Bump the production-dependencies group with 5 updates

[dependabot]

Bumps the production-dependencies group with 5 updates:

Package	From	To
@types/wordpress__blocks	12.5.14	15.17.0
@wordpress/base-styles	5.7.0	12.0.0
jquery	3.7.1	4.0.0
lodash-es	4.17.21	4.18.1
sass-mq	6.0.0	7.0.1

Updates @types/wordpress__blocks from 12.5.14 to 15.17.0

Commits

• See full diff in compare view

Updates @wordpress/base-styles from 5.7.0 to 12.0.0

Changelog

Sourced from @​wordpress/base-styles's changelog.

12.0.0 (2026-07-29)

Breaking Changes

• Remove the $accent-color parameter from input-control and input-style__focus. Focus styling now uses --wp-admin-theme-color internally (#80595).

Enhancements

• outset-ring__focus: Allow overriding the focus ring color via the --focus-color custom property (#80587).

Bug Fixes

• Lower the editor z-index of left/right aligned blocks below sticky and fixed position blocks, so floated blocks no longer cover stuck blocks while scrolling (#80749).

Internal

• Update exports to use subpath patterns instead of deprecated trailing / folder mappings (#80270).

11.0.0 (2026-07-14)

Breaking Changes

• Remove $font-weight-regular and $font-weight-medium. Use var(--wpds-typography-font-weight-default) or var(--wpds-typography-font-weight-emphasis) based on the intended emphasis (#80093).

Enhancements

• Use semantic @wordpress/theme font-weight tokens in typography mixins, and align the legacy font-family variables with the theme typography tokens (#80093).
• Add outset-ring__focus mixin for outline-based focus rings using --wpds-* design tokens (#78698, #80082).

10.2.0 (2026-07-01)

10.1.0 (2026-06-24)

10.0.1 (2026-06-16)

10.0.0 (2026-06-10)

Breaking Changes

• Remove the following entries from the z-index() helper (#77773):
• .nux-dot-tip

9.0.0 (2026-05-27)

Breaking Changes

• Remove the following entries from the z-index() helper (#78315, #78362):
  • .components-modal__header
  • .dataviews-footer
  • .dataviews-view-grid__card .dataviews-selection-checkbox

... (truncated)

Commits

• 7e8b17a chore(release): publish
• 42ad080 Update changelog files
• edffa74 Merge changes published in the Gutenberg plugin "release/23.7" branch
• e9a74f9 chore(release): publish
• 2a0c375 Update changelog files
• e61c854 Merge changes published in the Gutenberg plugin "release/23.6" branch
• 1055a35 Update changelog files
• 8ca3e8e Merge changes published in the Gutenberg plugin "release/23.6" branch
• 66c8050 Fix wp/latest release metadata (#79821)
• d0d1bfc Update changelog files
• Additional commits viewable in compare view

Updates jquery from 3.7.1 to 4.0.0

Release notes

Sourced from jquery's releases.

Release 4.0.0

Changelog

https://blog.jquery.com/2026/01/17/jquery-4-0-0/

Ajax

• Don't treat array data as binary (992a1911)
• Allow processData: true even for binary data (ce264e07)
• Support binary data (including FormData) (a7ed9a7b)
• Support headers for script transport even when cross-domain (#5142, 6d136443)
• Support null as success functions in jQuery.get (#4989, 74978b7e)
• Don't auto-execute scripts unless dataType provided (#4822, 025da4dd)
• Make responseJSON work for erroneous same-domain JSONP requests (68b4ec59)
• Execute JSONP error script responses (#4771, a1e619b0)
• Avoid CSP errors in the script transport for async requests (#3969, 07a8e4a1)
• Drop the json to jsonp auto-promotion logic (#1799, #3376, e7b3bc48)
• Overwrite s.contentType with content-type header value, if any (#4119, 7fb90a6b)
• Deprecate AJAX event aliases, inline event/alias into deprecated (23d53928)
• Do not execute scripts for unsuccessful HTTP responses (#4250, 50871a5a)
• Simplify jQuery.ajaxSettings.xhr (#1967, abdc89ac)

Attributes

• Make .attr( name, false ) remove for all non-ARIA attrs (#5388, 063831b6)
• Shave off a couple of bytes (b40a4807)
• Don't stringify attributes in the setter (#4948, 4250b628)
• Drop the toggleClass(boolean|undefined) signature (#3388, a4421101)
• Refactor val(): don't strip carriage return, isolate IE workarounds (ff281991)
• Don't set the type attr hook at all outside of IE (9e66fe9a)

CSS

• Fix dimensions of table <col> elements (#5628, eca2a564)
• Drop the cache in finalPropName (640d5825)
• Tests: Fix tests & support tests under CSS Zoom (#5489, 071f6dba)
• Fix reliableTrDimensions support test for initially hidden iframes (b1e66a5f)
• Selector: Align with 3.x, remove the outer selector.js wrapper (53cf7244)
• Make the reliableTrDimensions support test work with Bootstrap CSS (#5270, 65b85031)
• Make offsetHeight( true ), etc. include negative margins (#3982, bce13b72)
• Return undefined for whitespace-only CSS variable values (#5120) (7eb00196)
• Don’t trim whitespace of undefined custom property (#5105, ed306c02)
• Skip falsy values in addClass( array ), compress code (#4998, a338b407)
• Justify use of rtrim on CSS property values (655c0ed5)
• Trim whitespace surrounding CSS Custom Properties values (#4926, efadfe99)
• Include show, hide & toggle methods in the jQuery slim build (297d18dd)
• Remove the opacity CSS hook (865469f5)
• Workaround buggy getComputedStyle on table rows in IE/Edge (#4490, 26415e08)
• Don't automatically add "px" to properties with a few exceptions (#2795, 00a9c2e5)

... (truncated)

Commits

• 4f2fae0 Release: 4.0.0
• c838cfb Release: remove dist files from main branch
• 9752519 Release: 4.0.0-rc.2
• c128d5d Release: Update AUTHORS.txt
• 5fe9c29 Build: De-dupe three authors via mailmap
• afdd032 Build: Post beta browser tests errors to jquery/dev on Matrix
• 546a1eb Build: Bump the github-actions group with 4 updates
• ec738b3 Build: Fix Chrome beta tests
• c28c26a Build: Add periodic tests on beta versions of browsers
• f513413 Build: Bump the github-actions group with 2 updates
• Additional commits viewable in compare view

Updates lodash-es from 4.17.21 to 4.18.1

Release notes

Sourced from lodash-es's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates sass-mq from 6.0.0 to 7.0.1

Release notes

Sourced from sass-mq's releases.

v7.0.1

Fixed

• Vite 8 compatibility: added a package.json exports field with a sass condition so @use 'sass-mq' resolves again. Vite 8 dropped the main-field fallback that earlier versions relied on (#179).
  • Behavior change: adding exports encapsulates the package. The documented @use 'sass-mq' import is unaffected, but undocumented deep imports such as @use 'sass-mq/_mq.scss' are no longer resolvable — use @use 'sass-mq' instead.

Added

• examples/vite8: a runnable Vite 8 project that proves @use 'sass-mq' resolves and compiles. It runs in CI as a regression test.

v7.0.0

This is a major version bump that contains no breaking changes feature-wise, but may require a newer version of Sass and adopting the new @use syntax. It ensures compatibility with the latest version of dart-sass and removes support for @import, as @import is officially deprecated as of sass-dart 1.80.0.

🚨 BREAKING CHANGE: Dropped support for @import in favor of @use. If you need backward compatibility with @import, use sass-mq v6.0.0 or follow these instructions by @​svalanga

Added

• Added support for dart-sass >= 1.80.0 (without deprecation warnings)

Changed

• Updated all global Sass functions to use their module equivalents (for example: type-of ➡️ meta.type-of, slice ➡️ string.slice), silencing deprecation warnings introduced in dart-sass 1.80.0

Chores

• Upgraded Jest and Sass True dependencies to unlock testing with the latest versions of sass-dart
• Fixed a test where a space was missing between and and ( in the generated CSS (caused by the latest version of Sass)
• Migrated from Travis CI to GitHub Actions for testing

Changelog

Sourced from sass-mq's changelog.

v7.0.1 - 2026-06-19

Fixed

• Vite 8 compatibility: added a package.json exports field with a sass condition so @use 'sass-mq' resolves again. Vite 8 dropped the main-field fallback that earlier versions relied on (#179).
  • Behavior change: adding exports encapsulates the package. The documented @use 'sass-mq' import is unaffected, but undocumented deep imports such as @use 'sass-mq/_mq.scss' are no longer resolvable — use @use 'sass-mq' instead.

Added

• examples/vite8: a runnable Vite 8 project that proves @use 'sass-mq' resolves and compiles. It runs in CI as a regression test.

v7.0.0 - 2025-06-16

This is a major version bump that contains no breaking changes but may require a newer version of Sass. It ensures compatibility with the latest version of dart-sass and removes support for @import, as @import is officially deprecated as of sass-dart 1.80.0.

Added

• Added support for dart-sass >= 1.80.0 (without deprecation warnings)

Changed

• BREAKING CHANGE: Dropped support for @import (use sass-mq v6.0.0 if you need backward compatibility with @import)
• Updated all global Sass functions to use their module equivalents (for example: type-of ➡️ meta.type-of, slice ➡️ string.slice), silencing deprecation warnings introduced in dart-sass 1.80.0

Chores

• Upgraded Jest and Sass True dependencies to unlock testing with the latest versions of sass-dart
• Fixed a test where a space was missing between and and ( in the generated CSS (caused by the latest version of Sass)
• Migrated from Travis CI to GitHub Actions for testing

Commits

• 54ea1f3 7.0.1
• 098bbad fix: add package.json exports for Vite 8 compatibility (#179) (#180)
• 38f0a15 Bump picomatch from 2.3.1 to 2.3.2 (#176)
• 1c7fd7e Bump minimatch from 3.0.4 to 3.1.5 (#174)
• 19afe96 Bump immutable from 4.3.7 to 4.3.8 (#175)
• 2e35da2 Bump lodash from 4.17.23 to 4.18.1 (#177)
• 5bab398 Bump js-yaml from 3.14.1 to 3.14.2 (#172)
• c1b11ea Bump lodash from 4.17.21 to 4.17.23 (#173)
• cc1a63d Compile SassDoc
• 7b131fe 7.0.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions