Changeset 63041

Timestamp:

08/06/2026 01:00:34 PM (8 weeks ago)

Author:

jeremyfelt

Message:

Build/Test Tools: Ignore PHPCS Security Advisory CVE-2026-67434

Add an ignore for GHSA-hmqg-cxww-wqhq (CVE-2026-67434), under both its GitHub and Packagist advisory IDs.

WordPress tooling does not use the vulnerable Gitblame, Hgblame or Svnblame report formats, so the pinned version poses no practical risk.

Merges [63037] to the 6.7 branch.

Props johnbillion, joedolson, jonsurrell, sergeybiryukov.
Fixes #65822.

Location:

branches/6.7

Files:

• . (modified) (1 prop)
• composer.json (modified) (1 diff)

branches/6.7/composer.json

@@ -24 +24 @@
         },
         "config": {
-                "audit": { "ignore": [ "GHSA-3pwp-g2mj-5p3v" ] },
+                "audit": { "ignore": [ "GHSA-3pwp-g2mj-5p3v", "GHSA-hmqg-cxww-wqhq", "PKSA-rdkp-vv9z-mjkg" ] },
                 "allow-plugins": {
                         "dealerdirect/phpcodesniffer-composer-installer": true