Update js-yaml to 5.2.2 and pin Node to 24 (Dependabot #213) (#158)

* Update js-yaml to 5.2.2 and document package-lock.json version string

* Reduce lockfile change to the js-yaml bump only

The previous lockfile was regenerated with npm 11 on node 24, which pruned
the @emnapi optional peer deps that CI's npm 10 expects, breaking npm ci.
This restores master's lockfile and edits only the js-yaml entry and the
two version fields. Verified with npm ci and npm run build on node 20.

* Pin Node to 24 and bump js-yaml to 5.2.2

Node 20 reached end of life on 2026-04-30 and CI was still building the
release artifact on it. markdownlint-cli also declares node >=22, so CI
was emitting EBADENGINE warnings on every run.

- Add .nvmrc (24) as the single source of truth; workflows now read
  node-version-file instead of hardcoding '20' in five places.
- Add engines.node >=24.15.0, the floor ini@7 requires.
- Bump docker-compose node service to node:24-alpine.
- Exclude .nvmrc from the distribution zip.
- Regenerate package-lock.json on node 24.18 / npm 11.16, which keeps the
  @emnapi optional peers that npm 11.6.2 wrongly pruned.

Verified: npm ci clean with no EBADENGINE warnings, npm run build passes.

Author: gsarig

.distignore

@@ -24,6 +24,7 @@ assets/vendor/leaflet/reference-1.6.0*.html
 .distignore
 .eslintrc.js
 .gitignore
+.nvmrc
 Makefile
 package.json
 package-lock.json

.github/workflows/ci.yml

@@ -42,7 +42,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: 'npm'
       - run: npm ci
       - run: node bin/validate-blueprint.js
@@ -133,7 +133,7 @@ jobs:
           path: build/
       - uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: 'npm'
       - uses: shivammathur/setup-php@v2
         with:
@@ -185,7 +185,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: 'npm'
 
       - uses: shivammathur/setup-php@v2

.github/workflows/copilot-cr-fix.yml

@@ -157,7 +157,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: 'npm'
 
       - name: Install dependencies

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: 'npm'
 
       - name: Build JS assets

.nvmrc

@@ -0,0 +1 @@
+24

CLAUDE.md

@@ -252,12 +252,14 @@ When asked to **"deploy the release"**, execute the following steps in order —
 ### Steps (automated)
 
 1. **Confirm the target version** — ask if not told explicitly.
-2. **Update all five version strings** to the new version:
+2. **Update all six version strings** to the new version:
    - ` * Version:` header in `ootb-openstreetmap.php`
    - `OOTB_VERSION` constant in `ootb-openstreetmap.php`
    - `"version"` in `package.json`
    - `"version"` in `src/block/block.json`
    - `Stable tag:` in `readme.txt`
+   - `"version"` in `package-lock.json` (two places: the root object and `packages[""]`).
+     Easiest via `npm install --package-lock-only` after bumping `package.json`, rather than editing by hand.
 3. **Add a changelog entry** at the top of the `== Changelog ==` section in `readme.txt`:
    ```
    = X.Y.Z =
@@ -285,7 +287,7 @@ After the above is done, report:
 Pushing the tag triggers `release.yml` and deploys to WordPress.org. It is the point of no return.
 
 ### Version consistency rule
-All five locations must match exactly before tagging. The `artifact-playwright` CI job checks three of them (PHP header, `package.json`, `readme.txt`) and fails fast if they diverge.
+All six locations must match exactly before tagging. The `artifact-playwright` CI job checks only three of them (PHP header, `package.json`, `readme.txt`) and fails fast if they diverge, so the other three, including `package-lock.json`, can drift without CI noticing.
 
 ---
 

docker-compose.yml

@@ -67,7 +67,7 @@ services:
     working_dir: /app
 
   node:
-    image: node:20-alpine
+    image: node:24-alpine
     restart: "no"
     profiles: ["tools"]
     volumes: