Changeset 63309 for trunk

Timestamp:

08/16/2026 08:24:05 PM (2 weeks ago)

Author:

desrosj

Message:

Build/Test Tools: Remove all npx commands.

When an npx command is run, the specified package will be downloaded and installed when it does not exist locally. This will also install all of the package’s direct and transitive dependencies, and any installation scripts present for every installed package are run. This is potentially dangerous because a compromised package would be able to run code on a local machine or within a GitHub Actions workflow runner.

This replaces every npx call with npm exec --no, which runs an installed binary only and will fail when the package is missing. Additionally, update-browserslist-db is now defined as a direct devDependency.

Props adrianmoldovanwp, desrosj, lancewillett, johnbillion.
Fixes #65864.

Location:

trunk

Files:

• .github/workflows/reusable-end-to-end-tests.yml (modified) (1 diff)
• .github/workflows/reusable-performance-test-v2.yml (modified) (1 diff)
• Gruntfile.js (modified) (3 diffs)
• package-lock.json (modified) (2 diffs)
• package.json (modified) (1 diff)
• tests/qunit/playwright.config.js (modified) (1 diff)

trunk/.github/workflows/reusable-end-to-end-tests.yml

@@ -101 +101 @@
       - name: Install Playwright browsers
         if: ${{ inputs.install-playwright }}
-        run: npx playwright install --with-deps chromium
+        run: npm exec --no -- playwright install --with-deps chromium
 
       - name: Build WordPress

trunk/.github/workflows/reusable-performance-test-v2.yml

@@ -149 +149 @@
 
       - name: Install Playwright browsers
-        run: npx playwright install --with-deps chromium
+        run: npm exec --no -- playwright install --with-deps chromium
 
       - name: Start Docker environment

trunk/Gruntfile.js

@@ -2280 +2280 @@
                 var done = this.async();
                 grunt.util.spawn( {
-                        cmd: 'npx',
-                        args: [ 'playwright', 'test', '--config', 'tests/qunit/playwright.config.js' ],
+                        cmd: 'npm',
+                        args: [ 'exec', '--no', '--', 'playwright', 'test', '--config', 'tests/qunit/playwright.config.js' ],
                         opts: { stdio: 'inherit' }
                 }, function( error, result, code ) {
@@ -2364 +2364 @@
                 const distTag = grunt.option('dist-tag') || 'latest';
                 grunt.log.writeln( `Updating WordPress packages (--dist-tag=${distTag})` );
-                spawn( 'npx', [ 'wp-scripts', 'packages-update', `--dist-tag=${distTag}` ], {
+                spawn( 'npm', [ 'exec', '--no', '--', 'wp-scripts', 'packages-update', `--dist-tag=${distTag}` ], {
                         cwd: __dirname,
                         stdio: 'inherit',
@@ -2371 +2371 @@
 
         grunt.registerTask( 'browserslist:update', 'Update the local database of browser supports', function() {
-                grunt.log.writeln( `Updating browsers list` );
-                spawn( 'npx', [ 'update-browserslist-db@latest' ], {
+                grunt.log.writeln( 'Updating browsers list' );
+                spawn( 'npm', [ 'exec', '--no', '--', 'update-browserslist-db' ], {
                         cwd: __dirname,
                         stdio: 'inherit',

trunk/package-lock.json

@@ -90 +90 @@
                                 "source-map-loader": "5.0.0",
                                 "typescript": "6.0.3",
+                                "update-browserslist-db": "1.3.1",
                                 "uuid": "14.0.1",
                                 "wait-on": "9.0.10",
@@ -32267 +32268 @@
                 },
                 "node_modules/update-browserslist-db": {
-                        "version": "1.2.3",
-                        "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-                        "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+                        "version": "1.3.1",
+                        "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.1.tgz",
+                        "integrity": "sha512-ZZ61DsRsOnakl74HAmp3oSN4aXUmEWXf+i/yv0h7tIBfICc3VdrFErQKUUKPgu3AMsTUMbcongALEN4l6GSUrQ==",
                         "dev": true,
                         "funding": [

trunk/package.json

@@ -78 +78 @@
                 "source-map-loader": "5.0.0",
                 "typescript": "6.0.3",
+                "update-browserslist-db": "1.3.1",
                 "uuid": "14.0.1",
                 "wait-on": "9.0.10",

trunk/tests/qunit/playwright.config.js

@@ -13 +13 @@
         use: {
                 headless: true,
-                /* This avoids the need to run `npx playwright install` in CI. */
+                /* The system Chrome channel avoids a browser download in CI. */
                 channel: process.env.CI ? 'chrome' : undefined,
         },