Commit b9f577c6850 for woocommerce
commit b9f577c6850a73bbcd3d628a8eb4f66a18ffb4f0
Author: Ján Mikláš <neosinner@gmail.com>
Date: Tue Aug 11 10:24:19 2026 +0200
Resolve Dependabot alerts: trivial PHP bumps in the shared PHP packages (#67595)
* Update squizlabs/php_codesniffer to 3.13.6 in the shared PHP packages
Resolves GHSA-hmqg-cxww-wqhq (command injection in the gitblame report via
crafted filenames) for blueprint, email-editor, woocommerce-analytics and
woocommerce-subscriptions-engine. Dev-only tooling; no runtime code is
affected.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FzKh9uTzTKoJKq7ofWM89V
* Update composer/composer to 2.10.2 in the monorepo plugin
Resolves GHSA-499r-g7pc-vmp9, GHSA-g6xq-892h-64w3 and GHSA-gjfg-22fp-rrxx.
Also picks up squizlabs/php_codesniffer 3.13.6 in the same lock file.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FzKh9uTzTKoJKq7ofWM89V
* Add changelog entries for the shared PHP package updates
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FzKh9uTzTKoJKq7ofWM89V
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
diff --git a/packages/php/blueprint/changelog/update-php-dev-dependency-security-patches b/packages/php/blueprint/changelog/update-php-dev-dependency-security-patches
new file mode 100644
index 00000000000..f002b0c10a8
--- /dev/null
+++ b/packages/php/blueprint/changelog/update-php-dev-dependency-security-patches
@@ -0,0 +1,4 @@
+Significance: patch
+Type: dev
+
+Update PHP development dependencies to versions that resolve reported security advisories.
diff --git a/packages/php/blueprint/composer.lock b/packages/php/blueprint/composer.lock
index 629fdc6e333..9ca98eb4880 100644
--- a/packages/php/blueprint/composer.lock
+++ b/packages/php/blueprint/composer.lock
@@ -2670,16 +2670,16 @@
},
{
"name": "squizlabs/php_codesniffer",
- "version": "3.13.5",
+ "version": "3.13.6",
"source": {
"type": "git",
"url": "https://github.com/PHPCSStandards/PHP_CodeSniffer.git",
- "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4"
+ "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/0ca86845ce43291e8f5692c7356fccf3bcf02bf4",
- "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4",
+ "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
+ "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
"shasum": ""
},
"require": {
@@ -2745,7 +2745,7 @@
"type": "thanks_dev"
}
],
- "time": "2025-11-04T16:30:35+00:00"
+ "time": "2026-08-06T00:17:32+00:00"
},
{
"name": "symfony/console",
diff --git a/packages/php/email-editor/changelog/update-php-dev-dependency-security-patches b/packages/php/email-editor/changelog/update-php-dev-dependency-security-patches
new file mode 100644
index 00000000000..f002b0c10a8
--- /dev/null
+++ b/packages/php/email-editor/changelog/update-php-dev-dependency-security-patches
@@ -0,0 +1,4 @@
+Significance: patch
+Type: dev
+
+Update PHP development dependencies to versions that resolve reported security advisories.
diff --git a/packages/php/email-editor/composer.lock b/packages/php/email-editor/composer.lock
index 8d7866c97fc..9300b1b5f4c 100644
--- a/packages/php/email-editor/composer.lock
+++ b/packages/php/email-editor/composer.lock
@@ -4,7 +4,7 @@
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
"This file is @generated automatically"
],
- "content-hash": "b3ef2c389a180c69d7cdffad58c7e735",
+ "content-hash": "6c47722cb17980aef4dc5cb5425c9291",
"packages": [],
"packages-dev": [
{
@@ -2345,16 +2345,16 @@
},
{
"name": "squizlabs/php_codesniffer",
- "version": "3.13.5",
+ "version": "3.13.6",
"source": {
"type": "git",
"url": "https://github.com/PHPCSStandards/PHP_CodeSniffer.git",
- "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4"
+ "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/0ca86845ce43291e8f5692c7356fccf3bcf02bf4",
- "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4",
+ "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
+ "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
"shasum": ""
},
"require": {
@@ -2420,7 +2420,7 @@
"type": "thanks_dev"
}
],
- "time": "2025-11-04T16:30:35+00:00"
+ "time": "2026-08-06T00:17:32+00:00"
},
{
"name": "symfony/console",
diff --git a/packages/php/monorepo-plugin/composer.lock b/packages/php/monorepo-plugin/composer.lock
index 3b0f0460418..92951cdeb14 100644
--- a/packages/php/monorepo-plugin/composer.lock
+++ b/packages/php/monorepo-plugin/composer.lock
@@ -150,16 +150,16 @@
},
{
"name": "composer/composer",
- "version": "2.10.1",
+ "version": "2.10.2",
"source": {
"type": "git",
"url": "https://github.com/composer/composer.git",
- "reference": "4120703b9bda8795075047b40361d7ec4d2abe49"
+ "reference": "8d4439f572a97670a9edc039eb3b093cc976b4bc"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/composer/composer/zipball/4120703b9bda8795075047b40361d7ec4d2abe49",
- "reference": "4120703b9bda8795075047b40361d7ec4d2abe49",
+ "url": "https://api.github.com/repos/composer/composer/zipball/8d4439f572a97670a9edc039eb3b093cc976b4bc",
+ "reference": "8d4439f572a97670a9edc039eb3b093cc976b4bc",
"shasum": ""
},
"require": {
@@ -247,7 +247,7 @@
"irc": "ircs://irc.libera.chat:6697/composer",
"issues": "https://github.com/composer/composer/issues",
"security": "https://github.com/composer/composer/security/policy",
- "source": "https://github.com/composer/composer/tree/2.10.1"
+ "source": "https://github.com/composer/composer/tree/2.10.2"
},
"funding": [
{
@@ -259,7 +259,7 @@
"type": "github"
}
],
- "time": "2026-06-04T08:25:59+00:00"
+ "time": "2026-07-01T09:24:45+00:00"
},
{
"name": "composer/metadata-minifier",
@@ -1390,16 +1390,16 @@
},
{
"name": "squizlabs/php_codesniffer",
- "version": "3.13.5",
+ "version": "3.13.6",
"source": {
"type": "git",
"url": "https://github.com/PHPCSStandards/PHP_CodeSniffer.git",
- "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4"
+ "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/0ca86845ce43291e8f5692c7356fccf3bcf02bf4",
- "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4",
+ "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
+ "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
"shasum": ""
},
"require": {
@@ -1465,7 +1465,7 @@
"type": "thanks_dev"
}
],
- "time": "2025-11-04T16:30:35+00:00"
+ "time": "2026-08-06T00:17:32+00:00"
},
{
"name": "symfony/console",
diff --git a/packages/php/woocommerce-analytics/changelog/update-php-dev-dependency-security-patches b/packages/php/woocommerce-analytics/changelog/update-php-dev-dependency-security-patches
new file mode 100644
index 00000000000..05cf60875ee
--- /dev/null
+++ b/packages/php/woocommerce-analytics/changelog/update-php-dev-dependency-security-patches
@@ -0,0 +1,4 @@
+Significance: patch
+Type: changed
+
+Update PHP development dependencies to versions that resolve reported security advisories.
diff --git a/packages/php/woocommerce-analytics/composer.lock b/packages/php/woocommerce-analytics/composer.lock
index a316eaf7eee..149bea2bc85 100644
--- a/packages/php/woocommerce-analytics/composer.lock
+++ b/packages/php/woocommerce-analytics/composer.lock
@@ -3134,16 +3134,16 @@
},
{
"name": "squizlabs/php_codesniffer",
- "version": "3.13.5",
+ "version": "3.13.6",
"source": {
"type": "git",
"url": "https://github.com/PHPCSStandards/PHP_CodeSniffer.git",
- "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4"
+ "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/0ca86845ce43291e8f5692c7356fccf3bcf02bf4",
- "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4",
+ "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
+ "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
"shasum": ""
},
"require": {
@@ -3209,7 +3209,7 @@
"type": "thanks_dev"
}
],
- "time": "2025-11-04T16:30:35+00:00"
+ "time": "2026-08-06T00:17:32+00:00"
},
{
"name": "symfony/console",
diff --git a/packages/php/woocommerce-subscriptions-engine/changelog/update-php-dev-dependency-security-patches b/packages/php/woocommerce-subscriptions-engine/changelog/update-php-dev-dependency-security-patches
new file mode 100644
index 00000000000..f002b0c10a8
--- /dev/null
+++ b/packages/php/woocommerce-subscriptions-engine/changelog/update-php-dev-dependency-security-patches
@@ -0,0 +1,4 @@
+Significance: patch
+Type: dev
+
+Update PHP development dependencies to versions that resolve reported security advisories.
diff --git a/packages/php/woocommerce-subscriptions-engine/composer.lock b/packages/php/woocommerce-subscriptions-engine/composer.lock
index 5e481a26703..7fdfe6eef29 100644
--- a/packages/php/woocommerce-subscriptions-engine/composer.lock
+++ b/packages/php/woocommerce-subscriptions-engine/composer.lock
@@ -2345,16 +2345,16 @@
},
{
"name": "squizlabs/php_codesniffer",
- "version": "3.13.5",
+ "version": "3.13.6",
"source": {
"type": "git",
"url": "https://github.com/PHPCSStandards/PHP_CodeSniffer.git",
- "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4"
+ "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/0ca86845ce43291e8f5692c7356fccf3bcf02bf4",
- "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4",
+ "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
+ "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
"shasum": ""
},
"require": {
@@ -2420,7 +2420,7 @@
"type": "thanks_dev"
}
],
- "time": "2025-11-04T16:30:35+00:00"
+ "time": "2026-08-06T00:17:32+00:00"
},
{
"name": "symfony/console",