[josephfusco]

Resolves the two high-severity Dependabot alerts for extract-zip (#197, #209), which have no patched release.

extract-zip came in through @wordpress/jest-puppeteer-axe → puppeteer → @puppeteer/browsers. The Puppeteer packages and test-e2e scripts are left over from an e2e setup that was scaffolded but never used. The repo has no e2e specs or Jest config. This PR removes:

• the test-e2e, test-e2e:debug, and test-e2e:watch scripts
• @wordpress/jest-console, @wordpress/jest-puppeteer-axe, expect-puppeteer, and puppeteer-testing-library

That drops about 5,500 lockfile lines, including puppeteer and extract-zip. Nothing shipped in the plugin zip changes.

Other open alerts

• markdown-it (CoreTable column alignment returns null #239 high, Latest version of Wordpress 6.5.4 returns null for various core block attributes  #242, chore: remove unnecessary isset() in Anchor::get_block_interfaces() #217, Allow get_block_context_interfaces to be filtered #147): already fixed on main. deps: bump markdown-it and @wordpress/scripts #513 moved it to 14.3.3. The alerts should close when Dependabot rescans.
• @opentelemetry/* (chore: add WordPress 6.4 and 6.5 to testing matrix #228–Use "release" trigger for running the upload schema workflow. #233): no longer in the lockfile, so these should close on the same rescan.
• postcss-selector-parser (Add "latest" to testing matrix #234, medium): still present at 6.1.4 through cssnano 6 in @wordpress/scripts. Forcing 7.x onto cssnano 6 is a major-version override, so I left it for a separate change.

Testing

• npm ci and npm run build:zip succeed on Node 24.
• npm audit high findings go from 30 to 20. The remaining 20 all trace to braces <= 3.0.3 (GHSA-vfj7-8cjw-p6xm) inside @wordpress/scripts. There's no patched braces release and Dependabot doesn't raise that alert.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Assisting with triaging the Dependabot alerts and removing the unused dependencies.