feat!: require PHP >= 8.4 (4.0.0) by iruzevic · Pull Request #67 · infinum/eightshift-coding-standards

iruzevic · 2026-05-25T09:16:02Z

Summary

Breaking change: raises the minimum supported PHP version from 7.4 to 8.4, ships as 4.0.0. Also folds in toolchain modernization (Rector, PHPStan-WP, PHPUnit 9, dependency pins) and a fix for the long-broken HelpersEscapeUnitTest.

Core bump

Composer constraint >=7.4 → >=8.4
Eightshift/ruleset.xml and phpcs.xml.dist.sample testVersion → 8.4-
CI matrix collapsed to a single PHP 8.4 runtime; the PHPCS × WPCS cross-matrix is gone (versions are now pinned in composer.json)
wp-coding-standards/wpcs pinned to stable 3.3.0 (was a dev branch)
Bumped slevomat/coding-standard, phpcompatibility/phpcompatibility-wp, phpcsstandards/phpcsdevtools, phpunit/phpunit (^8.5 → ^9.6)
README badge + 4.0 install hint
CHANGELOG entry under [4.0.0]

Toolchain additions

Rector 2.x integration: rector.php config (PHP 8.4 level set + CODE_QUALITY, DEAD_CODE, TYPE_DECLARATION, EARLY_RETURN), composer test:rector / composer fix:rector, and a dedicated rector CI job
szepeviktor/phpstan-wordpress PHPStan extension; PHPStan analysis level raised 5 → 6
Composer scripts restructured under test:* / fix:* namespaces, plus an aggregate composer test that runs the whole suite. Removed lint, lint:ci, and the php-parallel-lint/* dev deps (PHPCS reports parse errors on PHP 8+, so the separate lint step was redundant)

Bundled fixes

Closes Dependabot alert GHSA-5wxr-w449-57cm by pinning shivammathur/setup-php → 2.37.1
Fixes the long-failing HelpersEscapeUnitTest: fixtures 1/2/3 expected error lists were stale (sniff treats FQCN vs shorthand Helpers\Helpers::* differently than the snapshots assumed). Tests had been failing every CI run since 3.1.0
Fixes the long-broken tests matrix exclude: that referenced a non-existent phpcs_branch: '3.7.2' — moot now that the cross-matrix is removed, but documented for history
Excludes WordPress.PHP.POSIXFunctions (deprecated in WPCS 3.3.0, removed in WPCS 4.0.0; POSIX regex was removed in PHP 7)
Renames Eightshift/Docs/Security/ComponentsEscapeStandard.xml → HelpersEscapeStandard.xml to match the HelpersEscapeSniff it documents (the sniff was renamed in 3.0.0 but the doc file was missed)
PHPStan type cleanups in DisallowDoShortcodeSniff and Tests/bootstrap.php (the register() return type, process_token void return, explicit (string) casts)
Modernizes HelpersEscapeSniff to PHP 8 idioms (str_contains in place of strpos(...) !== false). No behaviour change. The other two sniffs were inventoried and were already idiomatic
CI actions bumped: actions/checkout@v4 → v6, ramsey/composer-install@v2 → 4.0.0
phpunit.xml.dist schema reference bumped to PHPUnit 9.6
Removed SECURITY.md (handled via GitHub repository settings now)
LICENSE copyright year refreshed to 2026

Test plan

CI green on PHP 8.4 across all jobs (composer-validate, ruleset-validate, feature-completeness, lint, phpstan, rector, tests)
composer validate --strict passes
composer test clean locally (test:rector, test:standards, test:types, test:unit, test:unit-checkcs, test:check-complete, test:check-complete-strict)
Dependabot alert Make it work #3 auto-resolves after merge

Drops PHP 7.4-8.2 from the matrix, collapses now-redundant version-conditional steps, and addresses Dependabot alert GHSA-5wxr-w449-57cm by pinning setup-php to a patched release.

GitHub Action tag for shivammathur/setup-php is published without a leading 'v'. CI was failing with 'Unable to resolve action ... unable to find version v2.37.1' on every job.

…low-fail canary The HelpersEscapeUnitTest fixture-1/-2/-3 expected error lists were stale (the sniff treats FQCN and shorthand Helpers\Helpers::* differently than the prior test snapshots assumed). Tests had been failing on every CI run since 3.1.0. Also restore the dev-master+dev-develop combination as an explicit allow-fail canary on each PHP version. Promoting it to baseline in 4.0.0 was wrong — upstream development branches are expected to break occasionally regardless of PHP version, and the previous workflow had them gated via include+allow_failure for exactly this reason.

Result: only HelpersEscapeSniff.php has meaningful candidates (9 strpos -> str_contains substitutions). The other two sniffs are already PHP 8-idiomatic per the plan's "smallest idiom" guideline; rewriting them would be drive-by. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Replace 9× \strpos(..., ...) !== false with \str_contains(...). Behaviour unchanged; modernization driven by 4.0.0 PHP 8.3 minimum. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Folds the modernization work into the 4.0.0 entry rather than a separate 4.1.0 (same PR, same release). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Branch drifted from the original 8.3 plan: actual minimum is PHP 8.4, and several toolchain changes (Rector integration, PHPStan level bump with WordPress extension, PHPUnit 9, dependency pins, composer script rename) were folded into the same release. Updates the 4.0.0 entry to match the diff against main rather than the original intent. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

This PR is a breaking-release update that raises the minimum supported PHP version to 8.4 and modernizes the project’s QA/tooling (CI, PHPUnit, PHPStan, Rector), while also updating ruleset/test fixtures to match current sniff behavior.

Changes:

Bump minimum PHP requirement to >=8.4, update PHPCompatibility testVersion, and refresh CI to a single PHP 8.4 runtime.
Modernize and pin tooling/dependencies (WPCS 3.3.0, PHPUnit 9.6, PHPStan level 6 + WP extension, Rector config + CI job).
Fix/refresh long-failing unit test expectations and small internal modernizations (casts, str_contains, match expression).

Reviewed changes

Copilot reviewed 18 out of 20 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
`composer.json`	Raises PHP constraint to 8.4 and updates/pins tooling dependencies and scripts.
`Eightshift/ruleset.xml`	Updates compatibility target and ruleset exclusions; adjusts line-length limit.
`phpcs.xml.dist.sample`	Updates PHPCompatibility `testVersion` to match new minimum.
`.github/workflows/ci.yml`	Updates CI jobs/actions and aligns jobs with new scripts/tooling.
`phpunit.xml.dist`	Updates PHPUnit schema reference for PHPUnit 9.6.
`phpstan.neon.dist`	Raises level and adds WP extension include.
`rector.php`	Introduces Rector configuration for PHP 8.4 upgrade/tooling modernization.
`Tests/bootstrap.php`	Minor refactors for types/compatibility with updated tooling.
`Eightshift/Sniffs/Security/HelpersEscapeSniff.php`	Modernizes string checks and refactors control flow.
`Eightshift/Sniffs/Shortcodes/DisallowDoShortcodeSniff.php`	Tightens PHPStan types and adds explicit return type.
`Eightshift/Tests/Security/HelpersEscapeUnitTest.php`	Updates fixtures’ expected error lists and modernizes control flow.
`Eightshift/Tests/Shortcodes/DisallowDoShortcodeUnitTest.php`	Adds `strict_types=1`.
`Eightshift/Tests/Commenting/FunctionCommentUnitTest.php`	Adds `strict_types=1`.
`Eightshift/Docs/Security/HelpersEscapeStandard.xml`	Adds/renames documentation to match `HelpersEscapeSniff`.
`README.md`	Updates install version guidance and modernizes formatting/badges.
`CHANGELOG.md`	Adds 4.0.0 changelog entry documenting breaking/tooling changes.
`LICENSE`	Updates copyright year.
`SECURITY.md`	Removes repository security policy doc (handled via GitHub settings).
`.gitignore`	Ignores PHPUnit cache file and trims ignored entries.
`.phpunit.result.cache`	Removes committed PHPUnit cache artifact.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

dingo-d

Small comments I noticed

Ivan Ružević and others added 25 commits May 25, 2026 10:49

docs(plans): add PHP 8.3 minimum bump plan and follow-ups

0cf614d

build: require PHP >= 8.3

fb0b863

config(ruleset): bump PHPCompatibility testVersion to 8.3-

df3a223

config(sample): bump PHPCompatibility testVersion to 8.3-

5618957

ci: target PHP 8.3 and 8.4, pin setup-php to v2.37.1

1b12b52

Drops PHP 7.4-8.2 from the matrix, collapses now-redundant version-conditional steps, and addresses Dependabot alert GHSA-5wxr-w449-57cm by pinning setup-php to a patched release.

ci: drop dead allowed_failure matrix dimension

385657f

docs(readme): reflect PHP 8.3+ requirement and 4.0 install hint

e7f00f3

docs(changelog): document 4.0.0 PHP 8.3 minimum bump

3ae6147

ci: fix setup-php tag format (2.37.1, no v prefix)

259679a

GitHub Action tag for shivammathur/setup-php is published without a leading 'v'. CI was failing with 'Unable to resolve action ... unable to find version v2.37.1' on every job.

refactor(Security): modernize HelpersEscapeSniff to PHP 8 (str_contains)

6282fea

Replace 9× \strpos(..., ...) !== false with \str_contains(...). Behaviour unchanged; modernization driven by 4.0.0 PHP 8.3 minimum. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs(changelog): note HelpersEscapeSniff PHP 8 modernization in 4.0.0

a2a1109

Folds the modernization work into the 4.0.0 entry rather than a separate 4.1.0 (same PR, same release). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

updating linter

77fd3b4

updating linter

ce306e5

updating linter

7db90a8

updating linter

dc738b6

updating linter

317fd99

updating linter

55b0403

updating linter

b18908b

updating linter

efd77e3

updating linter

e393288

updating linter

1c0dc07

updating linter

e92d0b7

updating linter

73f6a13

iruzevic changed the title ~~feat!: require PHP >= 8.3 (4.0.0)~~ feat!: require PHP >= 8.4 (4.0.0) May 25, 2026

Ivan Ružević and others added 2 commits May 25, 2026 14:48

updating linter

235bc72

iruzevic requested a review from a team May 25, 2026 12:56

iruzevic self-assigned this May 25, 2026

iruzevic requested a review from Copilot May 25, 2026 12:56

iruzevic added the ai-assisted AI assisted label May 25, 2026

Copilot started reviewing on behalf of iruzevic May 25, 2026 12:56 View session

Copilot AI reviewed May 25, 2026

View reviewed changes

Comment thread rector.php

Comment thread README.md Outdated

Comment thread README.md Outdated

Comment thread phpstan.neon.dist Outdated

Comment thread Eightshift/ruleset.xml Outdated

Comment thread .github/workflows/ci.yml

Comment thread CHANGELOG.md

Ivan Ružević added 6 commits May 25, 2026 15:04

updating linter

10070d8

updating linter

006ce87

updating linter

11aff14

updating linter

17ed880

updating linter

cb9faf1

updating linter

80a31d5

goranalkovic-infinum previously approved these changes May 25, 2026

View reviewed changes

iobrado previously approved these changes May 25, 2026

View reviewed changes

dingo-d reviewed May 25, 2026

View reviewed changes

Comment thread Eightshift/Tests/Commenting/FunctionCommentUnitTest.php Outdated

Comment thread Eightshift/Tests/Security/HelpersEscapeUnitTest.php Outdated

updating linter

5a2d2d8

iruzevic dismissed stale reviews from iobrado and goranalkovic-infinum via 5a2d2d8 May 25, 2026 13:19

iobrado approved these changes May 25, 2026

View reviewed changes

iruzevic enabled auto-merge (squash) May 25, 2026 13:24

iruzevic merged commit f89e17e into main May 25, 2026
7 of 14 checks passed

iruzevic deleted the feat/min-php-8.3 branch May 25, 2026 13:24

Navigation Menu

Uh oh!

feat!: require PHP >= 8.4 (4.0.0) - #67

feat!: require PHP >= 8.4 (4.0.0)#67
iruzevic merged 34 commits into
mainfrom
feat/min-php-8.3

iruzevic commented May 25, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dingo-d left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

iruzevic commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Core bump

Toolchain additions

Bundled fixes

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dingo-d left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

iruzevic commented May 25, 2026 •

edited

Loading