Skip to content

Bump tough-cookie, @wordpress/scripts and npm-check-updates - #589

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-7c63a13ed6
Open

Bump tough-cookie, @wordpress/scripts and npm-check-updates#589
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-7c63a13ed6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps tough-cookie to 5.1.2 and updates ancestor dependencies tough-cookie, @wordpress/scripts and npm-check-updates. These dependencies need to be updated together.

Updates tough-cookie from 4.0.0 to 5.1.2

Release notes

Sourced from tough-cookie's releases.

v5.1.2

What's Changed

Full Changelog: salesforce/tough-cookie@v5.1.1...v5.1.2

v5.1.1

What's Changed

Full Changelog: salesforce/tough-cookie@v5.1.0...v5.1.1

v5.1.0

What's Changed

Full Changelog: salesforce/tough-cookie@v5.0.0...v5.1.0

v5.1.0-rc.0

What's Changed

... (truncated)

Commits
  • a2c72ef Merge pull request #501 from salesforce/prepare_v5.1.2
  • 7034c22 5.1.2
  • 824b401 Merge pull request #500 from salesforce/499_domain_match_fix
  • a312820 Fix regression bug in domainMatch
  • 9328fc4 Merge pull request #497 from salesforce/wjh/release-v5.1.1
  • 2899336 5.1.1
  • 4954aed chore: npm audit fix
  • bb3e137 chore: auto-close spam PRs (#493)
  • 55ba3c6 isolated modules and almost isolated declarations (#486)
  • 9fc37ef Merge pull request #491 from salesforce/dependabot/npm_and_yarn/eslint-config...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ccasey, a new releaser for tough-cookie since your current version.


Updates @wordpress/scripts from 17.1.0 to 33.0.0

Release notes

Sourced from @​wordpress/scripts's releases.

23.6.0

Changelog

Features

Post Editor

  • Allow setting viewport tablet and mobile values in theme.json. (79104)
  • Experimental: Expand DataForm inspector to patterns. (79452)
  • Notes: Add @​mention autocomplete. (79604)
  • Notes: Inline (partial-text) notes via hybrid marker + strip-on-render approach. (78218)
  • Show the admin bar in the Post and Site Editor by default. (79197)

Block Editor

  • Share block-bindings context assembly between call sites. (79855)

Data Layer

  • Blocks: Add innerContent support for static inner blocks, adopt it in the HTML block. (79115)

Components

  • DataViews: Add a richtext control backed by a private RichTextControl shell in @​wordpress/components. (78471)

Block Library

  • Icons: Add PHP method(s) for rendering inline SVG icons from the registry. (78332)

Enhancements

  • CSS: Follow-up fixes to split_selector_list(). (79723)
  • Document widget relevance, help. (80007)
  • Expose widget category through the build pipeline and REST API. (79638)
  • Omnibar: Move the 'site icon in admin bar' feature from experiment to 7.1 compat. (79807)
  • Scripts: Make 'test-e2e' run Playwright and remove Puppeteer. (80058)
  • Site Editor v2 experiment: Hide admin bar in distraction-free mode. (79937)
  • Widget Dashboard: Remove layout-settings editing. (79903)
  • Widget Dashboard: Reserve paint space for tile focus rings. (79990)
  • Widget Primitives: Add WidgetAttributeField for typed attribute schemas. (79544)
  • Widgets: Add a declarative help metadata field, surfaced as a header infotip. (79830)
  • Widgets: Add attribute relevance and inline editing in the tile toolbar. (79735)
  • Widgets: Translate title, description, and keywords server-side. (79701)

Block Library

  • Accordion block: Add background gradient support. (79840)
  • Add ariaLabel supports for Tab List Block. (79948)
  • Add icon state classes to Accordion block. (74257)
  • Add layout and block spacing support to Latest Posts block. (77989)
  • Add option to exclude current post from query block. (64916)
  • Animated GIF to video conversion (via mediabunny). (78410)
  • Classic block: Remove migration notice and restore inserter availability. (79894)
  • Cover: Allow restricting video embed providers. (80092)
  • File Block: Deduplicate the file to audio/video/image transforms. (80158)

... (truncated)

Changelog

Sourced from @​wordpress/scripts's changelog.

33.0.0 (2026-07-14)

Breaking Changes

  • The test-e2e command now runs the Playwright-based end-to-end test runner instead of Puppeteer (test-playwright remains available as an alias). Removed the Puppeteer test environment and configuration (jest-environment-puppeteer, jest-e2e.config.js, puppeteer.config.js) along with the puppeteer-core and expect-puppeteer dependencies. Puppeteer-specific options (e.g. --puppeteer-interactive, --puppeteer-devtools) are no longer supported (#60357).

Enhancements

  • Widen React peer dependency ranges to ^18 || ^19 to support both React 18 and React 19 environments (#80024).
  • Update stylelint to ^16.26.1 (#79648).
  • Widen the @playwright/test peer dependency to >=1 and mark it optional, so consumers aren't forced to bump Playwright or satisfy it under strict peer deps (#78632).
  • Update webpack-dev-server to ^5.2.1, resolving several Dependabot security alerts and migrating the internal dev-server proxy config to the v5 array format (#80347).

32.6.0 (2026-07-01)

32.5.0 (2026-06-24)

Enhancements

  • lint-style: Detect .cjs and .mjs config files so the bundled default config is not used when one of these is present (#79226).

32.4.1 (2026-06-16)

32.4.0 (2026-06-10)

32.3.0 (2026-05-27)

32.2.0 (2026-05-14)

32.1.0 (2026-04-29)

32.0.0 (2026-04-15)

Breaking Changes

  • The bundled eslint dependency has been upgraded from v8 to v10 (#76654).
  • The lint-js script now uses flat config (eslint.config.*) by default. Legacy .eslintrc.* files are still detected as a fallback, but this support is deprecated and will be removed in a future version (#76654).
  • The default config shipped with wp-scripts has changed from config/.eslintrc.js to config/eslint.config.cjs (#76654).

31.8.0 (2026-04-01)

31.7.0 (2026-03-18)

31.6.0 (2026-03-04)

31.5.0 (2026-02-18)

31.4.0 (2026-01-29)

31.3.0 (2026-01-16)

... (truncated)

Commits
  • e9a74f9 chore(release): publish
  • 2a0c375 Update changelog files
  • e61c854 Merge changes published in the Gutenberg plugin "release/23.6" branch
  • 1055a35 Update changelog files
  • 8ca3e8e Merge changes published in the Gutenberg plugin "release/23.6" branch
  • 66c8050 Fix wp/latest release metadata (#79821)
  • d0d1bfc Update changelog files
  • 66315f3 Merge changes published in the Gutenberg plugin "release/23.5" branch
  • 74218a2 Update changelog files
  • 504adfc Revert "Update changelog files"
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by desrosj, a new releaser for @​wordpress/scripts since your current version.


Updates npm-check-updates from 11.8.5 to 23.0.0

Release notes

Sourced from npm-check-updates's releases.

v23.0.0

⚠️ Breaking changes & migration

1. Node.js 22+ required (#1844) The minimum supported Node.js is now 22. Supported versions: ^22.22.2 || ^24.15.0 || >=26.0.0 (and npm >=10).

  • Migration: Upgrade Node before installing. On older Node, stay on v22.x.

2. Pure ESM package — CJS build dropped, default export is now callable (#1916, #1894) The package is now pure ESM (no more CommonJS build), and the default export is now callable directly. ncu.run() and ncu.defineConfig() still work as namespaced properties.

  • Migration (ESM): 
    // before
import * as ncu from 'npm-check-updates'
const upgraded = await ncu.run({ /* ... */ })
// after
import ncu from 'npm-check-updates'
const upgraded = await ncu({ /* ... */ }) // ncu.run({...}) also still works
  • Migration (CommonJS): Still usable via Node's native require() of ESM (Node 22+), but the import shape changed: 
    // before
const ncu = require('npm-check-updates')
// after
const { default: ncu } = require('npm-check-updates')
ncu({ /* ... */ }).then(upgraded => console.log(upgraded))

3. filterVersion / rejectVersion no longer accept a predicate function. Use filter / reject instead. (#1933) These options now accept only a string, wildcard, glob, comma/space-delimited list, or /regex/. (CLI usage is unchanged — the CLI never supported functions.)

  • Migration: If you passed a function to filterVersion/rejectVersion in .ncurc.js or via the module API, move it to filter / reject instead. Those receive the package name and the parsed current version, so they can match on both: 
    // before
filterVersion: (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)
// after
filter:        (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)

4. Output is now grouped by default (#1937) --format now defaults to ["group"], so upgrades are grouped by major / minor / patch out of the box. This is a better default for most users.

  • Migration: To get the old flat output, use: 
    ncu --format no-group
    The new no- prefix removes a value from the default list instead of replacing the whole list, so --format no-group,time disables grouping while adding publish times.

5. --target semver now respects explicit upper bounds (#1920) An explicit upper bound in a range is now preserved and never exceeded, e.g. ^9.5.0 <10 → ^9.7.0 <10 (previously the bound could be overrun). This can change which versions are selected for ranges with explicit upper bounds.

✨ Other improvements

  • Native TypeScript loading (#1888), lazy-loaded npm-registry-fetch for faster startup (#1898), and reduced dependencies for a lighter install.

... (truncated)

Commits
  • 2417fe3 23.0.0
  • 61b8818 Update deps (#1948)
  • 548c6e3 Merge pull request #1943 from raineorshine/xmr/test-doctor
  • d31677a test/doctor: run fixtures from a temp copy instead of mutating tracked files
  • 31c7e85 Fix and clean up skipped tests (#1941)
  • c7c968f Merge pull request #1935 from raineorshine/xmr/fix-regex
  • e42e613 Update dependencies (#1940)
  • 5c7b422 Add regression test for single-character override keys that are not '.'
  • 8d0d4be Move override tests into upgradePackageData.test.ts
  • 21b8f53 Use jsonc-parser for packageManager and JSON catalog upgrades
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump tough-cookie, @wordpress/scripts and npm-check-updates
908b79a 
Bumps [tough-cookie](https://github.com/salesforce/tough-cookie) to 5.1.2 and updates ancestor dependencies [tough-cookie](https://github.com/salesforce/tough-cookie), [@wordpress/scripts](https://github.com/WordPress/gutenberg/tree/HEAD/packages/scripts) and [npm-check-updates](https://github.com/raineorshine/npm-check-updates). These dependencies need to be updated together.


Updates `tough-cookie` from 4.0.0 to 5.1.2
- [Release notes](https://github.com/salesforce/tough-cookie/releases)
- [Changelog](https://github.com/salesforce/tough-cookie/blob/master/CHANGELOG.md)
- [Commits](salesforce/tough-cookie@v4.0.0...v5.1.2)

Updates `@wordpress/scripts` from 17.1.0 to 33.0.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/scripts/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/scripts@33.0.0/packages/scripts)

Updates `npm-check-updates` from 11.8.5 to 23.0.0
- [Release notes](https://github.com/raineorshine/npm-check-updates/releases)
- [Changelog](https://github.com/raineorshine/npm-check-updates/blob/main/CHANGELOG.md)
- [Commits](raineorshine/npm-check-updates@v11.8.5...v23.0.0)

---
updated-dependencies:
- dependency-name: tough-cookie
  dependency-version: 5.1.2
  dependency-type: indirect
- dependency-name: "@wordpress/scripts"
  dependency-version: 33.0.0
  dependency-type: direct:development
- dependency-name: npm-check-updates
  dependency-version: 23.0.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants