chore(deps-dev): bump wp-coding-standards/wpcs from 3.4.0 to 3.4.1

[dependabot]

Bumps wp-coding-standards/wpcs from 3.4.0 to 3.4.1.

Release notes

Sourced from wp-coding-standards/wpcs's releases.

3.4.1 - 2026-07-27

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

• The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #2770
• The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #2770
• Various housekeeping, including documentation improvements.

Fixed

• SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #2771 This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. For more details, see the security advisory Thanks to @​FORIMOC for responsibly disclosing the vulnerability.

Changelog

Sourced from wp-coding-standards/wpcs's changelog.

[3.4.1] - 2026-07-27

This is a security release and all users are advised to update their WordPressCS install as soon as possible.

Changed

• The minimum required PHPCSUtils version to 1.2.3 (was 1.2.2). #2770
• The minimum required PHPCSExtra version to 1.5.1 (was 1.5.0). #2770
• Various housekeeping, including documentation improvements.

Fixed

• SECURITY FIX: Running the WordPress.WP.EnqueuedResourceParameters sniff over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #2771 This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the WordPress-Docs ruleset are not affected. For more details, see the security advisory. Thanks to [@​FORIMOC] for responsibly disclosing the vulnerability.

#2770: WordPress/WordPress-Coding-Standards#2770 #2771: WordPress/WordPress-Coding-Standards#2771

Commits

• ec2ff94 Merge pull request #2773 from WordPress/develop
• b558639 Merge pull request #2772 from WordPress/feature/changelog-3.4.1
• 1696dc8 Changelog for the release of WordPressCS 3.4.1
• a29048d Merge pull request #2771 from WordPress/security/enqueuedresourceparams-fix-i...
• 7262444 WP/EnqueuedResourceParameters: remove eval() from is_falsy()
• 54719c0 Merge pull request #2770 from WordPress/feature/composer-update-versions
• 267d84e Composer: update minimum version PHPCSUtils + PHPCSExtra
• e8064a6 Add SECURITY.md file (#2766)
• 7ac8973 Merge pull request #2768 from WordPress/dependabot/github_actions/action-runn...
• 9466b4b GH Actions: Bump actions/checkout in the action-runners group
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.