Fix Plugin Check warnings: scope PHPCS, escape shortcode output

.distignore

@@ -0,0 +1,39 @@
+# Files and directories excluded from the built plugin zip.
+# Mirrors and extends .gitattributes export-ignore.
+
+# Dev tooling directories
+/.wordpress-org
+/.github
+/bin
+/vendor-bin
+/vendor
+/composer.lock
+/.env.example
+/.wp-env.json
+
+# Build / dev configs
+/webpack.config.js
+/playwright.config.js
+/package.json
+/package-lock.json
+/yarn.lock
+/composer.json
+/phpstan.neon
+/phpcs.ruleset.xml
+/phpunit.xml
+/.gitattributes
+/.gitignore
+/.scoper.inc.php
+/.claudeignore
+/CLAUDE.md
+
+# Tests
+/tests
+/tests/coverage
+
+# Build outputs
+/document-library-lite.zip
+/dist
+
+# This file
+/.distignore

phpcs.ruleset.xml

@@ -1,4 +1,27 @@
 <?xml version="1.0"?>
 <ruleset name="Barn2-PHP">
 	<rule ref="Barn2-PHP" />
-</ruleset>
+
+	<!-- Vendored libraries ship with their own text domains and PHPCS rules; do not scan them. -->
+	<exclude-pattern>dependencies/*</exclude-pattern>
+	<exclude-pattern>vendor/*</exclude-pattern>
+	<exclude-pattern>vendor-bin/*</exclude-pattern>
+	<exclude-pattern>bin/*</exclude-pattern>
+
+	<!-- Test coverage output is not source. -->
+	<exclude-pattern>tests/coverage/*</exclude-pattern>
+
+	<!-- Build / dev artifacts. -->
+	<exclude-pattern>webpack.config.js</exclude-pattern>
+	<exclude-pattern>playwright.config.js</exclude-pattern>
+	<exclude-pattern>package.json</exclude-pattern>
+	<exclude-pattern>package-lock.json</exclude-pattern>
+	<exclude-pattern>yarn.lock</exclude-pattern>
+	<exclude-pattern>composer.json</exclude-pattern>
+	<exclude-pattern>composer.lock</exclude-pattern>
+	<exclude-pattern>phpstan.neon</exclude-pattern>
+	<exclude-pattern>phpunit.xml</exclude-pattern>
+	<exclude-pattern>readme.txt</exclude-pattern>
+	<exclude-pattern>changelog.txt</exclude-pattern>
+	<exclude-pattern>license.txt</exclude-pattern>
+</ruleset>

src/Admin/Settings.php

@@ -95,14 +95,9 @@ public function register_settings() {
 
 	/**
 	 * Hook into the allowed_options filter.
-	 * Back compatibility ( < 5.5 ) included with 'whitelist_options'.
 	 */
 	public function filter_allowed_options() {
-		if ( function_exists( 'add_allowed_options' ) ) {
-			add_filter( 'allowed_options', [ $this, 'allowed_options' ] );
-		} else {
-			add_filter( 'whitelist_options', [ $this, 'allowed_options' ] );
-		}
+		add_filter( 'allowed_options', [ $this, 'allowed_options' ] );
 	}
 
 	/**
@@ -121,11 +116,7 @@ public function allowed_options( $options ) {
 			'document_library_pro_advanced' => [ Options::SHORTCODE_OPTION_KEY, Options::MISC_OPTION_KEY ],
 		];
 
-		if ( function_exists( 'add_allowed_options' ) ) {
-			$options = add_allowed_options( $new_options, $options );
-		} else {
-			$options = add_option_whitelist( $new_options, $options );
-		}
+		$options = add_allowed_options( $new_options, $options );
 
 		return $options;
 	}

src/Admin/Settings_Tab/Search.php

@@ -116,6 +116,7 @@ private function get_search_settings() {
 						'document_search' => __( 'Document search', 'document-library-lite' ),
 					],
 					'desc'    => sprintf(
+						/* translators: %s: global search link. */
 						__( 'When using the %s, this page will display your search results.', 'document-library-lite' ),
 						Lib_Util::barn2_link( 'kb/document-library-search/#standalone-search-box', __( 'global search', 'document-library-lite' ), true )
 					),

src/Document_Library_Shortcode.php

@@ -86,14 +86,14 @@ public function do_shortcode( $atts, $content = '' ) {
 		// Create table and return output
 		ob_start(); ?>
 		<input type="hidden" name="category-search-<?php echo esc_attr( $table_id ) ?>" value="<?php echo esc_attr( $table->args['doc_category'] ); ?>" class="category-search-<?php echo esc_attr( $table_id ) ?>">
-		<table <?php echo $table->get_attributes() ?>>
+		<table <?php echo $table->get_attributes(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- attribute string is pre-escaped in Simple_Document_Library::get_attributes() ?>>
 			<?php
-			echo $table->get_headers();
+			echo wp_kses_post( $table->get_headers() );
 			?>
 			<tbody>
 				<?php
 				if( ! $table->args['lazy_load'] ) {
-					echo $table->get_table( 'html' );
+					echo wp_kses_post( $table->get_table( 'html' ) );
 				}
 				?>
 			</tbody>