[master]: Update xwp/stream requirement from ^4.1.2 to ^4.2.0

[dependabot]

Updates the requirements on xwp/stream to permit the latest version.

Changelog

Sourced from xwp/stream's changelog.

4.2.0 - May 28, 2026

New Features

• Expose Stream abilities via the WordPress MCP Adapter when present, enabling AI tools to query Stream records through the Abilities API (XWPENG-13, #1859).

Bug Fixes

• Fix unbounded growth of stream / stream_meta tables: the TTL-based auto-purge now runs via Action Scheduler with batched deletion (default 250,000 rows per batch via the existing wp_stream_batch_size filter), resolving database bloat on sites where the previous WP-Cron-driven purge silently failed or timed out on large tables (XWPENG-28, #1882).
• Fix orphan stream_meta rows accumulating across repeated purge cycles: a terminal orphan reaper now runs at the end of every auto-purge chain, healing installs that have residual orphans from historical interrupted purges.
• Skip Action Scheduler "is running?" probes on front-end pageloads: the delete_all_records and clean_orphan_meta settings fields no longer issue Action Scheduler queries on every front-end request, eliminating 3-4 unnecessary queries per pageview on every Stream-active site (#1884, #1885).

Enhancements

• Add Clean Orphaned Meta link under Settings → Advanced for one-shot cleanup on already-bloated installs. The link is hidden while the auto-purge chain is running and reappears once the chain drains.
• Replace the legacy wp_stream_auto_purge WP-Cron event with a recurring Action Scheduler action. Run history and failures are now visible under Tools → Scheduled Actions.
• Auto-purge consults the existing wp_stream_is_large_records_table filter (default threshold: >1M rows) so small tables get a single inline DELETE while bloated tables go through the batched chain — same knob as the manual reset path.

Development

• Add HTTPS to the local dev environment via mkcert and an Apache SSL vhost; force HTTPS across local dev and tests.
• Add Playwright E2E job to CI; harden specs against activation races and add jQuery-dependent admin UI smoke spec (in #1873, #1874).
• Update Node.js to v24 (in #1867, #1883) and jQuery to v4 (in #1834).
• Switch dev dependencies from WPackagist to WP Packages (in #1858).
• Numerous dependency updates: composer/composer, phpunit/phpunit, @playwright/test, @wordpress/scripts, @wordpress/e2e-test-utils-playwright, axios, tar-fs, http-proxy-middleware, copy-webpack-plugin, npm-run-all2, eslint-plugin-react-hooks, uuid → native crypto.randomUUID().

Notes

• The wp_stream_auto_purge action continues to fire for backward compatibility, but its semantics have changed: previously it fired on every WP-Cron tick (~every 12 hours) regardless of whether work happened, so some integrators used it as a generic recurring timer. As of this release it fires only when a purge cycle is actually about to run — i.e. after the network-admin scope check, the keep_records_indefinitely check, the TTL-validity check, and the overlap guard all pass. Integrations that relied on the hook as a tick-rate timer should switch to Admin::AUTO_PURGE_ACTION (the recurring Action Scheduler action, hook name stream_auto_purge_action) which retains the "fires on every tick" semantics.
• The legacy wp_stream_auto_purge WP-Cron event is automatically unscheduled on upgrade so it cannot double-fire alongside the new Action Scheduler recurring action.

4.1.2 - February 19, 2026

Bug Fixes

• Fix handling the output of posix_getpwuid() (in #1828, #1810)

Enhancements

• Implement BuddyPress Connection improvements (in #1810)

4.1.1 - February 3, 2025

Bug fixes

• Fix Two Factor connector issue (in #1692)

4.1.0 - January 20, 2025

New features & Enhancements

... (truncated)

Commits

• 58b7139 e47dc08 Release 4.2.0 (#1893)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)