[desrosj]

Part of #82938.

What?

Two commits:

1. Pins @types/mime-types (2.1.1) and @types/yauzl (2.9.2) exactly in the root devDependencies, at the versions already in package-lock.json. npm drops "optional": true from the @types/yauzl entry, since it is now a direct dependency.
2. Updates the remaining entries under the puppeteer alias in package-lock.json to the versions npm resolves today: debug 4.4.3, mime-db 1.52.0, mime-types 2.1.35, ms 2.1.3, pump 3.0.4, readable-stream 3.6.2, tar-fs 2.1.5 and ws 7.5.13, plus sha512 integrity for fd-slicer and yauzl.

Why?

The "Static Analysis" job runs npm install and then npm run check-local-changes, which fails because npm install rewrites package-lock.json.

package.json declares Puppeteer through an npm alias ("puppeteer": "npm:puppeteer-core@3.0.0"). npm 6 doesn't keep the locked versions of an aliased package's dependencies: on every install it re-resolves them to the newest versions their ranges allow, so the lockfile changes whenever one of them publishes a release. Trunk has no such alias.

Pinning holds the top-level @types entries for good. The other entries are nested under the alias because other packages use older major versions at the top level, so they can't be pinned the same way (overrides needs npm 8.3+), and they will need updating again when they publish new releases in range.

How?

Both commits contain exactly what npm 6.14.18 (Node 14, as in CI) writes: npm install --package-lock-only reproduces CI's lockfile diff line for line, and a second run on the result leaves the lockfile unchanged. Placed above #84999, the last PR below this one that changes package-lock.json.

Use of AI Tools

This PR was created by Claude Code under my supervision. All code should be treated as AI-produced and not yet reviewed by a human until this PR is marked Ready for Review.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 302b2592-ff4c-4d30-a1c5-b9022083841b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: desrosj <desrosj@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[ntsekouras]

LGTM, thanks! npm install no longer changes package-lock.json, so Static Analysis goes green.