Align dependency versions across workspaces

[manzoorwanijk]

What?

Aligns declared dependency versions across the monorepo to avoid version mismatch - see #77950. Next we can enforce this automatically throughout the monorepo via #77950.

Why?

#77950 introduces the npm run lint:deps gate but doesn't touch any consumer package.json files. We are doing the changes first before enforcing the check

How?

By updating all the package versions to be the same version across the monorepo, using Syncpack from #77950

Testing Instructions

CI should be happy

Testing Instructions for Keyboard

N/A — dependency-only change.

Screenshots or screencast

N/A — no UI changes.

Use of AI Tools

Drafted with assistance from Claude Code. The fix itself was produced entirely by syncpack fix; the description was reviewed and edited by hand.

[github-actions]

Flaky tests detected in 5fb149a.
Some tests passed with failed attempts. The failures may not be related to this commit but are still reported for visibility. See the documentation for more information.

🔍 Workflow run URL: https://github.com/WordPress/gutenberg/actions/runs/25394726972
📝 Reported issues:

• [Flaky Test] post title and content are editable and blocks can be inserted #77720 in /test/e2e/specs/editor/various/post-content-focus-mode.spec.js
• [Flaky Test] should show correct homepage actions based on current homepage or posts page #77385 in /test/e2e/specs/site-editor/homepage-settings.spec.js

[github-actions]

Warning: Type of PR label mismatch

To merge this PR, it requires exactly 1 label indicating the type of PR. Other labels are optional and not being checked here.

• Required label: Any label starting with [Type].
• Labels found: [Package] Element, [Package] Data, [Package] Hooks, [Package] i18n, [Package] is-shallow-equal, [Package] Compose, [Package] Core data, [Package] Viewport, [Package] Plugins, [Package] Components, [Package] Blocks, [Package] Editor, [Package] Block library, [Package] Notices, [Package] Rich text, [Package] Block editor, [Package] Priority Queue, [Package] Edit Widgets, [Package] E2E Tests, [Package] Project management automation, [Package] Icons, [Package] Lazy import, [Package] Edit Site, [Package] Private APIs, [Package] DataViews, [Package] Fields, [Package] Sync.

Read more about Type labels in Gutenberg. Don't worry if you don't have the required permissions to add labels; the PR reviewer should be able to help with the task.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: manzoorwanijk <[email protected]>
Co-authored-by: ciampo <[email protected]>
Co-authored-by: tyxla <[email protected]>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[ciampo]

We could also consider adding "internal" CHANGELOG entries for packages where the dependency floor moved rather than just the range syntax (components, block-editor, editor, blocks, dataviews).

Also, react is bumped to ^18.3.1 but the paired react-dom stays ^18.3.0 in the same manifests. Nit, but maybe this is an opportunity to align them?

[ciampo]

Is the downgrade on purpose? Could we align all versions on 0.4.22 instead?

[manzoorwanijk]

Yes, that on purpose. There is some change in v0.4.22 that breaks unit tests because of some focus element not found. So, I downgraded it a patch version.

[ciampo]

In that case, I understand the downgrade for the sake of landing this PR.

Although it'd be good to plan a follow-up to update back to 0.22, fixing the unit tests etc etc

[manzoorwanijk]

Good idea. I will do that when this PR lands.

[Copilot]

Pull request overview

Aligns dependency version declarations across Gutenberg workspaces (per the upcoming Syncpack-based lint:deps gate) to reduce cross-workspace version drift and avoid mismatched installs/types.

Changes:

• Normalizes many workspace package.json dependency specifiers (e.g., moving exact pins to ^ ranges) to match the monorepo’s aligned versions.
• Updates a set of dependencies to the chosen aligned versions (e.g., React ^18.3.1, PostCSS ^8.4.38, Storybook ^10.2.8, etc.).
• Regenerates lockfiles and updates a few package changelogs/snapshots to reflect dependency-only/internal updates.

Reviewed changes

Copilot reviewed 62 out of 64 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tools/eslint/package.json	Align ESLint tooling dependency ranges/versions.
tools/docs/package.json	Align docs tooling dependency range for change-case.
tools/build-scripts/package.json	Align build-scripts deps (including React) to monorepo versions.
test/storybook-playwright/package.json	Align Storybook test workspace versions.
test/integration/package.json	Align React version used by integration tests.
test/e2e/package.json	Align @y/websocket-server range.
storybook/package.json	Align Vite version range.
platform-docs/package.json	Align React/ReactDOM versions for platform docs.
platform-docs/package-lock.json	Lockfile update following platform-docs dependency alignment.
packages/wp-build/package.json	Align build tool dependencies to consistent ^ ranges/versions.
packages/viewport/package.json	Align deep-freeze dependency range.
packages/sync/package.json	Align lib0/yjs ranges.
packages/shortcode/package.json	Align memize version.
packages/scripts/package.json	Align core tooling deps (@babel/core, postcss, chalk, etc.).
packages/rich-text/package.json	Align colord and deep-freeze ranges.
packages/report-flaky-tests/package.json	Align GitHub Actions/Octokit dependency ranges/versions.
packages/readable-js-assets-webpack-plugin/package.json	Align devDependency ranges.
packages/project-management-automation/package.json	Align GitHub Actions/Octokit dependency ranges/versions.
packages/private-apis/package.json	Align React version used in devDependencies.
packages/priority-queue/package.json	Align @types/requestidlecallback range.
packages/prettier-config/package.json	Align @types/prettier range.
packages/postcss-plugins-preset/package.json	Align autoprefixer patch version.
packages/plugins/package.json	Align memize version.
packages/notices/package.json	Align deep-freeze range.
packages/media-fields/package.json	Align clsx range.
packages/lazy-import/package.json	Align semver version and types ranges.
packages/jest-preset-default/package.json	Align babel-jest range.
packages/is-shallow-equal/package.json	Align benchmark range.
packages/icons/package.json	Align change-case range.
packages/i18n/package.json	Align benchmark range.
packages/hooks/package.json	Align benchmark range.
packages/global-styles-ui/package.json	Align clsx/colord versions.
packages/global-styles-engine/package.json	Align colord/deepmerge versions.
packages/fields/package.json	Align change-case/clsx ranges.
packages/eslint-plugin/package.json	Align ESLint plugin dependency versions/ranges.
packages/env/package.json	Align chalk and simple-git versions.
packages/element/package.json	Align React/ReactDOM versions.
packages/editor/package.json	Align colord/deep-freeze versions/ranges.
packages/editor/CHANGELOG.md	Add internal changelog entry for dependency updates.
packages/edit-widgets/package.json	Align deep-freeze range.
packages/edit-site/package.json	Align colord version.
packages/e2e-test-utils-playwright/package.json	Align @types/mime range.
packages/docgen/package.json	Align dependency ranges for docgen toolchain.
packages/design-system-mcp/package.json	Align dependency ranges for MCP server package.
packages/dependency-extraction-webpack-plugin/test/snapshots/build.js.snap	Snapshot updates due to dependency/lock changes affecting output hashes.
packages/dependency-extraction-webpack-plugin/package.json	Align json2php version.
packages/dataviews/package.json	Align colord/deepmerge versions/ranges.
packages/dataviews/CHANGELOG.md	Add internal changelog entry for dependency updates.
packages/data/package.json	Align deepmerge and deep-freeze versions/ranges.
packages/create-block/package.json	Align chalk version.
packages/core-data/package.json	Align deep-freeze range.
packages/compose/package.json	Align mock-match-media range and ReactDOM version.
packages/components/package.json	Align dependency ranges/versions (incl. @ariakit/react, colord, deepmerge).
packages/components/CHANGELOG.md	Add internal changelog entry for dependency updates.
packages/blocks/package.json	Align colord and deep-freeze versions/ranges.
packages/blocks/CHANGELOG.md	Add internal changelog entry for dependency updates.
packages/block-library/package.json	Align dependency ranges/versions (@arraypress/waveform-player, colord, etc.).
packages/block-editor/package.json	Align colord/deepmerge/postcss and other versions/ranges.
packages/block-editor/CHANGELOG.md	Add internal changelog entry for dependency updates.
packages/block-directory/package.json	Align deep-freeze range.
packages/babel-preset-default/package.json	Align Babel deps to ^ ranges and React version.
packages/babel-plugin-makepot/package.json	Align deepmerge and @babel/traverse ranges.
package.json	Align root devDependency ranges/versions.
package-lock.json	Lockfile update following dependency alignment changes.

Files not reviewed (1)

• platform-docs/package-lock.json: Language not supported

[ciampo]

LGTM 🚀

Just a couple of non-blocking thoughts:

• typescript and wp-prettier now have caret versions instead of a pinned version. It should be fine (since any breakage caused by updating them will reflect in lockfile and will fail loudly), but maybe we want to be more conservative and keep the exact version
• let's make sure to follow-up with a repo-wide ariakit update (either to ^0.4.22, or, potentially, to the latest version ^0.4.29?)

[manzoorwanijk]

• typescript and wp-prettier now have caret versions instead of a pinned version. It should be fine (since any breakage caused by updating them will reflect in lockfile and will fail loudly), but maybe we want to be more conservative and keep the exact version

I think that is fine and should use caret ranges to ensure we receive security updates. Otherwise, we are stuck with the pinned version.

• let's make sure to follow-up with a repo-wide ariakit update (either to ^0.4.22, or, potentially, to the latest version ^0.4.29?)

Here you go - #79051