[desrosj]

What?

Two commits:

1. Pins @types/mime-types (2.1.1) and @types/yauzl (2.9.2) exactly in the root devDependencies, at the versions already in package-lock.json. npm drops "optional": true from the @types/yauzl entry, since it is now a direct dependency.
2. Updates the remaining entries under the puppeteer alias in package-lock.json to the versions npm resolves today: debug 4.4.3, mime-db 1.52.0, mime-types 2.1.35, ms 2.1.3, pump 3.0.4, readable-stream 3.6.2, tar-fs 2.1.5 and ws 7.5.13, plus sha512 integrity for fd-slicer and yauzl.

Why?

The "Static Analysis" job runs npm install and then npm run check-local-changes, which fails because npm install rewrites package-lock.json.

package.json declares Puppeteer through an npm alias ("puppeteer": "npm:puppeteer-core@3.0.0"). npm 6 doesn't keep the locked versions of an aliased package's dependencies: on every install it re-resolves them to the newest versions their ranges allow, so the lockfile changes whenever one of them publishes a release. Trunk has no such alias.

Pinning holds the top-level @types entries for good. The other entries are nested under the alias because other packages use older major versions at the top level, so they can't be pinned the same way (overrides needs npm 8.3+), and they will need updating again when they publish new releases in range.

How?

Both commits contain exactly what npm 6.14.18 (Node 14, as in CI) writes: npm install --package-lock-only reproduces CI's lockfile diff line for line, and a second run on the result leaves the lockfile unchanged. Placed above #313, the last PR below this one that changes package-lock.json.

Use of AI Tools

This PR was created by Claude Code under my supervision. All code should be treated as AI-produced and not yet reviewed by a human until this PR is marked Ready for Review.

🤖 Generated with Claude Code

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: desrosj <desrosj@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[desrosj]

Moved to WordPress#85001.