From 408edc80df760af012f99f22f93f591a902c5a38 Mon Sep 17 00:00:00 2001 From: Manzoor Wani Date: Wed, 7 Oct 2026 09:22:12 +0530 Subject: [PATCH 1/4] Build/Test Tools: Raise the minimum npm version to 11.18. npm 11.16 and 11.17 reject registry dependencies with EALLOWREMOTE when allow-remote is set to none. Node.js 24.20 bundles npm 11.19, so .nvmrc moves to it. Applies to Core, Twenty Twenty-One, Twenty Twenty-Two and Twenty Twenty-Five, matching Gutenberg. --- .nvmrc | 2 +- package-lock.json | 2 +- package.json | 4 ++-- src/wp-content/themes/twentytwentyfive/.nvmrc | 2 +- src/wp-content/themes/twentytwentyfive/package-lock.json | 2 +- src/wp-content/themes/twentytwentyfive/package.json | 4 ++-- src/wp-content/themes/twentytwentyone/.nvmrc | 2 +- src/wp-content/themes/twentytwentyone/package-lock.json | 2 +- src/wp-content/themes/twentytwentyone/package.json | 4 ++-- src/wp-content/themes/twentytwentytwo/.nvmrc | 2 +- src/wp-content/themes/twentytwentytwo/package-lock.json | 2 +- src/wp-content/themes/twentytwentytwo/package.json | 4 ++-- 12 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.nvmrc b/.nvmrc index 82d5d714347ef..dea8da446de5d 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -24.18 +24.20 diff --git a/package-lock.json b/package-lock.json index 66c8e2ff74616..72f30dc11778c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -97,7 +97,7 @@ }, "engines": { "node": ">=24.18.0", - "npm": ">=11.16.0" + "npm": ">=11.18.0" } }, "node_modules/@343dev/gifsicle": { diff --git a/package.json b/package.json index 02255a40b245e..797004dfff5be 100644 --- a/package.json +++ b/package.json @@ -12,7 +12,7 @@ }, "engines": { "node": ">=24.18.0", - "npm": ">=11.16.0" + "npm": ">=11.18.0" }, "devEngines": { "runtime": { @@ -21,7 +21,7 @@ }, "packageManager": { "name": "npm", - "version": ">=11.16.0", + "version": ">=11.18.0", "onFail": "error" } }, diff --git a/src/wp-content/themes/twentytwentyfive/.nvmrc b/src/wp-content/themes/twentytwentyfive/.nvmrc index 82d5d714347ef..dea8da446de5d 100644 --- a/src/wp-content/themes/twentytwentyfive/.nvmrc +++ b/src/wp-content/themes/twentytwentyfive/.nvmrc @@ -1 +1 @@ -24.18 +24.20 diff --git a/src/wp-content/themes/twentytwentyfive/package-lock.json b/src/wp-content/themes/twentytwentyfive/package-lock.json index 26fc86bf03862..952fcc58dbc13 100644 --- a/src/wp-content/themes/twentytwentyfive/package-lock.json +++ b/src/wp-content/themes/twentytwentyfive/package-lock.json @@ -16,7 +16,7 @@ }, "engines": { "node": ">=24.18.0", - "npm": ">=11.16.0" + "npm": ">=11.18.0" } }, "node_modules/@wordpress/browserslist-config": { diff --git a/src/wp-content/themes/twentytwentyfive/package.json b/src/wp-content/themes/twentytwentyfive/package.json index f1b983e045db3..2d91208edc2da 100644 --- a/src/wp-content/themes/twentytwentyfive/package.json +++ b/src/wp-content/themes/twentytwentyfive/package.json @@ -14,7 +14,7 @@ "homepage": "https://wordpress.org/themes/twentytwentyfive/", "engines": { "node": ">=24.18.0", - "npm": ">=11.16.0" + "npm": ">=11.18.0" }, "devEngines": { "runtime": { @@ -23,7 +23,7 @@ }, "packageManager": { "name": "npm", - "version": ">=11.16.0", + "version": ">=11.18.0", "onFail": "error" } }, diff --git a/src/wp-content/themes/twentytwentyone/.nvmrc b/src/wp-content/themes/twentytwentyone/.nvmrc index 82d5d714347ef..dea8da446de5d 100644 --- a/src/wp-content/themes/twentytwentyone/.nvmrc +++ b/src/wp-content/themes/twentytwentyone/.nvmrc @@ -1 +1 @@ -24.18 +24.20 diff --git a/src/wp-content/themes/twentytwentyone/package-lock.json b/src/wp-content/themes/twentytwentyone/package-lock.json index 947acba18edcc..0eba721e3cfaf 100644 --- a/src/wp-content/themes/twentytwentyone/package-lock.json +++ b/src/wp-content/themes/twentytwentyone/package-lock.json @@ -34,7 +34,7 @@ }, "engines": { "node": ">=24.18.0", - "npm": ">=11.16.0" + "npm": ">=11.18.0" } }, "node_modules/@aashutoshrathi/word-wrap": { diff --git a/src/wp-content/themes/twentytwentyone/package.json b/src/wp-content/themes/twentytwentyone/package.json index 603b5bdf36e43..ded6dc0779956 100644 --- a/src/wp-content/themes/twentytwentyone/package.json +++ b/src/wp-content/themes/twentytwentyone/package.json @@ -14,7 +14,7 @@ "homepage": "https://wordpress.org/themes/twentytwentyone/", "engines": { "node": ">=24.18.0", - "npm": ">=11.16.0" + "npm": ">=11.18.0" }, "devEngines": { "runtime": { @@ -23,7 +23,7 @@ }, "packageManager": { "name": "npm", - "version": ">=11.16.0", + "version": ">=11.18.0", "onFail": "error" } }, diff --git a/src/wp-content/themes/twentytwentytwo/.nvmrc b/src/wp-content/themes/twentytwentytwo/.nvmrc index 82d5d714347ef..dea8da446de5d 100644 --- a/src/wp-content/themes/twentytwentytwo/.nvmrc +++ b/src/wp-content/themes/twentytwentytwo/.nvmrc @@ -1 +1 @@ -24.18 +24.20 diff --git a/src/wp-content/themes/twentytwentytwo/package-lock.json b/src/wp-content/themes/twentytwentytwo/package-lock.json index ffde012248aad..f34994e1b5498 100644 --- a/src/wp-content/themes/twentytwentytwo/package-lock.json +++ b/src/wp-content/themes/twentytwentytwo/package-lock.json @@ -16,7 +16,7 @@ }, "engines": { "node": ">=24.18.0", - "npm": ">=11.16.0" + "npm": ">=11.18.0" } }, "node_modules/@wordpress/browserslist-config": { diff --git a/src/wp-content/themes/twentytwentytwo/package.json b/src/wp-content/themes/twentytwentytwo/package.json index 33c5b10d58eb1..a16e00219f20b 100644 --- a/src/wp-content/themes/twentytwentytwo/package.json +++ b/src/wp-content/themes/twentytwentytwo/package.json @@ -14,7 +14,7 @@ "homepage": "https://wordpress.org/themes/twentytwentytwo/", "engines": { "node": ">=24.18.0", - "npm": ">=11.16.0" + "npm": ">=11.18.0" }, "devEngines": { "runtime": { @@ -23,7 +23,7 @@ }, "packageManager": { "name": "npm", - "version": ">=11.16.0", + "version": ">=11.18.0", "onFail": "error" } }, From 39f87ff4d5f9469f0e19eba19a29a7f19f35f49d Mon Sep 17 00:00:00 2001 From: Manzoor Wani Date: Wed, 7 Oct 2026 09:22:12 +0530 Subject: [PATCH 2/4] Build/Test Tools: Opt in to the npm supply chain defaults. Denies every dependency install script via allowScripts and fails the install on unreviewed ones with strict-allow-scripts. Refuses git, remote URL and local tarball dependencies, matching the npm v12 defaults plus allow-file. --- .npmrc | 7 +++++++ package.json | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/.npmrc b/.npmrc index 01593aba1c0ef..8b61360b4c209 100644 --- a/.npmrc +++ b/.npmrc @@ -3,3 +3,10 @@ legacy-peer-deps = true lockfile-version = 3 prefer-dedupe = true save-exact = true +# fail the install on any dependency script not covered by allowScripts in package.json +strict-allow-scripts = true +# opt in to the npm v12 defaults that refuse git and remote URL dependencies +allow-git = none +allow-remote = none +# extend that to local tarballs +allow-file = none diff --git a/package.json b/package.json index 797004dfff5be..a216a00968406 100644 --- a/package.json +++ b/package.json @@ -159,5 +159,12 @@ "gutenberg:copy": "node tools/gutenberg/copy.js", "gutenberg:verify": "node tools/gutenberg/utils.js", "gutenberg:download": "node tools/gutenberg/download.js && npm run build:gutenberg" + }, + "allowScripts": { + "@parcel/watcher": false, + "core-js": false, + "core-js-pure": false, + "fsevents": false, + "unrs-resolver": false } } From a1a9e4fd967c6b536dd44575e523f74190f00888 Mon Sep 17 00:00:00 2001 From: Manzoor Wani Date: Wed, 7 Oct 2026 09:22:12 +0530 Subject: [PATCH 3/4] Bundled Themes: Opt in to the npm supply chain defaults. Applies the Core install script and dependency source policy to Twenty Twenty-One, Twenty Twenty-Two and Twenty Twenty-Five. --- src/wp-content/themes/twentytwentyfive/.npmrc | 7 +++++++ src/wp-content/themes/twentytwentyfive/package.json | 3 +++ src/wp-content/themes/twentytwentyone/.npmrc | 7 +++++++ src/wp-content/themes/twentytwentyone/package.json | 6 ++++++ src/wp-content/themes/twentytwentytwo/.npmrc | 7 +++++++ src/wp-content/themes/twentytwentytwo/package.json | 3 +++ 6 files changed, 33 insertions(+) create mode 100644 src/wp-content/themes/twentytwentyfive/.npmrc create mode 100644 src/wp-content/themes/twentytwentytwo/.npmrc diff --git a/src/wp-content/themes/twentytwentyfive/.npmrc b/src/wp-content/themes/twentytwentyfive/.npmrc new file mode 100644 index 0000000000000..407fc7a0eebc6 --- /dev/null +++ b/src/wp-content/themes/twentytwentyfive/.npmrc @@ -0,0 +1,7 @@ +# fail the install on any dependency script not covered by allowScripts in package.json +strict-allow-scripts = true +# opt in to the npm v12 defaults that refuse git and remote URL dependencies +allow-git = none +allow-remote = none +# extend that to local tarballs +allow-file = none diff --git a/src/wp-content/themes/twentytwentyfive/package.json b/src/wp-content/themes/twentytwentyfive/package.json index 2d91208edc2da..60476d8d68109 100644 --- a/src/wp-content/themes/twentytwentyfive/package.json +++ b/src/wp-content/themes/twentytwentyfive/package.json @@ -39,5 +39,8 @@ "scripts": { "build": "postcss style.css --use cssnano -o style.min.css --no-map", "watch": "postcss style.css --use cssnano -o style.min.css --no-map --watch" + }, + "allowScripts": { + "fsevents": false } } diff --git a/src/wp-content/themes/twentytwentyone/.npmrc b/src/wp-content/themes/twentytwentyone/.npmrc index 80bcbed90c4f2..7b6f9d8229b29 100644 --- a/src/wp-content/themes/twentytwentyone/.npmrc +++ b/src/wp-content/themes/twentytwentyone/.npmrc @@ -1 +1,8 @@ legacy-peer-deps = true +# fail the install on any dependency script not covered by allowScripts in package.json +strict-allow-scripts = true +# opt in to the npm v12 defaults that refuse git and remote URL dependencies +allow-git = none +allow-remote = none +# extend that to local tarballs +allow-file = none diff --git a/src/wp-content/themes/twentytwentyone/package.json b/src/wp-content/themes/twentytwentyone/package.json index ded6dc0779956..d8e7da36b58d8 100644 --- a/src/wp-content/themes/twentytwentyone/package.json +++ b/src/wp-content/themes/twentytwentyone/package.json @@ -80,5 +80,11 @@ "watch": "chokidar \"**/*.scss\" -c \"npm run build\" --initial", "lint:scss": "stylelint **/*.scss", "lint-fix:scss": "stylelint **/*.scss --fix" + }, + "allowScripts": { + "@parcel/watcher": false, + "core-js": false, + "core-js-pure": false, + "fsevents": false } } diff --git a/src/wp-content/themes/twentytwentytwo/.npmrc b/src/wp-content/themes/twentytwentytwo/.npmrc new file mode 100644 index 0000000000000..407fc7a0eebc6 --- /dev/null +++ b/src/wp-content/themes/twentytwentytwo/.npmrc @@ -0,0 +1,7 @@ +# fail the install on any dependency script not covered by allowScripts in package.json +strict-allow-scripts = true +# opt in to the npm v12 defaults that refuse git and remote URL dependencies +allow-git = none +allow-remote = none +# extend that to local tarballs +allow-file = none diff --git a/src/wp-content/themes/twentytwentytwo/package.json b/src/wp-content/themes/twentytwentytwo/package.json index a16e00219f20b..c448cd4a0fcd4 100644 --- a/src/wp-content/themes/twentytwentytwo/package.json +++ b/src/wp-content/themes/twentytwentytwo/package.json @@ -39,5 +39,8 @@ "scripts": { "build": "postcss style.css --use cssnano -o style.min.css --no-map", "watch": "postcss style.css --use cssnano -o style.min.css --no-map --watch" + }, + "allowScripts": { + "fsevents": false } } From 4020804f645142567c081df29a8cd63a79be5003 Mon Sep 17 00:00:00 2001 From: Manzoor Wani Date: Wed, 7 Oct 2026 10:16:36 +0530 Subject: [PATCH 4/4] Build/Test Tools: Raise the minimum Node.js version to 24.20. Node.js 24.18 and 24.19 bundle npm 11.16 and 11.17, which fail the new npm 11.18 minimum in devEngines. Node.js 24.20 bundles npm 11.19. --- package-lock.json | 2 +- package.json | 4 ++-- src/wp-content/themes/twentytwentyfive/package-lock.json | 2 +- src/wp-content/themes/twentytwentyfive/package.json | 4 ++-- src/wp-content/themes/twentytwentyone/package-lock.json | 2 +- src/wp-content/themes/twentytwentyone/package.json | 4 ++-- src/wp-content/themes/twentytwentytwo/package-lock.json | 2 +- src/wp-content/themes/twentytwentytwo/package.json | 4 ++-- 8 files changed, 12 insertions(+), 12 deletions(-) diff --git a/package-lock.json b/package-lock.json index 72f30dc11778c..60a045bacf2d9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -96,7 +96,7 @@ "webpack": "5.108.4" }, "engines": { - "node": ">=24.18.0", + "node": ">=24.20.0", "npm": ">=11.18.0" } }, diff --git a/package.json b/package.json index a216a00968406..1e78eb8f006aa 100644 --- a/package.json +++ b/package.json @@ -11,13 +11,13 @@ "ghcrRepo": "WordPress/gutenberg/gutenberg-wp-develop-build" }, "engines": { - "node": ">=24.18.0", + "node": ">=24.20.0", "npm": ">=11.18.0" }, "devEngines": { "runtime": { "name": "node", - "version": ">=24.18.0" + "version": ">=24.20.0" }, "packageManager": { "name": "npm", diff --git a/src/wp-content/themes/twentytwentyfive/package-lock.json b/src/wp-content/themes/twentytwentyfive/package-lock.json index 952fcc58dbc13..41d7d992320c4 100644 --- a/src/wp-content/themes/twentytwentyfive/package-lock.json +++ b/src/wp-content/themes/twentytwentyfive/package-lock.json @@ -15,7 +15,7 @@ "postcss-cli": "^11.0.1" }, "engines": { - "node": ">=24.18.0", + "node": ">=24.20.0", "npm": ">=11.18.0" } }, diff --git a/src/wp-content/themes/twentytwentyfive/package.json b/src/wp-content/themes/twentytwentyfive/package.json index 60476d8d68109..a28c7eccfe87d 100644 --- a/src/wp-content/themes/twentytwentyfive/package.json +++ b/src/wp-content/themes/twentytwentyfive/package.json @@ -13,13 +13,13 @@ }, "homepage": "https://wordpress.org/themes/twentytwentyfive/", "engines": { - "node": ">=24.18.0", + "node": ">=24.20.0", "npm": ">=11.18.0" }, "devEngines": { "runtime": { "name": "node", - "version": ">=24.18.0" + "version": ">=24.20.0" }, "packageManager": { "name": "npm", diff --git a/src/wp-content/themes/twentytwentyone/package-lock.json b/src/wp-content/themes/twentytwentyone/package-lock.json index 0eba721e3cfaf..70ccf085399d6 100644 --- a/src/wp-content/themes/twentytwentyone/package-lock.json +++ b/src/wp-content/themes/twentytwentyone/package-lock.json @@ -33,7 +33,7 @@ "stylelint-config-recommended-scss": "^16.0.2" }, "engines": { - "node": ">=24.18.0", + "node": ">=24.20.0", "npm": ">=11.18.0" } }, diff --git a/src/wp-content/themes/twentytwentyone/package.json b/src/wp-content/themes/twentytwentyone/package.json index d8e7da36b58d8..070f7fe17a3e9 100644 --- a/src/wp-content/themes/twentytwentyone/package.json +++ b/src/wp-content/themes/twentytwentyone/package.json @@ -13,13 +13,13 @@ }, "homepage": "https://wordpress.org/themes/twentytwentyone/", "engines": { - "node": ">=24.18.0", + "node": ">=24.20.0", "npm": ">=11.18.0" }, "devEngines": { "runtime": { "name": "node", - "version": ">=24.18.0" + "version": ">=24.20.0" }, "packageManager": { "name": "npm", diff --git a/src/wp-content/themes/twentytwentytwo/package-lock.json b/src/wp-content/themes/twentytwentytwo/package-lock.json index f34994e1b5498..667ead948ebef 100644 --- a/src/wp-content/themes/twentytwentytwo/package-lock.json +++ b/src/wp-content/themes/twentytwentytwo/package-lock.json @@ -15,7 +15,7 @@ "postcss-cli": "^11.0.1" }, "engines": { - "node": ">=24.18.0", + "node": ">=24.20.0", "npm": ">=11.18.0" } }, diff --git a/src/wp-content/themes/twentytwentytwo/package.json b/src/wp-content/themes/twentytwentytwo/package.json index c448cd4a0fcd4..95ffa7075a8f7 100644 --- a/src/wp-content/themes/twentytwentytwo/package.json +++ b/src/wp-content/themes/twentytwentytwo/package.json @@ -13,13 +13,13 @@ }, "homepage": "https://wordpress.org/themes/twentytwentytwo/", "engines": { - "node": ">=24.18.0", + "node": ">=24.20.0", "npm": ">=11.18.0" }, "devEngines": { "runtime": { "name": "node", - "version": ">=24.18.0" + "version": ">=24.20.0" }, "packageManager": { "name": "npm",