chore(deps): pin Composer dependency ranges - #232
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
erseco
added a commit
that referenced
this pull request
Jul 28, 2026
Every open Dependabot alert is npm, in package-lock.json, and transitive through @wordpress/scripts. None are Composer, so the ranges pinned in #232 are not involved. Two changes, no overrides: 1. Lift the version cap. .github/dependabot.yml held @wordpress/scripts below 32.3.0 and @wordpress/e2e-test-utils-playwright below 1.47.0, because those releases pointed their package "exports" at TypeScript source that the Playwright runner cannot load. Upstream reverted that: 1.46.0 exports["."].default = ./build/index.cjs 1.47.0 exports["."].default = ./src/index.ts <- the breakage 1.48.0 exports["."].default = ./src/index.ts 1.50.0 exports["."].default = ./build/index.js <- fixed 1.51.0 exports["."].default = ./build/index.js So the cap is removed and both packages track latest again. 2. npm update, which moves the tree to patched releases already allowed by the ranges the parents declare. The lockfile had simply gone stale. Distinct advisories drop from 34 to 17. Measured across four installs, each npm ci followed by npm audit: main, untouched 34 upgrade alone 33 upgrade + npm update (this commit) 17 upgrade + 18 forced overrides 6 An earlier revision of this branch took the last route. It was dropped: half the reduction needs no overrides at all, and the remaining eleven advisories can only be bought by forcing majors upstream never tested together - webpack-dev-server 4->5, uuid 8->11, serialize-javascript 6->7, markdown-it 12->14, linkify-it 3->5, adm-zip 0.5->0.6 - in chains this project never executes. There is no build step and no dev server, so webpack, postcss and svgo are installed but never run. Those alerts will clear as @wordpress/scripts moves, without forced pins to maintain. Note that npm audit's total rises from 43 to 64 while distinct advisories halve: it counts packages affected, and the unfixable brace-expansion advisory cascades widely. Only 5.0.8+ is patched there, and v5 exports { expand } instead of the callable default v1/v2 exported, so forcing it throws "expand is not a function" in minimatch. Verified by running it. Verified: npm ci exits 0, test:unit-js 9 tests, PHPUnit 1808 tests, Playwright 72 passed with 1 pre-existing failure - document-types.spec.js fails identically on main with no changes applied, so it is not a regression from this upgrade.
erseco
added a commit
that referenced
this pull request
Jul 28, 2026
#235) Every open Dependabot alert is npm, in package-lock.json, and transitive through @wordpress/scripts. None are Composer, so the ranges pinned in #232 are not involved. Two changes, no overrides: 1. Lift the version cap. .github/dependabot.yml held @wordpress/scripts below 32.3.0 and @wordpress/e2e-test-utils-playwright below 1.47.0, because those releases pointed their package "exports" at TypeScript source that the Playwright runner cannot load. Upstream reverted that: 1.46.0 exports["."].default = ./build/index.cjs 1.47.0 exports["."].default = ./src/index.ts <- the breakage 1.48.0 exports["."].default = ./src/index.ts 1.50.0 exports["."].default = ./build/index.js <- fixed 1.51.0 exports["."].default = ./build/index.js So the cap is removed and both packages track latest again. 2. npm update, which moves the tree to patched releases already allowed by the ranges the parents declare. The lockfile had simply gone stale. Distinct advisories drop from 34 to 17. Measured across four installs, each npm ci followed by npm audit: main, untouched 34 upgrade alone 33 upgrade + npm update (this commit) 17 upgrade + 18 forced overrides 6 An earlier revision of this branch took the last route. It was dropped: half the reduction needs no overrides at all, and the remaining eleven advisories can only be bought by forcing majors upstream never tested together - webpack-dev-server 4->5, uuid 8->11, serialize-javascript 6->7, markdown-it 12->14, linkify-it 3->5, adm-zip 0.5->0.6 - in chains this project never executes. There is no build step and no dev server, so webpack, postcss and svgo are installed but never run. Those alerts will clear as @wordpress/scripts moves, without forced pins to maintain. Note that npm audit's total rises from 43 to 64 while distinct advisories halve: it counts packages affected, and the unfixable brace-expansion advisory cascades widely. Only 5.0.8+ is patched there, and v5 exports { expand } instead of the callable default v1/v2 exported, so forcing it throws "expand is not a function" in minimatch. Verified by running it. Verified: npm ci exits 0, test:unit-js 9 tests, PHPUnit 1808 tests, Playwright 72 passed with 1 pre-existing failure - document-types.spec.js fails identically on main with no changes applied, so it is not a regression from this upgrade.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
*composer.lockto preserve reproducible installationsDependency ranges
tinybutstrong/tinybutstrong:^3.15.3tinybutstrong/opentbs:^1.12.3phpunit/phpunit:^9.6.35wp-cli/i18n-command:^2.7.0wp-phpunit/wp-phpunit:^7.0.2yoast/phpunit-polyfills:^1.1.5yoast/wp-test-utils:^1.2.1Validation
composer.lockFollow-up
The lockfile should be refreshed with
composer update --lockif CI reports that its content hash is stale. This should only update lock metadata, not package versions.