Bundled Themes: Upgrade npm to v12 for themes with a build process.

Author: manzoorwanijk

src/wp-content/themes/twentytwentyfive/.npmrc

@@ -0,0 +1,4 @@
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none

src/wp-content/themes/twentytwentyfive/package-lock.json

@@ -14,7 +14,7 @@
 	"homepage": "https://wordpress.org/themes/twentytwentyfive/",
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.2.0"
 	},
 	"devEngines": {
 		"runtime": {
@@ -23,7 +23,7 @@
 		},
 		"packageManager": {
 			"name": "npm",
-			"version": ">=11.16.0",
+			"version": ">=12.2.0",
 			"onFail": "error"
 		}
 	},
@@ -39,5 +39,8 @@
 	"scripts": {
 		"build": "postcss style.css --use cssnano -o style.min.css --no-map",
 		"watch": "postcss style.css --use cssnano -o style.min.css --no-map --watch"
+	},
+	"allowScripts": {
+		"fsevents": false
 	}
 }

src/wp-content/themes/twentytwentyfive/package.json

@@ -1 +1,5 @@
 legacy-peer-deps = true
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none

src/wp-content/themes/twentytwentyone/.npmrc

@@ -14,7 +14,7 @@
 	"homepage": "https://wordpress.org/themes/twentytwentyone/",
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.2.0"
 	},
 	"devEngines": {
 		"runtime": {
@@ -23,7 +23,7 @@
 		},
 		"packageManager": {
 			"name": "npm",
-			"version": ">=11.16.0",
+			"version": ">=12.2.0",
 			"onFail": "error"
 		}
 	},
@@ -80,5 +80,11 @@
 		"watch": "chokidar \"**/*.scss\" -c \"npm run build\" --initial",
 		"lint:scss": "stylelint **/*.scss",
 		"lint-fix:scss": "stylelint **/*.scss --fix"
+	},
+	"allowScripts": {
+		"@parcel/watcher": false,
+		"core-js": false,
+		"core-js-pure": false,
+		"fsevents": false
 	}
 }

src/wp-content/themes/twentytwentyone/package-lock.json

@@ -0,0 +1,4 @@
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none

src/wp-content/themes/twentytwentyone/package.json

@@ -14,7 +14,7 @@
 	"homepage": "https://wordpress.org/themes/twentytwentytwo/",
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.2.0"
 	},
 	"devEngines": {
 		"runtime": {
@@ -23,7 +23,7 @@
 		},
 		"packageManager": {
 			"name": "npm",
-			"version": ">=11.16.0",
+			"version": ">=12.2.0",
 			"onFail": "error"
 		}
 	},
@@ -39,5 +39,8 @@
   "scripts": {
     "build": "postcss style.css --use cssnano -o style.min.css --no-map",
     "watch": "postcss style.css --use cssnano -o style.min.css --no-map --watch"
-  }
+  },
+	"allowScripts": {
+		"fsevents": false
+	}
 }