Commit bc0a45a7db for wordpress.org

commit bc0a45a7dbc280413b350d2a37cbdd11ceee2758
Author: johnbillion <johnbillion@git.wordpress.org>
Date:   Fri Nov 13 01:29:55 2026 +0000

    Security: Mark two more Secrets API parameters as sensitive.

    Follow-up to r64337, r65375.

    See #66187, #66414.

    Built from https://develop.svn.wordpress.org/trunk@65466


    git-svn-id: http://core.svn.wordpress.org/trunk@64587 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/secrets/class-wp-secret.php b/wp-includes/secrets/class-wp-secret.php
index d8db880ef3..7c236cdaa5 100644
--- a/wp-includes/secrets/class-wp-secret.php
+++ b/wp-includes/secrets/class-wp-secret.php
@@ -97,7 +97,12 @@ final class WP_Secret implements JsonSerializable {
 	 * @throws InvalidArgumentException If $name or $fingerprint is empty, or if $value
 	 *                                  is not a string. $value may be empty.
 	 */
-	public function __construct( string $name, $value, string $fingerprint ) {
+	public function __construct(
+		string $name,
+		#[\SensitiveParameter]
+		$value,
+		string $fingerprint
+	) {
 		if ( '' === $name ) {
 			throw new InvalidArgumentException( 'WP_Secret requires a non-empty name.' );
 		}
diff --git a/wp-includes/secrets/class-wp-secrets-cipher.php b/wp-includes/secrets/class-wp-secrets-cipher.php
index 4880d02317..ccc88b7c95 100644
--- a/wp-includes/secrets/class-wp-secrets-cipher.php
+++ b/wp-includes/secrets/class-wp-secrets-cipher.php
@@ -314,7 +314,14 @@ final class WP_Secrets_Cipher {
 	 * @phpstan-param 'site'|'network' $scope
 	 * @phpstan-param WP_Secret_Version::CURRENT|WP_Secret_Version::PREVIOUS $slot
 	 */
-	private function validate_common( string $master_key, string $scope, int $site_id, string $name, string $slot ) {
+	private function validate_common(
+		#[\SensitiveParameter]
+		string $master_key,
+		string $scope,
+		int $site_id,
+		string $name,
+		string $slot
+	) {
 		if ( ! in_array( $scope, array( 'site', 'network' ), true ) ) {
 			return $this->invalid_argument( __( 'The scope must be "site" or "network".' ) );
 		}
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 678dabf44d..a0516139f7 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-beta5-65465';
+$wp_version = '7.2-beta5-65466';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.