feat!: upgrade WordPress packages to latest

[thomasguillot]

All Submissions:

• Have you followed the Newspack Contributing guideline?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

Surgical upgrade of the WordPress dependency set, focused on the packages that consumers actively import (@wordpress/components, @wordpress/icons, @wordpress/base-styles) plus the build/lint tooling chain. Other @wordpress/* packages (block-editor, edit-post, blocks, etc.) are intentionally held at their original ranges to avoid downstream dep-tree-shape regressions — see "Why we held back block-editor" below.

Also adds a Dependabot groups: config to reduce future PR volume and tightens auto-merge to the patch tier so grouped PRs require manual review when they include minor updates.

WordPress packages bumped to latest:

• @wordpress/components 30 → 33
• @wordpress/icons 11 → 13
• @wordpress/base-styles 6 → 7
• @wordpress/scripts 30 → 31 (capped — v32 requires eslint@10)
• @wordpress/eslint-plugin aligned to ^24.5.0 (matches @wordpress/scripts@31's pinned version, removing a v22/v24 install-tree duplicate)

WordPress packages pinned tighter to avoid the cmdk/@radix-ui React-19 chain:

• @wordpress/block-editor ~15.6.0
• @wordpress/blocks ~15.6.0
• @wordpress/edit-post ~8.33.0

Other @wordpress/* packages (a11y, api-fetch, compose, data, element, etc.) are declared at their original ^X.33.0 ranges. @wordpress/components@33 transitively forces them to ^X.45.0 regardless, so the declared ranges are cosmetic; this PR doesn't intentionally bump them.

Other cleanup:

• Aligned @commitlint/config-conventional ^19.8.1 → ^20.5.3 to match @commitlint/cli@^20, removing a @commitlint/types v19/v20 duplicate.
• Added engines.node: ">=18.12.0" so consumers on older Node get a clear, early npm install failure instead of cryptic runtime errors.
• Updated actions/checkout@v2 → @v4 in .github/workflows/auto-merge.yml (Node 16 runtime is being deprecated by GitHub Actions).

This is marked as a breaking change because consumers receive transitive API changes — notably @wordpress/components API renames between versions 30/31/32/33, @wordpress/icons export changes in v12, @wordpress/base-styles v7 SCSS API changes, and the new engines.node floor.

Why we held back block-editor

@wordpress/block-editor@15.18.0 (the latest within the original ^15.6.0 range) brings @wordpress/commands@1.45.0 → cmdk@1.1.1 → @radix-ui/* packages that require React 19. Meanwhile, @wordpress/element@6.45.0 declares dependencies.react: ^18.3.0 (regular dep, not peer). When npm tries to satisfy both in a consumer tree that doesn't pin React explicitly, it puts React 19 at root and keeps React 18 nested inside @wordpress/element. Components and react-dom then load from different React copies, breaking hooks at runtime ("useState returns null").

This was reproduced in newspack-plugin testing — without the revert, 78 tests failed and the build broke (@wordpress/dataviews/build-style/style.css couldn't resolve because dataviews was nested instead of hoisted). Pinning block-editor at ~15.6.0 keeps the cmdk/Radix chain on its older versions where React resolves cleanly to a single 18.x.

This isn't permanent — once consumers' React setup is unified (likely as part of an eslint 9/10 + flat-config migration we've already deferred), block-editor and friends can be bumped in a follow-up PR.

How to test the changes in this Pull Request:

1. Verify lint passes locally: npm install && npm run lint:js — should complete without errors.
2. Confirm npm install resolves cleanly (peer-dep warnings about react-autosize-textarea wanting react-dom 16 are expected and non-fatal).
3. Test against representative downstream repos before merging — install this branch's tarball into each, then run their full pipeline.

Downstream test results

15 Newspack repos in newspack-workspace/repos/ were tested against this branch's tarball. 12 are completely clean. 3 have documented consumer-migration tasks (not regressions in this PR's content):

Repo	Issue	Migration
newspack-plugin	26 lint errors: jsdoc/no-undefined-types flags @returns {JSX.Element}	Either add // eslint-disable-next-line jsdoc/no-undefined-types or import the JSX namespace properly. The stricter rule comes from @wordpress/eslint-plugin v22→v24.
newspack-manager	42 lint errors: same as above	Same fix as newspack-plugin.
newspack-popups	1 test fails (out of 28): setWindowLocation test uses delete window.location; window.location = {}	Newer JSDOM (from @wordpress/scripts@31) blocks this pattern. Use Object.defineProperty(window, 'location', ...) or jest.spyOn instead.

All other 12 repos pass install, lint:js, lint:scss (where present), build, and test (where present) cleanly. Repos tested: newspack-ads, newspack-block-theme, newspack-blocks, newspack-listings, newspack-manager-client, newspack-multibranded-site, newspack-network, newspack-newsletters, newspack-sponsors, newspack-theme, republication-tracker-tool, super-cool-ad-inserter-plugin.

Other information:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes, as applicable? (N/A — dependency upgrade)
• Have you successfully ran tests with your changes locally? (npm run lint:js passes; downstream testing complete — see results above)

[Copilot]

Pull request overview

Updates newspack-scripts’s dependency set to newer WordPress/Gutenberg toolchain versions (while staying within eslint@8 constraints) and reduces Dependabot PR churn by batching minor/patch updates into ecosystem-based groups.

Changes:

• Bump @wordpress/* packages (notably @wordpress/components, @wordpress/icons, @wordpress/base-styles, @wordpress/scripts) and apply a set of minor/patch upgrades for related tooling dependencies.
• Add Dependabot groups configuration to batch minor/patch dependency updates by ecosystem (WordPress, ESLint, testing, release tooling, etc.).

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updates WordPress and tooling dependency versions (including @wordpress/scripts cap aligned to eslint@8).
.github/dependabot.yml	Adds grouped update rules to reduce Dependabot PR volume by batching minor/patch updates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Updates newspack-scripts’ npm dependency set—primarily bumping @wordpress/* packages while keeping compatibility with eslint@8—and adjusts Dependabot configuration to reduce update PR noise by batching minor/patch bumps.

Changes:

• Bumped @wordpress/* dependencies (including @wordpress/components, @wordpress/icons, @wordpress/base-styles, and @wordpress/scripts) and refreshed several related tooling deps.
• Updated various JS tooling dependencies (eslint/jest/lint-staged/postcss/types, etc.) to newer minor/patch releases.
• Added Dependabot groups rules to batch minor/patch updates by ecosystem.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
package.json	Updates WordPress/tooling dependency versions (eslint@8-compatible) used by newspack-scripts.
.github/dependabot.yml	Adds grouped-update configuration to reduce Dependabot PR volume for minor/patch bumps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Upgrades this repo’s WordPress/Gutenberg toolchain dependencies to newer @wordpress/* versions that remain compatible with eslint@8, and tunes Dependabot configuration to reduce dependency update PR noise.

Changes:

• Bump @wordpress/* packages (notably components, icons, base-styles, scripts) plus several related lint/test tooling dependencies.
• Add Dependabot groups configuration to batch minor/patch npm updates by ecosystem.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updates @wordpress/* and other tooling dependency versions (eslint 8–compatible).
.github/dependabot.yml	Adds grouped-update rules to reduce Dependabot PR volume.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Updates this repo’s WordPress/Gutenberg-related toolchain and Dependabot automation to reduce dependency PR noise while keeping within eslint@8 compatibility constraints.

Changes:

• Bump @wordpress/* packages (plus related tooling deps) to newer versions compatible with eslint@8.
• Add Dependabot groups to batch minor/patch updates by ecosystem.
• Restrict Dependabot auto-merge workflow from minor → patch only to reduce auto-merge blast radius.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
package.json	Updates @wordpress/* and other dependency versions used by consumers and CI tooling.
.github/workflows/auto-merge.yml	Limits auto-merge to patch-only Dependabot PRs to mitigate grouped-update risk.
.github/dependabot.yml	Adds grouped update configuration to batch PRs by ecosystem.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Updates this repo’s JS toolchain dependencies—primarily @wordpress/* packages—while keeping compatibility with eslint@8, and adjusts Dependabot/auto-merge settings to reduce PR noise without increasing unattended merge risk.

Changes:

• Bump @wordpress/* dependencies (including @wordpress/scripts@31) and other supporting tooling to newer minor/patch releases.
• Add engines.node >=18.12.0 to fail fast on unsupported Node versions.
• Group Dependabot minor/patch updates by ecosystem and restrict the auto-merge workflow to patch updates only.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updates WordPress/tooling dependencies and adds a Node engine floor.
.github/workflows/auto-merge.yml	Restricts Dependabot auto-merge to patch updates to reduce grouped-PR blast radius.
.github/dependabot.yml	Adds grouping rules so Dependabot batches minor/patch updates into fewer PRs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Updates newspack-scripts’s dependency set—primarily @wordpress/*—to the latest versions that remain compatible with eslint@8, while also adjusting Dependabot + auto-merge policy to reduce PR noise without increasing auto-merge blast radius.

Changes:

• Bumped @wordpress/* packages (and a handful of related tooling deps) to newer minor/major versions within the stated eslint compatibility constraints.
• Added engines.node >=18.12.0 to surface an early, clear install-time failure on unsupported Node versions.
• Grouped Dependabot npm updates by ecosystem and tightened the Dependabot auto-merge workflow to patch-only.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
package.json	Updates dependency versions and adds a Node engine floor to match updated tooling requirements.
.github/workflows/auto-merge.yml	Restricts Dependabot auto-merge to patch updates and updates actions/checkout to v4.
.github/dependabot.yml	Introduces grouped update rules so minor/patch updates arrive in a smaller number of batched PRs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Upgrades the project’s WordPress-related npm dependencies and supporting tooling, while adjusting Dependabot configuration to reduce PR noise and limit auto-merges.

Changes:

• Bumped key @wordpress/* packages (components, icons, base-styles, scripts) and aligned lint/tooling dependencies.
• Added engines.node to enforce a minimum Node version during install.
• Added Dependabot grouping rules and tightened the Dependabot auto-merge workflow to patch-only.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
package.json	Updates WordPress/tooling dependency versions and adds a Node engines floor.
.github/workflows/auto-merge.yml	Restricts Dependabot auto-merge to patch updates and updates actions/checkout to v4.
.github/dependabot.yml	Adds grouping rules to bundle minor/patch updates by dependency “ecosystem”.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[thomasguillot]

Closing this. The architectural questions surfaced here belong in #234 rather than this PR — getting input from the team on the broader audit before continuing with incremental upgrade attempts. The branch has been deleted; the commits remain referenced from the issue and can be revisited if useful.