Repair wp/6.3 branch Actions: Configure the Composer advisory policy - #83710

Part of #82930.

What?

Adds a config.policy.advisories.ignore-id block to composer.json, configuring Composer's security-advisory policy to ignore PKSA-mh9b-91zm-m1gy (CVE-2026-45293) for wp-coding-standards/wpcs. No version constraint changes; wp-coding-standards/wpcs stays at ^2.2.

Why?

Composer's default advisory policy refuses to install any package release covered by a known advisory, whether or not the vulnerable code path is reachable from the consuming project. On this branch that blocks every wp-coding-standards/wpcs release satisfying the existing ^2.2 requirement (2.2.0, 2.2.1, 2.3.0), so the PHP coding standards job fails at its "Install Composer dependencies" step:

Root composer.json requires wp-coding-standards/wpcs ^2.2, found wp-coding-standards/wpcs[2.2.0, 2.2.1, 2.3.0] but these were not loaded, because they are affected by security advisories ("PKSA-mh9b-91zm-m1gy").

CVE-2026-45293 is an eval()-injection bug in the WordPress.WP.EnqueuedResourceParameters sniff, which ships only in the WordPress and WordPress-Extra rulesets. This branch's phpcs.xml.dist pulls in WordPress-Core and WordPress-Docs plus a set of individually-named sniffs, and references neither of those two rulesets — so the vulnerable sniff is never loaded and the advisory cannot apply to this repository at any wp-coding-standards/wpcs version.

Expressing the exclusion as an explicit policy entry keeps the suppression narrow and auditable: exactly one advisory ID is ignored, the reason sits next to the ID in the file, and Composer keeps enforcing its default policy for everything else. Since wp/6.3 is a frozen maintenance branch that cannot simply move to a patched major, this block is also the natural place to record any further advisory that is demonstrably unreachable here.

Use of AI Tools

This PR was created by Claude Code under my supervision. All code should be treated as AI-produced and not yet reviewed by a human until this PR is marked Ready for Review.

🤖 Generated with Claude Code