Repository navigation
Remove roave/security-advisories - #205
Conversation
Composer 2.9+ blocks packages with known security advisories by default, which fully replaces this package. Since its latest update, the package also conflicts with every PHP version without the newest security release, so it can't be installed on the older PHP versions we test on. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Development dependency declaration composer.json |
Removed roave/security-advisories from development dependencies. wp-cli/wp-cli-tests remains. |
Priority:
Estimated code review effort: 1 (Trivial) | ~5 minutes
Change: Other
Suggested reviewers: danielbachhuber
Merge Risk: 
de67d
-
The removal relies on Composer's native advisory blocking. No actionable regression remains established; the change is mergeable after normal checks.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title "Remove roave/security-advisories" names the only change in the changeset, which removes the roave/security-advisories development dependency from composer.json. It is short, specific, and i… Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title "Remove roave/security-advisories" names the only change in the changeset, which removes the roave/security-advisories development dependency from composer.json. It is short, specific, and identifies the package that was removed.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
github-actions
Bot
added
enhancement
scope:distribution
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Part of wp-cli/.github#308.
Since Composer 2.9, Composer refuses to install packages with known security advisories by default, which the release post says fully replaces
roave/security-advisories. Since its latest update, the package also conflicts with every PHP version without the newest security release, so it can no longer be installed on the older PHP versions we test on.Composer's check covers the dependencies only, not PHP itself. CI runs the latest Composer, so every test job still blocks vulnerable dependencies, including those on older PHP versions.
Summary by CodeRabbit