Repository navigation
Repair wp/6.3 branch Actions: Configure Composer policy to ignore irrelevant advisories - #434
Closed
desrosj wants to merge 1 commit into
Conversation
desrosj
added this pull request to stack #436
September 21, 2026 23:51
desrosj
removed this pull request from stack #436
September 22, 2026 15:45
desrosj
changed the base branch from
fix-actions-6.3/remove-mobile-unit-js-job
to
wp/6.3
September 22, 2026 15:46
desrosj
changed the base branch from
wp/6.3
to
fix-actions-6.3/pin-wp-env-core-version
September 22, 2026 15:49
desrosj
added this pull request to stack #459
September 22, 2026 15:49
desrosj
force-pushed
the
fix-actions-6.3/configure-composer-advisory-policy
branch
from
September 22, 2026 15:51
aec0ed0 to
5233b20
Compare
desrosj
removed this pull request from stack #459
September 22, 2026 20:16
desrosj
changed the base branch from
fix-actions-6.3/pin-wp-env-core-version
to
wp/6.3
September 22, 2026 20:16
desrosj
force-pushed
the
fix-actions-6.3/configure-composer-advisory-policy
branch
from
September 22, 2026 20:18
5233b20 to
b0d9b99
Compare
desrosj
changed the base branch from
wp/6.3
to
fix-actions-6.3/pin-wp-env-core-version
September 22, 2026 20:20
desrosj
added this pull request to stack #477
September 22, 2026 20:20
desrosj
removed this pull request from stack #477
September 23, 2026 01:30
desrosj
changed the base branch from
fix-actions-6.3/pin-wp-env-core-version
to
wp/6.3
September 23, 2026 01:31
desrosj
force-pushed
the
fix-actions-6.3/configure-composer-advisory-policy
branch
from
September 23, 2026 01:40
b0d9b99 to
fbc5796
Compare
desrosj
changed the base branch from
wp/6.3
to
fix-actions-6.3/pin-wp-env-core-version
September 23, 2026 01:41
desrosj
added this pull request to stack #486
September 23, 2026 01:41
desrosj
removed this pull request from stack #486
September 24, 2026 17:11
desrosj
changed the base branch from
fix-actions-6.3/pin-wp-env-core-version
to
wp/6.3
September 24, 2026 17:11
desrosj
force-pushed
the
fix-actions-6.3/configure-composer-advisory-policy
branch
from
September 24, 2026 17:12
fbc5796 to
8acdcee
Compare
desrosj
changed the base branch from
wp/6.3
to
fix-actions-6.3/fix-composer-platform-override
September 24, 2026 17:13
desrosj
added this pull request to stack #511
September 24, 2026 17:15
desrosj
removed this pull request from stack #511
September 24, 2026 17:44
desrosj
changed the base branch from
fix-actions-6.3/fix-composer-platform-override
to
wp/6.3
September 24, 2026 17:44
desrosj
force-pushed
the
fix-actions-6.3/configure-composer-advisory-policy
branch
from
September 24, 2026 17:45
8acdcee to
492c6cd
Compare
desrosj
changed the base branch from
wp/6.3
to
fix-actions-6.3/fix-composer-platform-override
September 24, 2026 17:45
desrosj
added this pull request to stack #515
September 24, 2026 17:45
desrosj
removed this pull request from stack #515
September 28, 2026 14:31
desrosj
added this pull request to stack #537
September 28, 2026 14:32
desrosj
removed this pull request from stack #537
September 28, 2026 15:24
desrosj
added this pull request to stack #552
September 28, 2026 15:25
desrosj
removed this pull request from stack #552
September 28, 2026 18:41
desrosj
changed the base branch from
fix-actions-6.3/fix-composer-platform-override
to
wp/6.3
September 28, 2026 18:43
desrosj
changed the base branch from
wp/6.3
to
fix-actions-6.3/fix-composer-platform-override
September 28, 2026 18:46
desrosj
added this pull request to stack #563
September 28, 2026 18:46
Composer's default security policy refuses to install any package release covered by a known advisory, even when the vulnerable code path cannot be reached from this repository. That blocks every `wp-coding-standards/wpcs` release satisfying the existing `^2.2` requirement (`2.2.0`, `2.2.1`, `2.3.0`), so the `PHP coding standards` job fails while installing Composer dependencies: "Root composer.json requires wp-coding-standards/wpcs ^2.2, found wp-coding-standards/wpcs[2.2.0, 2.2.1, 2.3.0] but these were not loaded, because they are affected by security advisories." The advisory in question, `PKSA-mh9b-91zm-m1gy` (CVE-2026-45293), is an `eval()`-injection bug in the `WordPress.WP.EnqueuedResourceParameters` sniff, which ships only in the `WordPress` and `WordPress-Extra` rulesets. `phpcs.xml.dist` uses `WordPress-Core` and `WordPress-Docs` plus a handful of individually-named sniffs, never those two rulesets, so the vulnerable sniff is never loaded and the advisory cannot apply here. Adds a `config.policy.advisories.ignore-id` block to `composer.json` listing that advisory ID together with the reason it does not apply, so dependency resolution succeeds again without relaxing any version constraint. The block is the place to record any future advisory that is likewise unreachable on this branch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DtSAAJkQ9P6vPtDumqStg8
desrosj
removed this pull request from stack #563
September 28, 2026 19:03
desrosj
changed the base branch from
fix-actions-6.3/fix-composer-platform-override
to
wp/6.3
September 28, 2026 19:03
desrosj
force-pushed
the
fix-actions-6.3/configure-composer-advisory-policy
branch
from
September 28, 2026 19:03
492c6cd to
fbc2c5a
Compare
desrosj
changed the base branch from
wp/6.3
to
fix-actions-6.3/fix-composer-platform-override
September 28, 2026 19:04
desrosj
added this pull request to stack #566
September 28, 2026 19:04
desrosj
marked this pull request as ready for review
September 28, 2026 19:17
Owner
Author
|
Moved to WordPress#83710. The branch is left in place. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What?
Adds a
config.policy.advisories.ignore-idblock tocomposer.json, configuring Composer's security-advisory policy to ignorePKSA-mh9b-91zm-m1gy(CVE-2026-45293) forwp-coding-standards/wpcs. No version constraint changes;wp-coding-standards/wpcsstays at^2.2.Why?
Composer's default advisory policy refuses to install any package release covered by a known advisory, whether or not the vulnerable code path is reachable from the consuming project. On this branch that blocks every
wp-coding-standards/wpcsrelease satisfying the existing^2.2requirement (2.2.0,2.2.1,2.3.0), so thePHP coding standardsjob fails at its "Install Composer dependencies" step:CVE-2026-45293 is an
eval()-injection bug in theWordPress.WP.EnqueuedResourceParameterssniff, which ships only in theWordPressandWordPress-Extrarulesets. This branch'sphpcs.xml.distpulls inWordPress-CoreandWordPress-Docsplus a set of individually-named sniffs, and references neither of those two rulesets — so the vulnerable sniff is never loaded and the advisory cannot apply to this repository at anywp-coding-standards/wpcsversion.Expressing the exclusion as an explicit policy entry keeps the suppression narrow and auditable: exactly one advisory ID is ignored, the reason sits next to the ID in the file, and Composer keeps enforcing its default policy for everything else. Since
wp/6.3is a frozen maintenance branch that cannot simply move to a patched major, this block is also the natural place to record any further advisory that is demonstrably unreachable here.Use of AI Tools
This PR was created by Claude Code under my supervision. All code should be treated as AI-produced and not yet reviewed by a human until this PR is marked Ready for Review.
🤖 Generated with Claude Code