Build/Test Tools: Upgrade npm to v12

.npmrc

@@ -1,5 +1,8 @@
 engine-strict = true
 legacy-peer-deps = true
-lockfile-version = 3
 prefer-dedupe = true
 save-exact = true
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none

README.md

@@ -21,7 +21,7 @@ You will need Node and npm installed on your computer. Node is a JavaScript runt
 
 If you are not using a package manager, see the [Node.js download page](https://nodejs.org/en/download/) for installers and binaries.
 
-**Note:** WordPress currently only officially supports Node.js `24.x` and npm `11.x`.
+**Note:** WordPress currently only officially supports Node.js `24.x` and npm `12.x`. If your Node.js installation comes with an older npm, install the required version with `npm install --global npm@12`.
 
 You will also need a container environment such as [Docker Desktop](https://www.docker.com/products/docker-desktop) installed and running on your computer. The container environment is the virtualization software that powers the local development environment and can be installed just like any other regular application.
 

package.json

@@ -12,7 +12,7 @@
 	},
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.2.0"
 	},
 	"devEngines": {
 		"runtime": {
@@ -21,7 +21,7 @@
 		},
 		"packageManager": {
 			"name": "npm",
-			"version": ">=11.16.0",
+			"version": ">=12.2.0",
 			"onFail": "error"
 		}
 	},
@@ -160,5 +160,12 @@
 		"gutenberg:copy": "node tools/gutenberg/copy.js",
 		"gutenberg:verify": "node tools/gutenberg/utils.js",
 		"gutenberg:download": "node tools/gutenberg/download.js && npm run build:gutenberg"
+	},
+	"allowScripts": {
+		"@parcel/watcher": false,
+		"core-js": false,
+		"core-js-pure": false,
+		"fsevents": false,
+		"unrs-resolver": false
 	}
 }

src/wp-content/themes/twentytwentyfive/.npmrc

@@ -0,0 +1,4 @@
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none

src/wp-content/themes/twentytwentyfive/package.json

@@ -14,7 +14,7 @@
 	"homepage": "https://wordpress.org/themes/twentytwentyfive/",
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.2.0"
 	},
 	"devEngines": {
 		"runtime": {
@@ -23,7 +23,7 @@
 		},
 		"packageManager": {
 			"name": "npm",
-			"version": ">=11.16.0",
+			"version": ">=12.2.0",
 			"onFail": "error"
 		}
 	},
@@ -39,5 +39,8 @@
 	"scripts": {
 		"build": "postcss style.css --use cssnano -o style.min.css --no-map",
 		"watch": "postcss style.css --use cssnano -o style.min.css --no-map --watch"
+	},
+	"allowScripts": {
+		"fsevents": false
 	}
 }

src/wp-content/themes/twentytwentyone/.npmrc

@@ -1 +1,5 @@
 legacy-peer-deps = true
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none

src/wp-content/themes/twentytwentyone/package.json

@@ -14,7 +14,7 @@
 	"homepage": "https://wordpress.org/themes/twentytwentyone/",
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.2.0"
 	},
 	"devEngines": {
 		"runtime": {
@@ -23,7 +23,7 @@
 		},
 		"packageManager": {
 			"name": "npm",
-			"version": ">=11.16.0",
+			"version": ">=12.2.0",
 			"onFail": "error"
 		}
 	},
@@ -80,5 +80,11 @@
 		"watch": "chokidar \"**/*.scss\" -c \"npm run build\" --initial",
 		"lint:scss": "stylelint **/*.scss",
 		"lint-fix:scss": "stylelint **/*.scss --fix"
+	},
+	"allowScripts": {
+		"@parcel/watcher": false,
+		"core-js": false,
+		"core-js-pure": false,
+		"fsevents": false
 	}
 }

src/wp-content/themes/twentytwentytwo/.npmrc

@@ -0,0 +1,4 @@
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none

src/wp-content/themes/twentytwentytwo/package.json

@@ -14,7 +14,7 @@
 	"homepage": "https://wordpress.org/themes/twentytwentytwo/",
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.2.0"
 	},
 	"devEngines": {
 		"runtime": {
@@ -23,7 +23,7 @@
 		},
 		"packageManager": {
 			"name": "npm",
-			"version": ">=11.16.0",
+			"version": ">=12.2.0",
 			"onFail": "error"
 		}
 	},
@@ -39,5 +39,8 @@
   "scripts": {
     "build": "postcss style.css --use cssnano -o style.min.css --no-map",
     "watch": "postcss style.css --use cssnano -o style.min.css --no-map --watch"
-  }
+  },
+	"allowScripts": {
+		"fsevents": false
+	}
 }