[dbutts29]

Description of the change

This clears the two critical Dependabot alerts in package-lock.json, both published in October:

• Console styles error #67 simple-git 3.36.0: GHSA-x6jw-m9v5-85vh (CVE-2026-102828). Fixed in 4.0.1.
• WP_ENV is not used #68 @simple-git/argv-parser 1.1.1: GHSA-v5rq-49vh-5v5c (CVE-2026-102829). Fixed in 2.0.1.

Both come in only through @wordpress/env. Every 11.x release depends on simple-git ^3.32.3, and no 3.x simple-git is patched. Overriding simple-git to 4.x under wp-env 11 would put a major version under a package that asks for ^3. wp-env 12 is upstream's own fix: it depends on simple-git ^4.0.2, which resolves argv-parser 2.0.1. So this pins @wordpress/env at exactly 12.1.0, up from ^11.15.0.

wp-env 12.0.0's only breaking change is raising the minimum Node version to >=22.13.0 (changelog). This workflow's ubuntu-latest runners report Node v22.23.4 (from the last run's "General debug information" step), so CI is already compatible.

After the change, npm audit shows 0 critical findings. Two existing highs (body-parser, isomorphic-git) are unchanged and out of scope.

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Maintenance
• New release

Related issues

• Linear: PLA-2594

Checklists

Development

• Lint rules pass locally
• The code changed/added as part of this pull request has been covered with tests: n/a, dev tooling only
• All tests related to the changed code pass in development: CI runs the PHP × WordPress matrix through wp-env 12. Locally npm ci succeeds and wp-env --version reports 12.1.0. I didn't start the Docker environment.

🤖 Generated with Claude Code

[linear-code]

PLA-2594