chore(deps): upgrade @wordpress/scripts to 33 and refresh the lockfile

[erseco]

Reduces the open Dependabot alerts by lifting an obsolete version cap and refreshing a stale lockfile. No overrides.

Every open alert is npm, in package-lock.json, and transitive through @wordpress/scripts. None are Composer — the ranges pinned in #232 are not involved.

The version cap was obsolete

.github/dependabot.yml held @wordpress/scripts below 32.3.0 and @wordpress/e2e-test-utils-playwright below 1.47.0, because those releases pointed their package exports at TypeScript source the Playwright runner cannot load. Upstream reverted it:

1.46.0  exports["."].default = ./build/index.cjs
1.47.0  exports["."].default = ./src/index.ts     <- the breakage
1.48.0  exports["."].default = ./src/index.ts
1.50.0  exports["."].default = ./build/index.js   <- fixed
1.51.0  exports["."].default = ./build/index.js

So the cap is removed and both packages track latest again, confirmed by running the E2E suite on the uncapped toolchain — the job the cap existed to protect.

Result

Configuration	Distinct advisories
main, untouched	34
Upgrade alone	33
Upgrade + npm update (this PR)	17
Upgrade + 18 forced overrides	6

Half the advisories go away with no unusual machinery: the lockfile had simply gone stale, and npm update moves the tree to patched releases the parents' own ranges already allow.

An earlier revision of this branch took the last route, forcing 18 versions through overrides. It was dropped. The extra eleven advisories can only be bought by crossing majors upstream never tested together — webpack-dev-server 4→5, uuid 8→11, serialize-javascript 6→7, markdown-it 12→14, linkify-it 3→5, adm-zip 0.5→0.6 — inside chains this project never executes. There is no build step and no dev server in package.json, so webpack, postcss and svgo are installed but never run. Those alerts will clear as @wordpress/scripts moves, with no forced pins left behind to maintain.

npm audit fix was not an option either: every remaining fix needs --force, which would have lifted the cap blindly rather than after checking upstream had fixed the entry point.

Two numbers that look wrong and are not

npm audit's total rises from 43 to 64 while distinct advisories halve. It counts packages affected, not advisories, and the one unfixable advisory below cascades widely through the changed tree.

brace-expansion cannot be fixed. Only 5.0.8+ is patched, but v5's CommonJS entry exports { expand } instead of the callable default v1/v2 exported. minimatch@3 and @9 call expand(pattern), so forcing it throws expand is not a function and takes glob, jest and eslint with it. Verified by running it, not assumed. It needs upstream minimatch to migrate.

Verification

Rebased onto main after #236 merged, and re-verified there.

npm ci                 ✓ exits 0, and now leaves a clean tree (#236)
npm run test:unit-js   ✓ 9 tests
make test              ✓ 1808 tests, 13086 assertions
make test-e2e          ✓ 72 passed, 1 pre-existing failure, 21 skipped

The E2E failure is document-types.spec.js:17. It is not a regression: a full run on main with no changes applied fails the same test with the same 72/1/21 counts. Root cause found while investigating — DocumentTypesPage.create() registers waitForResponse after clicking submit, so a fast response arrives before the listener exists. Left for a separate fix rather than folded in here.

What still shows up

The 17 remaining advisories, all transitive and all needing a major crossing this PR declines to force:

Package	Advisories	Arrives via	Reachable here?
webpack-dev-server	5	@wordpress/scripts	No — dev server for a start script that does not exist
minimatch	3	eslint plugins, rimraf→glob, lighthouse	Globbing only
serialize-javascript	2	copy-webpack-plugin	No — there is no build step
linkify-it	2	markdown-it ← markdownlint	No — docs linting is not run
brace-expansion	1	under minimatch	See above; unfixable
adm-zip	1	@wordpress/env	Yes — unpacking WordPress from wordpress.org
markdown-it, uuid, @opentelemetry/core	3	markdownlint, sockjs, @sentry/node	No

adm-zip is the only one in a chain CI actually executes, and the advisory is a crafted ZIP triggering a large allocation — the ZIP being WordPress itself, fetched from wordpress.org.

path-to-regexp and body-parser, present before, were resolved by the upgrade.

Not included

• @playwright/test is used but not declared — require()d in tests/e2e/playwright.config.js, resolving by hoisting. Declaring it would be more honest, but Playwright breaks badly when the runner and the config resolve two different copies, so pinning it independently of what @wordpress/scripts expects carries its own risk. Flagged for a deliberate decision.

Worth considering separately

@wordpress/scripts is used for exactly two subcommands, test-playwright and test-unit-js, but it brings webpack, eslint, babel and jest in full — including webpack-dev-server, the dev server for a start script this project does not have. Most of the remaining advisories live in that unused surface. Replacing those two subcommands with direct playwright test and jest invocations would remove the bulk of them at the root, with no pins to maintain.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!