Changeset 63052

Timestamp:

08/06/2026 01:12:03 PM (3 days ago)

Author:

jeremyfelt

Message:

Build/Test Tools: Ignore PHPCS Security Advisory CVE-2026-67434

Add an ignore for GHSA-hmqg-cxww-wqhq (CVE-2026-67434), under both its GitHub and Packagist advisory IDs.

WordPress tooling does not use the vulnerable Gitblame, Hgblame or Svnblame report formats, so the pinned version poses no practical risk.

Merges [63037] to the 5.6 branch.

Props johnbillion, joedolson, jonsurrell, sergeybiryukov.
Fixes #65822.

Location:

branches/5.6

Files:

• . (modified) (1 prop)
• composer.json (modified) (1 diff)
• composer.lock (modified) (5 diffs)

branches/5.6/composer.json

@@ -35 +35 @@
         },
         "config": {
+                "audit": { "ignore": [ "GHSA-hmqg-cxww-wqhq", "PKSA-rdkp-vv9z-mjkg" ] },
                 "allow-plugins": {
                         "dealerdirect/phpcodesniffer-composer-installer": true

branches/5.6/composer.lock

@@ -5 +5 @@
         "This file is @generated automatically"
     ],
-    "content-hash": "d8bcbf1466f6595287a44721f525844d",
+    "content-hash": "f9614943a9127e725997fd4141d940fe",
     "packages": [],
     "packages-dev": [
@@ -1566 +1566 @@
             "source": {
                 "type": "git",
-                "url": "https://github.com/squizlabs/PHP_CodeSniffer.git",
+                "url": "https://github.com/PHPCSStandards/PHP_CodeSniffer.git",
                 "reference": "73e2e7f57d958e7228fce50dc0c61f58f017f9f6"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/squizlabs/PHP_CodeSniffer/zipball/73e2e7f57d958e7228fce50dc0c61f58f017f9f6",
+                "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/73e2e7f57d958e7228fce50dc0c61f58f017f9f6",
                 "reference": "73e2e7f57d958e7228fce50dc0c61f58f017f9f6",
                 "shasum": ""
@@ -1739 +1739 @@
             "source": {
                 "type": "git",
-                "url": "https://github.com/webmozart/assert.git",
+                "url": "https://github.com/webmozarts/assert.git",
                 "reference": "bafc69caeb4d49c39fd0779086c03a3738cbb389"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/webmozart/assert/zipball/bafc69caeb4d49c39fd0779086c03a3738cbb389",
+                "url": "https://api.github.com/repos/webmozarts/assert/zipball/bafc69caeb4d49c39fd0779086c03a3738cbb389",
                 "reference": "bafc69caeb4d49c39fd0779086c03a3738cbb389",
                 "shasum": ""
@@ -1895 +1895 @@
     "aliases": [],
     "minimum-stability": "stable",
-    "stability-flags": [],
+    "stability-flags": {},
     "prefer-stable": false,
     "prefer-lowest": false,
@@ -1901 +1901 @@
         "php": ">=5.6"
     },
-    "platform-dev": [],
-    "plugin-api-version": "2.1.0"
+    "platform-dev": {},
+    "plugin-api-version": "2.9.0"
 }