security: Sanitize URL-embedded usernames/token in a few more places (#13044)

Security: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#12988)

Fixed PHP 8.6 deprecation warnings (#12967, #13028)

Fixed error output when a policy blocks a package version to be clearer (#12993)

Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)

Fixed possible race condition while creating directories like the cache dir when running multiple Composer processes in parallel (#12977)

Fixed forgejo support to handle empty repositories better (#12968)

Fixed FilterListApiClient not forwarding transport options (#13040)

Commits

f0de0bf Release 2.10.3
f247758 Update changelog
0aac505 Merge commit from fork
53b8bb4 Merge commit from fork
24e396b Make it possible to pass transport options to FilterListApiClient (#13040)
f383d23 Do not use a conflicted content-hash as the autoloader suffix (#13048)
ada0055 Mask URL credentials anywhere in a string, not just at its start (#13044)
cd19785 Prevent curl SSL version parsing across lines (#13046)
eba7baa Fix Url::getOrigin prefix-matching a host against gitlab-domains (#12988)
5e9f655 Include the failed URL in max-file-size and content-length errors (#13041)
Additional commits viewable in compare view

Updates infection/infection from 0.34.0 to 0.35.3

Release notes

Sourced from infection/infection's releases.

0.35.3

Fixed:

fix(git): Fix GitDiffSourceLineMatcher compatibility with Windows by @theofidry in infection/infection#3516

perf: Stop retaining every Mutation until the end of the run by @Meacue in infection/infection#3506

Full Changelog: infection/infection@0.35.2...0.35.3

0.35.2

Fixed:

fix(phpunit): Remove the defects test order when disabling the test r… by @sebastianbergmann in infection/infection#3458

New Contributors

@sebastianbergmann made their first contribution in infection/infection#3458

Full Changelog: infection/infection@0.35.1...0.35.2

0.35.1

Fixed:

fix(phar): Upgrade Box so the PHAR works on PHP 8.5 (array_first() bug) by @lazerg in infection/infection#3495

Full Changelog: infection/infection@0.35.0...0.35.1

Fix auto-prepend file logic, mago freezes and Windows-specific PHPUnit tests filtering

Fixes:

[BC Break] Fail when PHP configures an auto-prepend file by @theofidry in #3448

fix(mago): Limit the mago thread count in the mutant processes by @theofidry in infection/infection#3489

fix(phpunit): Prevent Windows environment block overflow by @Meacue in infection/infection#3468

fix: Fix version detection with quiet console output by @theofidry in infection/infection#3474

Internal:

fix: Replace deprecated Node\Scalar\LNumber with Node\Scalar\Int_ by @sanmai in infection/infection#3461

fix(ci): Block outdated php-enum package by @sanmai in infection/infection#3481

New Contributors

@Meacue made their first contribution in infection/infection#3468

Full Changelog: infection/infection@0.34.2...0.35.0

0.34.2

Fixed:

Use recordTestRunHistory instead of cacheResult on PHPUnit 13.3 by @lazerg in infection/infection#3447

Escape GitHub annotation workflow commands by @theofidry in infection/infection#3441

... (truncated)

Commits

3ad1715 fix(git): Fix GitDiffSourceLineMatcher compatibility with Windows (#3516)
49a4923 refactor(Mutant): Simplify the prettyPrintedOriginalCode property type (#3513)
a7b4f3b perf: Stop retaining every Mutation until the end of the run (#3506)
31409fb build(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in /.github/...
9dd5c14 [Conductor] Update phpunit/php-file-iterator to 6.0.2 (#3504)
03bac9f [Conductor] Update carthage-software/mago to 1.47.4 (#3503)
3397237 [Conductor] Update carthage-software/mago to 1.47.3 (#3501)
b452e00 [Conductor] Update phpstan/phpstan to 2.2.9 (#3500)
0b64cc5 [Conductor] Update justinrainbow/json-schema to 6.11.0 (#3499)
2580fec [Conductor] Update carthage-software/mago to 1.47.2 (#3496)
Additional commits viewable in compare view

Updates phpunit/phpunit from 13.2.2 to 13.3.2

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.3.2

Fixed

#6904: SourceMap is built in child process even though identifyIssueTrigger is disabled

#6924: #[CoversFile] attribute is not considered for risky test check

Learn how to install or update PHPUnit 13.3 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.

You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.3.1

Changed

Invoking a static hook method such as setUpBeforeClass() no longer triggers a deprecation warning on PHP 8.6

Learn how to install or update PHPUnit 13.3 in the documentation.

Keep up to date with PHPUnit:

You can follow @phpunit@phpc.social to stay up to date with PHPUnit's development.

You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

PHPUnit 13.3.0

Added

#3794: Filesystem-based code coverage targeting

#5758: Make export of objects customizable

#6546: Both property hooks can now be configured on test doubles of virtual hooked properties, even when the doubled property only declares one of them

#6586: Custom code coverage driver support

#6591: Repeated test execution using --repeat CLI option and #[Repeat] attribute

#6701: Allow expectOutputString() and expectOutputRegex() to be combined and repeated

#6710: Deprecation Filters

#6722: Allow #[CoversNothing] on methods

#6742: Retry failing tests up to N times using --retry CLI option #[Retry] attribute

#6827: Customize which deprecation trigger types fail the test run

#6830: Warn when failOnAllIssues="true" is combined with an explicitly disabled fine-grained Description has been truncated

Bumps the php-deps group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [wp-coding-standards/wpcs](https://github.com/WordPress/WordPress-Coding-Standards) | `3.3.0` | `3.4.1` | | [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) | `2.2.5` | `2.2.10` | | [phpstan/phpstan-deprecation-rules](https://github.com/phpstan/phpstan-deprecation-rules) | `2.0.4` | `2.0.5` | | [phpstan/phpstan-strict-rules](https://github.com/phpstan/phpstan-strict-rules) | `2.0.11` | `2.0.12` | | [johnbillion/wp-compat](https://github.com/johnbillion/wp-compat) | `1.5.0` | `2.0.1` | | [composer/composer](https://github.com/composer/composer) | `2.10.2` | `2.10.3` | | [infection/infection](https://github.com/infection/infection) | `0.34.0` | `0.35.3` | | [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit) | `13.2.2` | `13.3.2` | Updates `wp-coding-standards/wpcs` from 3.3.0 to 3.4.1 - [Release notes](https://github.com/WordPress/WordPress-Coding-Standards/releases) - [Changelog](https://github.com/WordPress/WordPress-Coding-Standards/blob/develop/CHANGELOG.md) - [Commits](WordPress/WordPress-Coding-Standards@3.3.0...3.4.1) Updates `phpstan/phpstan` from 2.2.5 to 2.2.10 - [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits) Updates `phpstan/phpstan-deprecation-rules` from 2.0.4 to 2.0.5 - [Release notes](https://github.com/phpstan/phpstan-deprecation-rules/releases) - [Commits](phpstan/phpstan-deprecation-rules@2.0.4...2.0.5) Updates `phpstan/phpstan-strict-rules` from 2.0.11 to 2.0.12 - [Release notes](https://github.com/phpstan/phpstan-strict-rules/releases) - [Commits](phpstan/phpstan-strict-rules@2.0.11...2.0.12) Updates `johnbillion/wp-compat` from 1.5.0 to 2.0.1 - [Release notes](https://github.com/johnbillion/wp-compat/releases) - [Commits](johnbillion/wp-compat@1.5.0...2.0.1) Updates `composer/composer` from 2.10.2 to 2.10.3 - [Release notes](https://github.com/composer/composer/releases) - [Changelog](https://github.com/composer/composer/blob/main/CHANGELOG.md) - [Commits](composer/composer@2.10.2...2.10.3) Updates `infection/infection` from 0.34.0 to 0.35.3 - [Release notes](https://github.com/infection/infection/releases) - [Changelog](https://github.com/infection/infection/blob/master/CHANGELOG.md) - [Commits](infection/infection@0.34.0...0.35.3) Updates `phpunit/phpunit` from 13.2.2 to 13.3.2 - [Release notes](https://github.com/sebastianbergmann/phpunit/releases) - [Changelog](https://github.com/sebastianbergmann/phpunit/blob/13.3.2/ChangeLog-13.3.md) - [Commits](sebastianbergmann/phpunit@13.2.2...13.3.2) --- updated-dependencies: - dependency-name: wp-coding-standards/wpcs dependency-version: 3.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: php-deps - dependency-name: phpstan/phpstan dependency-version: 2.2.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: php-deps - dependency-name: phpstan/phpstan-deprecation-rules dependency-version: 2.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: php-deps - dependency-name: phpstan/phpstan-strict-rules dependency-version: 2.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: php-deps - dependency-name: johnbillion/wp-compat dependency-version: 2.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: php-deps - dependency-name: composer/composer dependency-version: 2.10.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: php-deps - dependency-name: infection/infection dependency-version: 0.35.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: php-deps - dependency-name: phpunit/phpunit dependency-version: 13.3.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: php-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Sep 7, 2026

Navigation Menu

chore(deps): bump the php-deps group across 1 directory with 8 updates - #34

chore(deps): bump the php-deps group across 1 directory with 8 updates#34
dependabot[bot] wants to merge 1 commit into
trunkfrom
dependabot/composer/php-deps-b96ee4a7e3

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 7, 2026

3.4.1 - 2026-07-27

Changed

Fixed

3.4.0

Added

Changed

Deprecated

Fixed

[3.4.1] - 2026-07-27

Changed

Fixed

[3.4.0] - 2026-07-16

Added

Changed

Deprecated

Fixed

2.0.5

2.0.12

2.0.1

What's Changed

2.0.0

What's Changed

New Contributors

2.10.3

[2.10.3] 2026-08-27

0.35.3

0.35.2

New Contributors

0.35.1

Fix auto-prepend file logic, mago freezes and Windows-specific PHPUnit tests filtering

New Contributors

0.34.2

PHPUnit 13.3.2

Fixed

Keep up to date with PHPUnit:

PHPUnit 13.3.1

Changed

Keep up to date with PHPUnit:

PHPUnit 13.3.0

Added

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants