Pin exact versions for all npm dependencies

.github/workflows/reusable-check-built-files.yml

@@ -47,12 +47,8 @@ jobs:
           node-version-file: '.nvmrc'
           cache: npm
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-        with:
-          custom-cache-suffix: $(/bin/date -u --date='last Mon' "+%F")
 
       - name: Log debug information
         run: |

.github/workflows/reusable-coding-standards-php.yml

@@ -73,12 +73,8 @@ jobs:
             .cache/phpcs-tests.json
           key: ${{ runner.os }}-date-${{ steps.get-date.outputs.date }}-php-${{ inputs.php-version }}-phpcs-cache-${{ hashFiles('**/composer.json', 'phpcs.xml.dist') }}
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-        with:
-          custom-cache-suffix: ${{ steps.get-date.outputs.date }}
 
       - name: Make Composer packages available globally
         run: echo "${PWD}/vendor/bin" >> "$GITHUB_PATH"

.github/workflows/reusable-php-compatibility.yml

@@ -68,12 +68,8 @@ jobs:
           path: .cache/phpcompat.json
           key: ${{ runner.os }}-date-${{ steps.get-date.outputs.date }}-php-${{ inputs.php-version }}-phpcompat-cache-${{ hashFiles('**/composer.json', 'phpcompat.xml.dist') }}
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-        with:
-          custom-cache-suffix: ${{ steps.get-date.outputs.date }}
 
       - name: Make Composer packages available globally
         run: echo "${PWD}/vendor/bin" >> "$GITHUB_PATH"

.github/workflows/reusable-phpstan-static-analysis-v1.yml

@@ -67,12 +67,8 @@ jobs:
           node --version
           composer --version
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-        with:
-          custom-cache-suffix: $(/bin/date -u --date='last Mon' "+%F")
 
       - name: Make Composer packages available globally
         run: echo "${PWD}/vendor/bin" >> "$GITHUB_PATH"

.github/workflows/reusable-phpunit-tests-v3.yml

@@ -154,8 +154,10 @@ jobs:
           php-version: '${{ inputs.php }}'
           coverage: none
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
+      # Passing a custom cache suffix ensures that the cache is flushed at least once per week.
+      #
+      # This must remain for backwards compatibility. While the composer.lock file was reintroduced in WordPress 7.1,
+      # older branches also make use of this reusable workflow file.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
         with:

.github/workflows/reusable-test-core-build-process.yml

@@ -50,6 +50,7 @@ jobs:
   #
   # Performs the following steps:
   # - Checks out the repository.
+  # - Installs Composer dependencies.
   # - Sets up Node.js.
   # - Logs debug information about the GitHub Action runner.
   # - Installs npm dependencies.
@@ -75,20 +76,9 @@ jobs:
           show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
           persist-credentials: false
 
-      # This date is used to ensure that the PHPCS cache is cleared at least once every week.
-      # http://man7.org/linux/man-pages/man1/date.1.html
-      - name: "Get last Monday's date"
-        id: get-date
-        if: ${{ inputs.test-certificates }}
-        run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"
-
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         if: ${{ inputs.test-certificates }}
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-        with:
-          custom-cache-suffix: ${{ steps.get-date.outputs.date }}
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/reusable-test-local-docker-environment-v1.yml

@@ -110,12 +110,8 @@ jobs:
           php-version: '${{ inputs.php }}'
           coverage: none
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-        with:
-          custom-cache-suffix: $(/bin/date -u --date='last Mon' "+%F")
 
       - name: Install npm dependencies
         run: npm ci

.gitignore

@@ -26,7 +26,6 @@ wp-tests-config.php
 /phpstan.neon
 /*.tsbuildinfo
 /jsdoc
-/composer.lock
 /vendor
 /src/wp-admin/css/*.min.css
 /src/wp-admin/css/*-rtl.css

Gruntfile.js

@@ -1946,9 +1946,9 @@ module.exports = function(grunt) {
 		var spawn = require( 'child_process' ).spawnSync;
 		var fs = require( 'fs' );
 
-		// Ensure that `composer update` has been run and the dependency is installed.
+		// Ensure that `composer install` has been run and the dependency is installed.
 		if ( ! fs.existsSync( 'vendor' ) || ! fs.existsSync( 'vendor/composer' ) || ! fs.existsSync( 'vendor/composer/ca-bundle' ) ) {
-			grunt.log.error( 'composer/ca-bundle dependency is missing. Please run `composer update` before attempting to upgrade the certificate bundle.' );
+			grunt.log.error( 'composer/ca-bundle dependency is missing. Please run `composer install` before attempting to upgrade the certificate bundle.' );
 			done( false );
 			return;
 		}

composer.json

@@ -24,17 +24,19 @@
 	"require-dev": {
 		"composer/ca-bundle": "1.5.12",
 		"squizlabs/php_codesniffer": "3.13.5",
-		"wp-coding-standards/wpcs": "~3.3.0",
-		"phpcompatibility/phpcompatibility-wp": "~2.1.3",
+		"wp-coding-standards/wpcs": "3.3.0",
+		"phpcompatibility/phpcompatibility-wp": "2.1.8",
 		"phpstan/phpstan": "2.2.2",
 		"phpstan/phpstan-phpunit": "2.0.16",
-		"yoast/phpunit-polyfills": "^1.1.0"
+		"yoast/phpunit-polyfills": "1.1.5"
 	},
 	"config": {
 		"allow-plugins": {
 			"dealerdirect/phpcodesniffer-composer-installer": true
 		},
-		"lock": false
+		"platform": {
+			"php": "7.4"
+		}
 	},
 	"autoload-dev": {
 		"psr-4": {