Bump the npm-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the npm-dependencies group with 6 updates in the / directory:

Package	From	To
@wordpress/env	10.38.0	11.13.0
@wordpress/scripts	30.27.0	34.1.0
autoprefixer	10.4.23	10.5.4
lint-staged	17.0.8	17.3.0
postcss	8.5.16	8.5.26
sass	1.97.3	1.103.1

Updates @wordpress/env from 10.38.0 to 11.13.0

Changelog

Sourced from @​wordpress/env's changelog.

11.13.0 (2026-08-12)

11.12.0 (2026-07-29)

11.11.0 (2026-07-14)

11.10.0 (2026-07-01)

11.9.0 (2026-06-24)

11.8.1 (2026-06-16)

11.8.0 (2026-06-10)

Enhancements

• Use partial clones (--filter=blob:none) when downloading git sources and the PHPUnit test suite to reduce download size. (#78918)

Bug Fixes

• Replace extract-zip with adm-zip to fix silent hang on Node 24.16.0 (libuv 1.52.1) when downloading URL-based zip sources. (#78762)

11.7.0 (2026-05-27)

11.6.0 (2026-05-14)

11.5.0 (2026-04-29)

11.4.0 (2026-04-15)

Bug Fixes

• Fix WP-Cron, REST API loopback, and Site Health loopback failures when wp-env runs on a non-default port. Apache inside the WordPress container now also listens on the host-mapped port, so PHP loopback requests to WP_HOME succeed instead of being refused. (#20569)

11.3.0 (2026-04-01)

11.2.0 (2026-03-18)

11.1.0 (2026-03-04)

Bug Fixes

• Suppress spinner and success message output when using --json flag to ensure clean, parseable JSON output.

11.0.0 (2026-02-18)

Bug Fixes

• Playground runtime now supports zip archive themes, matching Docker runtime behavior. (#75140).

... (truncated)

Commits

• 989764d chore(release): publish
• e18aa00 Update changelog files
• dbb73c9 Merge changes published in the Gutenberg plugin "release/23.8" branch
• 7e8b17a chore(release): publish
• 42ad080 Update changelog files
• edffa74 Merge changes published in the Gutenberg plugin "release/23.7" branch
• e9a74f9 chore(release): publish
• 2a0c375 Update changelog files
• e61c854 Merge changes published in the Gutenberg plugin "release/23.6" branch
• 1055a35 Update changelog files
• Additional commits viewable in compare view

Updates @wordpress/scripts from 30.27.0 to 34.1.0

Changelog

Sourced from @​wordpress/scripts's changelog.

34.1.0 (2026-08-12)

Bug Fixes

• Set Sass's charset option to false so production builds no longer emit a UTF-8 BOM in the middle of the extracted CSS (#81383).

34.0.0 (2026-07-29)

Breaking Changes

• Upgrade the bundled Jest packages from v29 to v30 (#80767).

Enhancements

• `format`: Detect `prettier.config.mjs` so the bundled default config is not used when one is present ([#80422](https://github.com/WordPress/gutenberg/pull/80422)).
  

33.0.0 (2026-07-14)

Breaking Changes

• The test-e2e command now runs the Playwright-based end-to-end test runner instead of Puppeteer (test-playwright remains available as an alias). Removed the Puppeteer test environment and configuration (jest-environment-puppeteer, jest-e2e.config.js, puppeteer.config.js) along with the puppeteer-core and expect-puppeteer dependencies. Puppeteer-specific options (e.g. --puppeteer-interactive, --puppeteer-devtools) are no longer supported (#60357).

Enhancements

• Widen React peer dependency ranges to ^18 || ^19 to support both React 18 and React 19 environments (#80024).
• Update stylelint to ^16.26.1 (#79648).
• Widen the @playwright/test peer dependency to >=1 and mark it optional, so consumers aren't forced to bump Playwright or satisfy it under strict peer deps (#78632).
• Update webpack-dev-server to ^5.2.1, resolving several Dependabot security alerts and migrating the internal dev-server proxy config to the v5 array format (#80347).

32.6.0 (2026-07-01)

32.5.0 (2026-06-24)

Enhancements

• lint-style: Detect .cjs and .mjs config files so the bundled default config is not used when one of these is present (#79226).

32.4.1 (2026-06-16)

32.4.0 (2026-06-10)

32.3.0 (2026-05-27)

32.2.0 (2026-05-14)

32.1.0 (2026-04-29)

32.0.0 (2026-04-15)

Breaking Changes

... (truncated)

Commits

• 989764d chore(release): publish
• e18aa00 Update changelog files
• dbb73c9 Merge changes published in the Gutenberg plugin "release/23.8" branch
• 7e8b17a chore(release): publish
• 42ad080 Update changelog files
• edffa74 Merge changes published in the Gutenberg plugin "release/23.7" branch
• e9a74f9 chore(release): publish
• 2a0c375 Update changelog files
• e61c854 Merge changes published in the Gutenberg plugin "release/23.6" branch
• 1055a35 Update changelog files
• Additional commits viewable in compare view

Updates autoprefixer from 10.4.23 to 10.5.4

Release notes

Sourced from autoprefixer's releases.

10.5.4

• Fixed prefixed rule duplication (by @​xianjianlf2).

10.5.3

• Fixed brackets and gradient parser (@​alanturing881).

10.5.2

• Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

10.5.0 “Each Endeavouring, All Achieving”

• Added mask-position-x and mask-position-y support (by @​toporek).

10.4.27

• Removed development key from package.json.

10.4.26

• Reduced package size.

10.4.25

• Fixed broken gradients on CSS Custom Properties (by @​serger777).

10.4.24

• Made Autoprefixer a little faster (by @​Cherry).

Changelog

Sourced from autoprefixer's changelog.

10.5.4

• Fixed prefixed rule duplication (by @​xianjianlf2).

10.5.3

• Fixed brackets and gradient parser (@​alanturing881).

10.5.2

• Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

10.5.0 “Each Endeavouring, All Achieving”

• Added mask-position-x and mask-position-y support (by @​toporek).

10.4.27

• Removed development key from package.json.

10.4.26

• Reduced package size.

10.4.25

• Fixed broken gradients on CSS Custom Properties (by @​serger777).

10.4.24

• Made Autoprefixer a little faster (by @​Cherry).

Commits

• 4cad00f Release 10.5.4 version
• e62a4b1 Update CI config
• c8f0d0a Update dependencies
• cae3577 Move back to latest pnpm 11
• fd31eb3 Fix duplicated prefixed selectors on reformatted CSS (#1552)
• 958d390 Release 10.5.3 version
• 21d2adb Fix gradient parser
• f7ddae9 Fix bracket parser
• 10ea5e7 Update dependencies and remove patch
• b6e8a2a Update Dev Container
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for autoprefixer since your current version.

Updates lint-staged from 17.0.8 to 17.3.0

Release notes

Sourced from lint-staged's releases.

v17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    "*": [
      [
        "oxfmt --check --no-error-on-unmatched-pattern",
        "oxlint --no-error-on-unmatched-pattern",
      ],
    ],
    "*.ts": () => "tsc",
  };

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

v17.2.0

Minor Changes

• #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

  /** @type {import('lint-staged').Configuration} */
  export default {
    "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
  };

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    '*': [
      ['oxfmt --check --no-error-on-unmatched-pattern', 'oxlint --no-error-on-unmatched-pattern'],
    ],
    '*.ts': () => 'tsc',
  }

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

17.2.0

Minor Changes

• #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

  /** @type {import('lint-staged').Configuration} */
  export default {
    '*.ts': () => 'tsc', // Run "tsc" when any TS file is changed (for entire project)
  }

  Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

... (truncated)

Commits

• d153443 Merge pull request #1828 from lint-staged/changeset-release/main
• 5162c14 chore(changeset): release
• a4db9a4 Merge pull request #1831 from lint-staged/linter-updates
• ea96cab style: enable oxlint "suspicious" category
• 2fae007 style: add @e18e/eslint-plugin
• 2280c38 Merge pull request #1829 from lint-staged/fix-merge-conflict-files
• 1453ae6 test: relax assertion so that it passes in worktree
• 15f7e53 fix: lint only files changed against HEAD and MERGE_HEAD, during a merge
• dedfc31 Merge pull request #1825 from lint-staged/parallel-tasks-inside-sequence
• 286e25c feat: allow running parallel tasks by nesting arrays
• Additional commits viewable in compare view

Updates postcss from 8.5.16 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

Changelog

Sourced from postcss's changelog.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

Commits

• 07b2577 Release 8.5.26 version
• 47de6b9 Update CI
• 1493a83 Fix Rule#selectors losing the empty selector (#2129)
• 180db16 Typo
• 29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
• 3ba8f84 Update dependencies
• 87e72f6 Update lock file
• caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
• 3609b6f Explain how to type plugin options
• fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
• Additional commits viewable in compare view

Updates sass from 1.97.3 to 1.103.1

Release notes

Sourced from sass's releases.

Dart Sass 1.103.1

To install Sass 1.103.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.103.0

To install Sass 1.103.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Potentially breaking compatibility fix: Colors now preserve "analogous sets" of missing channels during conversions, per the CSS spec. For example, color.to-space(lch(50% none none), lab) now returns lab(50% none none) instead of lab(50% 0 0).

See the full changelog for changes in earlier releases.

Dart Sass 1.102.0

To install Sass 1.102.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Use the 2.4 gamma transfer function for rec2020, as specified by the latest draft of CSS Color 4.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.7

To install Sass 1.101.7, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.6

To install Sass 1.101.6, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

... (truncated)

Changelog

Sourced from sass's changelog.

1.103.1

• No user-visible changes.

1.103.0

• Potentially breaking compatibility fix: Colors now preserve "analogous sets" of missing channels during conversions, per the CSS spec. For example, color.to-space(lch(50% none none), lab) now returns lab(50% none none) instead of lab(50% 0 0).

1.102.0

• Use the 2.4 gamma transfer function for rec2020, as specified by the latest draft of CSS Color 4.

1.101.7

• No user-visible changes.

1.101.6

• No user-visible changes.

1.101.5

• No user-visible changes.

1.101.4

• Avoid emitting rgb() or rgba() functions with non-percent decimal channels. Older browsers only support integer values or (potentially decimal) percentages for these functions, so in order to preserve backwards-compatibility while retaining full precision for modern browsers, legacy colors that contain at least one non-integer channel will now use percentages for their channels (for example, rgb(0%, 100%, 50%) rather than rgb(0, 255, 127.5)).

• Fix a bug where the values of plain-CSS if() expressions were emitted using their meta.inspect() format rather than their CSS serialization format.

1.101.3

• No user-visible changes.

1.101.2

• Fix a bug where the deprecation warning for vendor-prefixed expression() functions would incorrectly indicate whether or not the function would be invalid Sass in Dart Sass 2.0.0.

... (truncated)

Commits

• 62243d4 Set committer metadata when creating a tag (#2838)
• ed4dcc7 Use more dot shorthands (#2837)
• ac3d928 Support analogous sets of missing channels (#2810)
• 1e0cf28 Merge pull request #2834 from ntkme/fix-release
• f3bd86a Merge pull request #2835 from sass/dart-sdk-version
• 287f9ba Code review
• 91831b8 Fix dartdoc error
• 0971ea9 Bump bufbuild/buf-action from 1.4.0 to 1.5.0 in /.github/util/initialize (#2826)
• c45223b Bump zizmorcore/zizmor-action from 0.6.0 to 0.6.2 (#2828)
• cbb1db1 Bump dart-lang/setup-dart from 1.7.2 to 1.8.0 (#2829)
• Additional commits viewable in compare view