Bump @wordpress packages

[pfefferle]

Proposed changes:

Rolls the four open Dependabot bumps into one update. The ranges in package.json were further behind than the Dependabot titles suggest, since those name the resolved lockfile version rather than our range:

• @wordpress/blocks ^15.23.0 to ^15.27.0 (Bump @wordpress/blocks from 15.26.0 to 15.27.0 #3709)
• @wordpress/components ^39.0.0 to ^40.0.0 (Bump @wordpress/components from 39.0.0 to 40.0.0 #3708)
• @wordpress/core-data ^7.48.0 to ^7.54.0 (Bump @wordpress/core-data from 7.53.0 to 7.54.0 #3707)
• @wordpress/editor ^14.53.0 to ^14.54.0 (Bump @wordpress/editor from 14.53.0 to 14.54.0 #3710)

Three more had to come along. editor and core-data at these versions want block-editor 17 and components 40, while we still asked for block-editor ^16 and interface ^9, so npm resolved two copies of @wordpress/components and two of @wordpress/block-editor. Two copies of components in one tree means two React contexts and two store registrations, which is why the first push passed locally and failed in CI: I had bumped on top of an existing node_modules, CI installs the split tree from the lock.

• @wordpress/block-editor ^16.1.0 to ^17.0.0
• @wordpress/edit-post ^8.53.0 to ^8.54.0
• @wordpress/interface ^9.37.0 to ^10.0.0

So the Gutenberg set is on one major again, and the lock has no duplicate majors left.

I also rebuilt the assets, since we track build/ and Dependabot never rebuilds. It came out a no-op: these packages are externalized, they appear as dependencies in the .asset.php files rather than in our bundles, so a full rm -rf build rebuild is byte identical. Only package.json and package-lock.json change here.

That is also why the majors do not worry me much. What runs on a user's site is the version their WordPress ships, not ours, so this affects our linting, types and tests rather than runtime. Worth a click through the admin screens anyway.

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

• rm -rf node_modules && npm ci && npm run build, then confirm git status shows no changes under build/.
• npm run test:unit, 331 tests. npm run lint:js and npm run lint:css.
• Open the editor and the ActivityPub screens in wp-admin and click through the components-heavy ones, the followers and following lists and the pre-publish panel, in case a major moved something we use.

Superseded: #3707, #3708, #3709, #3710.

[Copilot]

🟡 Changes recommended

The PR description’s stated “from/to” versions don’t match the actual bumps in package.json, and the resulting dependency graph introduces major-version skew (duplicate @wordpress/* trees) that should be addressed or explicitly justified.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the plugin’s JavaScript development dependencies to newer Gutenberg/@wordpress/* package versions, consolidating multiple Dependabot updates and refreshing the npm lockfile accordingly.

Changes:

• Bump @wordpress/blocks to ^15.27.0, @wordpress/components to ^40.0.0, @wordpress/core-data to ^7.54.0, and @wordpress/editor to ^14.54.0.
• Update package-lock.json to reflect the new dependency graph from the bumps.

File summaries

File	Description
package.json	Updates the declared @wordpress/* dependency ranges for the targeted bumps.
package-lock.json	Refreshes resolved versions/transitive dependencies after the bumps.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The updated dependency tree implies a higher Node.js floor (>=20.x) than the project currently communicates/enforces, and package.json should declare engines accordingly to prevent unsupported installs.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Lite