Bump the npm-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the npm-dependencies group with 5 updates in the / directory:

Package	From	To
@kunoichi/grab-deps	2.0.2	3.1.4
@wordpress/env	10.36.0	11.9.0
@wordpress/scripts	30.27.0	32.5.0
postcss	8.5.6	8.5.16
sass	1.94.2	1.101.0

Updates @kunoichi/grab-deps from 2.0.2 to 3.1.4

Release notes

Sourced from @​kunoichi/grab-deps's releases.

v3.1.4

Changes

• Bugfix/empty wp component @​fumikito (#56)

Contributors

@​fumikito

v3.1.3

Changes

• Fix Issue #42: Complete tree-shaking solution with implementation code injection @​fumikito (#55)

Contributors

@​fumikito

v3.1.2

Changes

• Update README.md with file-type specific configuration examples @​fumikito (#54)

Contributors

@​fumikito

v3.1.1

Changes

• Bugfix/empty wp component @​fumikito (#53)

Contributors

@​fumikito

v3.1.0

Changes

• Feature/update ci workflow @​fumikito (#48)

Contributors

@​fumikito

3.0.12

Changes

• Update CI/CD workflow: Implement PR-based testing and GitHub Release automation @​fumikito (#45)
• Fix/issue 42 react component build @​fumikito (#44)

... (truncated)

Commits

• 552aa1d Merge pull request #56 from kuno1/bugfix/empty-wp-component
• db7d748 Merge branch 'master' into bugfix/empty-wp-component
• c36a4fc improve: enhance .gitignore to cover all wp-*.json files
• 6b9e636 fix: resolve Issue #42 - Tree-shaking problem with ES6 exports
• bec42b9 Merge pull request #55 from kuno1/bugfix/empty-wp-component
• f5026dc Merge branch 'master' into bugfix/empty-wp-component
• c702631 closes #42 Fix namespace export problem.
• 9443540 #42 namespaceベースのハンドル名にファイルタイプが入らないように
• 3776b0c Complete fix for Issue #42: Inject both implementation and global registratio...
• 7f7ca3a Merge pull request #54 from kuno1/bugfix/empty-wp-component
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates @wordpress/env from 10.36.0 to 11.9.0

Changelog

Sourced from @​wordpress/env's changelog.

11.9.0 (2026-06-24)

11.8.1 (2026-06-16)

11.8.0 (2026-06-10)

Enhancements

• Use partial clones (--filter=blob:none) when downloading git sources and the PHPUnit test suite to reduce download size. (#78918)

Bug Fixes

• Replace extract-zip with adm-zip to fix silent hang on Node 24.16.0 (libuv 1.52.1) when downloading URL-based zip sources. (#78762)

11.7.0 (2026-05-27)

11.6.0 (2026-05-14)

11.5.0 (2026-04-29)

11.4.0 (2026-04-15)

Bug Fixes

• Fix WP-Cron, REST API loopback, and Site Health loopback failures when wp-env runs on a non-default port. Apache inside the WordPress container now also listens on the host-mapped port, so PHP loopback requests to WP_HOME succeed instead of being refused. (#20569)

11.3.0 (2026-04-01)

11.2.0 (2026-03-18)

11.1.0 (2026-03-04)

Bug Fixes

• Suppress spinner and success message output when using --json flag to ensure clean, parseable JSON output.

11.0.0 (2026-02-18)

Bug Fixes

• Playground runtime now supports zip archive themes, matching Docker runtime behavior. (#75140).
• Add MySQL healthcheck to prevent race condition where WordPress containers start before MySQL is fully initialized. Uses MariaDB's official healthcheck.sh script with MARIADB_AUTO_UPGRADE to support both new and existing installations.
• Remove non-functional WP_ENV_MULTISITE config.

New Features

• Added --auto-port flag to the start command. When passed, wp-env automatically finds available ports if the configured ports are busy. Without this flag, ports default to 8888/8889 and Docker reports an error if they are busy (matching pre-existing behavior).

Breaking Changes

... (truncated)

Commits

• 0e7112a chore(release): publish
• a4c471e Update changelog files
• 99df743 chore(release): publish
• 58b2002 Update changelogs
• 6da9506 chore(release): publish
• 6afbb15 Update changelog files
• e816d95 Merge changes published in the Gutenberg plugin "release/23.4" branch
• 6237509 Update changelog files
• d653c5f chore(release): publish
• 065fa3b Update changelog files
• Additional commits viewable in compare view

Updates @wordpress/scripts from 30.27.0 to 32.5.0

Changelog

Sourced from @​wordpress/scripts's changelog.

32.5.0 (2026-06-24)

Enhancements

• lint-style: Detect .cjs and .mjs config files so the bundled default config is not used when one of these is present (#79226).

32.4.1 (2026-06-16)

32.4.0 (2026-06-10)

32.3.0 (2026-05-27)

32.2.0 (2026-05-14)

32.1.0 (2026-04-29)

32.0.0 (2026-04-15)

Breaking Changes

• The bundled eslint dependency has been upgraded from v8 to v10 (#76654).
• The lint-js script now uses flat config (eslint.config.*) by default. Legacy .eslintrc.* files are still detected as a fallback, but this support is deprecated and will be removed in a future version (#76654).
• The default config shipped with wp-scripts has changed from config/.eslintrc.js to config/eslint.config.cjs (#76654).

31.8.0 (2026-04-01)

31.7.0 (2026-03-18)

31.6.0 (2026-03-04)

31.5.0 (2026-02-18)

31.4.0 (2026-01-29)

31.3.0 (2026-01-16)

Internal

• The bundled eslint dependency has been updated from ^8.3.0 to ^8.57.1 (#74316).

31.1.0 (2025-11-26)

31.0.0 (2025-11-12)

Breaking Changes

• The lint-js script now includes .cjs, .mjs, .cts, and .mts as default extensions to lint. This is considered a breaking change because the script may now surface lint errors in your project which would not have been previously identified.

Commits

• 0e7112a chore(release): publish
• a4c471e Update changelog files
• b4cef19 Merge changes published in the Gutenberg plugin "release/23.5" branch
• 99df743 chore(release): publish
• 58b2002 Update changelogs
• 6da9506 chore(release): publish
• 6afbb15 Update changelog files
• e816d95 Merge changes published in the Gutenberg plugin "release/23.4" branch
• 6237509 Update changelog files
• d486535 Merge changes published in the Gutenberg plugin "release/23.3" branch
• Additional commits viewable in compare view

Updates postcss from 8.5.6 to 8.5.16

Release notes

Sourced from postcss's releases.

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

• Speed up source map encoding paring in case of the error.

8.5.8

• Fixed Processor#version.

8.5.7

• Improved source map annotation cleaning performance (by CodeAnt AI).

Changelog

Sourced from postcss's changelog.

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

• Speed up source map encoding paring in case of the error.

8.5.8

• Fixed Processor#version.

8.5.7

• Improved source map annotation cleaning performance (by CodeAnt AI).

Commits

• 92ccc93 Release 8.5.16 version
• 818bdd6 Update formatting
• 46e4510 Fix Input#origin() returning incorrect position (#2036)
• 34942ce Fix tests
• d4feed6 Don't clone root-less child nodes in container constructor (#2097)
• da323fc Revert version update to fix old Node.js on CI
• 8863369 Update dependencies
• 3828982 Preserve node raws when rehydrating a JSON AST (#2100)
• d1e80b8 Fix Node#rangeBy() ignoring index 0 (#2091)
• b91e4a6 Fix Node.js 26 tests
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates sass from 1.94.2 to 1.101.0

Release notes

Sourced from sass's releases.

Dart Sass 1.101.0

To install Sass 1.101.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Potentially breaking bug fix: The Node package importer now properly supports resolving import-only variants of Sass files declared in the exports, sass, and style fields of package.json. Previously, these files were ignored even when loaded via @import, so any code relying on loading module-system-only files this way may break.

See the full changelog for changes in earlier releases.

Dart Sass 1.100.0

To install Sass 1.100.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

  See the Sass website for details.

See the full changelog for changes in earlier releases.

Dart Sass 1.99.0

To install Sass 1.99.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Add support for parent selectors (&) at the root of the document. These are emitted as-is in the CSS output, where they're interpreted as the scoping root.

• User-defined functions named calc or clamp are no longer forbidden. If such a function exists without a namespace in the current module, it will be used instead of the built-in calc() or clamp() function.

• User-defined functions whose names begin with - and end with -expression, -url, -and, -or, or -not are no longer forbidden. These were originally intended to match vendor prefixes, but in practice no vendor prefixes for these functions ever existed in real browsers.

• User-defined functions named EXPRESSION, URL, and ELEMENT, those that begin with - and end with -ELEMENT, as well as the same names with some lowercase letters are now deprecated, These are names conflict with plain CSS functions that have special syntax.

  See the Sass website for details.

• In a future release, calls to functions whose names begin with - and end with -expression and -url will no longer have special parsing. For now, these calls are deprecated if their behavior will change in the future.

  See the Sass website for details.

... (truncated)

Changelog

Sourced from sass's changelog.

1.101.0

• Potentially breaking bug fix: The Node package importer now properly supports resolving import-only variants of Sass files declared in the exports, sass, and style fields of package.json. Previously, these files were ignored even when loaded via @import, so any code relying on loading module-system-only files this way may break.

1.100.0

• Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

  See the Sass website for details.

1.99.0

• Add support for parent selectors (&) at the root of the document. These are emitted as-is in the CSS output, where they're interpreted as the scoping root.

• User-defined functions named calc or clamp are no longer forbidden. If such a function exists without a namespace in the current module, it will be used instead of the built-in calc() or clamp() function.

• User-defined functions whose names begin with - and end with -expression, -url, -and, -or, or -not are no longer forbidden. These were originally intended to match vendor prefixes, but in practice no vendor prefixes for these functions ever existed in real browsers.

• User-defined functions named EXPRESSION, URL, and ELEMENT, those that begin with - and end with -ELEMENT, as well as the same names with some lowercase letters are now deprecated, These are names conflict with plain CSS functions that have special syntax.

  See the Sass website for details.

• In a future release, calls to functions whose names begin with - and end with -expression and -url will no longer have special parsing. For now, these calls are deprecated if their behavior will change in the future.

  See the Sass website for details.

• Calls to functions whose names begin with - and end with -progid:... are deprecated.

... (truncated)

Commits

• 63b9922 Load import-only files through package.json exports (#2772)
• c7e9947 Migrate from bufbuild/buf-setup-action to bufbuild/buf-action (#2773)
• 7674a4c Bump postcss from 8.5.13 to 8.5.15 in /pkg/sass-parser (#2774)
• 5fd18c7 Bump node engine requirement to >=20.19.0 and chokidar requirement to ^5.0.0 ...
• 8c1d984 Deprecate adjacent compound selectors (#2765)
• 8e5f718 Bump postcss from 8.5.12 to 8.5.13 in /pkg/sass-parser (#2767)
• 1447f9b Bump postcss from 8.5.8 to 8.5.12 in /pkg/sass-parser (#2766)
• 83c39fe Support the top-level parent selector (#2758)
• ec85871 Bump EndBug/add-and-commit from 9 to 10 (#2756)
• a604acd [Function Name] Implement changes (#2731)
• Additional commits viewable in compare view