Dependency updates: every advisory outside fchub-stream

.github/workflows/ci-memberships-contract.test.mjs

@@ -120,7 +120,7 @@ test('Memberships pull requests run every required JavaScript, smoke, and build
   assert.match(membershipsVite, /run: npm ci/)
   assert.match(membershipsVite, /name: Audit JavaScript dependencies[\s\S]*?run: npm audit --audit-level=high/)
   assert.match(membershipsVite, /name: Run JavaScript tests[\s\S]*?run: npm test/)
-  assert.match(membershipsVite, /actions\/cache@v4/)
+  assert.match(membershipsVite, /actions\/cache@v6/)
   assert.match(membershipsVite, /npx playwright install --with-deps chromium/)
   assert.match(membershipsVite, /npx playwright test/)
   assert.doesNotMatch(membershipsVite, /vendor\/bin\/phpunit/)

.github/workflows/ci-wporg-contract.test.mjs

@@ -119,7 +119,7 @@ test("every target builds and inspects its WordPress.org archive", () => {
   }
   assert.match(packages, /bash build\.sh "\$\{\{ matrix\.plugin \}\}"/);
   assert.match(build, /scripts\/wporg\/check-package\.mjs/);
-  assert.match(packages, /upload-artifact@v4/);
+  assert.match(packages, /upload-artifact@v7/);
   assert.match(packages, /if: failure\(\)/);
 });
 

.github/workflows/ci.yml

@@ -34,12 +34,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '24'
+          node-version: '26'
 
       - name: Run owned workflow contracts
         run: node --test .github/workflows/ci-memberships-contract.test.mjs .github/workflows/ci-wporg-contract.test.mjs .github/workflows/release-memberships-contract.test.mjs .github/workflows/release-wporg-gates-contract.test.mjs
@@ -97,7 +97,7 @@ jobs:
             fetch_depth: 0
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: ${{ matrix.fetch_depth }}
 
@@ -162,19 +162,19 @@ jobs:
           - plugin: fchub-wishlist
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '24'
+          node-version: '26'
 
       - name: Build and inspect archive
         run: bash build.sh "${{ matrix.plugin }}"
 
       - name: Upload rejected package evidence
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wporg-package-${{ matrix.plugin }}-failure
           path: |
@@ -187,7 +187,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # `Check for changes` below diffs against the pull request base, which
           # a depth-1 checkout does not contain: the diff fails, the count comes
@@ -203,9 +203,9 @@ jobs:
 
       - name: Setup Node.js
         if: steps.changes.outputs.count > 0
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '20'
+          node-version: '26'
           cache: 'npm'
           cache-dependency-path: plugins/fchub-memberships/package-lock.json
 
@@ -226,7 +226,7 @@ jobs:
 
       - name: Cache Playwright browsers
         if: steps.changes.outputs.count > 0
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: ${{ runner.os }}-playwright-${{ hashFiles('plugins/fchub-memberships/package-lock.json') }}
@@ -268,7 +268,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # `Check for changes` below diffs against the pull request base, which
           # a depth-1 checkout does not contain: the diff fails, the count comes
@@ -284,9 +284,9 @@ jobs:
 
       - name: Setup Node.js
         if: steps.changes.outputs.count > 0
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '20'
+          node-version: '26'
           cache: 'npm'
           cache-dependency-path: plugins/fchub-portal-extender/package-lock.json
 
@@ -324,7 +324,7 @@ jobs:
       # job remains because the repository asserts Stream is still here for a
       # possible return, not because anything is expected to run.
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Check for changes
         id: changes
@@ -334,9 +334,9 @@ jobs:
 
       - name: Setup Node.js
         if: steps.changes.outputs.count > 0
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '20'
+          node-version: '26'
 
       - name: Build admin-app
         if: steps.changes.outputs.count > 0
@@ -389,12 +389,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '22'
+          node-version: '26'
 
       # Cheap enough to run unconditionally, and the things it guards are exactly
       # the ones a changed-path filter would have missed: the catalogue is

.github/workflows/claude-interactive.yml

@@ -27,7 +27,7 @@ jobs:
       group: claude-interactive-${{ github.event.issue.number || github.event.pull_request.number }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -39,9 +39,9 @@ jobs:
           coverage: none
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '20'
+          node-version: '26'
 
       - name: Run Claude Code
         uses: anthropics/claude-code-action@v1

.github/workflows/claude-pr-review.yml

@@ -22,7 +22,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/docs-ci.yml

@@ -81,11 +81,11 @@ jobs:
     name: Version Consistency
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
-          node-version: '22'
+          node-version: '26'
 
       - name: Validate versions.json
         run: node -e "JSON.parse(require('fs').readFileSync('web-docs/lib/versions.json','utf8'))"

.github/workflows/issue-triage.yml

@@ -35,7 +35,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Run Claude Code
         uses: anthropics/claude-code-action@v1

.github/workflows/mcp-ci.yml

@@ -54,7 +54,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: '24'
+          node-version: '26'
           cache: npm
           cache-dependency-path: fluentcart-mcp/package-lock.json
       - run: npm ci
@@ -67,7 +67,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: '24'
+          node-version: '26'
           cache: npm
           cache-dependency-path: fluentcart-mcp/package-lock.json
       - run: npm ci
@@ -84,7 +84,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: '24'
+          node-version: '26'
           cache: npm
           cache-dependency-path: fluentcart-mcp/package-lock.json
       - run: npm ci
@@ -104,7 +104,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: '24'
+          node-version: '26'
           cache: npm
           cache-dependency-path: fluentcart-mcp/package-lock.json
       - run: npm ci
@@ -123,7 +123,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: '24'
+          node-version: '26'
           cache: npm
           cache-dependency-path: fluentcart-mcp/package-lock.json
       - run: npm ci
@@ -147,7 +147,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: '24'
+          node-version: '26'
           cache: npm
           cache-dependency-path: fluentcart-mcp/package-lock.json
       - run: npm ci

.github/workflows/mcp-docker.yml

@@ -56,7 +56,7 @@ jobs:
           sparse-checkout-cone-mode: false
       - uses: actions/setup-node@v7
         with:
-          node-version: '24'
+          node-version: '26'
       - name: Install locked script dependencies
         run: npm ci --prefix fluentcart-mcp
       - uses: actions/download-artifact@v8
@@ -163,12 +163,12 @@ jobs:
         with:
           name: ${{ env.IMAGE_ARTIFACT }}
       - run: docker load -i image.tar
-      - uses: docker/login-action@v4.5.2
+      - uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/login-action@v4.5.2
+      - uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/mcp-promote.yml

@@ -51,11 +51,11 @@ jobs:
     steps:
       - uses: actions/setup-node@v7
         with:
-          node-version: '24.13.0'
+          node-version: '26.7.0'
       - name: Verify reviewed release toolchain
         run: |
-          test "$(node --version)" = "v24.13.0"
-          test "$(npm --version)" = "11.6.2"
+          test "$(node --version)" = "v26.7.0"
+          test "$(npm --version)" = "11.19.0"
       - name: Download exact staging evidence
         uses: actions/download-artifact@v8
         with:
@@ -125,12 +125,12 @@ jobs:
           DOCKERHUB_ACTUAL=$(docker buildx imagetools inspect "${DOCKERHUB_IMAGE}:${VERSION}" --format '{{json .Manifest.Digest}}' | tr -d '"')
           test "$GHCR_ACTUAL" = "$GHCR_EXPECTED"
           test "$DOCKERHUB_ACTUAL" = "$DOCKERHUB_EXPECTED"
-      - uses: docker/login-action@v4.5.2
+      - uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/login-action@v4.5.2
+      - uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/mcp-release.yml

@@ -20,7 +20,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: '24'
+          node-version: '26'
           cache: npm
           cache-dependency-path: fluentcart-mcp/package-lock.json
       - run: npm ci
@@ -69,13 +69,13 @@ jobs:
           name: ${{ needs.validate.outputs.artifact_name }}
       - uses: actions/setup-node@v7
         with:
-          node-version: '24.13.0'
+          node-version: '26.7.0'
       - name: Install the reviewed publishing CLI
-        run: npm install --global npm@11.15.0
+        run: npm install --global npm@11.19.0
       - name: Verify reviewed release toolchain
         run: |
-          test "$(node --version)" = "v24.13.0"
-          test "$(npm --version)" = "11.15.0"
+          test "$(node --version)" = "v26.7.0"
+          test "$(npm --version)" = "11.19.0"
       - name: Publish inspected candidate through Trusted Publishing
         env:
           VERSION: ${{ needs.validate.outputs.version }}

.github/workflows/release-memberships-contract.test.mjs

@@ -58,7 +58,7 @@ test("Memberships publication consumes the package that passed reusable gates",
     /uses:\s*\.\/\.github\/workflows\/wporg-release-gates\.yml/,
   );
   assert.match(publish, /needs:\s*\[prepare,\s*wporg-gates\]/);
-  assert.match(publish, /actions\/download-artifact@v4/);
+  assert.match(publish, /actions\/download-artifact@v8/);
   assert.match(
     publish,
     /name:\s*wporg-package-\$\{\{\s*needs\.prepare\.outputs\.slug\s*\}\}/,

.github/workflows/release-wporg-gates-contract.test.mjs

@@ -43,7 +43,7 @@ test("WordPress.org tags call the reusable gate workflow before publication", ()
   const wporgGates = job(release, "wporg-gates");
   const publish = job(release, "release");
 
-  assert.match(prepare, /actions\/checkout@v4/);
+  assert.match(prepare, /actions\/checkout@v7/);
   assert.match(prepare, /fetch-depth:\s*0/);
   assert.match(prepare, /slug:\s*\$\{\{\s*steps\.tag\.outputs\.slug\s*\}\}/);
   assert.match(prepare, /version:\s*\$\{\{\s*steps\.tag\.outputs\.version\s*\}\}/);
@@ -70,7 +70,7 @@ test("WordPress.org tags call the reusable gate workflow before publication", ()
   assert.match(publish, /needs:\s*\[prepare,\s*wporg-gates\]/);
   assert.match(publish, /needs\.wporg-gates\.result == 'success'/);
   assert.match(publish, /needs\.wporg-gates\.result == 'skipped'/);
-  assert.match(publish, /actions\/download-artifact@v4/);
+  assert.match(publish, /actions\/download-artifact@v8/);
   assert.match(
     publish,
     /name:\s*wporg-package-\$\{\{\s*needs\.prepare\.outputs\.slug\s*\}\}/,
@@ -91,7 +91,7 @@ test("the called workflow packages and inspects every target on the caller tag S
     assert.match(packages, new RegExp(`- ${slug}(?:\\n|$)`));
   }
   assert.doesNotMatch(packages, /fchub-stream/);
-  assert.match(packages, /actions\/checkout@v4/);
+  assert.match(packages, /actions\/checkout@v7/);
   assert.match(packages, /fetch-depth:\s*0/);
   assert.doesNotMatch(packages, /ref:\s*(?:main|master)/);
   assert.match(packages, /needs:\s*\[source,\s*memberships-frontend\]/);
@@ -103,7 +103,7 @@ test("the called workflow packages and inspects every target on the caller tag S
     packages,
     /dist\/previous\/\$\{\{\s*matrix\.plugin\s*\}\}-\*\.zip/,
   );
-  assert.match(packages, /actions\/upload-artifact@v4/);
+  assert.match(packages, /actions\/upload-artifact@v7/);
 });
 
 test("source gates run the applicable PHP and Memberships frontend suites", () => {
@@ -174,7 +174,7 @@ test("the tag SHA runs five Plugin Check lanes and fifteen lifecycle lanes", ()
     assert.match(runtime, new RegExp(`- '${version.replace(".", "\\.")}'`));
   }
   assert.doesNotMatch(runtime, /fchub-stream/);
-  assert.match(runtime, /actions\/download-artifact@v4/);
+  assert.match(runtime, /actions\/download-artifact@v8/);
   assert.match(runtime, /scripts\/wporg\/run-lifecycle\.sh/);
   assert.match(runtime, /previous_zip_path=\$PREVIOUS_ZIP_PATH/);
   assert.match(