chore: update WPCS to patch CVE-2026-45293

[pattonwebz]

Summary

• WPCS (wp-coding-standards/wpcs) versions >= 0.14.1, < 3.4.1 have an eval() arbitrary code execution vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff (CVE-2026-45293). This repo was locked to 3.3.0, which is vulnerable.
• Ran composer update wp-coding-standards/wpcs automattic/vipwpcs --with-all-dependencies to bring in the patched 3.4.1 (and vipwpcs 3.1.0). composer.json constraints already allowed these versions, so only composer.lock changed.
• Re-ran phpcs; no new violations.

Linear: PRO-1249 (subtask of PRO-1245)

Test plan

• composer update wp-coding-standards/wpcs automattic/vipwpcs --with-all-dependencies
• composer check-cs — clean, no violations

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• composer.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c522ec9d-94fc-442b-994d-e4b0842f9e55

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch william/pro-1249-update-phpcswpcs-boardscribe

---

_{Comment @coderabbitai help to get the list of available commands.}