Framework: Remove invalid stale nested npm package references

[aduth]

What?

Updates package-lock.json to remove invalid package references:

• A copy of @wordpress/scripts@29.0.0 (and its transitive dependencies) under tools/validation/node_modules/@wordpress/scripts, introduced in Refactor validation tools and update related scripts #77522 (cc @kushagra-goyal-14)
• A copy of @types/node@20.19.30, left dangling after Upgrade and unify @types/node version #77900

Both of these issues can be seen on trunk by running npm ls --depth=0:

npm error code ELSPROBLEMS
npm error invalid: @types/node@20.19.30 /gutenberg/packages/core-data/node_modules/@types/node
npm error invalid: @wordpress/scripts@29.0.0 /gutenberg/tools/validation/node_modules/@wordpress/scripts

Related: #77900, #77522

Why?

• Performance: Fewer dependencies means faster npm install
• Security: Fewer dependencies means a smaller attack surface area for supply chain attacks
• Code quality: These are out of alignment with what's expected to be dependencies of our packages. In particular, internal dependencies like those to @wordpress/scripts should not pull packages from npm and instead reference internal workspace packages.

How?

Manually removed stale references to tools/validation/node_modules/* and core-data/node_modules/@types/node in package-lock.json and reran npm install to "reify" (as the AI puts it) the lockfile.

Testing Instructions

npm install and npm run build should complete successfully, without errors, and without any resulting changes to package-lock.json.

Use of AI Tools

Used Cursor + Claude Opus 4.8 to investigate the root cause, but code changes were done manually.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: aduth <aduth@git.wordpress.org>
Co-authored-by: manzoorwanijk <manzoorwanijk@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[aduth]

@manzoorwanijk Maybe another idea for your new mawesome toolkit 😄 It feels like we should have stronger guarantees that the lockfile is consistent with how packages define their dependencies. At the very least we should never expect a @wordpress/* package (at least one that exists within Gutenberg) to be pulled from npm.

[manzoorwanijk]

@aduth I guess you have hacked into my computer and are stealing my ideas! 😆

I was working exactly on the same issue 😄

[manzoorwanijk]

Thank you

[github-actions]

Size Change: 0 B

Total Size: 8.44 MB

_{compressed-size-action}

[manzoorwanijk]

FYI, this was preventing me from testing npm v12 in Gutenberg - v12 is strict about remote fetching it immediately caught this issue on regular npm install.

[aduth]

@aduth I guess you have hacked into my computer and are stealing my ideas! 😆 I was working exactly on the same issue 😄

😂 Great minds think alike!

v12 is strict about remote fetching it immediately caught this issue on regular npm install.

Oh, that's great to hear 👍 Maybe we won't need separate tooling to catch this sort of issue then.

[manzoorwanijk]

Oh, that's great to hear 👍 Maybe we won't need separate tooling to catch this sort of issue then.

Not exactly, this one actually resulted in react-native-video dep being git-downloaded, which v12 doesn't permit by default, that is what flagged the issue. The actual issue is still there, i.e. a lockfile containing stale version.

[github-actions]

Flaky tests detected in ce6fa21.
Some tests passed with failed attempts. The failures may not be related to this commit but are still reported for visibility. See the documentation for more information.

🔍 Workflow run URL: https://github.com/WordPress/gutenberg/actions/runs/27145584821
📝 Reported issues:

• [Flaky Test] shows post-locked modal when document size limit is exceeded #78753 in /test/e2e/specs/editor/collaboration/http-only/collaboration-document-size-lock.spec.ts