search

liquidweb / woocommerce-custom-orders-table

Store WooCommerce order data in a custom table for improved performance.
GNU General Public License v3.0
476 stars 51 forks source link

Update WP-CLI to `v2.5.0` #186

Closed tyrann0us closed 3 years ago

tyrann0us commented 3 years ago

Please check if the PR fulfills these requirements

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...) Dependency update

What is the current behavior? (You can also link to an open issue here) WP-CLI is installed at version v2.2.0. However, versions prior v2.5.0 are affected by a security vulnerability, see https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj.

What is the new behavior (if this is a feature change)? WP-CLI is updated to v2.5.0.

This also moves the platform dependency php to the first line of the "require-dev" property according to the Composer JSON schema.

Does this PR introduce a breaking change? (What changes might users need to make in their application due to this PR?) Unknown, because untested.

Other information: The vulnerability in WP-CLI triggers security warnings (e.g. from Private Packagist) for projects using the WooCommerce Custom Orders Table plugin. So even though the vulnerability itself may not be exploitable in this plugin, updating WP-CLI will silence the security warnings.

tyrann0us commented 3 years ago

I looked a little bit at the git history.

@stevegrunwell, you added wp-cli/wp-cli as a dependency here: https://github.com/liquidweb/woocommerce-custom-orders-table/pull/79/files#diff-d2ab9925cad7eac58e0ff4cc0d251a937ecf49e4b6bf57f8b95aab76648a9d34R14.

And in https://github.com/liquidweb/woocommerce-custom-orders-table/pull/162/files#diff-d2ab9925cad7eac58e0ff4cc0d251a937ecf49e4b6bf57f8b95aab76648a9d34L31, you removed the dependency again.

I don't know your branching strategy; will this PR be "backported" to master? If so, when? Because if this is going to happen soon, this PR is superfluous. 😉