[aryanjasala]

What this PR does

Clears plugin-elementary's critical and high Dependabot alerts. Bumps @wordpress/env to 12.1.0, which moves simple-git to v4, and refreshes package-lock.json within the declared version ranges.

All of these are development dependencies (build, lint, the dev server, wp-env), but they ship to every project made with composer create-project, so the fix needs a release to reach anyone: the fix(deps) title opens the 1.0.1 release PR.

Closes

N/A

Changes

• @wordpress/env 11.16.0 to 12.1.0.
• Node 24 required. @wordpress/env 12 pulls in @php-wasm/* and @wp-playground/* 3.1.62, which need Node 24.18+ and npm 11.16+. .nvmrc is now 24.22.1 (npm 11.19.1) and engines.node is ^24.22.1 || >=26.12.1, with the docs updated. Staying on Node 22 would mean @wordpress/env 11.16, which still ships the vulnerable simple-git 3.
• package-lock.json refreshed with npm update. The only other direct dependency that moved is @rtcamp/eslint-config 1.1.0 to 1.2.0, within its range.

Alerts cleared: simple-git and @simple-git/argv-parser (critical), shell-quote (critical), proxy-addr (critical), compression, follow-redirects, launch-editor, markdown-it, source-map-js (high), and the fast-uri, minimatch, postcss-selector-parser medium and low ones.

Still open, held by upstream pins: qs (express inside wp-env's Playground CLI), smol-toml, katex and serialize-javascript (@wordpress/scripts 36), and deepmerge, which has no fix yet. They clear with a @wordpress/scripts major upgrade.

How I verified

• npm audit: critical 4 to 0, high 10 to 0.
• Each open Dependabot alert checked against the installed versions with its own vulnerable range: only the five above remain.
• npm run lint:js, lint:css, lint:package-json and build:prod pass. test:js finds no tests, as on main.
• Not run locally: test:php, which needs Docker and wp-env 12; CI's PHPUnit matrix covers it.

Reviewer notes

• This supersedes most open Dependabot npm PRs (build(deps): bump shell-quote from 1.10.0 to 1.12.0 #53, build(deps): bump proxy-addr from 2.0.7 to 2.0.8 #55, build(deps-dev): bump compression from 1.8.1 to 1.8.2 #56, build(deps-dev): bump markdown-it from 14.3.2 to 14.3.3 #57, build(deps): bump follow-redirects from 1.16.0 to 1.16.1 #59, build(deps-dev): bump launch-editor from 2.14.1 to 2.14.2 #61, build(deps-dev): bump fast-uri from 3.1.8 to 3.1.9 #63, build(deps): bump postcss-selector-parser #64 and others); they can be closed once this merges.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

No open issues 🎉

What changed in this PR

Updates development tooling dependencies to address Dependabot security advisories, primarily by bumping @wordpress/env and refreshing the lockfile within declared ranges.

Changes:

• Bump @wordpress/env from 11.16.0 to 12.1.0 to pick up patched transitive dependencies (e.g., simple-git v4).
• Refresh dependency resolution (per PR description) to clear critical/high advisories within allowed ranges.

File	Description
package.json	Updates @wordpress/env version to pull in security fixes via updated transitive dependencies.

_{Review effort: Lite}

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

1 open issue

• @wordpress/env is typically a local development tool (wp-env) rather than a runtime dependency.… · New

_{Review effort: Lite}

[Adi-ty]

Running nvm use followed by npm ci on this branch produces EBADENGINE warnings for 21 Playground/PHP-WASM dependencies. With --engine-strict, the install fails. @wordpress/env 12.1.0 pulls in @php-wasm/* and @wp-playground/* 3.1.62, which require Node ≥24.18.0 and npm ≥11.16.0. CI shows the same warnings, because it also installs on Node 22.23.4. Pinning back isn't an option. The last Node 22-compatible Playground needs @wordpress/env 11.16, which still uses simple-git 3, so the critical alert this PR fixes would stay open. We can set .nvmrc to 24.22.1 and engines.node to ^24.22.1 || >=26.12.1.

[aryanjasala]

@Adi-ty thanks, applied your suggestion in 170d883: .nvmrc is 24.22.1, engines.node is ^24.22.1 || >=26.12.1, the docs, AGENTS.md and the README badge say Node 24, and package-lock.json is written with npm 11 again. A clean npm ci on Node 24 no longer warns about the Playground and PHP-WASM packages; the only EBADENGINE left is the project itself on Node older than the floor.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

4 open issues

• The PR description states that @wordpress/env 12’s only breaking change is a Node 22.13 floor and… · New
• The PR description states that @wordpress/env 12’s only breaking change is a Node 22.13 floor and… · New
• @wordpress/env is typically a local development tool (wp-env) rather than a runtime dependency.…
• Grammar: change '26.12.1+ also meets' to '26.12.1+ also meet' (agreement with the plural subject… · New

_{Review effort: Lite}