WordPress != WordPress-Core,WordPress-Docs,WordPress-Extra

After refreshing https://github.com/GaryJones/pwa-wp/tree/phpcs-refresh, no violations are reported when running phpcs. All good.

If I change:

<rule ref="WordPress-Core"/>
<rule ref="WordPress-Docs"/>
<rule ref="WordPress-Extra"/>

to:

<rule ref="WordPress"/>

Then new violations are reported:

FILE: wp-includes/class-wp-service-workers.php
-----------------------------------------------------------------------------------------------------------------------------------------
FOUND 2 ERRORS AFFECTING 1 LINE
-----------------------------------------------------------------------------------------------------------------------------------------
 117 | ERROR | Missing wp_unslash() before sanitization. (WordPress.Security.ValidatedSanitizedInput.MissingUnslash)
 117 | ERROR | Detected usage of a non-sanitized input variable: $_SERVER
     |       | (WordPress.Security.ValidatedSanitizedInput.InputNotSanitized)
-----------------------------------------------------------------------------------------------------------------------------------------

Is that supposed to happen?

cc @westonruter

Start by comparing the three separate rules in the referenced phpcs-refresh branch with the aggregate WordPress rule in the ruleset configuration. Run phpcs against wp-includes/class-wp-service-workers.php and inspect line 117 to reproduce the two reported violations. Done means determining whether the aggregate rule is expected to include these checks and documenting or correcting the discrepancy.