I understand why some of these are locked at older versions (eg tinymce and accessibility) but is it correct for all of them. For example bootstrap which is only a patch release. There may be others that we have locked at old versions for no good reason.

npm outdated

Package                      Current   Wanted  Latest  Location                                  Depended by
@rollup/plugin-babel           5.3.1    5.3.1   6.0.4  node_modules/@rollup/plugin-babel         j51
@rollup/plugin-commonjs       21.1.0   21.1.0  26.0.1  node_modules/@rollup/plugin-commonjs      j51
@rollup/plugin-node-resolve   13.3.0   13.3.0  15.2.3  node_modules/@rollup/plugin-node-resolve  j51
@rollup/plugin-replace         3.1.0    3.1.0   5.0.7  node_modules/@rollup/plugin-replace       j51
accessibility                 3.0.17   3.0.17   6.0.1  node_modules/accessibility                j51
bootstrap                      5.3.2    5.3.2   5.3.3  node_modules/bootstrap                    j51
choices.js                     9.1.0    9.1.0  10.2.0  node_modules/choices.js                   j51
commander                      8.3.0    8.3.0  12.1.0  node_modules/commander                    j51
esbuild                      0.19.12  0.19.12  0.23.1  node_modules/esbuild                      j51
eslint                        8.57.0   8.57.0   9.9.0  node_modules/eslint                       j51
eslint-plugin-vue              8.7.1    8.7.1  9.27.0  node_modules/eslint-plugin-vue            j51
fs-extra                      10.1.0   10.1.0  11.2.0  node_modules/fs-extra                     j51
ini                            2.0.0    2.0.0   4.1.3  node_modules/ini                          j51
jasmine-core                  3.99.1   3.99.1   5.2.0  node_modules/jasmine-core                 j51
mediaelement                   5.1.1    5.1.1   7.0.5  node_modules/mediaelement                 j51
rimraf                         3.0.2    3.0.2   6.0.1  node_modules/rimraf                       j51
rollup                        2.79.1   2.79.1  4.20.0  node_modules/rollup                       j51
rtlcss                         3.5.0    3.5.0   4.2.0  node_modules/rtlcss                       j51
shepherd.js                   11.2.0   11.2.0  13.0.3  node_modules/shepherd.js                  j51
stylelint                    14.16.1  14.16.1  16.8.2  node_modules/stylelint                    j51
stylelint-config-standard     24.0.0   24.0.0  36.0.1  node_modules/stylelint-config-standard    j51
stylelint-order                5.0.0    5.0.0   6.0.4  node_modules/stylelint-order              j51
stylelint-scss                 4.7.0    4.7.0   6.5.0  node_modules/stylelint-scss               j51
tinymce                        6.8.4    6.8.4   7.3.0  node_modules/tinymce                      j51
vue-focus-lock                 2.0.6    2.0.6   3.0.0  node_modules/vue-focus-lock               j51

composer outdated

Direct dependencies required in composer.json:
algo26-matthias/idna-convert                   v3.1.1  v4.0.2  A library for encoding and decoding internationalized domain names
dealerdirect/phpcodesniffer-composer-installer v0.7.2  v1.0.0  PHP_CodeSniffer Standards Composer Installer Plugin
doctrine/inflector                             1.4.4   2.0.10  PHP Doctrine Inflector is a small library that can perform string manipulations with regard to upper/lowercase a...  
enshrined/svg-sanitize                         0.15.4  0.19.0  An SVG sanitizer for PHP
laminas/laminas-diactoros                      2.26.0  3.3.1   PSR HTTP Message implementations
lcobucci/jwt                                   4.3.0   5.3.0   A simple library to work with JSON Web Token and JSON Web Signature
paragonie/sodium_compat                        v1.21.1 v2.0.1  Pure PHP implementation of libsodium; uses the PHP extension if it exists
phpunit/phpunit                                9.6.20  10.5.30 The PHP Unit Testing framework.
psr/link                                       1.1.1   2.0.1   Common interfaces for HTTP links
web-auth/webauthn-lib                          4.5.2   4.9.1   FIDO2/Webauthn Support For PHP

PHPCS fails in Drone.

@brianteeman I'm aware of that and most of these dependencies are either locked for a good reason or conflict with our b/c promises. So right now this is the maximum we can get, at least in this PR.