Release version 2.0.20

.github/workflows/cs.yml

@@ -13,10 +13,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   actionlint: #----------------------------------------------------------------------
     name: 'Check GHA workflows'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # Needed to clone the repo.
 
     steps:
       - name: Checkout code
@@ -41,6 +47,8 @@ jobs:
   phpcs: #----------------------------------------------------------------------
     name: 'PHPCS'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # Needed to clone the repo.
 
     steps:
       - name: Checkout code
@@ -51,7 +59,7 @@ jobs:
       - name: Install PHP
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
-          php-version: '7.4'
+          php-version: 'latest'
           coverage: none
           tools: cs2pr
 

.github/workflows/label-merge-conflicts.yml

@@ -13,10 +13,16 @@ on:
       - synchronize
       - reopened
 
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   check-prs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'WordPress'
+    permissions:
+      pull-requests: write # Needed to add and remove labels on the PR.
 
     name: Check PRs for merge conflicts
 

.github/workflows/lint.yml

@@ -13,9 +13,15 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   lint: #----------------------------------------------------------------------
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # Needed to clone the repo.
 
     strategy:
       matrix:
@@ -38,6 +44,8 @@ jobs:
           ini-values: error_reporting=-1, display_errors=On, display_startup_errors=On, log_errors_max_len=0
           coverage: none
           tools: cs2pr
+        env:
+          fail-fast: true
 
       # Install dependencies and handle caching in one go.
       # @link https://github.com/marketplace/actions/install-composer-dependencies

.github/workflows/quicktest.yml

@@ -13,11 +13,17 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   #### QUICK TEST STAGE ####
   # Runs the tests against select PHP versions for pushes to arbitrary branches.
   quicktest:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # Needed to clone the repo.
 
     strategy:
       matrix:
@@ -37,6 +43,8 @@ jobs:
           php-version: ${{ matrix.php }}
           ini-values: zend.assertions=1, error_reporting=-1, display_errors=On, display_startup_errors=On, log_errors_max_len=0
           coverage: none
+        env:
+          fail-fast: true
 
       # At least one test needs a non-en_US locale to be available, so make sure it is.
       - name: Install locales

.github/workflows/reusable-update-cacert.yml

@@ -3,11 +3,19 @@ name: Certificates
 on:
   workflow_call:
 
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   certificate-check:
     name: "Check for updated certificate bundle"
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: write      # Needed to push commits to a branch in the repo.
+      pull-requests: write # Needed to create a PR.
+
     steps:
       - name: Determine branches to use
         id: branches

.github/workflows/test.yml

@@ -14,10 +14,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   #### TEST STAGE ####
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # Needed to clone the repo.
 
     strategy:
       # Keys:
@@ -49,6 +55,8 @@ jobs:
           ini-values: zend.assertions=1, error_reporting=-1, display_errors=On, display_startup_errors=On, log_errors_max_len=0
           coverage: ${{ matrix.coverage && 'xdebug' || 'none' }}
           tools: cs2pr
+        env:
+          fail-fast: true
 
       # At least one test needs a non-en_US locale to be available, so make sure it is.
       - name: Install locales

.github/workflows/update-cacert-cron.yml

@@ -11,9 +11,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   certificate-check:
     # Don't run the cron job on forks.
     if: ${{ github.event.repository.fork == false }}
+    permissions:
+      contents: write      # Needed to push commits to a branch in the repo.
+      pull-requests: write # Needed to create a PR.
 
     uses: ./.github/workflows/reusable-update-cacert.yml

.github/workflows/update-cacert.yml

@@ -24,6 +24,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   certificate-check:
+    permissions:
+      contents: write      # Needed to push commits to a branch in the repo.
+      pull-requests: write # Needed to create a PR.
+
     uses: ./.github/workflows/reusable-update-cacert.yml

.github/workflows/update-website.yml

@@ -21,9 +21,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  pull-requests: write
-  contents: write
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
 
 jobs:
   prepare:
@@ -32,6 +32,9 @@ jobs:
     if: github.repository == 'WordPress/Requests'
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # Needed to clone the repo.
+
     steps:
       # By default use the `stable` branch as the published docs should always
       # reflect the latest release.
@@ -89,6 +92,10 @@ jobs:
     if: github.repository == 'WordPress/Requests'
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: write      # Needed to push commits to a branch in the repo.
+      pull-requests: write # Needed to create a PR.
+
     steps:
       # PRs based on the "pull request" event trigger will contain changes from the
       # current `develop` branch, so should not be published as the website should
@@ -193,7 +200,7 @@ jobs:
 
       # Test that the site builds correctly.
       - name: Set up Ruby
-        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           # Use the version as per https://pages.github.com/versions/.
           ruby-version: 3.3.4

.phpcs.xml.dist

@@ -71,12 +71,6 @@
 		<!-- Replaced by the Squiz version of the sniff which doesn't enforce whitespace around array index keys. -->
 		<exclude name="WordPress.Arrays.ArrayKeySpacingRestrictions"/>
 
-		<!-- Disabled as the preference for this repo is no spaces on the inside of parentheses.
-			 Once WPCS 3.0.0 comes out, the opposite can be enforced via the
-			 NormalizedArrays.Arrays.ArrayBraceSpacing sniff from PHPCSExtra. -->
-		<exclude name="WordPress.Arrays.ArrayDeclarationSpacing.NoSpaceAfterArrayOpener"/>
-		<exclude name="WordPress.Arrays.ArrayDeclarationSpacing.NoSpaceBeforeArrayCloser"/>
-
 		<!-- Let spacing before a cast be determined by the operator/parentheses whitespace rule
 			 of the preceding character. -->
 		<exclude name="WordPress.WhiteSpace.CastStructureSpacing"/>
@@ -86,7 +80,7 @@
 			 ========================================================================== -->
 		<exclude name="WordPress.PHP.YodaConditions"/>
 		<!-- A while loop is the only valid control structure where an assignment can be justified. -->
-		<exclude name="WordPress.CodeAnalysis.AssignmentInCondition.FoundInWhileCondition"/>
+		<exclude name="Generic.CodeAnalysis.AssignmentInCondition.FoundInWhileCondition"/>
 
 		<!-- ==========================================================================
 			 Miscellaneous other exclusions.
@@ -96,7 +90,7 @@
 		<exclude name="WordPress.Files.FileName"/>
 
 		<!-- WPCS demands long arrays. We'll be using short arrays from now on. -->
-		<exclude name="Generic.Arrays.DisallowShortArraySyntax"/>
+		<exclude name="Universal.Arrays.DisallowShortArraySyntax"/>
 
 		<!-- Ignore WP specific sniffs as Requests is also used outside of a WP context. -->
 		<exclude name="WordPress.WP"/>
@@ -133,6 +127,12 @@
 		</properties>
 	</rule>
 
+	<rule ref="NormalizedArrays.Arrays.ArrayBraceSpacing">
+		<properties>
+			<property name="spacesSingleLine" value="0"/>
+		</properties>
+	</rule>
+
 	<!-- Include replacement sniffs which enforce the opposite of WPCS for several excluded sniffs. -->
 	<rule ref="Squiz.WhiteSpace.ControlStructureSpacing">
 		<exclude name="Squiz.WhiteSpace.ControlStructureSpacing.LineAfterClose"/>
@@ -173,7 +173,7 @@
 	<!-- Allow error silencing only for a select group of functions. -->
 	<rule ref="WordPress.PHP.NoSilencedErrors">
 		<properties>
-			<property name="custom_whitelist" type="array">
+			<property name="customAllowedFunctionsList" type="array">
 				<element value="gzdecode"/>
 				<element value="gzinflate"/>
 				<element value="gzuncompress"/>

CHANGELOG.md

@@ -1,6 +1,15 @@
 Changelog
 =========
 
+2.0.20
+------
+
+### Overview of changes
+- Update bundled certificates as of 2026-08-13. [#1076]
+- General housekeeping.
+
+[#1076]: https://github.com/WordPress/Requests/pull/1076
+
 2.0.19
 ------