Bump the npm-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the npm-dependencies group with 5 updates in the / directory:

Package	From	To
@wordpress/env	10.38.0	11.10.0
@wordpress/scripts	30.27.0	32.6.0
autoprefixer	10.4.23	10.5.2
postcss	8.5.16	8.5.18
sass	1.97.3	1.101.0

Updates @wordpress/env from 10.38.0 to 11.10.0

Changelog

Sourced from @​wordpress/env's changelog.

11.10.0 (2026-07-01)

11.9.0 (2026-06-24)

11.8.1 (2026-06-16)

11.8.0 (2026-06-10)

Enhancements

• Use partial clones (--filter=blob:none) when downloading git sources and the PHPUnit test suite to reduce download size. (#78918)

Bug Fixes

• Replace extract-zip with adm-zip to fix silent hang on Node 24.16.0 (libuv 1.52.1) when downloading URL-based zip sources. (#78762)

11.7.0 (2026-05-27)

11.6.0 (2026-05-14)

11.5.0 (2026-04-29)

11.4.0 (2026-04-15)

Bug Fixes

• Fix WP-Cron, REST API loopback, and Site Health loopback failures when wp-env runs on a non-default port. Apache inside the WordPress container now also listens on the host-mapped port, so PHP loopback requests to WP_HOME succeed instead of being refused. (#20569)

11.3.0 (2026-04-01)

11.2.0 (2026-03-18)

11.1.0 (2026-03-04)

Bug Fixes

• Suppress spinner and success message output when using --json flag to ensure clean, parseable JSON output.

11.0.0 (2026-02-18)

Bug Fixes

• Playground runtime now supports zip archive themes, matching Docker runtime behavior. (#75140).
• Add MySQL healthcheck to prevent race condition where WordPress containers start before MySQL is fully initialized. Uses MariaDB's official healthcheck.sh script with MARIADB_AUTO_UPGRADE to support both new and existing installations.
• Remove non-functional WP_ENV_MULTISITE config.

New Features

• Added --auto-port flag to the start command. When passed, wp-env automatically finds available ports if the configured ports are busy. Without this flag, ports default to 8888/8889 and Docker reports an error if they are busy (matching pre-existing behavior).

... (truncated)

Commits

• 66c8050 Fix wp/latest release metadata (#79821)
• d0d1bfc Update changelog files
• 66315f3 Merge changes published in the Gutenberg plugin "release/23.5" branch
• 74218a2 Update changelog files
• 504adfc Revert "Update changelog files"
• b28bd6d Update changelog files
• ab25f49 Merge changes published in the Gutenberg plugin "release/23.5" branch
• 8c4f3ca Update changelog files
• f239b85 Merge changes published in the Gutenberg plugin "release/23.5" branch
• e2ae8e2 Update changelog files
• Additional commits viewable in compare view

Updates @wordpress/scripts from 30.27.0 to 32.6.0

Changelog

Sourced from @​wordpress/scripts's changelog.

32.6.0 (2026-07-01)

32.5.0 (2026-06-24)

Enhancements

• lint-style: Detect .cjs and .mjs config files so the bundled default config is not used when one of these is present (#79226).

32.4.1 (2026-06-16)

32.4.0 (2026-06-10)

32.3.0 (2026-05-27)

32.2.0 (2026-05-14)

32.1.0 (2026-04-29)

32.0.0 (2026-04-15)

Breaking Changes

• The bundled eslint dependency has been upgraded from v8 to v10 (#76654).
• The lint-js script now uses flat config (eslint.config.*) by default. Legacy .eslintrc.* files are still detected as a fallback, but this support is deprecated and will be removed in a future version (#76654).
• The default config shipped with wp-scripts has changed from config/.eslintrc.js to config/eslint.config.cjs (#76654).

31.8.0 (2026-04-01)

31.7.0 (2026-03-18)

31.6.0 (2026-03-04)

31.5.0 (2026-02-18)

31.4.0 (2026-01-29)

31.3.0 (2026-01-16)

Internal

• The bundled eslint dependency has been updated from ^8.3.0 to ^8.57.1 (#74316).

31.1.0 (2025-11-26)

31.0.0 (2025-11-12)

Breaking Changes

• The lint-js script now includes .cjs, .mjs, .cts, and .mts as default extensions to lint. This is considered a breaking change because the script may now surface lint errors in your project which would not have been previously identified.

Commits

• 66c8050 Fix wp/latest release metadata (#79821)
• d0d1bfc Update changelog files
• 66315f3 Merge changes published in the Gutenberg plugin "release/23.5" branch
• 74218a2 Update changelog files
• 504adfc Revert "Update changelog files"
• b28bd6d Update changelog files
• ab25f49 Merge changes published in the Gutenberg plugin "release/23.5" branch
• 8c4f3ca Update changelog files
• f239b85 Merge changes published in the Gutenberg plugin "release/23.5" branch
• e2ae8e2 Update changelog files
• Additional commits viewable in compare view

Updates autoprefixer from 10.4.23 to 10.5.2

Release notes

Sourced from autoprefixer's releases.

10.5.2

• Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

10.5.0 “Each Endeavouring, All Achieving”

• Added mask-position-x and mask-position-y support (by @​toporek).

10.4.27

• Removed development key from package.json.

10.4.26

• Reduced package size.

10.4.25

• Fixed broken gradients on CSS Custom Properties (by @​serger777).

10.4.24

• Made Autoprefixer a little faster (by @​Cherry).

Changelog

Sourced from autoprefixer's changelog.

10.5.2

• Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

10.5.0 “Each Endeavouring, All Achieving”

• Added mask-position-x and mask-position-y support (by @​toporek).

10.4.27

• Removed development key from package.json.

10.4.26

• Reduced package size.

10.4.25

• Fixed broken gradients on CSS Custom Properties (by @​serger777).

10.4.24

• Made Autoprefixer a little faster (by @​Cherry).

Commits

• e99e381 Release 10.5.2 version
• 98de3f5 Move -webkit-fill-available before -moz-available to get a closer to spec res...
• 8fe2513 Release 10.5.1 version
• 60ea651 Update release process
• cbd4a70 Update dependencies
• ffae49f fix: reset grid area spans when overriding areas (#1549)
• d90ad86 Fix CI
• a0f701b Update dependencies
• bb935eb Fix CI
• e63efe4 Move to pnpm 11
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for autoprefixer since your current version.

Updates postcss from 8.5.16 to 8.5.18

Release notes

Sourced from postcss's releases.

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

Changelog

Sourced from postcss's changelog.

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

Commits

• 4c0d194 Release 8.5.18 version
• 92b4e78 Update dependencies
• 95663d3 Limit where source map can be loaded for security reasons
• 74e25ae Release 8.5.17 version
• d1518af Fix Maximum call stack size exceeded error
• 2421312 Fix linter
• a50352c Fix CI
• 33948f0 Prevent prototype hijacking in fromJSON
• 2131909 Update dependencies
• 93440ab Fix non-closed \<div align="center"> in README (#2110)
• Additional commits viewable in compare view

Updates sass from 1.97.3 to 1.101.0

Release notes

Sourced from sass's releases.

Dart Sass 1.101.0

To install Sass 1.101.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Potentially breaking bug fix: The Node package importer now properly supports resolving import-only variants of Sass files declared in the exports, sass, and style fields of package.json. Previously, these files were ignored even when loaded via @import, so any code relying on loading module-system-only files this way may break.

See the full changelog for changes in earlier releases.

Dart Sass 1.100.0

To install Sass 1.100.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

  See the Sass website for details.

See the full changelog for changes in earlier releases.

Dart Sass 1.99.0

To install Sass 1.99.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Add support for parent selectors (&) at the root of the document. These are emitted as-is in the CSS output, where they're interpreted as the scoping root.

• User-defined functions named calc or clamp are no longer forbidden. If such a function exists without a namespace in the current module, it will be used instead of the built-in calc() or clamp() function.

• User-defined functions whose names begin with - and end with -expression, -url, -and, -or, or -not are no longer forbidden. These were originally intended to match vendor prefixes, but in practice no vendor prefixes for these functions ever existed in real browsers.

• User-defined functions named EXPRESSION, URL, and ELEMENT, those that begin with - and end with -ELEMENT, as well as the same names with some lowercase letters are now deprecated, These are names conflict with plain CSS functions that have special syntax.

  See the Sass website for details.

• In a future release, calls to functions whose names begin with - and end with -expression and -url will no longer have special parsing. For now, these calls are deprecated if their behavior will change in the future.

  See the Sass website for details.

... (truncated)

Changelog

Sourced from sass's changelog.

1.101.0

• Potentially breaking bug fix: The Node package importer now properly supports resolving import-only variants of Sass files declared in the exports, sass, and style fields of package.json. Previously, these files were ignored even when loaded via @import, so any code relying on loading module-system-only files this way may break.

1.100.0

• Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

  See the Sass website for details.

1.99.0

• Add support for parent selectors (&) at the root of the document. These are emitted as-is in the CSS output, where they're interpreted as the scoping root.

• User-defined functions named calc or clamp are no longer forbidden. If such a function exists without a namespace in the current module, it will be used instead of the built-in calc() or clamp() function.

• User-defined functions whose names begin with - and end with -expression, -url, -and, -or, or -not are no longer forbidden. These were originally intended to match vendor prefixes, but in practice no vendor prefixes for these functions ever existed in real browsers.

• User-defined functions named EXPRESSION, URL, and ELEMENT, those that begin with - and end with -ELEMENT, as well as the same names with some lowercase letters are now deprecated, These are names conflict with plain CSS functions that have special syntax.

  See the Sass website for details.

• In a future release, calls to functions whose names begin with - and end with -expression and -url will no longer have special parsing. For now, these calls are deprecated if their behavior will change in the future.

  See the Sass website for details.

• Calls to functions whose names begin with - and end with -progid:... are deprecated.

... (truncated)

Commits

• 63b9922 Load import-only files through package.json exports (#2772)
• c7e9947 Migrate from bufbuild/buf-setup-action to bufbuild/buf-action (#2773)
• 7674a4c Bump postcss from 8.5.13 to 8.5.15 in /pkg/sass-parser (#2774)
• 5fd18c7 Bump node engine requirement to >=20.19.0 and chokidar requirement to ^5.0.0 ...
• 8c1d984 Deprecate adjacent compound selectors (#2765)
• 8e5f718 Bump postcss from 8.5.12 to 8.5.13 in /pkg/sass-parser (#2767)
• 1447f9b Bump postcss from 8.5.8 to 8.5.12 in /pkg/sass-parser (#2766)
• 83c39fe Support the top-level parent selector (#2758)
• ec85871 Bump EndBug/add-and-commit from 9 to 10 (#2756)
• a604acd [Function Name] Implement changes (#2731)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.