Skip to content

Release WordPressCS 3.4.1 - #2773

Merged
jrfnl merged 11 commits into
mainfrom
develop
Jul 27, 2026
Merged

Release WordPressCS 3.4.1#2773
jrfnl merged 11 commits into
mainfrom
develop

Conversation

@jrfnl

@jrfnl jrfnl commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

PR for tracking changes for the 3.4.1 release. Target release date: NOW.

Release checklist

General

  • Verify, and if necessary, update the allowed version ranges for various dependencies in the composer.json - PR Composer: update minimum version PHPCSUtils + PHPCSExtra #2770
  • PHPCS: check if there have been releases since the last WordPressCS release and check through the changelog to see if there is anything WordPressCS could take advantage of - PR #xxx
  • PHPCSUtils: check if there have been releases since the last WordPressCS release and update WordPressCS code to take advantage of any new utilities - PR #xxx
  • PHPCSExtra: check if there have been releases since the last WordPressCS release and check through the changelog to see if there is anything WordPressCS could take advantage of - PR #xxx
  • Check if the minimum WP version property needs updating in MinimumWPVersionTrait::$default_minimum_wp_version and if so, action it - PR #xxx
  • Check if the minimum_wp_version and testVersion properties in phpcs.xml.dist.sample need updating and if so, action it - PR #xxx
  • Check if the PHPCompatibility testVersion mentioned in the README needs updating and if so, action it - PR #xxx
    ✏️ Rule of thumb: stay in line with the "support three versions of WP below the current version" guideline, as also applied for the minimum_wp_version.
  • Check if any of the list based sniffs need updating and if so, action it.
    ✏️ Make sure the "last updated" annotation in the docblocks for these lists has also been updated!
    List based sniffs:
    • WordPress.WP.ClassNameCase - PR #xxx
    • WordPress.WP.DeprecatedClasses - PR #xxx
    • WordPress.WP.DeprecatedFunctions - PR #xxx
    • WordPress.WP.DeprecatedParameters - PR #xxx
    • WordPress.WP.DeprecatedParameterValues - PR #xxx
  • Check if any of the other lists containing information about WP Core need updating and if so, action it.
    • $allowed_core_constants in WordPress.NamingConventions.PrefixAllGlobals - PR #xxx
    • $pluggable_functions in WordPress.NamingConventions.PrefixAllGlobals - PR #xxx
    • $pluggable_classes in WordPress.NamingConventions.PrefixAllGlobals - PR #xxx
    • $target_functions in WordPress.Security.PluginMenuSlug - PR #xxx
    • $reserved_names in WordPress.NamingConventions.ValidPostTypeSlug - PR #xxx
    • $wp_time_constants in WordPress.WP.CronInterval - PR #xxx
    • $known_test_classes in IsUnitTestTrait - PR #xxx
    • ...etc...
  • Verify there has been no vandalism on the wiki (and if so, remove/fix it).

Release prep

  • Double-check that all PRs which were merged since the last release have a milestone attached to it.
  • Add changelog for the release - PR Changelog for the release of WordPressCS 3.4.1 #2772
    ✏️ Remember to add a release link at the bottom!
  • Update README (if applicable) - PR #xxx
  • Update wiki (new customizable properties etc.) (if applicable)

Release

  • Merge this PR.
  • Make sure all CI builds are green.
  • Tag and create a release against main (careful, GH defaults to develop!) & copy & paste the changelog to it.
    From within the GH interface: Code tab -> Releases -> "Draft a new release" button at the top of the page.
    ✏️ Check if anything from the link collection at the bottom of the changelog needs to be copied in!
    • Remove square brackets from all ticket links or make them proper full links (as GH markdown parser doesn't parse these correctly).
    • Change all contributor links to full inline links (as GH markdown parser on the Releases page doesn't parse these correctly).
  • Make sure all CI builds are green.
  • Close the milestone.
  • Open a new milestone for the next release.
  • If any open PRs/issues which were milestoned for this release did not make it into the release, update their milestone.
  • Fast-forward develop to be equal to main (git checkout develop && git pull upstream/develop && git merge main).
    📝 Branch protection may need to get a temporary exception to allow for pushing the develop branch. Please remember to remove the exception once the push has gone through!

After release

  • Open a Trac ticket for WordPress Core to update.

Publicize

jrfnl and others added 11 commits July 16, 2026 16:27
@jrfnl
Release checklist: minor updates
958418c 
Rodrigo did today's release while in a call with me. Here are some small updates to the release checklist (and the README) based on that experience.
@dingo-d
Merge pull request #2765 from WordPress/feature/release-checklist-tweaks
0ee0482 
Release checklist: minor updates
@dependabot
GH Actions: Bump actions/checkout in the action-runners group
9466b4b 
Bumps the action-runners group with 1 update: [actions/checkout](https://github.com/actions/checkout).


Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: action-runners
...

Signed-off-by: dependabot[bot] <support@github.com>
@jrfnl
Merge pull request #2768 from WordPress/dependabot/github_actions/act…
7ac8973 
…ion-runners-7a5a078ad4

GH Actions: Bump actions/checkout from 7.0.0 to 7.0.1 in the action-runners group
@jrfnl @dingo-d
Add SECURITY.md file (#2766)
e8064a6 
* Add `SECURITY.md` file

The other day, Rodrigo and me noticed that WPCS does not have a published security policy (via a `SECURITY.md` file).

This commit intends to add such a file, which should help inform security researchers how to disclose any findings they may have.

The file is placed in the `.github` directory. This will allow for it to be recognized correctly by GitHub, while not cluttering up the project root directory.

Ref: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy

---------

Co-authored-by: jrfnl <jrfnl@users.noreply.github.com>
Co-authored-by: Denis Žoljom <dingo-d@users.noreply.github.com>
@jrfnl
Composer: update minimum version PHPCSUtils + PHPCSExtra
267d84e 
PHPCSUtils has just released version 1.2.3, which includes a security fix which is relevant for two sniffs which are included in PHPCSExtra, which has released version 1.5.1 in response.

With that in mind, I'm bumping the minimum supported PHPCSUtils and PHPCSExtra versions to encourage users of to upgrade the underlying dependencies.

Why does a version bump help ?

Well, it only helps when a new version of WordPressCS is released, which is what I intend to do next.
Once that's done, it helps as Composer will now show WordPressCS as a direct dependency which is outdated, while PHPCSUtils/PHPCSExtra would only show as an indirect dependency which is outdated, which doesn't have the same urgency for people to update.

Refs:
* https://github.com/PHPCSStandards/PHPCSUtils/releases/tag/1.2.3
* https://github.com/PHPCSStandards/PHPCSExtra/releases/tag/1.5.1
@jrfnl
Merge pull request #2770 from WordPress/feature/composer-update-versions
54719c0 
Composer: update minimum version PHPCSUtils + PHPCSExtra
@rodrigoprimo @jrfnl
WP/EnqueuedResourceParameters: remove eval() from is_falsy()
7262444 
This PR is a fix for CVE-2026-45293 / [GHSA-3pwp-g2mj-5p3v](GHSA-3pwp-g2mj-5p3v).

Replace the eval()-based logic with explicit token-level checks for a
small set of literal falsy values:

- Boolean false.
- An integer or float equal to zero.
- A text string with the content `'0'` or `''` (single or double-quoted,
  heredoc, or nowdoc).
- An empty array.

Other forms that the previous implementation recognised via eval() are no
longer detected, such as a value wrapped in a type cast (e.g. `(int) 0`).
Supporting them doesn't justify the risks of using eval().

This commit also clarifies test case comments as the previous version was
inaccurate. "0, false or NULL" are not the only values that are not allowed.
Also, NULL and missing $ver parameter generate a warning instead of an error.
@jrfnl
Merge pull request #2771 from WordPress/security/enqueuedresourcepara…
a29048d 
…ms-fix-is-falsy

WP/EnqueuedResourceParameters: remove eval() from is_falsy()
@jrfnl
Changelog for the release of WordPressCS 3.4.1
1696dc8 
The release will be tagged momentarily.
@jrfnl
Merge pull request #2772 from WordPress/feature/changelog-3.4.1
b558639 
Changelog for the release of WordPressCS 3.4.1
@jrfnl jrfnl added this to the 3.4.1 milestone Jul 27, 2026
@jrfnl
jrfnl merged commit ec2ff94 into main Jul 27, 2026
38 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Meta: Repo Type: Documentation

Projects

None yet

Milestone

3.4.1

Development

Successfully merging this pull request may close these issues.

3 participants

@jrfnl @dingo-d @rodrigoprimo