Skip to content

Repair wp/5.7 branch Actions: Configure the Composer advisory policy - #84778

Open
desrosj wants to merge 1 commit into
fix-actions-5.7/fix-php-matrix-wp-env-compatfrom
fix-actions-5.7/configure-composer-advisory-policy
Open

Repair wp/5.7 branch Actions: Configure the Composer advisory policy#84778
desrosj wants to merge 1 commit into
fix-actions-5.7/fix-php-matrix-wp-env-compatfrom
fix-actions-5.7/configure-composer-advisory-policy

Conversation

@desrosj

@desrosj desrosj commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Part of #82936.

What?

Adds a config.policy.advisories.ignore-id entry to composer.json for PKSA-mh9b-91zm-m1gy. The entry's description explains why the advisory doesn't apply here.

Why?

Composer 2.10 won't load a package version that has a security advisory against it. Every wp-coding-standards/wpcs release matching this branch's ^2.2 constraint is covered by PKSA-mh9b-91zm-m1gy, so any command that resolves dependencies fails:

wp-coding-standards/wpcs[2.2.0, 2.2.1, 2.3.0] but these were not loaded, because they are affected by security advisories ("PKSA-mh9b-91zm-m1gy").

That includes the composer require run by #84774's Install a PHPUnit release this PHP version can load step, and a local composer update.

The advisory (CVE-2026-45293) is in the WordPress.WP.EnqueuedResourceParameters sniff, which only ships in the WordPress and WordPress-Extra rulesets. This branch's phpcs.xml.dist uses WordPress-Core and WordPress-Docs, so the vulnerable sniff never loads.

Testing Instructions

With Composer 2.10.3, composer update exits 2 on this advisory without this change, and 0 with it. No other advisory blocks resolution.

Use of AI Tools

This PR was created by Claude Code under my supervision. All code should be treated as AI-produced and not yet reviewed by a human until this PR is marked Ready for Review.

🤖 Generated with Claude Code

@desrosj desrosj added [Type] Build Tooling Issues or PRs related to build tooling [Tool] Env /packages/env labels Oct 15, 2026
@desrosj desrosj self-assigned this Oct 15, 2026
@github-actions github-actions Bot removed the [Tool] Env /packages/env label Oct 15, 2026
@coderabbitai

coderabbitai Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 4e578490-703e-4561-a89a-68f5201ef7d0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@desrosj
desrosj added this pull request to stack #84797 October 15, 2026 03:46
This was referenced Oct 15, 2026
Open
Closed
Open
@desrosj
desrosj marked this pull request as ready for review October 15, 2026 19:08
@github-actions

github-actions Bot commented Oct 15, 2026

Copy link
Copy Markdown

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: desrosj <desrosj@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@desrosj
desrosj removed this pull request from stack #84797 October 16, 2026 00:33
@desrosj
desrosj added this pull request to stack #84872 October 16, 2026 00:34
@desrosj
desrosj removed this pull request from stack #84872 October 16, 2026 15:52
@desrosj
desrosj force-pushed the fix-actions-5.7/configure-composer-advisory-policy branch from 6696c60 to 87fe370 Compare October 16, 2026 15:52
@desrosj
desrosj added this pull request to stack #84945 October 16, 2026 15:53
@desrosj desrosj changed the title Repair wp/5.7 branch Actions: Configure Composer policy to ignore an irrelevant advisory Repair wp/5.7 branch Actions: Configure the Composer advisory policy Oct 16, 2026
@desrosj
desrosj force-pushed the fix-actions-5.7/configure-composer-advisory-policy branch from 87fe370 to 7264486 Compare October 19, 2026 17:09
@desrosj
desrosj removed this pull request from stack #84945 October 21, 2026 19:48
@desrosj
desrosj added this pull request to stack #85354 October 21, 2026 19:48
@desrosj
desrosj force-pushed the fix-actions-5.7/configure-composer-advisory-policy branch from 7264486 to d812faa Compare October 23, 2026 13:59
ntsekouras
ntsekouras approved these changes Oct 24, 2026
View reviewed changes

@ntsekouras ntsekouras left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ntsekouras ntsekouras ntsekouras approved these changes

Assignees

@desrosj desrosj

Labels

[Type] Build Tooling Issues or PRs related to build tooling

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@desrosj @ntsekouras