[manzoorwanijk]

Opts in to the npm v12 supply chain defaults on npm 11 for Core and the bundled themes with a build process, mirroring WordPress/gutenberg#82689. This replaces the npm v12 upgrade in #13536, which is on hold.

• .npmrc refuses git, remote URL and local tarball dependencies, and strict-allow-scripts fails the install on unreviewed install scripts.
• allowScripts denies every dependency install script. Twenty Twenty-One, Twenty Twenty-Two and Twenty Twenty-Five get the same policy.
• The minimum npm moves to >=11.18.0 because npm 11.16 and 11.17 reject registry dependencies with EALLOWREMOTE under allow-remote = none.
• .nvmrc moves to Node.js 24.20, which bundles npm 11.19, matching Chore: Use v24.20 in .nvmrc config file. gutenberg#84138.

Trac ticket: https://core.trac.wordpress.org/ticket/64543

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Implementation and this description, reviewed by me.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs.

Core Committers: Use this line as a base for the props when committing in SVN:

Props manzoorwanijk, mukesh27, lancewillett.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

---

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

• @propsbot add <username> to give props to a GitHub or WordPress.org user. Requires write access.
• @propsbot remove <username> to leave a user out of the props. Requires write access.
• @propsbot refresh to refresh this list. Adding the props-bot label works too.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[mukeshpanchal27]

Node.js 24.18 ships npm 11.16, and Node.js 24.19 ships npm 11.17. Both are below the new >=11.18.0 npm minimum. On those Node.js versions, npm install fails the devEngines npm check.

Can we raise the Node.js minimum to >=24.20.0 in engines and devEngines? Node.js 24.20 ships npm 11.19. The change applies to all four package.json files and their lockfiles.

Suggested change

	"node": ">=24.18.0",
	"node": ">=24.20.0",

[manzoorwanijk]

Done in 1c0086e

[lancewillett]

The npm policy and version requirements look correct. Clean installs and builds passed for Core and all three affected themes under Node 24.20/npm 11.19 in Docker. The native watcher and resolver dependencies also loaded successfully with their install scripts denied. CI is green.

_{AI review · gpt-6}

[Copilot]

🔵 Needs a closer look

The npm 11.18+ restrictions and disabled native install scripts require clean-install and build validation on supported platforms, which is unavailable in this source-only review.

No open issues 🎉

3 files not reviewed

• src/wp-content/themes/twentytwentyfive/package-lock.json: Generated file
• src/wp-content/themes/twentytwentyone/package-lock.json: Generated file
• src/wp-content/themes/twentytwentytwo/package-lock.json: Generated file

What changed in this PR

This PR adopts npm v12-style supply chain restrictions on npm 11 for WordPress Core and three bundled themes, replacing the deferred npm v12 upgrade.

Changes:

• Blocks Git, remote URL, and local tarball dependencies, and rejects unreviewed dependency install scripts.
• Explicitly denies install scripts for listed dependencies in Core and the three themes.
• Raises minimum requirements to Node.js 24.20.0 and npm 11.18.0, updating version selectors and lockfile metadata.

File	Description
src/​wp-content/​themes/​twentytwentytwo/​package.json	Raises runtime requirements and denies the fsevents install script.
src/​wp-content/​themes/​twentytwentytwo/​package-lock.json	Synchronizes engine requirements.
src/​wp-content/​themes/​twentytwentytwo/​.nvmrc	Selects Node.js 24.20.
src/​wp-content/​themes/​twentytwentytwo/​.npmrc	Adds dependency-source and install-script restrictions.
src/​wp-content/​themes/​twentytwentyone/​package.json	Raises runtime requirements and denies listed dependency scripts.
src/​wp-content/​themes/​twentytwentyone/​package-lock.json	Synchronizes engine requirements.
src/​wp-content/​themes/​twentytwentyone/​.nvmrc	Selects Node.js 24.20.
src/​wp-content/​themes/​twentytwentyone/​.npmrc	Adds restrictions while preserving legacy peer-dependency handling.
src/​wp-content/​themes/​twentytwentyfive/​package.json	Raises runtime requirements and denies the fsevents install script.
src/​wp-content/​themes/​twentytwentyfive/​package-lock.json	Synchronizes engine requirements.
src/​wp-content/​themes/​twentytwentyfive/​.nvmrc	Selects Node.js 24.20.
src/​wp-content/​themes/​twentytwentyfive/​.npmrc	Adds dependency-source and install-script restrictions.
package.json	Raises Core’s runtime requirements and denies listed dependency scripts.
package-lock.json	Synchronizes Core’s engine requirements.
.nvmrc	Selects Node.js 24.20 for Core.
.npmrc	Adds Core’s dependency-source and install-script restrictions.

_{Review effort: Balanced}

[lancewillett]

@desrosj could you give this an independent review? The npm install policy and version requirements have passed local install/build checks, but I am holding landing for a second opinion on the supply-chain policy and its effect on contributors.

_{AI review · gpt-6}

[lancewillett]

@desrosj following up on my Oct 31 request: could you give this an independent review when you have time? It's approved and waiting only on your second opinion of the npm install policy.

_{AI review · claude-opus-5-5}

[lancewillett]

@desrosj I plan to land this on Wednesday, November 25, unless you'd like changes or more time before then.

Since my approval, the only change is a trunk merge with the same effective diff, and CI is green. What it changes for contributors: the minimum moves to Node.js 24.20 and npm 11.18, and npm install fails on any dependency install script that allowScripts doesn't list.

_{AI review · claude-opus-5-5}