1267: Update NPM dependencies

[James-Roberts]

What

Updates NPM dependencies to the latest versions allowed by the existing version constraints as part of the September routine maintenance work in #1267.

Only package-lock.json has been updated; no dependency constraints in package.json have been changed.

Testing

• npm run build passes successfully.
• npm audit reviewed; known vulnerabilities reduced from 45 to 40.
• composer update was also checked, but there were no Composer dependency updates available within the existing constraints.

Ticket: #1267

[svandragt]

PR #383 only changes the lockfile — no theme code, no config. The dependency versions it picks up are all within the ranges already set in package.json, and CI built the theme successfully off this lockfile.¹

One thing worth noting in the PR body: React went up a major version, 18 to 19.² It's allowed by the constraints and it doesn't change anything the theme ships, because WordPress core supplies React at runtime and the build swaps our imports out for core's copy.³ But someone bisecting a future React problem shouldn't have to discover that inside a routine dependency refresh.

Everything else came out clean: one harmless peer-dependency warning, a few packages dropping out that nothing referenced, and some major bumps confined to build tooling.⁴

Good to merge.

Footnotes

1. Verified rather than assumed: all 1,645 packages resolve within the tree, all 14 direct deps satisfy their package.json ranges, every entry comes from registry.npmjs.org with an integrity hash, lockfileVersion still 3. .github/workflows/node.yml:63 runs npm run build whenever package-lock.json changes, so the green CI run is real evidence. ↩

2. package-lock.json:5085 — react/react-dom 18.3.1 → 19.3.0, scheduler 0.23.2 → 0.28.0. React isn't a direct dependency; it arrives through @wordpress/element, @wordpress/scripts and @wordpress/icons, all of which declare ^18 || ^19. ↩

3. webpack.config.js spreads defaultConfig.plugins, so DependencyExtractionWebpackPlugin externalises react/react-dom to the window.React globals WordPress enqueues. assets/dist isn't committed, so
   no built output changes in this PR either. ↩

4. use-memo-one declares a peer range topping out at React 18 — a warning, npm ci passes. @wordpress/base-styles leaves the tree with no references in assets/src or any config. Removed jest-pnp-resolver, makeerror, tmpl, walker are Jest 30.4→30.5 internals. Dev-tree majors: ajv-formats 2→3, babel-plugin-istanbul 7→8, test-exclude 6→7, adm-zip 0.5→0.6, @wordpress/theme 1→2. sass 1.102→1.104 keeps @import, so the silenceDeprecations: ['import', 'mixed-decls'] workaround at webpack.config.js:104 still applies. ↩