Bump wp-module-installer dependency to ^1.7.4

[arunshenoy99]

https://newfold.atlassian.net/browse/PRESS0-3627

Proposed changes

The auto-install of Payments & Shipping added in #930 (detect_plugin_activation() → PluginInstaller::install('nfd_slug_wp_plugin_payments_shipping', true)) depends on the catalog entry that ships in wp-module-installer 1.7.4 (added in newfold-labs/wp-module-installer#331, released in tag 1.7.4).

The current constraint ^1.7.3 also permits the older 1.7.3 release (tagged 2026-03-23, before #331), which does not contain the nfd_slug_wp_plugin_payments_shipping slug. With ^1.7.3, composer could resolve an installer without that entry — in which case the install call falls through to a WP_Error and silently no-ops (no fatal, but the plugin is never installed). The committed composer.lock was in fact pinned to the old 1.7.3 (ref 6c0471fc).

• Bumps require constraint: newfold-labs/wp-module-installer ^1.7.3 → ^1.7.4.
• Refreshes composer.lock (installer 1.7.3 → 1.7.4, ref 3d3b9004) via composer update newfold-labs/wp-module-installer. composer validate passes.

Type of Change

• Bugfix (non-breaking change which fixes an issue)

Further comments

Dependency/lock change only. Guarantees the Payments & Shipping catalog entry is present wherever this module is consumed (e.g. the Bluehost plugin), so the WooCommerce-activation auto-install works as intended.

[github-actions]

AI code review

✅ Strengths

• Clear, minimal fix that directly addresses the regression risk from Auto-install Payments & Shipping plugin on WooCommerce activation #930 by guaranteeing the Payments & Shipping slug exists via wp-module-installer >= 1.7.4.
• composer.lock refreshed to 1.7.4 with correct source/dist references; composer validate noted as passing.
• Scope is tight (dependency and lock only), which keeps risk low and makes rollback straightforward if needed.

⚠️ Suggestions (non-blocking)

• Update docs per repo guidance:
  • docs/dependencies.md: reflect the new minimum wp-module-installer version.
  • docs/changelog.md: add an entry noting the dependency bump and the WooCommerce auto-install reliability fix.
• Consider adding a defensive log or metric around the auto-install call path if PluginInstaller::install() returns a WP_Error (even though this bump should prevent the missing-slug case). This would help detect future catalog regressions.
• After merge, ensure downstream consumers (e.g., Bluehost plugin) run composer install to pick up the new lock and avoid resolving 1.7.3 from caches.

❌ Issues (blocking/critical)

• None found. No security, performance, or correctness risks apparent from this diff.

Verdict

✅ Verdict: LGTM — safe dependency bump that unblocks the auto-install flow. Please follow up with the minor docs/changelog updates noted above.

[github-actions]

Coverage: Base 8.88% → PR 8.88% (must not decrease).
✅ No decrease.

project coverage report 8.88% @ 6d6b43d