Clean up dependabot PRs #607

Review, test and merge all current open dependabot PRs.

Last updated 2026-10-22: 5 open, 34 done.

Composer

• #546 bump squizlabs/php_codesniffer from 3.8.1 to 3.10.1 (opened 2024-05-23) — closed by Dependabot: no longer updatable
• #560 bump dealerdirect/phpcodesniffer-composer-installer from 1.0.0 to 1.2.1 (opened 2026-05-21) — closed by Dependabot: already up to date
• #582 bump symfony/process from 5.4.22 to 5.4.51 (opened 2026-07-26)

npm

• #517 bump ip from 1.1.8 to 2.0.1 (opened 2024-02-20) — closed by Dependabot: no longer a dependency
• #528 bump webpack-dev-middleware from 5.3.3 to 6.1.3 (opened 2024-03-21) — closed by Dependabot: no longer updatable
• #534 bump typescript from 5.3.3 to 5.9.3 (opened 2024-04-11) — closed by Dependabot: no longer updatable
• #540 bump ejs from 3.1.9 to 3.1.10 (opened 2024-05-02) — closed by Dependabot: already up to date
• #541 bump storybook from 7.6.15 to 7.6.24 (opened 2024-05-02) — closed by Dependabot: no longer updatable
• #547 bump re-resizable from 6.9.11 to 6.11.2 (opened 2024-05-30)
• #549 bump braces from 3.0.2 to 3.0.3 (opened 2024-06-19) — closed by Dependabot: already up to date
• #554 bump node-forge from 1.3.1 to 1.4.0 (opened 2026-05-16)
• #555 bump handlebars from 4.7.8 to 4.7.9 (opened 2026-05-16) — closed by Dependabot: superseded by npm: bump handlebars from 4.7.9 to 4.7.10 #621
• #556 bump @babel/plugin-transform-modules-systemjs from 7.23.3 to 7.29.4 (opened 2026-05-16) — closed by Dependabot: already up to date
• #557 bump simple-git from 3.17.0 to 3.36.0 (opened 2026-05-16)
• #562 bump serialize-javascript from 6.0.1 to 6.0.2 (opened 2026-05-21)
• #563 bump @tootallnate/once from 2.0.0 to 2.0.1 (opened 2026-05-22) — closed by Dependabot: no longer a dependency
• #565 bump launch-editor from 2.13.2 to 2.14.2 (opened 2026-06-03)
• #568 bump form-data from 4.0.5 to 4.0.6 (opened 2026-06-15)
• #569 bump tar from 6.2.0 to 6.2.1 (opened 2026-06-18)
• #570 bump @babel/core from 7.23.5 to 7.29.7 (opened 2026-06-18) — closed by Dependabot: no longer updatable
• #572 bump http-proxy-middleware from 2.0.9 to 2.0.10 (opened 2026-06-23) — merged
• #573 bump ws from 6.2.3 to 6.2.6 (opened 2026-07-14)
• #574 bump websocket-driver from 0.7.4 to 0.7.5 (opened 2026-07-15)
• #576 bump shell-quote from 1.8.3 to 1.10.0 (opened 2026-07-23)
• #593 bump postcss from 8.5.14 to 8.5.26 (opened 2026-08-05)
• #596 bump immutable from 5.1.5 to 5.1.9 (opened 2026-08-08)
• #598 bump the wordpress group across 1 directory with 37 updates (opened 2026-08-13)
• #599 bump browserslist from 4.28.2 to 4.28.8 (opened 2026-09-03)
• #600 bump joi from 18.2.1 to 18.2.8 (opened 2026-09-09) — closed by Dependabot: superseded by npm: bump joi from 18.2.1 to 18.3.0 #610
• #601 bump svgo from 3.3.3 to 3.3.5 (opened 2026-09-09)
• #602 bump baseline-browser-mapping from 2.10.30 to 2.11.21 (opened 2026-09-09)
• #603 bump ip-address from 10.2.0 to 10.7.4 (opened 2026-09-28)
• #604 bump moment from 2.30.1 to 2.31.0 (opened 2026-10-01)
• #605 bump axios from 1.16.1 to 1.20.0 (opened 2026-10-02)
• #610 bump joi from 18.2.1 to 18.2.9 (opened 2026-10-13)
• #620 bump proxy-addr from 2.0.7 to 2.0.8 (opened 2026-10-16)
• #621 bump handlebars from 4.7.9 to 4.7.10 (opened 2026-10-16)
• #622 bump source-map-js from 1.2.1 to 1.2.2 (opened 2026-10-16)
• #623 bump compression from 1.8.1 to 1.8.2 (opened 2026-10-16)