Pin exact versions for all npm dependencies

.github/workflows/reusable-check-built-files.yml

@@ -48,18 +48,8 @@ jobs:
           node-version-file: '.nvmrc'
           cache: npm
 
-      # This date is used to ensure that the PHPCS cache is cleared at least once every week.
-      # http://man7.org/linux/man-pages/man1/date.1.html
-      - name: "Get last Monday's date"
-        id: get-date
-        run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"
-
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-        with:
-          custom-cache-suffix: ${{ steps.get-date.outputs.date }}
 
       - name: Log debug information
         run: |

.github/workflows/reusable-coding-standards-php.yml

@@ -72,12 +72,8 @@ jobs:
             .cache/phpcs-tests.json
           key: ${{ runner.os }}-date-${{ steps.get-date.outputs.date }}-php-${{ inputs.php-version }}-phpcs-cache-${{ hashFiles('**/composer.json', 'phpcs.xml.dist') }}
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-        with:
-          custom-cache-suffix: ${{ steps.get-date.outputs.date }}
 
       - name: Make Composer packages available globally
         run: echo "${PWD}/vendor/bin" >> "$GITHUB_PATH"

.github/workflows/reusable-php-compatibility.yml

@@ -68,12 +68,8 @@ jobs:
           path: .cache/phpcompat.json
           key: ${{ runner.os }}-date-${{ steps.get-date.outputs.date }}-php-${{ inputs.php-version }}-phpcompat-cache-${{ hashFiles('**/composer.json', 'phpcompat.xml.dist') }}
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-        with:
-          custom-cache-suffix: ${{ steps.get-date.outputs.date }}
 
       - name: Make Composer packages available globally
         run: echo "${PWD}/vendor/bin" >> "$GITHUB_PATH"

.github/workflows/reusable-phpstan-static-analysis-v1.yml

@@ -58,24 +58,14 @@ jobs:
           coverage: none
           tools: cs2pr
 
-      # This date is used to ensure that the Composer cache is cleared at least once every week.
-      # http://man7.org/linux/man-pages/man1/date.1.html
-      - name: "Get last Monday's date"
-        id: get-date
-        run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"
-
       - name: General debug information
         run: |
           npm --version
           node --version
           composer --version
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-        with:
-          custom-cache-suffix: ${{ steps.get-date.outputs.date }}
 
       - name: Make Composer packages available globally
         run: echo "${PWD}/vendor/bin" >> "$GITHUB_PATH"

.github/workflows/reusable-phpunit-tests-v3.yml

@@ -154,12 +154,8 @@ jobs:
           php-version: '${{ inputs.php }}'
           coverage: none
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-        with:
-          custom-cache-suffix: $(/bin/date -u --date='last Mon' "+%F")
 
       - name: Install npm dependencies
         run: npm ci

.github/workflows/reusable-test-core-build-process.yml

@@ -75,20 +75,9 @@ jobs:
           show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
           persist-credentials: false
 
-      # This date is used to ensure that the PHPCS cache is cleared at least once every week.
-      # http://man7.org/linux/man-pages/man1/date.1.html
-      - name: "Get last Monday's date"
-        id: get-date
-        if: ${{ inputs.test-certificates }}
-        run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"
-
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         if: ${{ inputs.test-certificates }}
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-        with:
-          custom-cache-suffix: ${{ steps.get-date.outputs.date }}
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/reusable-test-local-docker-environment-v1.yml

@@ -110,12 +110,8 @@ jobs:
           php-version: '${{ inputs.php }}'
           coverage: none
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-        with:
-          custom-cache-suffix: $(/bin/date -u --date='last Mon' "+%F")
 
       - name: Install npm dependencies
         run: npm ci

.gitignore

@@ -26,7 +26,6 @@ wp-tests-config.php
 /phpstan.neon
 /*.tsbuildinfo
 /jsdoc
-/composer.lock
 /vendor
 /src/wp-admin/css/*.min.css
 /src/wp-admin/css/*-rtl.css

Gruntfile.js

@@ -1911,16 +1911,16 @@ module.exports = function(grunt) {
 		var spawn = require( 'child_process' ).spawnSync;
 		var fs = require( 'fs' );
 
-		// Ensure that `composer update` has been run and the dependency is installed.
+		// Ensure that `composer install` has been run and the dependency is installed.
 		if ( ! fs.existsSync( 'vendor' ) || ! fs.existsSync( 'vendor/composer' ) || ! fs.existsSync( 'vendor/composer/ca-bundle' ) ) {
-			grunt.log.error( 'composer/ca-bundle dependency is missing. Please run `composer update` before attempting to upgrade the certificate bundle.' );
+			grunt.log.error( 'composer/ca-bundle dependency is missing. Please run `composer install` before attempting to upgrade the certificate bundle.' );
 			done( false );
 			return;
 		}
 
 		/*
 		 * Because the `composer/ca-bundle` is pinned to an exact version to ensure upgrades are applied intentionally,
-		 * the `composer update` command will not upgrade the dependency. Instead, `composer require` must be called,
+		 * the `composer install` command will not upgrade the dependency. Instead, `composer require` must be called,
 		 * but the specific version being upgraded to must be known and passed to the command.
 		 */
 		var outdatedResult = spawn( 'composer', [ 'outdated', 'composer/ca-bundle', '--format=json' ] );

composer.json

@@ -21,16 +21,18 @@
 	"require-dev": {
 		"composer/ca-bundle": "1.5.12",
 		"squizlabs/php_codesniffer": "3.13.5",
-		"wp-coding-standards/wpcs": "~3.3.0",
-		"phpcompatibility/phpcompatibility-wp": "~2.1.3",
+		"wp-coding-standards/wpcs": "3.3.0",
+		"phpcompatibility/phpcompatibility-wp": "2.1.8",
 		"phpstan/phpstan": "2.1.39",
-		"yoast/phpunit-polyfills": "^1.1.0"
+		"yoast/phpunit-polyfills": "1.1.5"
 	},
 	"config": {
 		"allow-plugins": {
 			"dealerdirect/phpcodesniffer-composer-installer": true
 		},
-		"lock": false
+		"platform": {
+			"php": "7.4"
+		}
 	},
 	"autoload-dev": {
 		"psr-4": {