Commit d5721d514e0 for woocommerce

commit d5721d514e011020cedd7ae46326a1ec8763ce55
Author: Darren Ethier <darren@roughsmootheng.in>
Date:   Fri Aug 21 11:09:17 2026 -0400

    Document settings request boundaries (#67894)

diff --git a/plugins/woocommerce/changelog/dev-settings-request-boundary-suppressions b/plugins/woocommerce/changelog/dev-settings-request-boundary-suppressions
new file mode 100644
index 00000000000..43d65e7015b
--- /dev/null
+++ b/plugins/woocommerce/changelog/dev-settings-request-boundary-suppressions
@@ -0,0 +1,4 @@
+Significance: patch
+Type: dev
+
+Document intentional raw-data boundaries in the settings APIs with exact coding-standard annotations.
diff --git a/plugins/woocommerce/includes/abstracts/abstract-wc-settings-api.php b/plugins/woocommerce/includes/abstracts/abstract-wc-settings-api.php
index 08459bf8a8e..f1b1b648fd1 100644
--- a/plugins/woocommerce/includes/abstracts/abstract-wc-settings-api.php
+++ b/plugins/woocommerce/includes/abstracts/abstract-wc-settings-api.php
@@ -137,7 +137,7 @@ abstract class WC_Settings_API {
 	public function get_field_value( $key, $field, $post_data = array() ) {
 		$type      = $this->get_field_type( $field );
 		$field_key = $this->get_field_key( $key );
-		$post_data = empty( $post_data ) ? $_POST : $post_data; // WPCS: CSRF ok, input var ok.
+		$post_data = empty( $post_data ) ? $_POST : $post_data; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Raw settings values are passed to field-specific validators; authorization belongs to the caller.
 		$value     = isset( $post_data[ $field_key ] ) ? $post_data[ $field_key ] : null;

 		if ( isset( $field['sanitize_callback'] ) && is_callable( $field['sanitize_callback'] ) ) {
@@ -176,7 +176,7 @@ abstract class WC_Settings_API {
 		if ( ! empty( $this->data ) && is_array( $this->data ) ) {
 			return $this->data;
 		}
-		return $_POST; // WPCS: CSRF ok, input var ok.
+		return $_POST; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Raw settings values are returned for field-specific validation; authorization belongs to the caller.
 	}

 	/**
diff --git a/plugins/woocommerce/includes/admin/class-wc-admin-settings.php b/plugins/woocommerce/includes/admin/class-wc-admin-settings.php
index a4299f990df..1be87edd6d3 100644
--- a/plugins/woocommerce/includes/admin/class-wc-admin-settings.php
+++ b/plugins/woocommerce/includes/admin/class-wc-admin-settings.php
@@ -932,7 +932,7 @@ if ( ! class_exists( 'WC_Admin_Settings', false ) ) :
 		 */
 		public static function save_fields( $options, $data = null ) {
 			if ( is_null( $data ) ) {
-				$data = $_POST; // WPCS: input var okay, CSRF ok.
+				$data = $_POST; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Values are unslashed and sanitized by declared field type below; authorization belongs to the caller.
 			}
 			if ( empty( $data ) ) {
 				return false;