Repository navigation
fix(deps): update dev dependencies with security advisories - #839
Open
aryanjasala wants to merge 4 commits into
Open
aryanjasala wants to merge 4 commits into
aryanjasala wants to merge 4 commits into
Conversation
Bumps @wordpress/env to 12.1.0, which moves simple-git to v4 and clears the two critical Dependabot alerts (simple-git and its argv parser) and the minimatch one, and refreshes package-lock.json within the declared ranges, which also clears npm audit's high findings in body-parser, zod, chromium-bidi and puppeteer-core. wp-env 12's only breaking change is a Node 22.13 floor, which the engines range already meets. The two import/no-extraneous-dependencies lint errors for @rtcamp/tailwind-config are already on main.
There was a problem hiding this comment.
🔵 Needs a closer look
wp-env 12 still needs a Docker-backed PHP integration run because local validation is missing and shared CI only runs PHPUnit for PHP-file changes.
No open issues 🎉
What changed in this PR
Updates the theme’s development dependencies to address security advisories, preparing the fixes for distribution through the next patch release.
Changes:
- Bumps
@wordpress/envfrom 11.16.0 to 12.1.0 to bring insimple-gitv4. - Keeps the existing Node engine range, which already meets the new dependency’s minimum requirement.
| File | Description |
|---|---|
package.json |
Updates the pinned @wordpress/env development dependency to 12.1.0. |
Review effort: Balanced
The refreshed schema-utils has a webpack ^5.112.0 peer, so with webpack pinned at 5.111.1 npm 10 (the version CI's Node 22 ships) wanted nested webpack copies the npm 11 lockfile didn't have, and npm ci failed. Pinning webpack 5.112.2 keeps one copy; the lockfile is now written by npm 10 and installs cleanly with npm 10 and 11. A dependency change makes CI lint the whole project, which surfaced two import/no-extraneous-dependencies errors already on main for @rtcamp/tailwind-config. It is optional, installed by the tailwind init feature, and webpack.config.js already guards it with try/catch, so both imports get a scoped disable with the reason.
Adi-ty
requested changes
Nov 5, 2026
@wordpress/env 12 pulls in @php-wasm/* and @wp-playground/* 3.1.62, which need Node 24.18+ and npm 11.16+, so every install on the pinned Node 22.23.4 printed 21 EBADENGINE warnings (and fails with engine-strict). Going back to @wordpress/env 11.16 isn't an option: it still uses simple-git 3, so the critical alert would stay open. Pin Node 24.22.1 (npm 11.19.1) in .nvmrc, set engines to ^24.22.1 || >=26.12.1, update the docs, and write package-lock.json with npm 11 again. The only EBADENGINE warning left is the project itself on Node older than the floor. Also drops the two import/no-extraneous-dependencies suppressions for @rtcamp/tailwind-config: ESLint only flagged those imports where a parent folder's node_modules happened to contain the package. On a clean checkout, and in CI, the import doesn't resolve and isn't reported, so the disables were unused.
There was a problem hiding this comment.
🟡 Changes recommended
The runtime changes drop Node 22 support, introducing an undocumented compatibility break in the planned 2.0.1 security patch that must be resolved or explicitly documented with an adjusted release plan.
1 open issue
Review effort: Balanced
Adi-ty
approved these changes
Nov 9, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Clears theme-elementary's open Dependabot alerts. Bumps
@wordpress/envto 12.1.0, which movessimple-gitto v4, and refreshespackage-lock.jsonwithin the declared version ranges.All of these are development dependencies, but they ship to every theme made with
composer create-project, which installs the latest tag (v2.0.0), so the fix needs a release to reach anyone: thefix(deps)title opens the 2.0.1 release PR, which also carries the eight security bumps already merged since v2.0.0 (#814 to #823).Closes
N/A
Changes
@wordpress/env11.16.0 to 12.1.0.@wordpress/env12 pulls in@php-wasm/*and@wp-playground/*3.1.62, which need Node 24.18+ and npm 11.16+..nvmrcis now 24.22.1 (npm 11.19.1) andengines.nodeis^24.22.1 || >=26.12.1, with the docs updated. Staying on Node 22 would mean@wordpress/env11.16, which still ships the vulnerablesimple-git3.package-lock.jsonrefreshed withnpm updateand written with npm 11, the version Node 24 ships.webpack5.111.1 to 5.112.2: the refreshedschema-utilshas awebpack^5.112.0 peer, and with the old pin npm wanted nested webpack copies (npm cifailed on the first push). One webpack copy now. Same bump as Dependabot build(deps-dev): Bump webpack from 5.111.1 to 5.112.2 #830.Alerts cleared:
simple-gitand@simple-git/argv-parser(critical) andminimatch(medium), which is every open Dependabot alert. The refresh also clearsnpm audit's high findings inbody-parser,zod,chromium-bidiandpuppeteer-core.How I verified
npm audit: high 4 to 0, critical 0.npm run lint:css,lint:package-jsonandbuild:prodpass; Jest passes 33 of 33 tests in 3 suites.npm cion Node 24 succeeds with no dependencyEBADENGINEwarnings;npm run lint:jshas 0 errors (6 warnings, as onmain).test:php, which needs Docker and wp-env 12; CI covers it.Reviewer notes