From c69ea7c65a4eef25ba923382bc22c094bd51881a Mon Sep 17 00:00:00 2001 From: Aryan Jasala Date: Tue, 10 Nov 2026 14:28:11 +0530 Subject: [PATCH 1/2] fix(deps): override isomorphic-git to 1.38.6 for two path-traversal advisories --- package-lock.json | 6 +++--- package.json | 3 +++ 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index e7d6535..c8aada7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -21803,9 +21803,9 @@ } }, "node_modules/isomorphic-git": { - "version": "1.37.6", - "resolved": "https://registry.npmjs.org/isomorphic-git/-/isomorphic-git-1.37.6.tgz", - "integrity": "sha512-qr1NFCPsVTZ6YGqTXw0CzamnsHyH9QQ1OTEfeXIweSljRUMzuHFCJdUn0wc6OcjtTDns6knxjPb7N6LmJeftOA==", + "version": "1.38.6", + "resolved": "https://registry.npmjs.org/isomorphic-git/-/isomorphic-git-1.38.6.tgz", + "integrity": "sha512-lCmZ1m2R0LqbZ4QATtLCxhwNBQPNJc74R81dfyF90yLqP8xs2DZLedcnkVuRj6th/L2HYoIvWP5lBpS1ooAagw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index b72a0c4..a349eb5 100644 --- a/package.json +++ b/package.json @@ -68,6 +68,9 @@ }, "@wordpress/scripts": { "adm-zip": "0.6.1" + }, + "@wp-playground/storage": { + "isomorphic-git": "1.38.6" } }, "scripts": { From 185e394955e66135268f0d96fa82ad3b3e8db223 Mon Sep 17 00:00:00 2001 From: Aryan Jasala Date: Tue, 10 Nov 2026 14:58:53 +0530 Subject: [PATCH 2/2] fix(deps): pin webpack-dev-server to 6.0.0 to stop the block editor reload loop --- docs/internal/maintenance.md | 1 + package-lock.json | 23 +++++++++++++++++++---- package.json | 4 +++- 3 files changed, 23 insertions(+), 5 deletions(-) diff --git a/docs/internal/maintenance.md b/docs/internal/maintenance.md index bcddb19..5c52689 100644 --- a/docs/internal/maintenance.md +++ b/docs/internal/maintenance.md @@ -99,6 +99,7 @@ The release pull request is opened with `GITHUB_TOKEN`, so GitHub starts no work | --- | --- | --- | | `rtcamp/wp-primitives` | `composer.json` (`^2.0`), `composer.lock` | Run `composer update rtcamp/wp-primitives -W`, then `npm run sync-ai` to refresh the generated instructions. Update every pinned docs link (`grep -rn "wp-primitives/blob/v" README.md DEVELOPMENT.md docs`) to the new tag, and review the framework's changelog for anything the examples or docs must follow. | | `@rtcamp/wp-tooling`, lint configs | `package.json` (`^` ranges on the npm registry), `package-lock.json` | Run `npm update @rtcamp/wp-tooling` (and the configs) to move the lock, then re-run init and scaffold validation. | +| `webpack-dev-server` | `package.json` (`6.0.0` in `devDependencies`, and `overrides` pointing at it) | Pinned below 6.1.0, whose client compares the dev server's combined hash from the two `--experimental-modules` compilers strictly against the page's own hash, so the block editor reloads in a loop under `npm start`. The `overrides` entry alone would nest the pin under `@wordpress/scripts`, where `webpack-cli` cannot find it, so both lines stay. Remove both once a release after 6.1.0 handles multi-compiler hashes, then check that an edit to a block's `edit.js` hot-applies without a reload. | | Coding standards | `composer.json` (`rtcamp/wp-phpcs`, `rtcamp/wp-phpstan`) | `composer update rtcamp/wp-phpcs rtcamp/wp-phpstan`; fix or baseline new findings in a separate commit. | | Shared CI | `.github/workflows/test-measure.yml` (`@v1`) | `@v1` moves to compatible v1.x releases on its own. For a new major version, move the ref and check the input names against the new `wp-ci.yml`. | | Docs builder | `.github/workflows/documentation.yml` (pinned SHA) | See [Documentation publishing](#documentation-publishing). | diff --git a/package-lock.json b/package-lock.json index c8aada7..8cdd803 100644 --- a/package-lock.json +++ b/package-lock.json @@ -39,6 +39,7 @@ "jest-silent-reporter": "0.6.0", "lint-staged": "17.6.0", "npm-run-all": "4.1.5", + "webpack-dev-server": "6.0.0", "webpack-remove-empty-scripts": "1.1.1" }, "engines": { @@ -14084,6 +14085,19 @@ "url": "https://github.com/sponsors/sindresorhus" } }, + "node_modules/ansi-html-community": { + "version": "0.0.8", + "resolved": "https://registry.npmjs.org/ansi-html-community/-/ansi-html-community-0.0.8.tgz", + "integrity": "sha512-1APHAyr3+PCamwNw3bXCPp4HFLONZt/yIH0sZp0/469KWNTEy+qN5jQ3GVX6DMZ1UXAi34yVwtTeaG/HpBuuzw==", + "dev": true, + "engines": [ + "node >= 0.8.0" + ], + "license": "Apache-2.0", + "bin": { + "ansi-html": "bin/ansi-html" + } + }, "node_modules/ansi-regex": { "version": "5.0.1", "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz", @@ -32563,9 +32577,9 @@ } }, "node_modules/webpack-dev-server": { - "version": "6.1.0", - "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-6.1.0.tgz", - "integrity": "sha512-T52SEoefJWZDgiYRMeQn4q/w9EVIZjBNWfy/WNRR2+EosPwpUmdUY1Wj0b1Mk7+svgKXojdQTP425fJ+DN58yg==", + "version": "6.0.0", + "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-6.0.0.tgz", + "integrity": "sha512-q9SD4ItOGhZLeU6EGT10caDZdHjF50Pz1DtkRZZOPsfluMXOkacWKKOtSBSLVkPqKiF67eFUC0rI88U/tSFPEw==", "dev": true, "license": "MIT", "dependencies": { @@ -32576,6 +32590,7 @@ "@types/serve-index": "^1.9.4", "@types/serve-static": "^2.2.0", "@types/ws": "^8.18.1", + "ansi-html-community": "^0.0.8", "bonjour-service": "^1.3.0", "chokidar": "^5.0.0", "compression": "^1.8.1", @@ -32591,7 +32606,7 @@ "selfsigned": "^5.5.0", "serve-index": "^1.9.2", "tinyglobby": "^0.2.15", - "webpack-dev-middleware": "^8.4.0", + "webpack-dev-middleware": "^8.0.3", "ws": "^8.20.0" }, "bin": { diff --git a/package.json b/package.json index a349eb5..296a67c 100644 --- a/package.json +++ b/package.json @@ -52,6 +52,7 @@ "jest-silent-reporter": "0.6.0", "lint-staged": "17.6.0", "npm-run-all": "4.1.5", + "webpack-dev-server": "6.0.0", "webpack-remove-empty-scripts": "1.1.1" }, "overrides": { @@ -71,7 +72,8 @@ }, "@wp-playground/storage": { "isomorphic-git": "1.38.6" - } + }, + "webpack-dev-server": "$webpack-dev-server" }, "scripts": { "build:dev": "cross-env NODE_ENV=development npm-run-all 'build:!(dev|prod)'",