Commit 83981bf177 for wordpress.org

commit 83981bf17765cb841e789f8073de423f6450c2a2
Author: westonruter <westonruter@git.wordpress.org>
Date:   Thu Oct 22 22:48:55 2026 +0000

    Formatting: Document `sanitize_key()` as accepting `mixed`.

    Since a non-scalar key was made to yield an empty string in r52292 and non-string scalars were again coerced to a string in r52370, `sanitize_key()` handles values of any type, and its tests cover this. Most of its callers pass raw request data or REST parameters, which are untyped, so documenting `$key` as a `string` caused PHPStan to report an error at nearly every call site.

    The `sanitize_key` filter is updated to match, as it receives the original key, and its sanitized key is now typed as a lowercase string so that the result of `apply_filters()` agrees with the function's return type. The cast to `string` before `strtolower()` makes the existing coercion explicit without changing behavior. Tests are added for additional non-string types and for the arguments passed to the filter.

    This resolves 50 PHPStan errors at rule level 10.

    Developed in https://github.com/WordPress/wordpress-develop/pull/14759.
    Follow-up to r13718, r52292, r52370.

    See #54160, #65817.

    Built from https://develop.svn.wordpress.org/trunk@64682


    git-svn-id: http://core.svn.wordpress.org/trunk@63832 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php
index d261721d70..ecae45083a 100644
--- a/wp-includes/formatting.php
+++ b/wp-includes/formatting.php
@@ -2187,7 +2187,7 @@ function sanitize_user( $username, $strict = false ) {
  *
  * @since 3.0.0
  *
- * @param string $key String key.
+ * @param mixed $key String key. Other scalars are cast to a string; any other type yields an empty string.
  * @return string Sanitized key.
  * @phpstan-return lowercase-string
  */
@@ -2195,7 +2195,7 @@ function sanitize_key( $key ) {
 	$sanitized_key = '';

 	if ( is_scalar( $key ) ) {
-		$sanitized_key = strtolower( $key );
+		$sanitized_key = strtolower( (string) $key );
 		$sanitized_key = preg_replace( '/[^a-z0-9_\-]/', '', $sanitized_key );
 	}

@@ -2205,7 +2205,8 @@ function sanitize_key( $key ) {
 	 * @since 3.0.0
 	 *
 	 * @param string $sanitized_key Sanitized key.
-	 * @param string $key           The key prior to sanitization.
+	 * @param mixed  $key           The key prior to sanitization.
+	 * @phpstan-param lowercase-string $sanitized_key
 	 */
 	return apply_filters( 'sanitize_key', $sanitized_key, $key );
 }
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 1040f6eb96..7d9e3aa80e 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-beta1-64681';
+$wp_version = '7.2-beta1-64682';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.