Repository navigation
test(php): run PHPUnit in a separate wp-env config - #791
Merged
Merged
Conversation
Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.5 to 0.2.7. - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.5...v0.2.7) --- updated-dependencies: - dependency-name: tmp dependency-version: 0.2.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.3 to 1.8.4. - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.8.4) --- updated-dependencies: - dependency-name: shell-quote dependency-version: 1.8.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [launch-editor](https://github.com/vitejs/launch-editor) from 2.13.1 to 2.14.1. - [Commits](vitejs/launch-editor@v2.13.1...v2.14.1) --- updated-dependencies: - dependency-name: launch-editor dependency-version: 2.14.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [form-data](https://github.com/form-data/form-data) from 4.0.5 to 4.0.6. - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) --- updated-dependencies: - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.29.0 to 7.29.6. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [ws](https://github.com/websockets/ws) and [@wp-playground/cli](https://github.com/WordPress/wordpress-playground). These dependencies needed to be updated together. Updates `ws` from 8.18.3 to 8.21.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.18.3...8.21.1) Updates `ws` from 8.19.0 to 8.21.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.18.3...8.21.1) Updates `ws` from 7.5.10 to 7.5.12 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.18.3...8.21.1) Updates `@wp-playground/cli` from 3.1.3 to 3.1.44 - [Release notes](https://github.com/WordPress/wordpress-playground/releases) - [Changelog](https://github.com/WordPress/wordpress-playground/blob/trunk/CHANGELOG.md) - [Commits](WordPress/wordpress-playground@v3.1.3...v3.1.44) --- updated-dependencies: - dependency-name: ws dependency-version: 8.21.1 dependency-type: indirect - dependency-name: ws dependency-version: 8.21.1 dependency-type: indirect - dependency-name: ws dependency-version: 7.5.12 dependency-type: indirect - dependency-name: "@wp-playground/cli" dependency-version: 3.1.44 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [websocket-driver](https://github.com/faye/websocket-driver-node) from 0.7.4 to 0.7.5. - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.4...0.7.5) --- updated-dependencies: - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps and [svgo](https://github.com/svg/svgo). These dependencies needed to be updated together. Updates `svgo` from 3.3.3 to 3.3.4 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v3.3.3...v3.3.4) Updates `svgo` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v3.3.3...v3.3.4) --- updated-dependencies: - dependency-name: svgo dependency-version: 3.3.4 dependency-type: indirect - dependency-name: svgo dependency-version: 4.0.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0. - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.4...v1.10.0) --- updated-dependencies: - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [immutable](https://github.com/immutable-js/immutable-js) from 5.1.5 to 5.1.9. - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9) --- updated-dependencies: - dependency-name: immutable dependency-version: 5.1.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.10.0 to 5.10.1. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.10.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.4. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.3...v3.1.4) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.10 to 8.5.22. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.10...8.5.22) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.22 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.4...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.22 to 8.5.25. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.22...8.5.25) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.25 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Run Copilot code review on GitHub-hosted runners
Bumps and [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser). These dependencies needed to be updated together. Updates `postcss-selector-parser` from 7.1.1 to 7.1.5 - [Release notes](https://github.com/postcss/postcss-selector-parser/releases) - [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-selector-parser@v7.1.1...7.1.5) Updates `postcss-selector-parser` from 6.1.2 to 6.1.4 - [Release notes](https://github.com/postcss/postcss-selector-parser/releases) - [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-selector-parser@v7.1.1...7.1.5) --- updated-dependencies: - dependency-name: postcss-selector-parser dependency-version: 7.1.5 dependency-type: indirect - dependency-name: postcss-selector-parser dependency-version: 6.1.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.5 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) from 0.16.7 to 0.16.8. - [Release notes](https://github.com/humanwhocodes/humanfs/releases) - [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node) --- updated-dependencies: - dependency-name: "@humanfs/node" dependency-version: 0.16.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [joi](https://github.com/hapijs/joi) from 18.0.2 to 18.2.8. - [Commits](hapijs/joi@v18.0.2...v18.2.8) --- updated-dependencies: - dependency-name: joi dependency-version: 18.2.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#767) Bumps [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) from 2.10.0 to 2.11.21. - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.0...v2.11.21) --- updated-dependencies: - dependency-name: baseline-browser-mapping dependency-version: 2.11.21 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps and [svgo](https://github.com/svg/svgo). These dependencies needed to be updated together. Updates `svgo` from 3.3.4 to 3.3.5 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v3.3.4...v3.3.5) Updates `svgo` from 4.0.2 to 4.1.0 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v3.3.4...v3.3.5) --- updated-dependencies: - dependency-name: svgo dependency-version: 3.3.5 dependency-type: indirect - dependency-name: svgo dependency-version: 4.1.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps and [js-yaml](https://github.com/nodeca/js-yaml). These dependencies needed to be updated together. Updates `js-yaml` from 3.14.2 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.2...3.15.2) Updates `js-yaml` from 4.1.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.2...3.15.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [adm-zip](https://github.com/cthackers/adm-zip) to 0.6.1 and updates ancestor dependency [@wordpress/scripts](https://github.com/WordPress/gutenberg/tree/HEAD/packages/scripts). These dependencies need to be updated together. Updates `adm-zip` from 0.5.16 to 0.6.1 - [Release notes](https://github.com/cthackers/adm-zip/releases) - [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md) - [Commits](cthackers/adm-zip@v0.5.16...v0.6.1) Updates `@wordpress/scripts` from 31.5.0 to 35.0.0 - [Release notes](https://github.com/WordPress/gutenberg/releases) - [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/scripts/CHANGELOG.md) - [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/scripts@35.0.0/packages/scripts) --- updated-dependencies: - dependency-name: adm-zip dependency-version: 0.6.1 dependency-type: indirect - dependency-name: "@wordpress/scripts" dependency-version: 35.0.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [markdown-it](https://github.com/markdown-it/markdown-it) to 14.3.2 and updates ancestor dependency [@wordpress/scripts](https://github.com/WordPress/gutenberg/tree/HEAD/packages/scripts). These dependencies need to be updated together. Updates `markdown-it` from 12.3.2 to 14.3.2 - [Changelog](https://github.com/markdown-it/markdown-it/blob/14.3.2/CHANGELOG.md) - [Commits](markdown-it/markdown-it@12.3.2...14.3.2) Updates `@wordpress/scripts` from 35.0.0 to 36.0.0 - [Release notes](https://github.com/WordPress/gutenberg/releases) - [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/scripts/CHANGELOG.md) - [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/scripts@36.0.0/packages/scripts) --- updated-dependencies: - dependency-name: markdown-it dependency-version: 14.3.2 dependency-type: indirect - dependency-name: "@wordpress/scripts" dependency-version: 36.0.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.21. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.21) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Brings main's history into v2 so release PR #692 has no conflicts. main only changed package.json and package-lock.json (v1 Dependabot bumps, superseded by v2's own dependencies) and copilot-code-review.yml (already identical on v2), so the tree stays exactly as v2 had it.
npm audit reported 93 vulnerabilities (62 high) on v2. Now 0. - @wordpress/scripts 32.3.0 -> 35.0.0, the first release whose e2e tooling no longer pulls in extract-zip, which has no patched version. @wordpress/jest-preset-default 12.47.0 -> 14.2.0 to match (Jest 30). - @wordpress/env 11.7.0 -> 11.16.0 (drops extract-zip), @wordpress/babel-preset-default 8.47.0 -> 8.56.0, browserslist 4.28.2 -> 4.29.3, svgo 4.0.1 -> 4.1.0. - overrides, for fixes the parents' ranges do not reach: webpack-dev-server 6.0.0 (no patched 5.x; was pinned to 5.2.1), serialize-javascript 7.1.2 (was 7.0.3), minimatch 3.1.5 for v3 consumers only (was 3.1.3 for every consumer), qs 6.16.0, markdownlint-cli 0.49.1 and js-yaml 5.4.2 for its v5 consumers. - webpack.blocks.config.js and docs/hmr.md no longer say the dev server is v5; the proxy workaround still applies to v6.
@wordpress/jest-console 9 (via jest-preset-default 14) fails any test that calls console.warn unless the test expects it through its own matchers, so spying on console.warn no longer works. Use toHaveWarnedWith with the exact message.
3.13.5 is affected by CVE-2026-67434 (OS command injection, GHSA-hmqg-cxww-wqhq).
Follows rtCamp/plugin-elementary#28 and #29 so both starters stay on the same toolchain: - @wordpress/scripts 36.0.0 instead of 35.0.0. 36 runs Vitest for test-unit-js and drops the bundled Jest preset, Babel transform and GitHub Actions reporter, so test:js uses wp-scripts test-unit-jest, jest and jest-environment-jsdom 30.5.0 are direct dev dependencies, @wordpress/jest-preset-default is removed, and tests/js/jest.config.js sets up jsdom, test discovery and a style mock itself. - webpack-dev-server stays on 5.x at 5.2.6, which is patched; only its sockjs > uuid dependency needed an override. This reverts the 6.0.0 override and the doc and comment changes that went with it. - Overrides are scoped to the parent that pins the old version (express > qs, markdownlint-cli > js-yaml, copy-webpack-plugin > serialize-javascript, sockjs > uuid, @wordpress/scripts > adm-zip) instead of applying everywhere. - The duplicate-entry test goes back to spying on console.warn, since @wordpress/jest-console no longer loads without the preset. npm audit still reports 0 vulnerabilities.
wp-env 11.16 deprecates the env.tests block and the automatic tests environment. The replacement it documents is a second config file, so .wp-env.tests.json defines the test environment (port 5891, its own containers and database, WP_DEBUG on), and .wp-env.json sets testsEnvironment to false. pretest:php starts that environment and test:php runs PHPUnit in its cli container. A second config, not the development environment's cli container: wp-env's wp-tests-config.php there uses the site's database and wp_ prefix, so the suite would wipe the development site's content. CI keeps working unchanged: WP_ENV_PHP_VERSION and WP_ENV_CORE apply to the test environment too. The docs drop the test-only WP_DEBUG override, which the committed test config now covers.
aryanjasala
changed the base branch from
fix/v2-security
to
theme-elementary-v2
October 1, 2026 20:53
AnuragVasanwala
approved these changes
Oct 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@wordpress/env11.16 (from #790, now on this branch) deprecates theenv.testsblock and the automatic tests environment, and prints a warning on everywp-env start. Its documented replacement is a second config file passed with--config.Changes
.wp-env.tests.jsondefines the test environment: the theme, PHP 8.2, port 5891, its own containers and database, andWP_DEBUGon (the logger tests need it)..wp-env.jsonsetstestsEnvironmenttofalseand dropsenv.tests.pretest:phpstarts the test environment (a few seconds when it is already up) and installs Composer dependencies in itsclicontainer;test:phpruns PHPUnit there.WP_DEBUGoverride step indocs/local-development.mdand its row indocs/internal/maintenance.mdare gone: the committed test config covers it..gitignoreignores.wp-env.tests.override.json.Why not run the tests in the development environment's
clicontainer: wp-env'swp-tests-config.phpthere uses the site's database andwp_prefix, so the suite wipes the development site's content. Checked: the site's posts went from 3 to 0.CI needs no change:
ci-test-phprunsnpm run wp-env startand thennpm run test:php, whose pretest hook starts the test environment, andWP_ENV_PHP_VERSIONandWP_ENV_COREapply to it too.Testing
wp-env startandnpm run test:php: no deprecation warnings; the test environment comes up on 5891 in its own containersWP_ENV_PHP_VERSION=8.3 npm run test:phpruns on PHP 8.3.35 and passeslint:allpasses