chore(deps-dev): drop @wordpress/scripts and share one Playwright config by josephfusco · Pull Request #835 · wpengine/hwptoolkit

josephfusco · 2026-10-23T14:59:51Z

Clears 15 of the 17 Dependabot alerts on the root pnpm-lock.yaml, and removes a build toolchain from a repo meant to ship from source with no build step.

Why

@wordpress/scripts was used for exactly one thing: wp-scripts test-playwright and its base Playwright config, in the plugin e2e suites. In exchange it pulled in webpack, Babel, stylelint, markdownlint, and Jest, which brought markdown-it, uuid, postcss-selector-parser, @babel/core, and others into the alerts. @wordpress/jest-console wasn't imported anywhere.

What changes

playwright.config.base.js at the root has the same settings as the wp-scripts config, minus its global setup, which every plugin already replaced with its own. hwp-previews, wpgraphql-logging, and hwp-documents import it by relative path and run plain playwright test. Nothing is generated or copied.
Removes @wordpress/scripts and @wordpress/jest-console from the root and the plugins.
Removes the Playwright tooling from wpgraphql-debug-extensions and wpgraphql-webhooks, which have no e2e tests.
Bumps @wordpress/e2e-test-utils-playwright from 1.54 to 3.1, which clears the extract-zip and OpenTelemetry alerts. Its breaking changes are a higher Node minimum and two helpers (switchEditorTool and setGutenbergExperiments) that no spec uses.
Raises the root engines.node to >=22.19.0, which e2e-test-utils 3.x requires. CI already runs Node 24, and .nvmrc is lts/krypton.
pnpm-lock.yaml drops about 12,600 lines.
The e2e workflow installs browsers with the locked Playwright (pnpm exec playwright install --with-deps chromium) instead of pnpm dlx, which fetched the newest Playwright and could drift from the locked @playwright/test. It now installs Chromium only, since that's the only project the config runs.

Remaining alerts

http-cache-semantics comes in through @wordpress/env 12, which is already the latest, and there's no upstream fix.
braces is a withdrawn advisory.
The six Nuxt example alerts need a Nuxt 3 → 4 migration, which belongs in a separate PR.

Testing

playwright test --list loads each plugin's config and finds every spec: hwp-previews 20 tests, wpgraphql-logging 8, hwp-documents 3.
Checked that no vulnerable version of the cleared packages is left in the lockfile.
I couldn't run the e2e suites locally because they need the Docker WordPress environment. The e2e workflow only runs the first changed plugin's suite (hwp-documents here), so it's worth running hwp-previews and wpgraphql-logging by hand before merging.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Assisting with tracing the Dependabot alerts to their source, replacing the wp-scripts Playwright config, and updating dependencies.

The plugin configs spread @wordpress/scripts' Playwright config, the only thing wp-scripts was used for. A root playwright.config.base.js carries the same settings, and the plugins run plain `playwright test`.

…wright to 3.1 - Remove @wordpress/scripts and the unused @wordpress/jest-console from the root and plugins. - Remove the Playwright tooling from wpgraphql-debug-extensions and wpgraphql-webhooks, which have no E2E tests. - Bump @wordpress/e2e-test-utils-playwright to ^3.1.0, which needs Node 22.19+, so raise the root engines field to match.

changeset-bot · 2026-10-23T14:59:57Z

⚠️ No Changeset found

Latest commit: 2642945

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2026-10-23T15:01:01Z

📦 Plugin Artifacts Ready!

Download from GitHub Actions run

Available plugins:

✅ hwp-documents.zip
✅ hwp-previews.zip
✅ wpgraphql-debug-extensions.zip
✅ wpgraphql-logging.zip
✅ wpgraphql-webhooks.zip

See the "Artifacts" section at the bottom of the Actions run page

github-actions · 2026-10-23T15:02:18Z

🔍 WordPress Plugin Check Report

❌ Status: Failed

📊 Report

🎯 Total Issues	❌ Errors	⚠️ Warnings
38	38	0

❌ Errors (38)

📁 examples/hwp-preview-rest/wp-env/uploads.zip (1 error)

📍 Line	🔖 Check	💬 Message
`0`	compressed_files	Compressed files are not permitted.

📁 examples/hwp-preview-wpgraphql/wp-env/uploads.zip (1 error)

📍 Line	🔖 Check	💬 Message
`0`	compressed_files	Compressed files are not permitted.

📁 examples/hwp-preview-rest/wp-env/setup/.htaccess (1 error)

📍 Line	🔖 Check	💬 Message
`0`	hidden_files	Hidden files are not permitted.

📁 examples/hwp-preview-rest/.wp-env.json (1 error)

📍 Line	🔖 Check	💬 Message
`0`	hidden_files	Hidden files are not permitted.

📁 examples/hwp-preview-wpgraphql/wp-env/setup/.htaccess (1 error)

📍 Line	🔖 Check	💬 Message
`0`	hidden_files	Hidden files are not permitted.

📁 examples/hwp-preview-wpgraphql/wp-env/__MACOSX/._uploads (1 error)

📍 Line	🔖 Check	💬 Message
`0`	hidden_files	Hidden files are not permitted.

📁 examples/hwp-preview-wpgraphql/.wp-env.json (1 error)

📍 Line	🔖 Check	💬 Message
`0`	hidden_files	Hidden files are not permitted.

📁 examples/hwp-preview-astro/wp-env/setup/.htaccess (1 error)

📍 Line	🔖 Check	💬 Message
`0`	hidden_files	Hidden files are not permitted.

📁 examples/hwp-preview-astro/.wp-env.json (1 error)

📍 Line	🔖 Check	💬 Message
`0`	hidden_files	Hidden files are not permitted.

📁 .env.dist (2 errors)

📍 Line	🔖 Check	💬 Message
`0`	hidden_files	Hidden files are not permitted.
`0`	application_detected	Application files are not permitted.

📁 docs/.gitkeep (1 error)

📍 Line	🔖 Check	💬 Message
`0`	hidden_files	Hidden files are not permitted.

📁 .docker/.env.ci (1 error)

📍 Line	🔖 Check	💬 Message
`0`	hidden_files	Hidden files are not permitted.

📁 .editorconfig (1 error)

📍 Line	🔖 Check	💬 Message
`0`	hidden_files	Hidden files are not permitted.

📁 .wp-env.json (1 error)

📍 Line	🔖 Check	💬 Message
`0`	hidden_files	Hidden files are not permitted.

📁 phpstan.neon.dist (1 error)

📍 Line	🔖 Check	💬 Message
`0`	application_detected	Application files are not permitted.

📁 bin/build-docker.sh (1 error)

📍 Line	🔖 Check	💬 Message
`0`	application_detected	Application files are not permitted.

📁 bin/_lib.sh (1 error)

📍 Line	🔖 Check	💬 Message
`0`	application_detected	Application files are not permitted.

📁 bin/sync-package-version.sh (1 error)

📍 Line	🔖 Check	💬 Message
`0`	application_detected	Application files are not permitted.

📁 bin/run-codeception.sh (1 error)

📍 Line	🔖 Check	💬 Message
`0`	application_detected	Application files are not permitted.

📁 bin/install-plugins.sh (1 error)

📍 Line	🔖 Check	💬 Message
`0`	application_detected	Application files are not permitted.

📁 bin/install-test-env.sh (1 error)

📍 Line	🔖 Check	💬 Message
`0`	application_detected	Application files are not permitted.

📁 bin/local/run-e2e-tests.sh (1 error)

📍 Line	🔖 Check	💬 Message
`0`	application_detected	Application files are not permitted.

📁 bin/local/setup-docker-env.sh (1 error)

📍 Line	🔖 Check	💬 Message
`0`	application_detected	Application files are not permitted.

📁 bin/local/run-qa.sh (1 error)

📍 Line	🔖 Check	💬 Message
`0`	application_detected	Application files are not permitted.

📁 bin/local/run-unit-tests.sh (1 error)

📍 Line	🔖 Check	💬 Message
`0`	application_detected	Application files are not permitted.

📁 .docker/init-docker.sh (1 error)

📍 Line	🔖 Check	💬 Message
`0`	application_detected	Application files are not permitted.

📁 examples/hwp-preview-wpgraphql/example-app/src/pages/[identifier].js (1 error)

📍 Line	🔖 Check	💬 Message
`0`	badly_named_files	File and folder names must not contain spaces or special characters.

📁 examples/hwp-preview-astro/example-app/src/pages/[...uri].astro (1 error)

📍 Line	🔖 Check	💬 Message
`0`	badly_named_files	File and folder names must not contain spaces or special characters.

📁 hwp-previews.php (3 errors)

📍 Line	🔖 Check	💬 Message
`0`	plugin_header_invalid_requires_php	The "Requires PHP" header in the plugin file should only contain a PHP version such as "5.2.4" or "7.0".
`0`	plugin_updater_detected	Including An Update Checker / Changing Updates functionality. Plugin Updater detected. Use of the Update URI header is not allowed in plugins hosted on WordPress.org.
`0`	mismatched_tested_up_to_header	Mismatched "Tested up to": 6.9 != 7.0. The "Tested up to" value in the readme file must match the "Tested up to" value in the plugin header. If the plugin header has a "Tested up to" value, it will override the readme value, which can cause confusion.

📁 readme.txt (2 errors)

📍 Line	🔖 Check	💬 Message
`0`	outdated_tested_upto_header	Tested up to: 6.9 < 7.1. The "Tested up to" value in your plugin is not set to the current version of WordPress. This means your plugin will not show up in searches, as we require plugins to be compatible and documented as tested up to the most recent version of WordPress.
`0`	readme_mismatched_header_requires_php	Mismatched Requires PHP: 7.4 != 8.2+. "Requires PHP" needs to be exactly the same with that in your main plugin file's header.

📁 activation.php (1 error)

📍 Line	🔖 Check	💬 Message
`0`	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

📁 deactivation.php (1 error)

📍 Line	🔖 Check	💬 Message
`0`	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

📁 src/Templates/admin.php (1 error)

📍 Line	🔖 Check	💬 Message
`0`	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

📁 src/Templates/iframe.php (1 error)

📍 Line	🔖 Check	💬 Message
`0`	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check

josephfusco added 2 commits October 23, 2026 10:59

test: share one Playwright base config across plugin E2E suites

1180934

The plugin configs spread @wordpress/scripts' Playwright config, the only thing wp-scripts was used for. A root playwright.config.base.js carries the same settings, and the plugins run plain `playwright test`.

josephfusco requested review from a team, colinmurphy and wpe-ie-deploy-bot as code owners October 23, 2026 14:59

josephfusco added 2 commits October 23, 2026 11:05

Merge remote-tracking branch 'origin/main' into chore/drop-wp-scripts

cf7f1d7

ci: install the locked Playwright's Chromium for E2E tests

2642945

Navigation Menu

Repository navigation

chore(deps-dev): drop @wordpress/scripts and share one Playwright config - #835

chore(deps-dev): drop @wordpress/scripts and share one Playwright config#835
josephfusco wants to merge 4 commits into
mainfrom
chore/drop-wp-scripts

josephfusco commented Oct 23, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

josephfusco commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changes

Remaining alerts

Testing

Uh oh!

changeset-bot Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

github-actions Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Plugin Artifacts Ready!

Uh oh!

github-actions Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 WordPress Plugin Check Report

📊 Report

❌ Errors (38)

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

josephfusco commented Oct 23, 2026 •

edited

Loading

changeset-bot Bot commented Oct 23, 2026 •

edited

Loading

github-actions Bot commented Oct 23, 2026 •

edited

Loading

github-actions Bot commented Oct 23, 2026 •

edited

Loading