Commit e6e5f581de3 for woocommerce
commit e6e5f581de3ee51833a92b556fa51b3e25cd46d0
Author: Ján Mikláš <neosinner@gmail.com>
Date: Tue Aug 11 10:24:19 2026 +0200
Resolve Dependabot alerts: trivial PHP bumps in the WooCommerce plugin (#67603)
* Update squizlabs/php_codesniffer to 3.13.6 in the plugin lock files
Resolves GHSA-hmqg-cxww-wqhq (command injection in the gitblame report via
crafted filenames) for the WooCommerce plugin's phpcs bin dependency and the
beta tester. Dev-only tooling; no runtime code is affected.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FzKh9uTzTKoJKq7ofWM89V
* Update PHPUnit and Symfony dev dependencies to patched versions
PHPUnit 9.6.29 to 9.6.35 (GHSA-vvj3-c3rp-c85p), symfony/process 5.4.47 to
5.4.51 (GHSA-qq5c-677p-737q, GHSA-r39x-jcww-82v6) and symfony/yaml 5.4.45
to 5.4.53 (GHSA-4qpc-3hr4-r2p4, GHSA-9frc-8383-795m, GHSA-c2p3-7m5p-cv8x).
sebastian/comparator moves to 4.0.10 because PHPUnit 9.6.33+ requires it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FzKh9uTzTKoJKq7ofWM89V
* Add changelog entries for the plugin dependency updates
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FzKh9uTzTKoJKq7ofWM89V
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
diff --git a/plugins/woocommerce-beta-tester/changelog/update-php-dev-dependency-security-patches b/plugins/woocommerce-beta-tester/changelog/update-php-dev-dependency-security-patches
new file mode 100644
index 00000000000..f002b0c10a8
--- /dev/null
+++ b/plugins/woocommerce-beta-tester/changelog/update-php-dev-dependency-security-patches
@@ -0,0 +1,4 @@
+Significance: patch
+Type: dev
+
+Update PHP development dependencies to versions that resolve reported security advisories.
diff --git a/plugins/woocommerce-beta-tester/composer.lock b/plugins/woocommerce-beta-tester/composer.lock
index 0422e2b5b87..ed70d156b5f 100644
--- a/plugins/woocommerce-beta-tester/composer.lock
+++ b/plugins/woocommerce-beta-tester/composer.lock
@@ -2300,16 +2300,16 @@
},
{
"name": "squizlabs/php_codesniffer",
- "version": "3.13.5",
+ "version": "3.13.6",
"source": {
"type": "git",
"url": "https://github.com/PHPCSStandards/PHP_CodeSniffer.git",
- "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4"
+ "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/0ca86845ce43291e8f5692c7356fccf3bcf02bf4",
- "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4",
+ "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
+ "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
"shasum": ""
},
"require": {
@@ -2375,7 +2375,7 @@
"type": "thanks_dev"
}
],
- "time": "2025-11-04T16:30:35+00:00"
+ "time": "2026-08-06T00:17:32+00:00"
},
{
"name": "symfony/console",
diff --git a/plugins/woocommerce/bin/composer/phpcs/composer.lock b/plugins/woocommerce/bin/composer/phpcs/composer.lock
index 395e9be0b34..b789002045c 100644
--- a/plugins/woocommerce/bin/composer/phpcs/composer.lock
+++ b/plugins/woocommerce/bin/composer/phpcs/composer.lock
@@ -693,16 +693,16 @@
},
{
"name": "squizlabs/php_codesniffer",
- "version": "3.13.5",
+ "version": "3.13.6",
"source": {
"type": "git",
"url": "https://github.com/PHPCSStandards/PHP_CodeSniffer.git",
- "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4"
+ "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/0ca86845ce43291e8f5692c7356fccf3bcf02bf4",
- "reference": "0ca86845ce43291e8f5692c7356fccf3bcf02bf4",
+ "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
+ "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
"shasum": ""
},
"require": {
@@ -768,7 +768,7 @@
"type": "thanks_dev"
}
],
- "time": "2025-11-04T16:30:35+00:00"
+ "time": "2026-08-06T00:17:32+00:00"
},
{
"name": "woocommerce/woocommerce-sniffs",
diff --git a/plugins/woocommerce/bin/composer/phpunit/composer.lock b/plugins/woocommerce/bin/composer/phpunit/composer.lock
index cbbeec43de7..7b75df1ce66 100644
--- a/plugins/woocommerce/bin/composer/phpunit/composer.lock
+++ b/plugins/woocommerce/bin/composer/phpunit/composer.lock
@@ -634,25 +634,25 @@
},
{
"name": "phpunit/phpunit",
- "version": "9.6.29",
+ "version": "9.6.35",
"source": {
"type": "git",
"url": "https://github.com/sebastianbergmann/phpunit.git",
- "reference": "9ecfec57835a5581bc888ea7e13b51eb55ab9dd3"
+ "reference": "0edba2f3a0c48df3553cb9b640810b30df60302b"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/9ecfec57835a5581bc888ea7e13b51eb55ab9dd3",
- "reference": "9ecfec57835a5581bc888ea7e13b51eb55ab9dd3",
+ "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/0edba2f3a0c48df3553cb9b640810b30df60302b",
+ "reference": "0edba2f3a0c48df3553cb9b640810b30df60302b",
"shasum": ""
},
"require": {
"doctrine/instantiator": "^1.5.0 || ^2",
"ext-dom": "*",
+ "ext-filter": "*",
"ext-json": "*",
"ext-libxml": "*",
"ext-mbstring": "*",
- "ext-xml": "*",
"ext-xmlwriter": "*",
"myclabs/deep-copy": "^1.13.4",
"phar-io/manifest": "^2.0.4",
@@ -665,7 +665,7 @@
"phpunit/php-timer": "^5.0.3",
"sebastian/cli-parser": "^1.0.2",
"sebastian/code-unit": "^1.0.8",
- "sebastian/comparator": "^4.0.9",
+ "sebastian/comparator": "^4.0.10",
"sebastian/diff": "^4.0.6",
"sebastian/environment": "^5.1.5",
"sebastian/exporter": "^4.0.8",
@@ -717,31 +717,15 @@
"support": {
"issues": "https://github.com/sebastianbergmann/phpunit/issues",
"security": "https://github.com/sebastianbergmann/phpunit/security/policy",
- "source": "https://github.com/sebastianbergmann/phpunit/tree/9.6.29"
+ "source": "https://github.com/sebastianbergmann/phpunit/tree/9.6.35"
},
"funding": [
{
- "url": "https://phpunit.de/sponsors.html",
- "type": "custom"
- },
- {
- "url": "https://github.com/sebastianbergmann",
- "type": "github"
- },
- {
- "url": "https://liberapay.com/sebastianbergmann",
- "type": "liberapay"
- },
- {
- "url": "https://thanks.dev/u/gh/sebastianbergmann",
- "type": "thanks_dev"
- },
- {
- "url": "https://tidelift.com/funding/github/packagist/phpunit/phpunit",
- "type": "tidelift"
+ "url": "https://phpunit.de/sponsoring.html",
+ "type": "other"
}
],
- "time": "2025-09-24T06:29:11+00:00"
+ "time": "2026-07-06T14:48:07+00:00"
},
{
"name": "sebastian/cli-parser",
@@ -912,16 +896,16 @@
},
{
"name": "sebastian/comparator",
- "version": "4.0.9",
+ "version": "4.0.10",
"source": {
"type": "git",
"url": "https://github.com/sebastianbergmann/comparator.git",
- "reference": "67a2df3a62639eab2cc5906065e9805d4fd5dfc5"
+ "reference": "e4df00b9b3571187db2831ae9aada2c6efbd715d"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/67a2df3a62639eab2cc5906065e9805d4fd5dfc5",
- "reference": "67a2df3a62639eab2cc5906065e9805d4fd5dfc5",
+ "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/e4df00b9b3571187db2831ae9aada2c6efbd715d",
+ "reference": "e4df00b9b3571187db2831ae9aada2c6efbd715d",
"shasum": ""
},
"require": {
@@ -974,7 +958,7 @@
],
"support": {
"issues": "https://github.com/sebastianbergmann/comparator/issues",
- "source": "https://github.com/sebastianbergmann/comparator/tree/4.0.9"
+ "source": "https://github.com/sebastianbergmann/comparator/tree/4.0.10"
},
"funding": [
{
@@ -994,7 +978,7 @@
"type": "tidelift"
}
],
- "time": "2025-08-10T06:51:50+00:00"
+ "time": "2026-01-24T09:22:56+00:00"
},
{
"name": "sebastian/complexity",
diff --git a/plugins/woocommerce/changelog/update-php-dev-dependency-security-patches b/plugins/woocommerce/changelog/update-php-dev-dependency-security-patches
new file mode 100644
index 00000000000..f002b0c10a8
--- /dev/null
+++ b/plugins/woocommerce/changelog/update-php-dev-dependency-security-patches
@@ -0,0 +1,4 @@
+Significance: patch
+Type: dev
+
+Update PHP development dependencies to versions that resolve reported security advisories.
diff --git a/plugins/woocommerce/client/admin/composer.lock b/plugins/woocommerce/client/admin/composer.lock
index b2b437cd0f3..a8443a03096 100644
--- a/plugins/woocommerce/client/admin/composer.lock
+++ b/plugins/woocommerce/client/admin/composer.lock
@@ -779,16 +779,16 @@
},
{
"name": "symfony/process",
- "version": "v5.4.47",
+ "version": "v5.4.51",
"source": {
"type": "git",
"url": "https://github.com/symfony/process.git",
- "reference": "5d1662fb32ebc94f17ddb8d635454a776066733d"
+ "reference": "467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/process/zipball/5d1662fb32ebc94f17ddb8d635454a776066733d",
- "reference": "5d1662fb32ebc94f17ddb8d635454a776066733d",
+ "url": "https://api.github.com/repos/symfony/process/zipball/467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f",
+ "reference": "467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f",
"shasum": ""
},
"require": {
@@ -821,7 +821,7 @@
"description": "Executes commands in sub-processes",
"homepage": "https://symfony.com",
"support": {
- "source": "https://github.com/symfony/process/tree/v5.4.47"
+ "source": "https://github.com/symfony/process/tree/v5.4.51"
},
"funding": [
{
@@ -832,12 +832,16 @@
"url": "https://github.com/fabpot",
"type": "github"
},
+ {
+ "url": "https://github.com/nicolas-grekas",
+ "type": "github"
+ },
{
"url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
"type": "tidelift"
}
],
- "time": "2024-11-06T11:36:42+00:00"
+ "time": "2026-01-26T15:53:37+00:00"
},
{
"name": "symfony/service-contracts",
@@ -1074,5 +1078,5 @@
"platform-overrides": {
"php": "7.4"
},
- "plugin-api-version": "2.6.0"
+ "plugin-api-version": "2.9.0"
}
diff --git a/plugins/woocommerce/composer.lock b/plugins/woocommerce/composer.lock
index 181d16f90d9..bdf683b943d 100644
--- a/plugins/woocommerce/composer.lock
+++ b/plugins/woocommerce/composer.lock
@@ -2852,25 +2852,25 @@
},
{
"name": "phpunit/phpunit",
- "version": "9.6.29",
+ "version": "9.6.35",
"source": {
"type": "git",
"url": "https://github.com/sebastianbergmann/phpunit.git",
- "reference": "9ecfec57835a5581bc888ea7e13b51eb55ab9dd3"
+ "reference": "0edba2f3a0c48df3553cb9b640810b30df60302b"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/9ecfec57835a5581bc888ea7e13b51eb55ab9dd3",
- "reference": "9ecfec57835a5581bc888ea7e13b51eb55ab9dd3",
+ "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/0edba2f3a0c48df3553cb9b640810b30df60302b",
+ "reference": "0edba2f3a0c48df3553cb9b640810b30df60302b",
"shasum": ""
},
"require": {
"doctrine/instantiator": "^1.5.0 || ^2",
"ext-dom": "*",
+ "ext-filter": "*",
"ext-json": "*",
"ext-libxml": "*",
"ext-mbstring": "*",
- "ext-xml": "*",
"ext-xmlwriter": "*",
"myclabs/deep-copy": "^1.13.4",
"phar-io/manifest": "^2.0.4",
@@ -2883,7 +2883,7 @@
"phpunit/php-timer": "^5.0.3",
"sebastian/cli-parser": "^1.0.2",
"sebastian/code-unit": "^1.0.8",
- "sebastian/comparator": "^4.0.9",
+ "sebastian/comparator": "^4.0.10",
"sebastian/diff": "^4.0.6",
"sebastian/environment": "^5.1.5",
"sebastian/exporter": "^4.0.8",
@@ -2935,31 +2935,15 @@
"support": {
"issues": "https://github.com/sebastianbergmann/phpunit/issues",
"security": "https://github.com/sebastianbergmann/phpunit/security/policy",
- "source": "https://github.com/sebastianbergmann/phpunit/tree/9.6.29"
+ "source": "https://github.com/sebastianbergmann/phpunit/tree/9.6.35"
},
"funding": [
{
- "url": "https://phpunit.de/sponsors.html",
- "type": "custom"
- },
- {
- "url": "https://github.com/sebastianbergmann",
- "type": "github"
- },
- {
- "url": "https://liberapay.com/sebastianbergmann",
- "type": "liberapay"
- },
- {
- "url": "https://thanks.dev/u/gh/sebastianbergmann",
- "type": "thanks_dev"
- },
- {
- "url": "https://tidelift.com/funding/github/packagist/phpunit/phpunit",
- "type": "tidelift"
+ "url": "https://phpunit.de/sponsoring.html",
+ "type": "other"
}
],
- "time": "2025-09-24T06:29:11+00:00"
+ "time": "2026-07-06T14:48:07+00:00"
},
{
"name": "psr/container",
@@ -3328,16 +3312,16 @@
},
{
"name": "sebastian/comparator",
- "version": "4.0.9",
+ "version": "4.0.10",
"source": {
"type": "git",
"url": "https://github.com/sebastianbergmann/comparator.git",
- "reference": "67a2df3a62639eab2cc5906065e9805d4fd5dfc5"
+ "reference": "e4df00b9b3571187db2831ae9aada2c6efbd715d"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/67a2df3a62639eab2cc5906065e9805d4fd5dfc5",
- "reference": "67a2df3a62639eab2cc5906065e9805d4fd5dfc5",
+ "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/e4df00b9b3571187db2831ae9aada2c6efbd715d",
+ "reference": "e4df00b9b3571187db2831ae9aada2c6efbd715d",
"shasum": ""
},
"require": {
@@ -3390,7 +3374,7 @@
],
"support": {
"issues": "https://github.com/sebastianbergmann/comparator/issues",
- "source": "https://github.com/sebastianbergmann/comparator/tree/4.0.9"
+ "source": "https://github.com/sebastianbergmann/comparator/tree/4.0.10"
},
"funding": [
{
@@ -3410,7 +3394,7 @@
"type": "tidelift"
}
],
- "time": "2025-08-10T06:51:50+00:00"
+ "time": "2026-01-24T09:22:56+00:00"
},
{
"name": "sebastian/complexity",
@@ -4964,16 +4948,16 @@
},
{
"name": "symfony/process",
- "version": "v5.4.47",
+ "version": "v5.4.51",
"source": {
"type": "git",
"url": "https://github.com/symfony/process.git",
- "reference": "5d1662fb32ebc94f17ddb8d635454a776066733d"
+ "reference": "467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/process/zipball/5d1662fb32ebc94f17ddb8d635454a776066733d",
- "reference": "5d1662fb32ebc94f17ddb8d635454a776066733d",
+ "url": "https://api.github.com/repos/symfony/process/zipball/467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f",
+ "reference": "467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f",
"shasum": ""
},
"require": {
@@ -5006,7 +4990,7 @@
"description": "Executes commands in sub-processes",
"homepage": "https://symfony.com",
"support": {
- "source": "https://github.com/symfony/process/tree/v5.4.47"
+ "source": "https://github.com/symfony/process/tree/v5.4.51"
},
"funding": [
{
@@ -5017,12 +5001,16 @@
"url": "https://github.com/fabpot",
"type": "github"
},
+ {
+ "url": "https://github.com/nicolas-grekas",
+ "type": "github"
+ },
{
"url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
"type": "tidelift"
}
],
- "time": "2024-11-06T11:36:42+00:00"
+ "time": "2026-01-26T15:53:37+00:00"
},
{
"name": "symfony/service-contracts",
@@ -5195,16 +5183,16 @@
},
{
"name": "symfony/yaml",
- "version": "v5.4.45",
+ "version": "v5.4.53",
"source": {
"type": "git",
"url": "https://github.com/symfony/yaml.git",
- "reference": "a454d47278cc16a5db371fe73ae66a78a633371e"
+ "reference": "ae0bbb46f77ff56591d0a0259c7f458f4b3e1f77"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/yaml/zipball/a454d47278cc16a5db371fe73ae66a78a633371e",
- "reference": "a454d47278cc16a5db371fe73ae66a78a633371e",
+ "url": "https://api.github.com/repos/symfony/yaml/zipball/ae0bbb46f77ff56591d0a0259c7f458f4b3e1f77",
+ "reference": "ae0bbb46f77ff56591d0a0259c7f458f4b3e1f77",
"shasum": ""
},
"require": {
@@ -5250,7 +5238,7 @@
"description": "Loads and dumps YAML files",
"homepage": "https://symfony.com",
"support": {
- "source": "https://github.com/symfony/yaml/tree/v5.4.45"
+ "source": "https://github.com/symfony/yaml/tree/v5.4.53"
},
"funding": [
{
@@ -5261,12 +5249,16 @@
"url": "https://github.com/fabpot",
"type": "github"
},
+ {
+ "url": "https://github.com/nicolas-grekas",
+ "type": "github"
+ },
{
"url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
"type": "tidelift"
}
],
- "time": "2024-09-25T14:11:13+00:00"
+ "time": "2026-05-20T17:13:41+00:00"
},
{
"name": "szepeviktor/phpstan-wordpress",