[swissspidy]

roave/security-advisories also conflicts with PHP releases that have known advisories, currently php <8.2.35 | >=8.3,<8.3.36 | >=8.4,<8.4.27 | >=8.5,<8.5.12 (Roave/SecurityAdvisories#155). composer install therefore fails on CI legs whose PHP is in that range, including old PHP versions and runners that lag a patch release (e.g. Windows on PHP 8.5.11; see wp-cli/wp-cli-tests run 40820389437).

This changes reusable-unit.yml and reusable-functional.yml to:

• Update PHP to the latest patch on Windows (update: true for setup-php). Ubuntu and macOS runners pick up patched builds automatically, but Windows doesn't (PHP security releases shivammathur/setup-php#1139).
• Drop roave only where it can't install. A new step does nothing unless the package has roave/security-advisories in require-dev. It reads roave's current php conflict constraint from Packagist (composer show --available) and removes roave from require-dev only if the running PHP version falls within that constraint.

Up-to-date PHP versions keep roave, so it still flags other insecure dependencies. The step uses php/composer rather than jq, so it also runs on Windows and macOS.

Ignoring the PHP conflict is safe on CI because setup-php ships builds with security fixes backported, even for EOL versions, so the version number alone overstates the risk (see shivammathur/setup-php#1139).

Verification (wp-cli/wp-cli-tests, run 40834001475 against this branch): all 60 jobs pass. Windows updates to PHP 8.5.12 and keeps roave, Ubuntu PHP 8.5 keeps roave, and PHP 7.4 drops it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UWTd5mjnLFLCExqdULKVSB

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0d62bce7-841e-4e20-a4c6-53cd6b22252e

Commits

Reviewing files that changed from the base of the PR and between e9104a6 and c7459ef.

Files selected for processing: 2

• .github/workflows/reusable-functional.yml
• .github/workflows/reusable-unit.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

Both reusable Composer workflows enable PHP setup updates on Windows. Before dependency installation, each workflow checks whether roave/security-advisories is required and removes it without updating dependencies when the current PHP version matches one of its conflict constraints.

Changes: Composer Compatibility

Layer / File(s)	Summary
Workflow PHP compatibility handling .github/workflows/reusable-functional.yml, .github/workflows/reusable-unit.yml	Both workflows enable the PHP setup update option on Windows. Before installing dependencies, they check the package’s PHP conflict constraints and remove roave/security-advisories with no dependency update when a constraint matches.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: schlessera

Merge Risk: Minimal · up to c7459

The workflows conditionally remove Roave for conflicting PHP versions and request Windows PHP updates. No merge-blocking issue was established.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and specifically describes the primary CI change: removing roave/security-advisories when it conflicts with the active PHP version.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot code review could not start because the generated Actions workflow failed validation. Check .github/workflows/copilot-code-review.yml (or .yaml) on your default branch, or copilot-setup-steps.yml (or .yaml) if the code review workflow is absent. Check action references and the placement of workflow settings. If the configuration is valid, or you have no setup workflow, contact GitHub Support.