Bump tmp and @wordpress/env

[dependabot]

Bumps tmp to 0.2.7 and updates ancestor dependency @wordpress/env. These dependencies need to be updated together.

Updates tmp from 0.2.5 to 0.2.7

Commits

• 8ea1f37 Bump up the version
• 8f24f78 Merge commit from fork
• ce787f3 Reject non-string prefix, postfix, template
• 41f7159 Bump up the version
• efa4a06 Merge commit from fork
• 7ef2728 Check for relative values
• See full diff in compare view

Updates @wordpress/env from 9.10.0 to 11.8.0

Changelog

Sourced from @​wordpress/env's changelog.

11.8.0 (2026-06-10)

Enhancements

• Use partial clones (--filter=blob:none) when downloading git sources and the PHPUnit test suite to reduce download size. (#78918)

Bug Fixes

• Replace extract-zip with adm-zip to fix silent hang on Node 24.16.0 (libuv 1.52.1) when downloading URL-based zip sources. (#78762)

11.7.0 (2026-05-27)

11.6.0 (2026-05-14)

11.5.0 (2026-04-29)

11.4.0 (2026-04-15)

Bug Fixes

• Fix WP-Cron, REST API loopback, and Site Health loopback failures when wp-env runs on a non-default port. Apache inside the WordPress container now also listens on the host-mapped port, so PHP loopback requests to WP_HOME succeed instead of being refused. (#20569)

11.3.0 (2026-04-01)

11.2.0 (2026-03-18)

11.1.0 (2026-03-04)

Bug Fixes

• Suppress spinner and success message output when using --json flag to ensure clean, parseable JSON output.

11.0.0 (2026-02-18)

Bug Fixes

• Playground runtime now supports zip archive themes, matching Docker runtime behavior. (#75140).
• Add MySQL healthcheck to prevent race condition where WordPress containers start before MySQL is fully initialized. Uses MariaDB's official healthcheck.sh script with MARIADB_AUTO_UPGRADE to support both new and existing installations.
• Remove non-functional WP_ENV_MULTISITE config.

New Features

• Added --auto-port flag to the start command. When passed, wp-env automatically finds available ports if the configured ports are busy. Without this flag, ports default to 8888/8889 and Docker reports an error if they are busy (matching pre-existing behavior).

Breaking Changes

• Pretty permalinks (/%year%/%monthnum%/%day%/%postname%/) are now enabled by default, matching WordPress core behavior on fresh installs. Previously, plain permalinks were used because the loopback test that WordPress runs during installation fails inside Docker.
• The port option now defaults to null (auto-select) instead of 8888. When null, wp-env tries port 8888 (or 8889 for tests) first, then falls back to an available ephemeral port. Set an explicit port number to preserve the previous behavior.
• Replaced install-path command with status command. The work directory path is now available as part of the status output.

... (truncated)

Commits

• 6da9506 chore(release): publish
• 6afbb15 Update changelog files
• e816d95 Merge changes published in the Gutenberg plugin "release/23.4" branch
• 6237509 Update changelog files
• d653c5f chore(release): publish
• 065fa3b Update changelog files
• f63ca66 Merge changes published in the Gutenberg plugin "release/23.3" branch
• 7f4e229 Update changelog files
• b5afac3 Merge changes published in the Gutenberg plugin "release/23.3" branch
• fee7eec Update changelog files
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 1e8df4e...45e879e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Jun 11, 2026 4:01p.m.	Review ↗
JavaScript		Jun 11, 2026 4:01p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.