Upgrade npm dependencies#1223
Open
gabrielcld2 wants to merge 4 commits into
Open
Conversation
Bumps @wordpress/components, @wordpress/scripts, copy-webpack-plugin, css-minimizer-webpack-plugin, jsdoc, eslint, and @wordpress/eslint-plugin to their latest majors, and replaces the unmaintained npm-run-all with the actively maintained npm-run-all2 fork. ESLint 10 drops support for legacy .eslintrc.json/.eslintignore, so those are replaced with a flat eslint.config.js. Adds overrides to force patched versions of nested transitive deps that npm's resolver couldn't otherwise reach: eslint-import-resolver-typescript (pinned to the last version compatible with eslint-plugin-import), serialize-javascript, uuid, and brace-expansion (fixes GHSA-mh99-v99m-4gvg). Remaining vulnerabilities are confined to the grunt-based build/deploy toolchain (grunt, grunt-contrib-*, grunt-wp-deploy, grunt-wp-i18n, load-grunt-tasks) and dot-object, which are already at their latest published versions with no upstream fix available. Vulnerability count: 94 -> 36. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Runs `wp-scripts lint-js --fix` to apply the auto-fixable formatting findings surfaced now that lint:js actually runs again (it was silently broken before the previous commit). Purely cosmetic: quote style, trailing commas, blank lines, and removal of a stale eslint-disable comment. No logic changes. Excludes asset-manager.js, breakpoints-preview.js, deactivate.js, front-overlay.js, inline-loader.js, and wp-color-picker-alpha.js, which still carry pre-existing non-auto-fixable lint errors (undefined globals, camelCase naming, etc.) that trip the pre-commit hook - formatting those is left for when those underlying issues get addressed. Kept in a separate commit from the dependency bump so it's easy to revert independently if needed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
… commit - asset-manager.js: rename the init() `States` parameter to `states` to stop it shadowing the top-level `States` import. - inline-loader.js: reference `window.CLDBind`/`window.initFallback` internally instead of the bare identifiers, since assigning to `window.*` doesn't put them in scope for no-undef. - front-overlay.js: rename `Front_Overlay` to `FrontOverlay` (purely local identifier, no external references). - breakpoints-preview.js: the translated string interpolated variables directly into the `__()` argument, which WordPress's i18n tooling can't extract for translation - switched to `sprintf()` with placeholders. - eslint.config.js: register `CLDASSETS` as a known wp_localize_script global (same pattern as CLDCACHE/CLD_METADATA), and allow `CLD_Deactivate` through the camelcase rule since it's a wp_localize_script object name defined in php/class-deactivation.php - renaming it would require a matching PHP-side change. - wp-color-picker-alpha.js is vendored third-party code (github.com/kallookoo/wp-color-picker-alpha), so instead of hand-editing it to match house style, it's now excluded from linting entirely. `npm run lint:js` is fully clean across the project. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@wordpress/scripts@33 pins webpack-dev-server to ^4.15.1, and 4.15.2 (the latest 4.x release) is still caught by several moderate advisories (GHSA-9jgg-88mc-972h, GHSA-4v9v-hfq4-rm2v, GHSA-79cf-xcqc-c78w, GHSA-mx8g-39q3-5c79, GHSA-f5vj-f2hx-8m93, GHSA-m28w-2pqf-7qgj) with no fix available within that range - `npm audit fix` reports one anyway, but it's a no-op since there's no newer 4.x to move to. Overriding to ^5.2.6 works because our installed webpack (5.109.0) already satisfies v5's peer requirement (^5.101.0). Verified `npm run dev` still boots and compiles cleanly under the new major. Vulnerability count: 36 -> 35. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Approach
@wordpress/components,@wordpress/scripts,copy-webpack-plugin,css-minimizer-webpack-plugin,jsdoc,eslint,@wordpress/eslint-pluginto latest majorsnpm-run-all→npm-run-all2eslint-import-resolver-typescript,serialize-javascript,uuid--fixacross the codebase now thatlint:jsactually runs (it was silently broken before commit 1)wp-color-picker-alpha.js) from linting instead of hand-editing itlint:jsnow fully clean project-widewebpack-dev-serverto v5.2.6brace-expansionoverride (fixed a separate, newer high-severity DoS advisory) and awebpack-dev-serveroverride past what@wordpress/scriptspins, verifiednpm run devstill bootsQA notes
npm run buildandnpm run devstill works