[superdav42]

Summary

• Refresh compatible npm dependency versions together in package-lock.json, preserving lockfile v2 and the existing React 18 / WordPress component APIs.
• Raise the webpack manifest floor to ^5.111.1 and override only @wordpress/components' UUID dependency to ^11.1.1. UUID 11 retains both CommonJS and ESM exports; this avoids upgrading the WordPress component library solely to fix UUID.
• Keep the existing typescript-estree minimatch override (9.0.7). All other minimatch entries resolve to patched 3.1.5; source-map-js resolves to 1.2.2; adm-zip is absent.

Issue disposition

Resolves #77
Resolves #76
Resolves #67
Resolves #66
Resolves #64
Resolves #33

For #57 and #65: not resolved. Registry checks confirm the latest braces (3.0.3) and sprintf-js (1.1.3) releases are still vulnerable and have no patched release. The full npm audit reports 30 findings cascading from these two dependencies. Removing them requires replacing/upgrading their parent tooling, not just refreshing the lockfile. Do not close these issues on merge.

Some linked issues are stale: before this change, the live GitHub alert inventory listed only UUID, three minimatch alerts, braces, and sprintf-js. The new lockfile verifies the desired patched/absent states for the other linked issues too. GitHub alerts must be rechecked after merge; this PR does not claim they have already closed.

Verification

• git diff --check: passed.
• npm audit --omit=dev --json: zero vulnerabilities. This applies only to npm's dependency classification; it is not a claim that WordPress-externalized dependencies are risk-free at runtime.
• Full npm audit --json: 30 findings (15 moderate, 15 high), all rooted in the unpatched braces and sprintf-js advisories; no UUID, minimatch, webpack, source-map-js, or adm-zip findings.
• npm ci --ignore-scripts --loglevel=error: passed on Node 22.22.2 / npm 10.9.7.
• npm run build: passed (webpack 5.111.1; 21 Sass warnings plus a Babel plugin deprecation). Generated assets were restored after verification; this is a manifest/lockfile-only PR, not a release asset refresh.
• ./node_modules/.bin/grunt --no-color: passed.
• Existing ESLint configuration resolves successfully with eslint --print-config src/js/frontend/index.js; no source lint pass is claimed.
• UUID CommonJS v4() / validate() smoke check: passed. The installed WordPress component consumers use v4() without options.

Scope and follow-up

No source, UI, linter configuration, test infrastructure, PHP, or release-version changes are intended. Reference patterns: existing npm overrides in package.json, webpack scripts in package.json, and Gruntfile.js's packaging task. Rollback is reverting the manifest/lockfile commit and running npm ci --ignore-scripts.

Remaining paths: braces is pulled in by micromatch (through TypeScript lint tooling and Grunt); sprintf-js is pulled in by WordPress i18n, Grunt's argparse and underscore.string, and prettier-eslint's argparse. Follow-up on #57 / #65 should inspect these parents in package-lock.json, preserve the existing ESLint configuration and Grunt packaging behavior, and verify with a clean install, full audit, production build, and packaging. No unpatched package is being silently risk-accepted here.

PR #30 also edits package.json to add quality-check scripts; preserve both its script additions and this PR's dependency changes if it needs conflict resolution.

---

aidevops.sh v3.39.27 plugin for OpenCode

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 48 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: Ultimate-Multisite/wp-ajaxify-comments/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 09c423a6-0a9a-4c38-9cc5-f57f2e9987f2

📥 Commits

Reviewing files that changed from the base of the PR and between 1a81606 and 8b0dc0b.

⛔ Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing: 1

• package.json

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}