fix(deps): update dev dependencies with security advisories by aryanjasala · Pull Request #74 · rtCamp/plugin-elementary

aryanjasala · 2026-11-05T10:34:37Z

What this PR does

Clears plugin-elementary's critical and high Dependabot alerts. Bumps @wordpress/env to 12.1.0, which moves simple-git to v4, and refreshes package-lock.json within the declared version ranges.

All of these are development dependencies (build, lint, the dev server, wp-env), but they ship to every project made with composer create-project, so the fix needs a release to reach anyone: the fix(deps) title opens the 1.0.1 release PR.

Closes

N/A

Changes

@wordpress/env 11.16.0 to 12.1.0.
Node 24 required. @wordpress/env 12 pulls in @php-wasm/* and @wp-playground/* 3.1.62, which need Node 24.18+ and npm 11.16+. .nvmrc is now 24.22.1 (npm 11.19.1) and engines.node is ^24.22.1 || >=26.12.1, with the docs updated. Staying on Node 22 would mean @wordpress/env 11.16, which still ships the vulnerable simple-git 3.
package-lock.json refreshed with npm update. The only other direct dependency that moved is @rtcamp/eslint-config 1.1.0 to 1.2.0, within its range.

Alerts cleared: simple-git and @simple-git/argv-parser (critical), shell-quote (critical), proxy-addr (critical), compression, follow-redirects, launch-editor, markdown-it, source-map-js (high), and the fast-uri, minimatch, postcss-selector-parser medium and low ones.

Still open, held by upstream pins: qs (express inside wp-env's Playground CLI), smol-toml, katex and serialize-javascript (@wordpress/scripts 36), and deepmerge, which has no fix yet. They clear with a @wordpress/scripts major upgrade.

How I verified

npm audit: critical 4 to 0, high 10 to 0.
Each open Dependabot alert checked against the installed versions with its own vulnerable range: only the five above remain.
npm run lint:js, lint:css, lint:package-json and build:prod pass. test:js finds no tests, as on main.
Not run locally: test:php, which needs Docker and wp-env 12; CI's PHPUnit matrix covers it.

Reviewer notes

This supersedes most open Dependabot npm PRs (build(deps): bump shell-quote from 1.10.0 to 1.12.0 #53, build(deps): bump proxy-addr from 2.0.7 to 2.0.8 #55, build(deps-dev): bump compression from 1.8.1 to 1.8.2 #56, build(deps-dev): bump markdown-it from 14.3.2 to 14.3.3 #57, build(deps): bump follow-redirects from 1.16.0 to 1.16.1 #59, build(deps-dev): bump launch-editor from 2.14.1 to 2.14.2 #61, build(deps-dev): bump fast-uri from 3.1.8 to 3.1.9 #63, build(deps): bump postcss-selector-parser #64 and others); they can be closed once this merges.

Bumps @wordpress/env to 12.1.0, which moves simple-git to v4, and refreshes package-lock.json within the declared ranges. That clears every critical and high Dependabot alert: simple-git and its argv parser, shell-quote, proxy-addr, compression, follow-redirects, launch-editor, markdown-it and source-map-js, plus the fast-uri, minimatch and postcss-selector-parser ones. wp-env 12's only breaking change is a Node 22.13 floor, which the engines range already meets. Five low and medium alerts stay, held by upstream pins: qs (express in wp-env's Playground CLI), smol-toml, katex and serialize-javascript (@wordpress/scripts 36), and deepmerge, which has no fix yet.

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

No open issues 🎉

What changed in this PR

Updates development tooling dependencies to address Dependabot security advisories, primarily by bumping @wordpress/env and refreshing the lockfile within declared ranges.

Changes:

Bump @wordpress/env from 11.16.0 to 12.1.0 to pick up patched transitive dependencies (e.g., simple-git v4).
Refresh dependency resolution (per PR description) to clear critical/high advisories within allowed ranges.

File	Description
package.json	Updates `@wordpress/env` version to pull in security fixes via updated transitive dependencies.

_{Review effort: Lite}

…resh

npm 10, which CI's Node 22 ships, drops the libc fields npm 11 adds to platform-specific optional packages. No resolved versions change.

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

1 open issue

@wordpress/env is typically a local development tool (wp-env) rather than a runtime dependency.… · New

_{Review effort: Lite}

Adi-ty

Running nvm use followed by npm ci on this branch produces EBADENGINE warnings for 21 Playground/PHP-WASM dependencies. With --engine-strict, the install fails. @wordpress/env 12.1.0 pulls in @php-wasm/* and @wp-playground/* 3.1.62, which require Node ≥24.18.0 and npm ≥11.16.0. CI shows the same warnings, because it also installs on Node 22.23.4. Pinning back isn't an option. The last Node 22-compatible Playground needs @wordpress/env 11.16, which still uses simple-git 3, so the critical alert this PR fixes would stay open. We can set .nvmrc to 24.22.1 and engines.node to ^24.22.1 || >=26.12.1.

@wordpress/env 12 pulls in @php-wasm/* and @wp-playground/* 3.1.62, which need Node 24.18+ and npm 11.16+, so every install on the pinned Node 22.23.4 printed 21 EBADENGINE warnings (and fails with engine-strict). Going back to @wordpress/env 11.16 isn't an option: it still uses simple-git 3, so the critical alert would stay open. Pin Node 24.22.1 (npm 11.19.1) in .nvmrc, set engines to ^24.22.1 || >=26.12.1, update the docs, and write package-lock.json with npm 11 again. The only EBADENGINE warning left is the project itself on Node older than the floor.

aryanjasala · 2026-11-05T17:56:01Z

@Adi-ty thanks, applied your suggestion in 170d883: .nvmrc is 24.22.1, engines.node is ^24.22.1 || >=26.12.1, the docs, AGENTS.md and the README badge say Node 24, and package-lock.json is written with npm 11 again. A clean npm ci on Node 24 no longer warns about the Playground and PHP-WASM packages; the only EBADENGINE left is the project itself on Node older than the floor.

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

4 open issues

The PR description states that @wordpress/env 12’s only breaking change is a Node 22.13 floor and… · New
The PR description states that @wordpress/env 12’s only breaking change is a Node 22.13 floor and… · New
@wordpress/env is typically a local development tool (wp-env) rather than a runtime dependency.…
Grammar: change '26.12.1+ also meets' to '26.12.1+ also meet' (agreement with the plural subject… · New

_{Review effort: Lite}

aryanjasala requested review from Adi-ty and AnuragVasanwala as code owners November 5, 2026 10:34

Copilot AI balanced review requested due to automatic review settings November 5, 2026 10:34

Copilot AI reviewed Nov 5, 2026

View reviewed changes

aryanjasala added 2 commits November 5, 2026 18:02

Merge remote-tracking branch 'origin/main' into fix/deps-security-ref…

52b09e3

…resh

chore(deps): write package-lock.json with npm 10

f5e5ae1

npm 10, which CI's Node 22 ships, drops the libc fields npm 11 adds to platform-specific optional packages. No resolved versions change.

Copilot AI balanced review requested due to automatic review settings November 5, 2026 12:33

Copilot AI reviewed Nov 5, 2026

View reviewed changes

Comment thread package.json Resolved

Adi-ty requested changes Nov 5, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings November 5, 2026 17:54

Copilot AI reviewed Nov 5, 2026

View reviewed changes

Comment thread package.json Resolved

Comment thread package.json Resolved

Comment thread docs/getting-started.md Resolved

Adi-ty approved these changes Nov 9, 2026

View reviewed changes

Navigation Menu

Repository navigation

fix(deps): update dev dependencies with security advisories - #74

fix(deps): update dev dependencies with security advisories#74
aryanjasala wants to merge 4 commits into
mainfrom
fix/deps-security-refresh

aryanjasala commented Nov 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Adi-ty left a comment

Uh oh!

aryanjasala commented Nov 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

aryanjasala commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Closes

Changes

How I verified

Reviewer notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

Adi-ty left a comment

Choose a reason for hiding this comment

Uh oh!

aryanjasala commented Nov 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aryanjasala commented Nov 5, 2026 •

edited

Loading