[aryanjasala]

What this PR does

Two dependency fixes for 1.0.1.

Block editor reload loop (regression from #77). Aditya found that under npm start the block editor reloads in a loop. webpack-dev-server 6.1.0 hands its browser client to webpack-dev-middleware 8.4, which checks lastHash === __webpack_hash__. With --experimental-modules there are two compilers, so the server sends a combined hash that never equals the page's own; the client asks for a hot-update.json that doesn't exist, gets a 404 and reloads. 6.0.0's client accepted a hash that contains the page's, so it is stable on the same setup. 6.1.0 is the latest release.

Security alerts. Clears the two open Dependabot alerts on main, both in isomorphic-git 1.37.6:

• #129 (high), GHSA-9qw7-j9xw-fv9c: arbitrary file write outside the working tree through a directory symlink during checkout.
• #131 (medium), GHSA-cw2g-2vwq-88w6: path traversal through a .. tree-entry name on clone or checkout.

It is a dev-only dependency: @wordpress/env 12.1.0 → @wp-playground/cli → @wp-playground/storage, which pins isomorphic-git to exactly 1.37.6. Both advisories are fixed in 1.38.6.

Changes

• webpack-dev-server 6.0.0 in devDependencies, with "webpack-dev-server": "$webpack-dev-server" in overrides. Both are needed: the override alone nests the pin under @wordpress/scripts, where webpack-cli can't find it. The lockfile change is 6.1.0 → 6.0.0 plus ansi-html-community 0.0.8.
• A docs/internal/maintenance.md row for the pin: why it is there, and when and how to drop it.
• overrides in package.json: @wp-playground/storage > isomorphic-git 1.38.6, scoped to the one package that pulls it.
• package-lock.json: only the isomorphic-git entry changes.

How I verified

• Aditya verified the pin: the editor loads once, and an edit to example-block/edit.js hot-applies without a reload.
• Compared the two clients: 6.0.0 has currentHash.indexOf(previousHash) >= 0, and webpack-dev-middleware 8.4's client/process-update.js has lastHash === __webpack_hash__.
• npm ls webpack-dev-server shows 6.0.0 at the top level, deduped under @wordpress/scripts.
• npm ci from the new lockfile, then npm ls isomorphic-git shows 1.38.6, overridden, under @wp-playground/storage.
• npx wp-env --version runs and @wp-playground/storage loads.
• npm run lint:package-json passes.

Reviewer notes

• No upstream bump fixes it yet: the latest @wp-playground/storage (3.1.63) still pins 1.37.6, and @wordpress/env 12.1.0 is the latest. Drop the override once Playground moves past 1.38.6.
• theme-elementary has the same reload loop (same scripts 37 and --experimental-modules setup); its pin is in a separate PR. It has no isomorphic-git alerts.
• The squash commit only takes the title, so this block gives release-please both entries:

BEGIN_COMMIT_OVERRIDE
fix(deps): pin webpack-dev-server to 6.0.0 to stop the block editor reload loop
fix(deps): override isomorphic-git to 1.38.6 for two path-traversal advisories
END_COMMIT_OVERRIDE

[Adi-ty]

Regression from #77: block editor reloads in a loop under npm start

webpack-dev-server 6.1.0 compares the dev server's combined two-compiler hash (40 chars, from --experimental-modules) strictly against the page's 20-char __webpack_hash__. It then requests a hot-update.json that doesn't exist, gets a 404 and reloads, every time. 6.0.0 is stable on the same setup, and 6.1.0 is the latest release.

Could this PR pin it?

"devDependencies": { "webpack-dev-server": "6.0.0" },
"overrides": { "webpack-dev-server": "$webpack-dev-server" }

Both lines are needed: an override alone nests it under @wordpress/scripts, where webpack-cli can't find it. The lockfile change is webpack-dev-server 6.1.0 → 6.0.0 plus ansi-html-community 0.0.8.

Verified with the pin: the editor loads once, and an edit to example-block/edit.js hot-applies without a reload. The pin can go once a release after 6.1.0 handles multi-compiler hashes.