Pin exact versions for all npm dependencies

.github/workflows/reusable-check-built-files.yml

@@ -47,8 +47,7 @@ jobs:
           node-version-file: '.nvmrc'
           cache: npm
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
+      # Passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
         with:

.github/workflows/reusable-coding-standards-php.yml

@@ -73,8 +73,7 @@ jobs:
             .cache/phpcs-tests.json
           key: ${{ runner.os }}-date-${{ steps.get-date.outputs.date }}-php-${{ inputs.php-version }}-phpcs-cache-${{ hashFiles('**/composer.json', 'phpcs.xml.dist') }}
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
+      # Passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
         with:

.github/workflows/reusable-php-compatibility.yml

@@ -68,8 +68,7 @@ jobs:
           path: .cache/phpcompat.json
           key: ${{ runner.os }}-date-${{ steps.get-date.outputs.date }}-php-${{ inputs.php-version }}-phpcompat-cache-${{ hashFiles('**/composer.json', 'phpcompat.xml.dist') }}
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
+      # Passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
         with:

.github/workflows/reusable-phpstan-static-analysis-v1.yml

@@ -67,8 +67,7 @@ jobs:
           node --version
           composer --version
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
+      # Passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
         with:

.github/workflows/reusable-phpunit-tests-v3.yml

@@ -154,8 +154,7 @@ jobs:
           php-version: '${{ inputs.php }}'
           coverage: none
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
+      # Passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
         with:

.github/workflows/reusable-test-core-build-process.yml

@@ -82,8 +82,7 @@ jobs:
         if: ${{ inputs.test-certificates }}
         run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
+      # Passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         if: ${{ inputs.test-certificates }}
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0

.github/workflows/reusable-test-local-docker-environment-v1.yml

@@ -110,8 +110,7 @@ jobs:
           php-version: '${{ inputs.php }}'
           coverage: none
 
-      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
-      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
+      # Passing a custom cache suffix ensures that the cache is flushed at least once per week.
       - name: Install Composer dependencies
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
         with:

.gitignore

@@ -26,7 +26,6 @@ wp-tests-config.php
 /phpstan.neon
 /*.tsbuildinfo
 /jsdoc
-/composer.lock
 /vendor
 /src/wp-admin/css/*.min.css
 /src/wp-admin/css/*-rtl.css

Gruntfile.js

@@ -1945,9 +1945,9 @@ module.exports = function(grunt) {
 		var spawn = require( 'child_process' ).spawnSync;
 		var fs = require( 'fs' );
 
-		// Ensure that `composer update` has been run and the dependency is installed.
+		// Ensure that `composer install` has been run and the dependency is installed.
 		if ( ! fs.existsSync( 'vendor' ) || ! fs.existsSync( 'vendor/composer' ) || ! fs.existsSync( 'vendor/composer/ca-bundle' ) ) {
-			grunt.log.error( 'composer/ca-bundle dependency is missing. Please run `composer update` before attempting to upgrade the certificate bundle.' );
+			grunt.log.error( 'composer/ca-bundle dependency is missing. Please run `composer install` before attempting to upgrade the certificate bundle.' );
 			done( false );
 			return;
 		}

composer.json

@@ -22,16 +22,18 @@
 	"require-dev": {
 		"composer/ca-bundle": "1.5.12",
 		"squizlabs/php_codesniffer": "3.13.5",
-		"wp-coding-standards/wpcs": "~3.3.0",
-		"phpcompatibility/phpcompatibility-wp": "~2.1.3",
+		"wp-coding-standards/wpcs": "3.3.0",
+		"phpcompatibility/phpcompatibility-wp": "2.1.8",
 		"phpstan/phpstan": "2.2.2",
-		"yoast/phpunit-polyfills": "^1.1.0"
+		"yoast/phpunit-polyfills": "1.1.5"
 	},
 	"config": {
 		"allow-plugins": {
 			"dealerdirect/phpcodesniffer-composer-installer": true
 		},
-		"lock": false
+		"platform": {
+			"php": "7.4"
+		}
 	},
 	"autoload-dev": {
 		"psr-4": {