build(deps): clear 40 dev-dependency security advisories by jkmassel · Pull Request #583 · wordpress-mobile/GutenbergKit

jkmassel · 2026-08-12T19:04:11Z

What?

Bumps 15 dev-only dependencies to clear 40 open Dependabot advisories — 1 critical, most of the rest high — across the build, lint, test, and local-WP (@wordpress/env) tooling. None of these packages ship in the iOS/Android app bundle.

Dashboard: https://github.com/wordpress-mobile/GutenbergKit/security/dependabot

Why?

The Security tab currently has 85 open alerts. This PR clears the 40 that are (a) in the development dependency tree and (b) resolvable with a dependency bump — including the lone critical (shell-quote, alert 133) and the undici SOCKS5 TLS-validation advisory that kicked this off (alert 136). The other 45 alerts need a major upgrade or are runtime-scoped — see What's not addressed.

How?

Two mechanisms. Alert numbers below are Dependabot alert IDs (navigate via the dashboard link above).

1. In-range bumps

The declared semver ranges already permitted the patched versions, so npm update — plus a floor bump for the one direct dep (vite) — was enough:

Package	Bump	Alerts
`undici`	7.24.7 → 7.29.0	136, 137, 139, 140, 141, 143, 180–184
`vite` (direct; floor → `^8.0.16`)	8.0.5 → 8.2.1	134, 135
`shell-quote`	→ 1.10.0	133 (critical), 165
`fast-uri`	→ 3.1.5	163, 164, 179, 206, 207
`js-yaml`	→ 3.15.1 / 4.3.1	157, 158, 167, 168, 200, 201
`brace-expansion`	→ 1.1.18 / 2.1.4	160, 166
`immutable`	→ 5.1.9	161, 162
`fast-xml-builder`	→ 1.3.0	122, 123
`tmp`	→ 0.2.7	131
`simple-git`	→ 3.36.0	119
`@babel/plugin-transform-modules-systemjs`	→ 7.29.8	126

2. Scoped `overrides`

Four packages were exact-pinned by a parent (ws@"8.18.3", minimatch@"9.0.3", …), so a leaf npm update couldn't move them. Each override is scoped so it can't clobber a legitimately-different major elsewhere in the tree:

Override	Scope	Preserves	Alerts
`ws` → 8.21.0	global, with an exception	`ws@7.5.13` under `react-devtools-core` (needs `^7`)	138, 153
`qs` → 6.15.2	under `@wordpress/env`	—	130
`minimatch` → 9.0.9	under `@typescript-eslint/typescript-estree`	`minimatch@3.1.5` under ESLint	65
`@babel/core` → 7.29.7	under `@wordpress/babel-preset-default`	—	154

What's not addressed

electron (33 alerts) + its bundled got (alert 33) — both come only through react-devtools@7.0.1, which is already the latest published version and still bundles electron@^23. npm's only offered "fix" is a breaking downgrade to react-devtools@1.0.5. Clearing these needs a separate effort to replace or drop react-devtools.
Runtime-scope advisories — seroval (critical), nanoid, postcss, showdown, uuid (11 alerts). These ship to users, so they're out of scope for a dev-only bump and deserve a focused follow-up.

CI fixes

Getting this PR green surfaced two failures in the Test Web E2E job, unrelated to the dependency bumps. Both are fixed here as separate commits — the second is a repo-wide breakage that also blocks trunk.

`ci: skip electron's binary download`

The E2E job installs the full dep tree, and electron's postinstall downloads a ~100 MB prebuilt binary (GitHub releases) that no CI step runs — it only backs react-devtools' dev:tools. That download flaked (RequestError: socket hang up) and failed the job. Set ELECTRON_SKIP_BINARY_DOWNLOAD=1 in the pipeline env: block so every npm ci skips it; local dev:tools still pulls the binary it needs.

`ci: source wp-env WordPress core from the WordPress.org zip`

With no core in .wp-env.json, wp-env resolves core to WordPress/WordPress#<latest> — a git source — and git fetches the newest version tag from api.wordpress.org. At a WordPress release boundary the version API returns the new version (7.0.4) before the WordPress/WordPress git mirror is tagged, so the fetch fails with couldn't find remote ref 7.0.4 and wp-env start dies — on every branch, trunk included (it only surfaced here once the electron fix let the job reach wp-env start). Pointing core at https://wordpress.org/latest.zip — served immediately on release — keeps tracking latest while sidestepping the git-mirror lag. Verified locally: core resolves to a zip source (no git ref) and the playground runtime boots in ~12s.

Testing Instructions

npm run test:unit — 202 passing
npm run build — clean production build on vite@8.2.1
wp-env start --runtime=playground boots locally with the zip core (~12s)
CI green — the electron skip lets the E2E npm ci finish; the zip core lets wp-env start succeed
After merge, confirm Dependabot re-scans trunk and auto-closes the 40 listed alerts

Accessibility Testing Instructions

N/A — dependency and CI-config change; no UI or app-runtime behavior is affected.

Screenshots or screencast

N/A

undici's ProxyAgent silently drops the requestTls option on SOCKS5 proxy URIs, bypassing TLS certificate pinning (GHSA-vmh5-mc38-953g, high). It reaches us only as a transitive dev dependency of jsdom (our test DOM), so it never ships to app users. jsdom already declares `undici: "^7.24.5"`, so the caret range permits the patched release with no package.json change -- `npm update undici` bumps the lockfile from 7.24.7 to 7.29.0 (>= 7.28.0, patched). Resolves Dependabot alerts 136, 137, 139, 140, 141, 143 and 180-184.

…ories Resolves 29 Dependabot advisories in the dev dependency tree. None of these packages ship in the iOS/Android app bundle -- they are build, lint, and local-WP (`@wordpress/env`) tooling. In-range bumps: - `vite` 8.0.5 -> 8.2.1 (direct devDep; floor raised to `^8.0.16`) [134, 135] - `shell-quote` -> 1.10.0 [133 critical, 165] - `fast-uri` -> 3.1.5 [163, 164, 179, 206, 207] - `js-yaml` -> 3.15.1 / 4.3.1 [157, 158, 167, 168, 200, 201] - `brace-expansion` [160, 166], `immutable` [161, 162], `tmp` [131], `fast-xml-builder` [122, 123], `simple-git` [119], `@babel/plugin-transform-modules-systemjs` [126] Scoped `overrides` (parents exact-pinned the vulnerable version): - `ws` -> 8.21.0, keeping 7.5.13 for `react-devtools-core` [138, 153] - `qs` -> 6.15.2 under `@wordpress/env` [130] - `minimatch` -> 9.0.9 under `@typescript-eslint/typescript-estree` [65] - `@babel/core` -> 7.29.7 under `@wordpress/babel-preset-default` [154] Not addressed here: `electron` (33 alerts) and its bundled `got` (alert 33) are pinned by `react-devtools@7.0.1` -- already the latest, and npm's only "fix" is a breaking downgrade to `react-devtools@1.0.5`. Runtime-scope advisories (`seroval`, `nanoid`, `postcss`, `showdown`, `uuid`) are out of scope for a dev-only bump. Verified: `npm run test:unit` (202 passing) and `npm run build` green.

wpmobilebot · 2026-08-12T19:21:37Z

XCFramework Build

This PR's XCFramework is available for testing. Add the following to your Package.swift:

.package(url: "https://github.com/wordpress-mobile/GutenbergKit", branch: "pr-build/583")

_{Built from e032526}

The Test Web E2E job installs the full dependency tree, and electron's postinstall (`node install.js`) downloads a ~100 MB prebuilt binary. That download is flaky from CI -- build 2558 failed it twice with `RequestError: socket hang up` -- and it is pure waste: no CI step ever launches electron. It reaches the tree only as a transitive dependency of `react-devtools`, whose `dev:tools` debug app is never run here; the E2E suite drives Playwright/Chromium. Set `ELECTRON_SKIP_BINARY_DOWNLOAD=1` for the whole pipeline so every `npm ci` skips it. Scoped to CI -- local `npm run dev:tools` still downloads the binary it needs.

wp-env resolves an unspecified `core` to `WordPress/WordPress#<latest>` -- a git source whose ref is the newest stable version reported by api.wordpress.org. At a WordPress release boundary the version API returns the new version before the WordPress/WordPress git mirror is tagged, so `git fetch --tags origin 7.0.4` fails with "couldn't find remote ref" and `make wp-env-start` dies. That broke the Test Web E2E job on every branch, trunk included -- not just this PR, and only surfaced here once the electron-download skip let the job reach `wp-env start`. Point `core` at https://wordpress.org/latest.zip. WordPress.org serves the release zip immediately on release, so this keeps tracking latest while sidestepping the git-mirror lag entirely. Verified locally: wp-env now resolves core to a zip source (`core.type = zip`, no git ref) and the playground runtime boots in ~12s.

mokagio

LGTM. I'd never seen ovverrides in npm.

mokagio · 2026-08-13T03:48:53Z

+    # electron ships a ~100 MB prebuilt binary via a postinstall download
+    # that no CI step ever runs (it only backs react-devtools' `dev:tools`).
+    # The download is flaky from CI, so skip it -- see the Test Web E2E job.
+    ELECTRON_SKIP_BINARY_DOWNLOAD: '1'


mokagio · 2026-08-13T04:06:44Z

-			"version": "3.3.11",
-			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-			"integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+			"version": "3.3.18",
+			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+			"integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",


Runtime-scope advisories — seroval (critical), nanoid, postcss, showdown, uuid (11 alerts). These ship to users, so they're out of scope for a dev-only bump and deserve a focused follow-up.

Looks like nanoid and postcss (see below) ended up being touched. Does it matter? They're just patches so I think it should be fine without explicitly checking the behavior in the clients.

Interesting that it's part of the shipping bundle – I don't think it'll be a problem, but we can keep an eye out for CSS weirdness?

jkmassel added 2 commits August 12, 2026 13:03

github-actions Bot added the [Type] Build Tooling Issues or PRs related to build tooling label Aug 12, 2026

jkmassel added the dependencies Pull requests that update a dependency file label Aug 12, 2026

jkmassel self-assigned this Aug 12, 2026

jkmassel requested a review from a team as a code owner August 12, 2026 19:36

jkmassel requested a review from dcalhoun August 12, 2026 20:54

jkmassel enabled auto-merge (squash) August 12, 2026 20:54

mokagio approved these changes Aug 13, 2026

View reviewed changes

jkmassel merged commit f202117 into trunk Aug 13, 2026
25 checks passed

jkmassel deleted the jkmassel/el-paso branch August 13, 2026 04:08

Navigation Menu

Uh oh!

build(deps): clear 40 dev-dependency security advisories - #583

build(deps): clear 40 dev-dependency security advisories#583
jkmassel merged 4 commits into
trunkfrom
jkmassel/el-paso

jkmassel commented Aug 12, 2026 •

edited

Loading

Uh oh!

wpmobilebot commented Aug 12, 2026 •

edited

Loading

Uh oh!

mokagio left a comment

Uh oh!

mokagio Aug 13, 2026

Uh oh!

mokagio Aug 13, 2026

Uh oh!

jkmassel Aug 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

jkmassel commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What?

Why?

How?

1. In-range bumps

2. Scoped overrides

What's not addressed

CI fixes

ci: skip electron's binary download

ci: source wp-env WordPress core from the WordPress.org zip

Testing Instructions

Accessibility Testing Instructions

Screenshots or screencast

Uh oh!

wpmobilebot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

XCFramework Build

Uh oh!

mokagio left a comment

Choose a reason for hiding this comment

Uh oh!

mokagio Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

mokagio Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

jkmassel Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jkmassel commented Aug 12, 2026 •

edited

Loading

2. Scoped `overrides`

`ci: skip electron's binary download`

`ci: source wp-env WordPress core from the WordPress.org zip`

wpmobilebot commented Aug 12, 2026 •

edited

Loading