10up · fabiankaegy · Aug 18, 2026 · Aug 18, 2026
diff --git a/.changeset/pre.json b/.changeset/pre.json
@@ -0,0 +1,22 @@
+{
+  "mode": "pre",
+  "tag": "next",
+  "initialVersions": {
+    "@10up/babel-preset-default": "2.1.2",
+    "@10up/eslint-config": "4.1.4",
+    "@10up/stylelint-config": "3.0.1",
+    "10up-toolkit": "6.5.1",
+    "tenup-theme": "1.1.5-next.7",
+    "@10up/component-accordion": "2.1.5",
+    "@10up/library-ts-test": "2.1.5"
+  },
+  "changesets": [
+    "align-css-best-practices",
+    "block-metadata-manifest",
+    "brave-pandas-migrate",
+    "quick-falcons-return",
+    "quiet-donkeys-repeat",
+    "security-vulnerability-fixes",
+    "tough-jokes-double"
+  ]
+}
diff --git a/packages/babel-preset-default/CHANGELOG.md b/packages/babel-preset-default/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## 3.0.0-next.0
+
+### Major Changes
+
+- e40dc56: Support and default to Node 24
+
+  Node 24 (current Active LTS) is now the version the toolkit is developed, tested and released against, and the minimum supported Node version is now 20. Node 16 and 18 are past end-of-life and have been dropped from the test matrix; CI now covers Node 20, 22 and 24.
+
+  This is a breaking change only in the sense that `engines` no longer permits Node 16/18. No build, config or API behaviour has changed — see `UPGRADING.md` for details.
+
 ## 2.1.2
 
 ### Patch Changes

diff --git a/packages/babel-preset-default/package.json b/packages/babel-preset-default/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@10up/babel-preset-default",
-  "version": "2.1.2",
+  "version": "3.0.0-next.0",
   "description": "10up's default babel preset",
   "publishConfig": {
     "access": "public"
@@ -38,7 +38,7 @@
     "core-js": "^3.35.0"
   },
   "devDependencies": {
-    "@10up/eslint-config": "^4.1.3-next.0",
+    "@10up/eslint-config": "^5.0.0-next.0",
     "@wordpress/element": "^4.20.0",
     "babel-jest": "^27.5.1",
     "eslint": "^8.40.0",

diff --git a/packages/eslint-config/CHANGELOG.md b/packages/eslint-config/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## 5.0.0-next.0
+
+### Major Changes
+
+- e40dc56: Support and default to Node 24
+
+  Node 24 (current Active LTS) is now the version the toolkit is developed, tested and released against, and the minimum supported Node version is now 20. Node 16 and 18 are past end-of-life and have been dropped from the test matrix; CI now covers Node 20, 22 and 24.
+
+  This is a breaking change only in the sense that `engines` no longer permits Node 16/18. No build, config or API behaviour has changed — see `UPGRADING.md` for details.
+
+### Patch Changes
+
+- Updated dependencies [e40dc56]
+  - @10up/babel-preset-default@3.0.0-next.0
+
 ## 4.1.4
 
 ### Patch Changes

diff --git a/packages/eslint-config/package.json b/packages/eslint-config/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@10up/eslint-config",
-	"version": "4.1.4",
+	"version": "5.0.0-next.0",
 	"description": "A shareable ESLint configuration",
 	"publishConfig": {
 		"access": "public"
@@ -38,7 +38,7 @@
 		"10up"
 	],
 	"dependencies": {
-		"@10up/babel-preset-default": "^2.1.2"
+		"@10up/babel-preset-default": "^3.0.0-next.0"
 	},
 	"devDependencies": {
 		"@wordpress/eslint-plugin": "^17.5.0",

diff --git a/packages/stylelint-config/CHANGELOG.md b/packages/stylelint-config/CHANGELOG.md
@@ -1,5 +1,47 @@
 # Changelog
 
+## 4.0.0-next.0
+
+### Major Changes
+
+- e40dc56: Support and default to Node 24
+
+  Node 24 (current Active LTS) is now the version the toolkit is developed, tested and released against, and the minimum supported Node version is now 20. Node 16 and 18 are past end-of-life and have been dropped from the test matrix; CI now covers Node 20, 22 and 24.
+
+  This is a breaking change only in the sense that `engines` no longer permits Node 16/18. No build, config or API behaviour has changed — see `UPGRADING.md` for details.
+
+### Minor Changes
+
+- 2535d76: Align stylelint configuration with 10up CSS Engineering Best Practices
+
+  This release adds several new rules to enforce 10up CSS best practices:
+
+  **Specificity Controls:**
+  - Add `selector-max-specificity` rule limiting specificity to 0,2,1
+  - Add `selector-max-id` rule disallowing ID selectors for styling
+  - Add `max-nesting-depth` rule limiting nesting to 2 levels
+  - Re-enable `no-descending-specificity` rule
+
+  **Code Quality:**
+  - Add `declaration-no-important` rule disallowing !important
+  - Add `selector-no-qualifying-type` rule preventing type+class qualifiers
+  - Add `shorthand-property-no-redundant-values` rule for efficient CSS
+
+  **Naming Conventions:**
+  - Enable `selector-class-pattern` rule enforcing kebab-case for classes, with optional BEM `__element` and `--modifier` suffixes. camelCase and snake_case are rejected; `.card__header--compact` and WordPress core classes such as `.wp-block-group__inner-container` are allowed
+  - Add `keyframes-name-pattern` rule enforcing kebab-case for animations
+
+  **Breaking Changes:**
+  Projects using this configuration may need to update existing CSS to comply with the new rules. The most impactful changes are:
+  - ID selectors are now disallowed for styling
+  - Class names must use kebab-case, optionally with BEM `__element`/`--modifier` suffixes (no camelCase or snake_case, and no leading hyphen such as `.-secondary`)
+  - Maximum selector specificity is now enforced at 0,2,1
+  - Nesting depth is limited to 2 levels
+
+  `!important` is reported as an error, but best practices reserve it for truly exceptional cases such as `prefers-reduced-motion` overrides. Disable it narrowly at the call site with a comment explaining why, rather than turning the rule off project-wide.
+
+  See the updated README for detailed documentation on each rule and how to override them if needed for your project.
+
 ## 3.0.1
 
 ### Patch Changes

diff --git a/packages/stylelint-config/package.json b/packages/stylelint-config/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@10up/stylelint-config",
-	"version": "3.0.1",
+	"version": "4.0.0-next.0",
 	"description": "10up stylelint config for WordPress projects",
 	"main": "index.js",
 	"homepage": "https://github.com/10up/10up-toolkit/tree/develop/packages/stylelint-config#readme",
@@ -43,7 +43,7 @@
 		"node": ">=20.9.0"
 	},
 	"devDependencies": {
-		"@10up/eslint-config": "^4.1.3-next.0",
+		"@10up/eslint-config": "^5.0.0-next.0",
 		"jest": "^29.7.0"
 	},
 	"peerDependencies": {

diff --git a/packages/toolkit/CHANGELOG.md b/packages/toolkit/CHANGELOG.md
@@ -1,5 +1,134 @@
 # Changelog
 
+## 7.0.0-next.0
+
+### Major Changes
+
+- e40dc56: Support and default to Node 24
+
+  Node 24 (current Active LTS) is now the version the toolkit is developed, tested and released against, and the minimum supported Node version is now 20. Node 16 and 18 are past end-of-life and have been dropped from the test matrix; CI now covers Node 20, 22 and 24.
+
+  This is a breaking change only in the sense that `engines` no longer permits Node 16/18. No build, config or API behaviour has changed — see `UPGRADING.md` for details.
+
+### Minor Changes
+
+- b08fb3b: Add WordPress Block Metadata Collections API support
+
+  Integrate automatic generation of block metadata manifest files to improve block registration performance in WordPress 6.7+. When enabled, toolkit generates a PHP file (`blocks-manifest.php`) containing all block metadata from a single source, eliminating the need to read multiple `block.json` files at runtime.
+
+  **New Features:**
+  - Add `useBlockManifest` configuration option (boolean, default: `false`)
+  - Add `--block-manifest` CLI flag for one-time manifest generation
+  - Add `BuildBlocksManifestPlugin` webpack plugin that hooks into build completion
+  - Automatic manifest regeneration in watch mode when blocks change
+
+  **Configuration:**
+
+  Enable via package.json:
+
+  ```json
+  {
+    "10up-toolkit": {
+      "useBlockAssets": true,
+      "useBlockManifest": true
+    }
+  }
+  ```
+
+  Or via CLI flag:
+
+  ```bash
+  10up-toolkit build --block-manifest
+  10up-toolkit start --block-manifest
+  10up-toolkit watch --block-manifest
+  ```
+
+  **WordPress Integration:**
+
+  Register the collection and automatically register all blocks:
+
+  ```php
+  $blocks_dir = get_template_directory() . '/dist/blocks';
+  $manifest_path = get_template_directory() . '/dist/blocks-manifest.php';
+
+  wp_register_block_metadata_collection( $blocks_dir, $manifest_path );
+
+  // Automatically register all blocks from the manifest
+  $manifest = require $manifest_path;
+  foreach ( array_keys( $manifest ) as $block_dir ) {
+      register_block_type_from_metadata( $blocks_dir . '/' . $block_dir );
+  }
+  ```
+
+  **Benefits:**
+  - Improved performance for projects with many blocks (50+)
+  - Reduced filesystem I/O operations
+  - Better opcode caching for block metadata
+  - Preserves transformed asset paths from the build process (TS→JS, SCSS→CSS)
+
+  The manifest is generated in `dist/blocks-manifest.php` and works seamlessly with the existing `useBlockAssets` workflow.
+
+- dda2bbd: Security: Fix critical and high severity CVEs in transitive dependencies
+
+  Minimum Node.js version is now 20.9. The major dependency bumps required
+  for the security fixes (copy-webpack-plugin@^14, image-minimizer-webpack-plugin@^5)
+  require Node ≥20.9. Node 16 and 18 are EOL and no longer supported.
+  - Bump `copy-webpack-plugin` from ^11 to ^14 — resolves serialize-javascript RCE (GHSA-5c6j-r48x-rmvq) and CPU exhaustion (GHSA-qj8w-gfj5-8c6v)
+  - Bump `image-minimizer-webpack-plugin` from ^3 to ^5 — same serialize-javascript fix
+  - Downgrade `@linaria/*` from ^5 to ^4.5.4 in 10up-theme — removes happy-dom@10 CVE-2024-53382
+  - Bump `webpackbar` from ^6 to ^7 — webpack 5.96+ added stricter ProgressPlugin schema validation that webpackbar 6 fails by passing non-schema options to its `ProgressPlugin` parent; webpackbar 7 routes those options to a separate instance and is forward-compatible. Avoids needing to pin webpack downstream.
+  - Switch the toolkit's linaria integration from the meta-package `@linaria/webpack-loader` to `@linaria/webpack5-loader` directly. The meta-package always installs **both** the webpack 4 and webpack 5 loaders, dragging webpack@4.47.0 (and a long tail of vulnerable transitive deps — `serialize-javascript@<7.0.5`, `braces@2`, `micromatch@3`, `terser-webpack-plugin@1`, etc.) into every install even though only webpack 5 is used. Importing the webpack5 loader directly drops the webpack 4 chain entirely, fixing those CVEs at the dep-tree level instead of via root-level `overrides` (which don't propagate to consumers of the published `10up-toolkit`).
+
+    **Migration for `10up-toolkit` consumers using linaria:** replace `"@linaria/webpack-loader"` with `"@linaria/webpack5-loader"` in your project's `package.json` and update any `loader: '@linaria/webpack-loader'` references in custom webpack configs. No API changes — the webpack5 loader is the same module the meta-package was delegating to.
+
+  - Bump `engines.node` to `>=20.9.0` across the toolkit, eslint-config, stylelint-config, and 10up-theme workspaces. Update CI matrix to test on Node 20 + 22 only.
+
+  Reduces critical/high vulnerabilities to 0. The serialize-javascript / braces / micromatch fixes propagate to consumers via the linaria webpack5-loader swap. Remaining low/moderate issues are in dev tooling (`@wordpress/env`, `jest-environment-jsdom`, etc.) with no upstream fixes available yet.
+
+  ### Note on remaining monorepo-only `overrides`
+
+  The root `package.json` keeps three `overrides` as documented temporary workarounds. npm only honors `overrides` declared in the top-level project, so these apply only to this monorepo's `npm install` / `npm ci` — they do **not** flow through to consumers installing `10up-toolkit` as a dependency. None of the three are blocking consumer security:
+  - `minimatch: ^9.0.7` — patches a ReDoS in `@typescript-eslint@^6`'s pinned minimatch. Resolved permanently by upgrading `@typescript-eslint` to v8 (deferred — major bump on `@10up/eslint-config` with consumer impact).
+  - `stylelint-declaration-strict-value: ~1.10.11` — keeps the plugin on the stylelint 15 line. The 1.11.x line bumped its peer to stylelint ≥16, conflicting with `@10up/stylelint-config`'s stylelint 15 peer. Resolved by upgrading the stylelint config to v16 (deferred — major bump with consumer impact).
+  - `@types/node: ^20.19.0` — workaround for `@manypkg/find-root@1`'s legacy `@types/node@^12.7.1` declaration, which conflicts with `@inquirer/external-editor`'s `@types/node>=18` peer. Upstream blocker: `@changesets/cli@2.x` still ships with `@manypkg/find-root@1`; only the `@changesets/cli@3.0.0-next.2` pre-release has migrated.
+
+  ### Follow-up security bumps (added when restacking onto Node 24 support)
+
+  New advisories landed against the original set of fixes. Additionally addressed:
+  - Bump `postcss` from `^8.4.31` to `^8.5.26` — resolves path traversal in previous-source-map auto-loading via `sourceMappingURL` (GHSA-6g55-p6wh-862q and its incomplete-fix follow-up).
+  - Bump `svgo` from `^3.2.0` to `^4.0.2` — resolves the `removeScripts` advisory, where the plugin left some executable scripts intact. This is directly relevant since this is the code path that sanitises project SVGs.
+
+    **Migration for consumers with a custom `svgo.config.js`:** svgo 4 removed `removeViewBox` from `preset-default`, and changed parts of the plugin config format. The toolkit's own default config was updated accordingly (viewBox is preserved by default in svgo 4, so the previous `overrides: { removeViewBox: false }` is both unnecessary and no longer valid). Custom svgo configs written for svgo 3 may need updating — see the [svgo 4 release notes](https://github.com/svg/svgo/releases).
+
+  - Bump `@wordpress/env` in `projects/10up-theme` from `^10.10.0` to `^11.13.0` — dev-only, resolves an `extract-zip` symlink path traversal.
+
+  ### Known remaining advisories
+
+  `npm audit` still reports issues that are **not** fixable within this PR:
+  - **`sharp` (high) — inherited libvips CVEs.** `sharp@^0.35.3` fixes these and its `engines.node >=20.9.0` matches this branch's floor exactly, but it cannot land here yet. From 0.33 onward sharp ships its prebuilt binaries as per-platform optional dependencies (`@img/sharp-linux-x64`, `@img/sharp-win32-x64`, …), and npm only records the _host_ platform's entries in the lockfile — `--os`/`--cpu` are ignored, even on a from-scratch resolution. A lockfile generated on macOS therefore breaks `npm ci` on Linux and Windows with _"Could not load the `sharp` module using the linux-x64 runtime"_. Landing it needs the lockfile regenerated on Linux (or in CI). Two things to carry over when that happens: sharp reports `.avif` input as format `heif`, and 0.35 requires an explicit compression, so `config.heif` must become `{ ...config.avif, compression: 'av1' }` (verified byte-identical to the old `avif()` output); a `NOTE` to that effect is left in `optimization.js`.
+  - **`webpack-dev-server` (2 critical, several high/moderate — `shell-quote`, `websocket-driver`, `ws`, `http-proxy-middleware`, `sockjs`, `launch-editor`).** Every one of these comes through `webpack-dev-server`, and the whole 5.x line is affected — the only fix is `webpack-dev-server@6`, a major upgrade with dev-server config changes that deserves its own PR and HMR testing. These affect the local dev server only, not built output.
+  - **`@wordpress/env` → `@wp-playground/*` → `adm-zip`, `tmp` (dev-only).** `@wordpress/env@11.13.0` is the latest release and still pulls `adm-zip@0.5.x`; needs an upstream fix.
+  - **`postcss@8.5.14` still present in this monorepo's tree**, hoisted via `stylelint@15` / `cssnano` transitives. Consumers of the published `10up-toolkit` are not affected, because the toolkit declares `postcss@^8.5.26` and npm resolves a single satisfying copy for `postcss-loader`. Clearing it here depends on the deferred `stylelint@16` upgrade.
+  - **`immutable` (via `sass`), `js-yaml` / `brace-expansion` (via the `eslint@8` chain), `form-data` / `ws` (via `jsdom` in tests).** All build/test-time only, awaiting upstream releases.
+
+### Patch Changes
+
+- 1fe01b6: Fix: Update "Dependency Extraction Webpack Plugin" Dependency
+- d22ef93: Fix block entrypoint tests failing on Windows
+
+  The `entry` tests mocked `process.cwd()` with a POSIX path while the module under test derives the blocks directory with `path.resolve`, which is platform-native. On Windows the two never lined up, so the blocks directory prefix was never stripped and every entry name came out as a full absolute path, failing 9 tests on the `windows-latest` CI job.
+
+  Fixtures are now anchored to the same `path.resolve` call as the code under test, so they describe a filesystem that is self-consistent on every platform. Windows path handling additionally gets its own suite that swaps `path` for `path.win32`, so the behaviour is covered on Linux and macOS runs too instead of only when CI happens to run on Windows.
+
+  Test-only change; no runtime behaviour was modified.
+
+- 6cb07e6: Fix: leading slashes in asset generation
+- Updated dependencies [2535d76]
+- Updated dependencies [e40dc56]
+  - @10up/stylelint-config@4.0.0-next.0
+  - @10up/babel-preset-default@3.0.0-next.0
+  - @10up/eslint-config@5.0.0-next.0
+
 ## 6.5.1
 
 ### Patch Changes

diff --git a/packages/toolkit/package.json b/packages/toolkit/package.json
@@ -13,7 +13,7 @@
 		"url": "git+https://github.com/10up/10up-toolkit.git",
 		"directory": "packages/toolkit"
 	},
-	"version": "6.5.1",
+	"version": "7.0.0-next.0",
 	"bin": {
 		"10up-toolkit": "bin/10up-toolkit.js"
 	},
@@ -76,14 +76,14 @@
 		"yaml": "^2.4.1"
 	},
 	"devDependencies": {
-		"@10up/babel-preset-default": ">=2.1.2",
-		"@10up/eslint-config": ">=4.1.3",
-		"@10up/stylelint-config": ">=3.0.1"
+		"@10up/babel-preset-default": ">=3.0.0-next.0",
+		"@10up/eslint-config": ">=5.0.0-next.0",
+		"@10up/stylelint-config": ">=4.0.0-next.0"
 	},
 	"peerDependencies": {
-		"@10up/babel-preset-default": ">=2.1.1",
-		"@10up/eslint-config": ">=4.1.3-next.0",
-		"@10up/stylelint-config": ">=3.0.0",
+		"@10up/babel-preset-default": ">=3.0.0-next.0",
+		"@10up/eslint-config": ">=5.0.0-next.0",
+		"@10up/stylelint-config": ">=4.0.0-next.0",
 		"@linaria/babel-preset": ">=4.3.3",
 		"@linaria/webpack5-loader": ">=4.1.11",
 		"typescript": ">=5.0.0"

diff --git a/projects/10up-theme/package.json b/projects/10up-theme/package.json
@@ -20,7 +20,7 @@
     "@linaria/babel-preset": "^4.5.4",
     "@linaria/webpack5-loader": "^4.5.4",
     "@wordpress/env": "^11.13.0",
-    "10up-toolkit": "^6.5.1"
+    "10up-toolkit": "^7.0.0-next.0"
   },
   "dependencies": {
     "@10up/block-components": "^1.18.0",

diff --git a/projects/library-ts/package.json b/projects/library-ts/package.json
@@ -39,7 +39,7 @@
   },
   "homepage": "https://github.com/10up/component-accordion#readme",
   "devDependencies": {
-    "10up-toolkit": "^6.5.1"
+    "10up-toolkit": "^7.0.0-next.0"
   },
   "dependencies": {
     "xss": "^1.0.11"

diff --git a/projects/library/package.json b/projects/library/package.json
@@ -26,7 +26,7 @@
   },
   "homepage": "https://github.com/10up/component-accordion#readme",
   "devDependencies": {
-    "10up-toolkit": "^6.5.1",
+    "10up-toolkit": "^7.0.0-next.0",
     "@testing-library/dom": "9.3.3",
     "@testing-library/jest-dom": "^6.2.0",
     "@testing-library/user-event": "^14.5.2",