Skip to content

Fix PHPStan errors and phpunit CVE on main#764

Open
ilicfilip wants to merge 2 commits into
mainfrom
filip/fix-main-ci-checks
Open

Fix PHPStan errors and phpunit CVE on main#764
ilicfilip wants to merge 2 commits into
mainfrom
filip/fix-main-ci-checks

Conversation

@ilicfilip
Copy link
Copy Markdown
Collaborator

No description provided.

Brings main's static analysis and dependency security checks back to green:

- Static Analysis: clear 25 pre-existing PHPStan errors. Ports develop's
  typed @return on Date::get_periods()/get_range() (which also resolves the
  Chart modify() errors), takes develop's exact versions of class-page-settings,
  class-activity-scores, class-chart and class-update-140, converts the WP-core
  require_once ignores to the @phpstan-ignore-next-line form that suppresses
  under PHPStan 2.1.x, and adds inline ignores elsewhere.
- Security check: bump phpunit/phpunit 9.6.30 -> 9.6.34 in composer.lock to
  resolve CVE-2026-24765 (unsafe deserialization in PHPT code coverage).
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 26, 2026

Test on Playground
Test this pull request on the Playground
or download the zip

@github-actions
Copy link
Copy Markdown
Contributor

Composer package changes
Dev Packages Operation Base Target
nikic/php-parser Upgraded v5.6.2 v5.7.0
phpstan/phpdoc-parser Upgraded 2.3.0 2.3.2
phpunit/phpunit Upgraded 9.6.30 9.6.34
sebastian/comparator Upgraded 4.0.9 4.0.10
symfony/deprecation-contracts Upgraded v3.6.0 v3.7.0
symfony/polyfill-ctype Upgraded v1.33.0 v1.37.0
symfony/polyfill-php80 Upgraded v1.33.0 v1.37.0

The anonymous classes extending the abstract Tasks_Interactive did not
implement the abstract Tasks::should_add_task() method. phpunit 9.6.30
did not surface this, but 9.6.34 (the CVE-2026-24765 fix) does, causing
a fatal when the test class loads. Implement should_add_task() in all 8
anonymous task providers.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant