[Snyk] Fix for 5 vulnerabilities

[MaxMood96]

Snyk has created this PR to fix 5 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18313044	614
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-17900054	614
	Infinite loop SNYK-JS-TAR-17909068	614
	Allocation of Resources Without Limits or Throttling SNYK-JS-TAR-17909152	614
	Interpretation Conflict SNYK-JS-FASTURI-18021349	506

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[MaxMood96]

This upgrade includes major version bumps for both lerna and @wordpress/scripts, with lerna introducing significant breaking changes.

lerna 9.0.7 → 10.0.0 (HIGH RISK)

This is a major upgrade with several critical breaking changes requiring immediate action.

Breaking Changes:

• Node.js Version: The minimum required Node.js version has been increased to ^22.13.0. Your CI and local development environments must be upgraded.
• ESM Only: Lerna is now distributed as an ESM-only package. If you are using require('lerna') in any custom scripts, you must update your code to use import.
• CI Behavior Change: By default, lerna version and lerna publish will now fail in a CI environment if the local branch is behind the remote. This is to prevent publishing from a stale checkout. This can be configured if the old behavior is desired.
• Changelog Generation: The internal dependency for generating changelogs (conventional-changelog) has been updated. This may alter the formatting of your generated CHANGELOG.md files.

Recommendation:

• Ensure your Node.js version is at least 22.13.0.
• Convert any CommonJS require() calls for lerna to ESM import statements.
• Review your CI pipeline configuration to account for the new default behavior of failing on stale checkouts.

@wordpress/scripts 33.0.0 → 34.0.0 (MEDIUM RISK)

This is a major version upgrade. While the project aims to minimize breaking changes, no specific changelog for v34.0.0 was found to confirm the impact. Given the lack of documentation, this is considered a medium risk due to uncertainty.

Recommendation:

• After upgrading, run your project's build and test scripts to validate that the new version has not impacted your build process.
• Check the official WordPress developer resources or the package's repository for a detailed changelog when it becomes available.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @snyk-bot, @MaxMood96, @mergify.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: snyk-bot, MaxMood96, mergify.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.