Merge pull request #29 from soderlind/chore/dependabot-security

chore(release): resolve dependabot alerts, bump to 1.8.2

Author: soderlind

.github/dependabot.yml

@@ -0,0 +1,43 @@
+version: 2
+updates:
+  # JavaScript / build toolchain
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      npm-development:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+          - "patch"
+      npm-production:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # PHP / Composer
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      composer-all:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.8.2] - 2026-07-12
+
+### Security
+
+- Resolved the majority of Dependabot alerts by updating build/test dependencies (`npm audit fix`, `@wordpress/scripts` 31 → 32, `@wordpress/components` → 36). Remaining alerts are dev-only transitive dependencies pinned by `@wordpress/scripts`.
+
+### Changed
+
+- Added grouped `.github/dependabot.yml` config (npm/composer/github-actions) to consolidate future dependency update PRs.
+
 ## [1.8.1] - 2026-06-16
 
 ### Changed

build/review-rtl.css

@@ -1 +1 @@
-<?php return array('dependencies' => array(), 'version' => '4f046f2ed6c4c171ffdd');
+<?php return array('dependencies' => array(), 'version' => '567b738b16445534fb2f');