[aryanjasala]

Prepares theme-elementary-v2 for #692 without bringing any security alerts onto main, using the same approach as rtCamp/plugin-elementary#28 and #29 so both starters stay on the same toolchain.

npm audit reported 93 vulnerabilities on v2 (62 high) and composer audit one; main has 2 open Dependabot alerts (browserslist, squizlabs/php_codesniffer). After this PR, npm audit and composer audit both report none, which covers both of main's alerts too.

Merge with "Create a merge commit", not squash: the first commit records main as a parent, which is what makes #692 conflict-free. A squash drops that link again, the way #787's did.

Changes

• Merge main into v2. main only changed package.json and package-lock.json (v1 Dependabot bumps, superseded by v2's own dependencies) and copilot-code-review.yml (already identical on v2), so v2's files win and release: theme-elementary v2 🚀 #692 has no conflicts.
• @wordpress/scripts 32.3.0 → 36.0.0. This removes the extract-zip (no patched release), markdown-it, linkify-it and @opentelemetry/core chains. 36 runs Vitest for test-unit-js and drops the bundled Jest preset, Babel transform and GitHub Actions reporter, so, as in plugin-elementary#29:
  • test:js uses wp-scripts test-unit-jest, with jest and jest-environment-jsdom 30.5.0 as direct dev dependencies;
  • @wordpress/jest-preset-default is removed;
  • tests/js/jest.config.js sets up jsdom, the same test discovery and a style mock itself, and uses Jest's built-in github-actions reporter.
• Other direct bumps: @wordpress/env 11.7.0 → 11.16.0 (also drops extract-zip), @wordpress/babel-preset-default 8.47.0 → 8.56.0, browserslist 4.28.2 → 4.29.3, svgo 4.0.1 → 4.1.0.
• overrides, scoped to the parent that pins the old version (same set as plugin-elementary): webpack-dev-server 5.2.6 (the existing pin, moved from 5.2.1), express > qs 6.16.0, markdownlint-cli > js-yaml 5.4.1, copy-webpack-plugin > serialize-javascript 7.0.5, sockjs > uuid 11.1.1, @wordpress/scripts > adm-zip 0.6.1. The old global serialize-javascript 7.0.3 and minimatch 3.1.3 overrides pinned affected versions and are gone.
• Composer: squizlabs/php_codesniffer 3.13.5 → 3.13.6 (CVE-2026-67434, OS command injection). wpcs, phpcsutils and phpcsextra were already on their patched versions.

@wordpress/scripts 36 declares Node ^22.22.2 || ^24.15.0; CI's Node 22 satisfies it, older local versions only get an engine warning.

Testing

• npm audit: 0 vulnerabilities. composer audit: no advisories
• Node 22 (npm 10.9) and Node 24 (npm 11.6): npm ci, lint:all, build:prod pass; Jest 59 of 59, also in the CI form (--ci --cacheDirectory)
• PHPCS (3.13.6) and PHPStan: clean
• PHPUnit through @wordpress/env 11.16: 101 tests, 267 assertions (PHP 8.2)
• Against a running wp-env site (theme active, SCRIPT_DEBUG, ENABLE_HMR), with a temporary probe block:
  • Block HMR on webpack-dev-server 5.2.6: the websocket client gets hot and liveReload; editing the block's edit.js sends invalid, a new hash and ok, and the bundle rebuilds
  • The block editor loads react-refresh-runtime, react-refresh-entry and the block's hot bundle
  • BrowserSync: the frontend enqueues its client (HTTP 200), the socket handshake succeeds on engine.io 6.6.11, and a SCSS change is picked up
• npm run init -- --yes --name="Acme Blog" --features=tailwind,hmr on a copy: installs, builds, runs Jest and audits clean