Fix the WPCS code execution advisory and require PHP 8.2

[svandragt]

The locked WordPress Coding Standards version has a high-severity arbitrary code execution advisory. It is the only open Dependabot alert on this repo.¹ The package is a dev dependency, so it affects anyone who runs the linter, not sites that run the plugin.

The fixed release needs version 2 of the Human Made coding standards, and those need PHP 8.2 to run. This PR also raises the plugin's own minimum PHP version to 8.2, so the plugin and its tooling require the same version.

What changed

• The Human Made coding standards move from 1.x to 2.5, which brings in the patched WordPress Coding Standards 3.4.1.² The Composer audit now reports no advisories.
• Breaking: the plugin now requires PHP 8.2 or later. WordPress refuses to activate it on older PHP, and Composer refuses to install it there.³
• The new standards add PSR-12 formatting rules. The code fixes are mechanical: no space before a return type colon, a space after function in closures, and no blank line before a class's closing brace. phpcbf applied all of them.
• The static methods on Flags now say public. PHP already treated them as public, so callers see no change.
• The admin bar file imports the Ajax namespace instead of the single function. This keeps the import order valid for both ordering rules in the new standards, which conflict for function imports.⁴

Test plan

• The linter passes on PHP 8.2 with the new standards and the 8.2 compatibility target (exit 0).⁵
• Every PHP file passes a syntax check.
• composer validate passes and composer audit reports no advisories.
• CI lints this PR once Lint PHP and report Composer package changes in CI #26 (Lint PHP and report Composer package changes in CI) is merged. This repo has no CI on master yet.

Not checked: I did not load the plugin in WordPress. Apart from the version bump, the diff changes formatting, adds visibility keywords that change nothing, and changes one namespaced function call.

Risk: a site on PHP older than 8.2 that updates the plugin can no longer activate it. Mention this in the release notes for the next version.

Merge #26 first. It switches CI to PHP 8.2, which this lock needs. #25 (Cookie scope) needs a rebase after this PR merges, because its new code uses the old return type spacing.

Footnotes

1. wp-coding-standards/wpcs >= 0.14.1, < 3.4.1, alert 1 at https://github.com/humanmade/wp-flags/security/dependabot/1. ↩

2. humanmade/coding-standards ^1.2 → ^2.5, and wp-coding-standards/wpcs 2.3.0 → 3.4.1. minimum-stability is still dev, so some sniff packages lock to dev branches, as squizlabs/php_codesniffer already did. ↩

3. Requires PHP: 8.2 in the plugin.php header, "php": ">=8.2" in composer.json, testVersion 8.2- in phpcs.ruleset.xml, and config.platform.php pinned to 8.2. ↩

4. PSR12.Files.FileHeader.IncorrectOrder wants class imports before function imports. PSR2R.Namespaces.UseInAlphabeticalOrder wants all imports in alphabetical order. The call is now Ajax\get_toggle_url() in inc/admin-bar.php. ↩

5. vendor/squizlabs/php_codesniffer/bin/phpcs --standard=phpcs.ruleset.xml ./
   

   ↩