Build/Test Tools: Opt in to the npm supply chain defaults

[manzoorwanijk]

Opts in to the npm v12 supply chain defaults on npm 11 for Core and the bundled themes with a build process, mirroring WordPress/gutenberg#82689. This replaces the npm v12 upgrade in #13536, which is on hold.

• .npmrc refuses git, remote URL and local tarball dependencies, and strict-allow-scripts fails the install on unreviewed install scripts.
• allowScripts denies every dependency install script. Twenty Twenty-One, Twenty Twenty-Two and Twenty Twenty-Five get the same policy.
• The minimum npm moves to >=11.18.0 because npm 11.16 and 11.17 reject registry dependencies with EALLOWREMOTE under allow-remote = none.
• .nvmrc moves to Node.js 24.20, which bundles npm 11.19, matching Chore: Use v24.20 in .nvmrc config file. gutenberg#84138.

Trac ticket: https://core.trac.wordpress.org/ticket/64543

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Implementation and this description, reviewed by me.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props manzoorwanijk, mukesh27.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[mukeshpanchal27]

Node.js 24.18 ships npm 11.16, and Node.js 24.19 ships npm 11.17. Both are below the new >=11.18.0 npm minimum. On those Node.js versions, npm install fails the devEngines npm check.

Can we raise the Node.js minimum to >=24.20.0 in engines and devEngines? Node.js 24.20 ships npm 11.19. The change applies to all four package.json files and their lockfiles.

Suggested change

	"node": ">=24.18.0",
	"node": ">=24.20.0",

[manzoorwanijk]

Done in 1c0086e

[lancewillett]

The npm policy and version requirements look correct. Clean installs and builds passed for Core and all three affected themes under Node 24.20/npm 11.19 in Docker. The native watcher and resolver dependencies also loaded successfully with their install scripts denied. CI is green.

_{AI review · gpt-6}