Fatal error from WordPressVIPMinimum\Sniffs\Security\T_PROPERTY

[paulschreiber]

Describe the bug

Starting this week, the action is producing this error on all checks:

Fatal error: Uncaught Error: Undefined constant "WordPressVIPMinimum\Sniffs\Security\T_PROPERTY" in /github/home/.composer/vendor/automattic/vipwpcs/WordPressVIPMinimum/Sniffs/Security/UnderscorejsSniff.php:57

Steps to Reproduce

Dependabot created unrelated updates. PHPCS checks are failing.

Example repo: https://github.com/techmatters/bd4d-plugin
Example PR: techmatters/bd4d-plugin#282
Example job: https://github.com/techmatters/bd4d-plugin/actions/runs/17731004470/job/50381996501?pr=282

Screenshots, screen recording, code snippet

GitHub workflow:

name: WPCS check

on: pull_request

jobs:
  phpcs:
      name: WPCS
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@v5
        - name: WPCS check
          uses: 10up/wpcs-action@stable
          with:
            enable_warnings: true
            standard: 'WordPress-VIP-Go'
            use_local_config: true

Environment

GitHub CI with ubuntu-latest runner

Question	Answer
PHP version	8.3.6
PHP_CodeSniffer version	3.13.4
PHPCSUtils version	1.1.2
VIPCS version	3.0.1
WordPressCS version	3.2.0
PHPCSExtra version	1.4.1
VariableAnalysis version	2.12.0

WordPress information

No response

[GaryJones]

Hi @paulschreiber,

The T_PROPERTY token was removed from PHPCS 4.x.

The 10up/wpcs-action which is used in the plugin's CI workflow, has this Dockerfile, which will clone the PHPCS repo, and then read from the tags to decide which version of the PHAR file should be installed.

The reason it started breaking last week, is because @jrfnl changed the default branch (see PHPCSStandards/PHP_CodeSniffer#1258) for the PHPCS repo. So the git clone now results in the 4.x as the default branch, and git describe --abbrev=0 --tags returns 4.0.0 currently - as such, PHPCS v4 is installed, and VIPCS doesn't claim any compatibility with that.

Rather than use a combination of git clone (in the Docker file), and Composer (in the plugin repo), I'd suggest keeping it to just Composer to resolve the versioning.

VIPCS will need compatibility with PHPCS v4 at some stage, but we'll need WPCS to be compatible as well anyway.