update deps and ci config

.github/workflows/ci.yml

@@ -54,8 +54,9 @@ jobs:
             - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
               with:
                   node-version-file: .nvmrc
+            - run: npm ci --ignore-scripts
             - name: npm audit
-              run: npm audit --audit-level=moderate
+              run: npx audit-ci --config audit-ci.jsonc
             - name: composer audit
               run: composer audit --locked
 

audit-ci.jsonc

@@ -0,0 +1,19 @@
+{
+	"$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
+	"moderate": true,
+	"report-type": "important",
+	"allowlist": [
+		// No patched release exists yet (latest published versions are still affected).
+		// Dev/build tooling only; nothing here ships in the plugin zip.
+		"GHSA-vfj7-8cjw-p6xm", // braces (via @wordpress/scripts)
+		"GHSA-hp3w-g68c-fv3c", // sprintf-js (via @wordpress/scripts)
+
+		// simple-git (via @wordpress/env). Fixed only in simple-git 4.x, which drops the
+		// default export wp-env 11.17 relies on. wp-env only clones sources from our own
+		// .wp-env.json. Remove once @wordpress/env supports simple-git >= 4.0.1.
+		"GHSA-v5rq-49vh-5v5c",
+		"GHSA-x6jw-m9v5-85vh",
+		"GHSA-g4wm-2vf7-vfgr",
+		"GHSA-858h-whjf-mvg5"
+	]
+}