T396733 Update dependencies and npm audit (Jun 2025)

[hueitan]

https://phabricator.wikimedia.org/T396733

Before the update:

npm audit report

@babel/runtime <7.26.10
Severity: moderate
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - GHSA-968p-4wvh-cqc8
fix available via npm audit fix --force
Will install @wordpress/block-editor@14.4.0, which is a breaking change
node_modules/@babel/runtime
@wordpress/a11y >=4.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/dom-ready
Depends on vulnerable versions of @wordpress/i18n
node_modules/@wordpress/a11y
@wordpress/components 4.1.2 || 5.1.0 || 7.2.1 || >=28.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/a11y
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/date
Depends on vulnerable versions of @wordpress/deprecated
Depends on vulnerable versions of @wordpress/dom
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/escape-html
Depends on vulnerable versions of @wordpress/hooks
Depends on vulnerable versions of @wordpress/html-entities
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/icons
Depends on vulnerable versions of @wordpress/is-shallow-equal
Depends on vulnerable versions of @wordpress/keycodes
Depends on vulnerable versions of @wordpress/primitives
Depends on vulnerable versions of @wordpress/private-apis
Depends on vulnerable versions of @wordpress/rich-text
node_modules/@wordpress/components
@wordpress/block-editor 1.1.1 || >=14.5.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/a11y
Depends on vulnerable versions of @wordpress/api-fetch
Depends on vulnerable versions of @wordpress/blob
Depends on vulnerable versions of @wordpress/block-serialization-default-parser
Depends on vulnerable versions of @wordpress/blocks
Depends on vulnerable versions of @wordpress/commands
Depends on vulnerable versions of @wordpress/components
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/date
Depends on vulnerable versions of @wordpress/deprecated
Depends on vulnerable versions of @wordpress/dom
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/escape-html
Depends on vulnerable versions of @wordpress/hooks
Depends on vulnerable versions of @wordpress/html-entities
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/icons
Depends on vulnerable versions of @wordpress/is-shallow-equal
Depends on vulnerable versions of @wordpress/keyboard-shortcuts
Depends on vulnerable versions of @wordpress/keycodes
Depends on vulnerable versions of @wordpress/notices
Depends on vulnerable versions of @wordpress/preferences
Depends on vulnerable versions of @wordpress/priority-queue
Depends on vulnerable versions of @wordpress/private-apis
Depends on vulnerable versions of @wordpress/rich-text
Depends on vulnerable versions of @wordpress/style-engine
Depends on vulnerable versions of @wordpress/token-list
Depends on vulnerable versions of @wordpress/upload-media
Depends on vulnerable versions of @wordpress/url
Depends on vulnerable versions of @wordpress/wordcount
node_modules/@wordpress/block-editor
@wordpress/core-data 2.0.4 || 2.0.10 || 2.2.1 || >=7.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/api-fetch
Depends on vulnerable versions of @wordpress/block-editor
Depends on vulnerable versions of @wordpress/blocks
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/deprecated
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/html-entities
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/is-shallow-equal
Depends on vulnerable versions of @wordpress/private-apis
Depends on vulnerable versions of @wordpress/rich-text
Depends on vulnerable versions of @wordpress/sync
Depends on vulnerable versions of @wordpress/undo-manager
Depends on vulnerable versions of @wordpress/url
node_modules/@wordpress/core-data
@wordpress/editor 4.0.3 || 6.2.0 || 9.2.1 || 14.7.1-next.1f6eadc42.0 - 14.8.1 || >=14.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/a11y
Depends on vulnerable versions of @wordpress/api-fetch
Depends on vulnerable versions of @wordpress/blob
Depends on vulnerable versions of @wordpress/block-editor
Depends on vulnerable versions of @wordpress/blocks
Depends on vulnerable versions of @wordpress/commands
Depends on vulnerable versions of @wordpress/components
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/core-data
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/dataviews
Depends on vulnerable versions of @wordpress/date
Depends on vulnerable versions of @wordpress/deprecated
Depends on vulnerable versions of @wordpress/dom
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/fields
Depends on vulnerable versions of @wordpress/hooks
Depends on vulnerable versions of @wordpress/html-entities
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/icons
Depends on vulnerable versions of @wordpress/interface
Depends on vulnerable versions of @wordpress/keyboard-shortcuts
Depends on vulnerable versions of @wordpress/keycodes
Depends on vulnerable versions of @wordpress/media-utils
Depends on vulnerable versions of @wordpress/notices
Depends on vulnerable versions of @wordpress/patterns
Depends on vulnerable versions of @wordpress/plugins
Depends on vulnerable versions of @wordpress/preferences
Depends on vulnerable versions of @wordpress/private-apis
Depends on vulnerable versions of @wordpress/reusable-blocks
Depends on vulnerable versions of @wordpress/rich-text
Depends on vulnerable versions of @wordpress/server-side-render
Depends on vulnerable versions of @wordpress/url
Depends on vulnerable versions of @wordpress/wordcount
node_modules/@wordpress/editor
@wordpress/fields >=0.2.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/api-fetch
Depends on vulnerable versions of @wordpress/blob
Depends on vulnerable versions of @wordpress/block-editor
Depends on vulnerable versions of @wordpress/blocks
Depends on vulnerable versions of @wordpress/components
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/core-data
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/dataviews
Depends on vulnerable versions of @wordpress/date
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/hooks
Depends on vulnerable versions of @wordpress/html-entities
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/icons
Depends on vulnerable versions of @wordpress/media-utils
Depends on vulnerable versions of @wordpress/notices
Depends on vulnerable versions of @wordpress/patterns
Depends on vulnerable versions of @wordpress/primitives
Depends on vulnerable versions of @wordpress/private-apis
Depends on vulnerable versions of @wordpress/router
Depends on vulnerable versions of @wordpress/url
node_modules/@wordpress/fields
@wordpress/patterns >=2.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/a11y
Depends on vulnerable versions of @wordpress/block-editor
Depends on vulnerable versions of @wordpress/blocks
Depends on vulnerable versions of @wordpress/components
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/core-data
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/html-entities
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/icons
Depends on vulnerable versions of @wordpress/notices
Depends on vulnerable versions of @wordpress/private-apis
Depends on vulnerable versions of @wordpress/url
node_modules/@wordpress/patterns
@wordpress/reusable-blocks >=5.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/block-editor
Depends on vulnerable versions of @wordpress/blocks
Depends on vulnerable versions of @wordpress/components
Depends on vulnerable versions of @wordpress/core-data
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/icons
Depends on vulnerable versions of @wordpress/notices
Depends on vulnerable versions of @wordpress/private-apis
Depends on vulnerable versions of @wordpress/url
node_modules/@wordpress/reusable-blocks
@wordpress/commands >=1.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/components
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/icons
Depends on vulnerable versions of @wordpress/keyboard-shortcuts
Depends on vulnerable versions of @wordpress/private-apis
node_modules/@wordpress/commands
@wordpress/dataviews >=4.6.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/components
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/icons
Depends on vulnerable versions of @wordpress/primitives
Depends on vulnerable versions of @wordpress/private-apis
node_modules/@wordpress/dataviews
@wordpress/interface >=7.0.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/a11y
Depends on vulnerable versions of @wordpress/components
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/deprecated
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/icons
Depends on vulnerable versions of @wordpress/plugins
Depends on vulnerable versions of @wordpress/preferences
Depends on vulnerable versions of @wordpress/viewport
node_modules/@wordpress/interface
@wordpress/plugins 2.0.7 || >=7.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/components
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/deprecated
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/hooks
Depends on vulnerable versions of @wordpress/icons
Depends on vulnerable versions of @wordpress/is-shallow-equal
node_modules/@wordpress/plugins
@wordpress/preferences >=4.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/a11y
Depends on vulnerable versions of @wordpress/components
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/deprecated
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/icons
Depends on vulnerable versions of @wordpress/private-apis
node_modules/@wordpress/preferences
@wordpress/server-side-render >=5.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/api-fetch
Depends on vulnerable versions of @wordpress/blocks
Depends on vulnerable versions of @wordpress/components
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/deprecated
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/url
node_modules/@wordpress/server-side-render
@wordpress/notices 1.0.3 || >=5.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/a11y
Depends on vulnerable versions of @wordpress/data
node_modules/@wordpress/notices
@wordpress/rich-text 2.0.3 || >=7.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/a11y
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/deprecated
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/escape-html
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/keycodes
node_modules/@wordpress/rich-text
@wordpress/blocks 4.0.3 || 5.2.0 || 6.2.1 || >=13.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/autop
Depends on vulnerable versions of @wordpress/blob
Depends on vulnerable versions of @wordpress/block-serialization-default-parser
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/deprecated
Depends on vulnerable versions of @wordpress/dom
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/hooks
Depends on vulnerable versions of @wordpress/html-entities
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/is-shallow-equal
Depends on vulnerable versions of @wordpress/private-apis
Depends on vulnerable versions of @wordpress/rich-text
Depends on vulnerable versions of @wordpress/shortcode
node_modules/@wordpress/blocks
@wordpress/api-fetch >=7.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/url
node_modules/@wordpress/api-fetch
@wordpress/autop >=4.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/autop
@wordpress/babel-preset-default >=8.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/babel-preset-default
@wordpress/eslint-plugin 21.3.0 || 21.5.1-next.082ed6819.0 || 21.6.1-next.cd6172eb0.0 || >=22.0.1-next.a9f418477.0
Depends on vulnerable versions of @wordpress/babel-preset-default
node_modules/@wordpress/eslint-plugin
@wordpress/scripts 2.4.2 || >=20.0.0
Depends on vulnerable versions of @wordpress/babel-preset-default
Depends on vulnerable versions of @wordpress/eslint-plugin
Depends on vulnerable versions of @wordpress/jest-preset-default
Depends on vulnerable versions of webpack-dev-server
node_modules/@wordpress/scripts
@wordpress/blob >=4.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/blob
@wordpress/media-utils >=5.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/api-fetch
Depends on vulnerable versions of @wordpress/blob
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/private-apis
node_modules/@wordpress/media-utils
@wordpress/upload-media *
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/api-fetch
Depends on vulnerable versions of @wordpress/blob
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/i18n
Depends on vulnerable versions of @wordpress/preferences
Depends on vulnerable versions of @wordpress/private-apis
Depends on vulnerable versions of @wordpress/url
node_modules/@wordpress/upload-media
@wordpress/block-serialization-default-parser >=5.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/block-serialization-default-parser
@wordpress/compose 2.1.1 || >=7.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/deprecated
Depends on vulnerable versions of @wordpress/dom
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/is-shallow-equal
Depends on vulnerable versions of @wordpress/keycodes
Depends on vulnerable versions of @wordpress/priority-queue
Depends on vulnerable versions of @wordpress/undo-manager
node_modules/@wordpress/compose
@wordpress/router >=1.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/private-apis
Depends on vulnerable versions of @wordpress/url
node_modules/@wordpress/router
@wordpress/viewport 2.0.4 || 2.0.9 || >=6.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/element
node_modules/@wordpress/viewport
@wordpress/data 3.1.1 || >=10.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/compose
Depends on vulnerable versions of @wordpress/deprecated
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/is-shallow-equal
Depends on vulnerable versions of @wordpress/priority-queue
Depends on vulnerable versions of @wordpress/private-apis
Depends on vulnerable versions of @wordpress/redux-routine
node_modules/@wordpress/data
@wordpress/keyboard-shortcuts >=5.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/data
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/keycodes
node_modules/@wordpress/keyboard-shortcuts
@wordpress/date >=5.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/deprecated
node_modules/@wordpress/date
@wordpress/deprecated >=4.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/hooks
node_modules/@wordpress/deprecated
@wordpress/dom >=4.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/deprecated
node_modules/@wordpress/dom
@wordpress/dom-ready >=4.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/dom-ready
@wordpress/element 2.1.6 || >=6.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/escape-html
node_modules/@wordpress/element
@wordpress/icons >=10.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/element
Depends on vulnerable versions of @wordpress/primitives
node_modules/@wordpress/icons
@wordpress/primitives >=4.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/element
node_modules/@wordpress/primitives
@wordpress/escape-html >=3.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/escape-html
@wordpress/hooks >=4.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/hooks
@wordpress/i18n >=5.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/hooks
node_modules/@wordpress/i18n
@wordpress/keycodes >=4.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/i18n
node_modules/@wordpress/keycodes
@wordpress/html-entities >=4.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/html-entities
@wordpress/is-shallow-equal >=5.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/is-shallow-equal
@wordpress/undo-manager >=1.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/is-shallow-equal
node_modules/@wordpress/undo-manager
@wordpress/jest-console >=8.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/jest-console
@wordpress/jest-preset-default 3.0.1 || 12.10.0 || 12.12.1-next.082ed6819.0 || 12.13.1-next.a9f418477.0 - 12.13.1-next.cd6172eb0.0 || >=12.15.0
Depends on vulnerable versions of @wordpress/jest-console
node_modules/@wordpress/jest-preset-default
@wordpress/priority-queue >=3.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/priority-queue
@wordpress/private-apis >=1.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/private-apis
@wordpress/redux-routine >=5.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/redux-routine
@wordpress/shortcode >=4.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/shortcode
@wordpress/style-engine >=2.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/style-engine
@wordpress/sync >=1.10.0
Depends on vulnerable versions of @babel/runtime
Depends on vulnerable versions of @wordpress/url
node_modules/@wordpress/sync
@wordpress/token-list >=3.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/token-list
@wordpress/url >=4.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/url
@wordpress/wordcount >=4.10.0
Depends on vulnerable versions of @babel/runtime
node_modules/@wordpress/wordcount

webpack-dev-server <=5.2.0
Severity: moderate
webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser - GHSA-9jgg-88mc-972h
webpack-dev-server users' source code may be stolen when they access a malicious web site - GHSA-4v9v-hfq4-rm2v
fix available via npm audit fix --force
Will install @wordpress/scripts@19.2.4, which is a breaking change
node_modules/webpack-dev-server

58 moderate severity vulnerabilities

[hueitan]

I have tested all above with the wordpress 6.8.1 #143 will merge it after this.

[Abijeet]

Is the npm audit report post update or pre-update?

[hueitan]

Is the npm audit report post update or pre-update?

just update for the info, it is pre-update.