Revert the dependabot PRs merged on 13/14 jan 2025

[KMchaudhary]

This pull request updates several dependencies and GitHub Actions workflows to use more stable or compatible versions. The main focus is on aligning package versions and workflow actions to improve reliability and compatibility across the project.

Dependency version updates

• Downgraded yoast/phpunit-polyfills from ^4.0 to ^1.0 in composer.json for better compatibility with the test suite.
• Downgraded several npm packages in package.json, including @uppy/dashboard (5.1.0 → 5.0.1), tailwind-merge (3.4.0 → 3.0.1), uuid (13.0.0 → 11.1.0), videojs-ima (2.5.0 → 2.4.0), and @wordpress/i18n (6.10.0 → 6.1.0), to address compatibility or stability concerns. [1] [2] [3]

GitHub Actions workflow updates

• Updated actions/checkout and actions/setup-node to use lower major versions (mostly v4 instead of v6) across multiple workflow files, including .github/workflows/deploy_on_push.yml, .github/workflows/plugin_check_on_pull_request.yml, .github/workflows/release_on_tag.yml, and .github/workflows/phpcs_on_pull_request.yml, to ensure compatibility and stability with current tooling. [1] [2] [3] [4]
• Updated artifact upload and release actions in .github/workflows/release_on_tag.yml to use earlier versions (actions/upload-artifact@v4.6.1 and softprops/action-gh-release@v2.2.1) for improved reliability.

[Copilot]

Pull request overview

This pull request reverts dependency updates that were merged on January 13-14, 2025, downgrading multiple npm packages, composer dependencies, and GitHub Actions to earlier versions to address compatibility or stability concerns.

Changes:

• Downgraded 5 npm packages including @uppy/dashboard, tailwind-merge, uuid, videojs-ima, and @wordpress/i18n
• Downgraded yoast/phpunit-polyfills from ^4.0 to ^1.0 in composer.json
• Downgraded GitHub Actions including actions/checkout, actions/setup-node, actions/upload-artifact, and softprops/action-gh-release across multiple workflow files

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
package.json	Downgraded 5 npm packages to earlier minor/major versions
package-lock.json	Updated lockfile to reflect npm package downgrades
composer.json	Downgraded yoast/phpunit-polyfills from ^4.0 to ^1.0
composer.lock	Updated composer lockfile with downgraded dependencies
.github/workflows/release_on_tag.yml	Downgraded actions from v6 to v4
.github/workflows/plugin_check_on_pull_request.yml	Downgraded actions from v6 to v4
.github/workflows/phpcs_on_pull_request.yml	Downgraded actions/checkout from v6 to v2
.github/workflows/deploy_on_push.yml	Downgraded actions/checkout from v6 to v4

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The downgrade of actions/checkout from v6 to v2 in the PHPCS workflow is concerning. Version 2 is significantly outdated (released in 2020) and may have known security vulnerabilities. While other workflows downgrade to v4 which is more reasonable, v2 is too old. Consider using v4 consistently across all workflows.

Suggested change

	- uses: actions/checkout@v2
	- uses: actions/checkout@v4

[Copilot]

Downgrading yoast/phpunit-polyfills from ^4.0 to ^1.0 is a major version downgrade that may remove support for newer PHPUnit features and PHP versions. Version 1.x supports PHP 5.4+, while 4.x requires PHP 7.1+. This downgrade may be incompatible with other dependencies that expect newer PHPUnit functionality. Verify that all tests still pass with this older version.

Suggested change

	"yoast/phpunit-polyfills": "^1.0",
	"yoast/phpunit-polyfills": "^4.0",

[github-actions]

🔍 WordPress Plugin Check Report

❌ Status: Failed

📊 Report

🎯 Total Issues	❌ Errors	⚠️ Warnings
29	12	17

---

❌ Errors (12)

📁 inc/classes/wpforms/wpforms-field-godam-record-frontend.php (1 error)

📍 Line	🔖 Check	💬 Message
0	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

📁 inc/classes/wpforms/wpforms-field-godam-record-entry-view.php (1 error)

📍 Line	🔖 Check	💬 Message
0	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

📁 inc/classes/wpforms/wpforms-field-godam-record-entry-edit.php (1 error)

📍 Line	🔖 Check	💬 Message
0	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

📁 inc/classes/class-rewrite.php (1 error)

📍 Line	🔖 Check	💬 Message
0	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

📁 inc/classes/class-elementor-widgets.php (1 error)

📍 Line	🔖 Check	💬 Message
0	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

📁 inc/classes/everest-forms/everest-forms-field-godam-record-frontend.php (1 error)

📍 Line	🔖 Check	💬 Message
0	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

📁 inc/classes/assets/class-ima-assets.php (1 error)

📍 Line	🔖 Check	💬 Message
0	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

📁 inc/classes/assets/class-jetpack-form-assets.php (1 error)

📍 Line	🔖 Check	💬 Message
0	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

📁 inc/classes/class-video-preview.php (1 error)

📍 Line	🔖 Check	💬 Message
0	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

📁 inc/classes/lifter-lms/class-lifter-lms.php (1 error)

📍 Line	🔖 Check	💬 Message
0	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

📁 inc/classes/fluentforms/class-form-submit.php (1 error)

📍 Line	🔖 Check	💬 Message
0	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

📁 inc/classes/class-video-engagement.php (1 error)

📍 Line	🔖 Check	💬 Message
0	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

---

⚠️ Warnings (17)

📁 composer.json (1 warning)

📍 Line	🔖 Check	💬 Message
0	missing_composer_json_file	The "/vendor" directory using composer exists, but "composer.json" file is missing.

📁 readme.txt (2 warnings)

📍 Line	🔖 Check	💬 Message
0	mismatched_plugin_name	Plugin name "GoDAM - Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more" is different from the name declared in plugin header "GoDAM".
0	trademarked_term	The plugin name includes a restricted term. Your chosen plugin name - "GoDAM - Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more" - contains the restricted term "wordpress" which cannot be used at all in your plugin name.

📁 inc/classes/media-library/class-media-folder-utils.php (1 warning)

📍 Line	🔖 Check	💬 Message
91	PluginCheck.Security.DirectDB.UnescapedDBParameter	Unescaped parameter $where_clause used in $wpdb->get_var($wpdb->prepare(\n\t\t\t\t"\n\t\t\tSELECT COUNT(DISTINCT p.ID)\n\t\t\tFROM {$wpdb->posts} p\n\t\t\tINNER JOIN {$wpdb->term_relationships} tr ON p.ID = tr.object_id\n\t\t\tINNER JOIN {$wpdb->term_taxonomy} tt ON tr.term_taxonomy_id = tt.term_taxonomy_id\n\t\t\tWHERE {$where_clause}\n\t\t",\n\t\t\t\t$query_params\n\t\t\t))\n$where_clause assigned unsafely at line 82:\n $where_clause .= ' AND p.post_mime_type LIKE %s'\n$query_params[] used without escaping.\n$mime_type used without escaping.

📁 assets/build/css/main.css (1 warning)

📍 Line	🔖 Check	💬 Message
0	EnqueuedStylesScope	This style is being loaded in all contexts.

📁 assets/src/libs/analytics.min.js (6 warnings)

📍 Line	🔖 Check	💬 Message
0	EnqueuedScriptsScope	This script is being loaded in all frontend contexts.
0	NonBlockingScripts.NoStrategy	This script on http://localhost:8880 (with handle analytics-library) is loaded in the footer. Consider a defer or async script loading strategy instead.
0	NonBlockingScripts.NoStrategy	This script on http://localhost:8880/?p=1 (with handle analytics-library) is loaded in the footer. Consider a defer or async script loading strategy instead.
0	NonBlockingScripts.NoStrategy	This script on http://localhost:8880/?page_id=2 (with handle analytics-library) is loaded in the footer. Consider a defer or async script loading strategy instead.
0	NonBlockingScripts.NoStrategy	This script on http://localhost:8880/?attachment_id=6 (with handle analytics-library) is loaded in the footer. Consider a defer or async script loading strategy instead.
0	NonBlockingScripts.NoStrategy	This script on http://localhost:8880/?godam-video=demo-godam-video-post (with handle analytics-library) is loaded in the footer. Consider a defer or async script loading strategy instead.

📁 assets/build/js/main.min.js (6 warnings)

📍 Line	🔖 Check	💬 Message
0	EnqueuedScriptsScope	This script is being loaded in all frontend contexts.
0	NonBlockingScripts.NoStrategy	This script on http://localhost:8880 (with handle rtgodam-script) is loaded in the footer. Consider a defer or async script loading strategy instead.
0	NonBlockingScripts.NoStrategy	This script on http://localhost:8880/?p=1 (with handle rtgodam-script) is loaded in the footer. Consider a defer or async script loading strategy instead.
0	NonBlockingScripts.NoStrategy	This script on http://localhost:8880/?page_id=2 (with handle rtgodam-script) is loaded in the footer. Consider a defer or async script loading strategy instead.
0	NonBlockingScripts.NoStrategy	This script on http://localhost:8880/?attachment_id=6 (with handle rtgodam-script) is loaded in the footer. Consider a defer or async script loading strategy instead.
0	NonBlockingScripts.NoStrategy	This script on http://localhost:8880/?godam-video=demo-godam-video-post (with handle rtgodam-script) is loaded in the footer. Consider a defer or async script loading strategy instead.

---

🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check