Update wp-coding-standards/wpcs requirement from 3.3.0 to 3.4.0

[dependabot]

Updates the requirements on wp-coding-standards/wpcs to permit the latest version.

Release notes

Sourced from wp-coding-standards/wpcs's releases.

3.4.0

We're happy to welcome @​rodrigoprimo as co-maintainer of WordPressCS as of this release.

Added

• WordPress.Arrays.ArrayDeclarationSpacing: new allow_single_item_single_line_explicit_key_arrays property to replace the, now deprecated, allow_single_item_single_line_associative_arrays property. #2696
• End-user documentation to the following existing sniffs: WordPress.Arrays.ArrayDeclarationSpacing (props @​RafaelFunchal, @​mattgaldino and @​rodrigoprimo, #2489, #2593, #2682), WordPress.CodeAnalysis.AssignmentInTernaryCondition (props @​Nic-Sevic and @​rodrigoprimo, #2488, #2678), WordPress.DB.RestrictedClasses (props @​paulgibbs and @​rodrigoprimo, #2455, #2689), WordPress.DB.DirectDatabaseQuery (props @​jaymcp and @​rodrigoprimo, #2458, #2697), WordPress.DB.RestrictedFunctions (props @​paulgibbs and @​rodrigoprimo, #2453, #2676), WordPress.DB.SlowDBQuery (props @​petitphp and @​rodrigoprimo, #2464, #2699), WordPress.PHP.DevelopmentFunctions (props @​gogdzl and @​rodrigoprimo, #2490, #2690), WordPress.PHP.NoSilencedErrors (props @​gogdzl and @​rodrigoprimo, #2495, #2694), WordPress.PHP.PregQuoteDelimiter (props @​tikifez and @​rodrigoprimo, #2487, #2677), WordPress.PHP.RestrictedPHPFunctions (props @​gogdzl and @​rodrigoprimo, #2491, #2693), WordPress.Security.PluginMenuSlug (props @​jasonkenison, #2592), WordPress.WP.AlternativeFunctions (props @​pamprn09, @​bhubbard and @​rodrigoprimo, #2496, #2588, #2687), WordPress.WP.DiscouragedConstants (props @​RafaelFunchal, @​paulopmt1 and @​rodrigoprimo, #2493, #2589, #2680), WordPress.WP.GlobalVariablesOverride (props @​paulopmt1 and @​rodrigoprimo, #2586, #2679). This documentation can be exposed via the PHP_CodeSniffer --generator=... command-line argument.

Changed

• The minimum required PHP_CodeSniffer version to 3.13.5 (was 3.13.4). #2761
• The minimum required PHPCSUtils version to 1.2.2 (was 1.1.0). #2761
• The default value for minimum_wp_version, as used by a number of sniffs detecting usage of deprecated WP features, has been updated to 6.7. #2757
• WordPress.NamingConventions.PrefixAllGlobals has been updated to recognize pluggable functions introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.ClassNameCase has been updated to recognize classes introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.DeprecatedFunctions now detects functions deprecated in WordPress up to WP 7.0.0. #2747
• The ConstantsHelper::is_use_of_global_constant() method will no longer flag a constant alias created via an import use statement as it were the use of a global constant. #2579
• The ConstantsHelper::is_in_function_call() method will now act fully case-agnostic for the function names being checked. #2706 Previously, the $valid_functions parameter would need to be passed with the function names as keys in lowercase.
• WordPress.PHP.NoSilencedErrors: error silencing is no longer accepted for the parse_url() function. #2701
• Improved the wording of the error message for WordPress.Arrays.ArrayDeclarationSpacing.AssociativeArrayFound. #2688
• Improved the wording of the error message for WordPress.PHP.RestrictedPHPFunctions. #2702
• Various housekeeping, including documentation and test improvements. Includes a contribution by @​dd32.

Deprecated

• WordPress.Arrays.ArrayDeclarationSpacing: the allow_single_item_single_line_associative_arrays property has been deprecated in favor of the new allow_single_item_single_line_explicit_key_arrays property. #2696 This is a name change only. The functionality of these properties is the same.

Fixed

• WordPress.DB.PreparedSQL and WordPress.DB.PreparedSQLPlaceholders: false positive for static method calls to a non-global class named wpdb. #2753
• WordPress.Security.EscapeOutput: false positive for get_search_query() when the $escaped parameter was passed as fully qualified or non-lowercase true. #2618
• WordPress.Security.EscapeOutput: false negative for _deprecated_file() calls when the basename( __FILE__ ) pattern used non-standard casing for either basename() and/or __FILE__. #2729
• WordPress.WP.AlternativeFunctions: false negative when class functions/constants/properties use the same name as select global WP constants/functions. #2617
• WordPress.WP.AlternativeFunctions: false positive for fully qualified references to the global PHP stream constants \STDIN, \STDOUT, and \STDERR. #2617
• WordPress.WP.CronInterval: false positive when the callback function reference used a different case than the function declaration, even though they are in the same file. #2730

Changelog

Sourced from wp-coding-standards/wpcs's changelog.

[3.4.0] - 2026-07-16

We're happy to welcome [@​rodrigoprimo] as co-maintainer of WordPressCS as of this release.

Added

• WordPress.Arrays.ArrayDeclarationSpacing: new allow_single_item_single_line_explicit_key_arrays property to replace the, now deprecated, allow_single_item_single_line_associative_arrays property. #2696
• End-user documentation to the following existing sniffs: WordPress.Arrays.ArrayDeclarationSpacing (props [@​RafaelFunchal], [@​mattgaldino] and [@​rodrigoprimo], #2489, #2593, #2682), WordPress.CodeAnalysis.AssignmentInTernaryCondition (props [@​Nic-Sevic] and [@​rodrigoprimo], #2488, #2678), WordPress.DB.RestrictedClasses (props [@​paulgibbs] and [@​rodrigoprimo], #2455, #2689), WordPress.DB.DirectDatabaseQuery (props [@​jaymcp] and [@​rodrigoprimo], #2458, #2697), WordPress.DB.RestrictedFunctions (props [@​paulgibbs] and [@​rodrigoprimo], #2453, #2676), WordPress.DB.SlowDBQuery (props [@​petitphp] and [@​rodrigoprimo], #2464, #2699), WordPress.PHP.DevelopmentFunctions (props [@​gogdzl] and [@​rodrigoprimo], #2490, #2690), WordPress.PHP.NoSilencedErrors (props [@​gogdzl] and [@​rodrigoprimo], #2495, #2694), WordPress.PHP.PregQuoteDelimiter (props [@​tikifez] and [@​rodrigoprimo], #2487, #2677), WordPress.PHP.RestrictedPHPFunctions (props [@​gogdzl] and [@​rodrigoprimo], #2491, #2693), WordPress.Security.PluginMenuSlug (props [@​jasonkenison], #2592), WordPress.WP.AlternativeFunctions (props [@​pamprn09], [@​bhubbard] and [@​rodrigoprimo], #2496, #2588, #2687), WordPress.WP.DiscouragedConstants (props [@​RafaelFunchal], [@​paulopmt1] and [@​rodrigoprimo], #2493, #2589, #2680), WordPress.WP.GlobalVariablesOverride (props [@​paulopmt1] and [@​rodrigoprimo], #2586, #2679). This documentation can be exposed via the PHP_CodeSniffer --generator=... command-line argument.

Changed

• The minimum required PHP_CodeSniffer version to 3.13.5 (was 3.13.4). #2761
• The minimum required PHPCSUtils version to 1.2.2 (was 1.1.0). #2761
• The default value for minimum_wp_version, as used by a number of sniffs detecting usage of deprecated WP features, has been updated to 6.7. #2757
• WordPress.NamingConventions.PrefixAllGlobals has been updated to recognize pluggable functions introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.ClassNameCase has been updated to recognize classes introduced in WP up to WP 7.0.0. #2747
• WordPress.WP.DeprecatedFunctions now detects functions deprecated in WordPress up to WP 7.0.0. #2747
• The ConstantsHelper::is_use_of_global_constant() method will no longer flag a constant alias created via an import use statement as it were the use of a global constant. #2579
• The ConstantsHelper::is_in_function_call() method will now act fully case-agnostic for the function names being checked. #2706 Previously, the $valid_functions parameter would need to be passed with the function names as keys in lowercase.
• WordPress.PHP.NoSilencedErrors: error silencing is no longer accepted for the parse_url() function. #2701
• Improved the wording of the error message for WordPress.Arrays.ArrayDeclarationSpacing.AssociativeArrayFound. #2688
• Improved the wording of the error message for WordPress.PHP.RestrictedPHPFunctions. #2702
• Various housekeeping, including documentation and test improvements. Includes a contribution by [@​dd32].

Deprecated

• WordPress.Arrays.ArrayDeclarationSpacing: the allow_single_item_single_line_associative_arrays property has been deprecated in favor of the new allow_single_item_single_line_explicit_key_arrays property. #2696 This is a name change only. The functionality of these properties is the same.

Fixed

• WordPress.DB.PreparedSQL and WordPress.DB.PreparedSQLPlaceholders: false positive for static method calls to a non-global class named wpdb. #2753
• WordPress.Security.EscapeOutput: false positive for get_search_query() when the $escaped parameter was passed as fully qualified or non-lowercase true. #2618
• WordPress.Security.EscapeOutput: false negative for _deprecated_file() calls when the basename( __FILE__ ) pattern used non-standard casing for either basename() and/or __FILE__. #2729
• WordPress.WP.AlternativeFunctions: false negative when class functions/constants/properties use the same name as select global WP constants/functions. #2617
• WordPress.WP.AlternativeFunctions: false positive for fully qualified references to the global PHP stream constants \STDIN, \STDOUT, and \STDERR. #2617
• WordPress.WP.CronInterval: false positive when the callback function reference used a different case than the function declaration, even though they are in the same file. #2730

#2453: WordPress/WordPress-Coding-Standards#2453 #2455: WordPress/WordPress-Coding-Standards#2455 #2458: WordPress/WordPress-Coding-Standards#2458 #2464: WordPress/WordPress-Coding-Standards#2464 #2487: WordPress/WordPress-Coding-Standards#2487 #2488: WordPress/WordPress-Coding-Standards#2488 #2489: WordPress/WordPress-Coding-Standards#2489 #2490: WordPress/WordPress-Coding-Standards#2490 #2491: WordPress/WordPress-Coding-Standards#2491 #2493: WordPress/WordPress-Coding-Standards#2493 #2495: WordPress/WordPress-Coding-Standards#2495 #2496: WordPress/WordPress-Coding-Standards#2496 #2579: WordPress/WordPress-Coding-Standards#2579 #2586: WordPress/WordPress-Coding-Standards#2586

... (truncated)

Commits

• 469c18c Merge pull request #2762 from WordPress/develop
• 816fc74 Merge pull request #2758 from WordPress/feature/changelog-3.4.0
• 598dab1 README: minor markdown fix
• 2b16e01 Changelog for the release of WordPressCS 3.4.0
• 04244a8 Merge pull request #2763 from WordPress/update-phpcs-sample-file
• 00931f5 Update minimum_wp_version in phpcs.xml.dist.sample
• 6f1cb5c Merge pull request #2729 from WordPress/fix-escape-output-basename-case-insen...
• c19172f Merge pull request #2761 from WordPress/feature/composer-update-minimum-versions
• 219b182 Merge pull request #2754 from WordPress/tests-array-walking-functions-helper
• d69ed7f Composer: raise the minimum supported PHPCS version to 3.13.5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)