Update PHP and JavaScript dependencies

[rhendrickson-sc]

Issue

The project had quite a few Dependabot warnings about gitbook-cli. We also wanted to update the site overall.

Solution

Updated and removed the packages in composer.json. Most of the dependencies were updated, however I removed some that weren't being used and/or were causing conflicts/weren't necessary anymore after updating another dependency.

Replaced gitbook-cli entirely with VitePress. Note: this does have the "negative" that the documentation site will not longer have the "Api References" section because the libraries I could find that would do something like that were either incompatible with VitePress, or were last updated five+ years ago.

Impact

This shouldn't have any negative impact. It updates some dependencies and integrates Rector into the project, to help with this update + future updates.

Note: Rector did add some PHP 8.1 specific changes, but I didn't think this would be a problem considering PHP 8.1 is end of life in December 2025.

Usage Changes

Only thing I can think of is that these updates do make Conifer a bit more strict on the typing, but I was conservative with it, so we didn't jump from 0% typing to 100% typing.

Considerations

At some point we might want to beef up the typing in this project, but that would probably require a new major release + work on any site using Conifer.

Testing

All unit tests are passing. No new tests were added.

[Copilot]

Pull Request Overview

This PR modernizes the Conifer codebase by introducing strict type declarations and modern PHP syntax throughout the project. The changes focus on improving type safety, code quality, and maintainability while updating development tooling.

• Added declare(strict_types=1) to all PHP files
• Migrated to modern PHP 8.1+ syntax (constructor property promotion, first-class callables, match expressions, null coalescing assignment, etc.)
• Updated development tooling: replaced GitBook with VitePress for documentation, added Rector for automated refactoring
• Enhanced type hints and PHPDoc annotations for better static analysis
• Updated dependencies (PHPStan, WPCS, ACF stubs, PHPUnit)

Reviewed Changes

Copilot reviewed 78 out of 81 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
rector.php	Added Rector configuration for automated code quality improvements
composer.json	Updated dependencies, added Rector, modernized PHPStan/WPCS versions
test/unit/*.php	Added strict types, modernized test method signatures, improved type hints
lib/Conifer/**/*.php	Applied strict types, constructor property promotion, first-class callables
docs/.vitepress/config.mts	Added VitePress configuration replacing GitBook
package.json	Replaced GitBook with VitePress for documentation

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[rhendrickson-sc]

@sdunham I made the Sniff updates/fixes. There ended up being two "fixes" I didn't implement.

The first is an issue of Processing form data without nonce verification. While it would make sense to fix this, it felt like a breaking change + we'd have to update the documentation. Which felt slightly out of scope for this, but I'm willing to do it if you think it should be done.

The second is an issue of All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks). But I tried fixing those errors with sanitize_text_field() and htmlspecialchars(), but the issue still got flagged. I'm not sure if it's expecting a WordPress specific function? Also seemed like it might be safe to ignore since the rest of the problems were addressed.

[sdunham]

@rhendrickson-sc I think you're good to skip those sniff fixes.

I agree that the first one is out of scope for this update. I also agree that implementing it is a good idea, but there will be plenty of edge-cases to account for (especially when you factor in caching, which can cause all kinds of issues when using nonces). I'd say adding a backlog task would be a good idea so it doesn't get lost in the shuffle, but we're definitely going to need to think through the implementation so we don't run into major issues once something like Cloudflare is in the mix.

As for the second one, it's odd that you're still getting a sniff result after adding sanitize_text_field() and htmlspecialchars(). Feels a bit like a false positive, which is why I think skipping it like you did is fine.