[Herm71]

Moves CI and releases to Node 24 (#27) and clears npm audit's critical findings in the dev toolchain (#26). Nothing in the release zip changes.

Closes #26
Closes #27

What changed

Node 24 (#27)

• .nvmrc: pins 24, the current LTS. ci.yml (two jobs) and release.yml read it with node-version-file: .nvmrc, replacing three hard-coded node-version: 20 lines.
• Actions: moved to the majors that run on Node 24: actions/checkout v7, actions/setup-node v7, actions/cache v6 and softprops/action-gh-release v3. shivammathur/setup-php@v2 already runs on Node 24. Each one's action.yml was checked. action-gh-release v3's only change is the runtime.

npm audit (#26): 96 → 37 findings, 0 critical

Step	Findings
Before	96 (2 critical, 35 high)
npm audit fix, no --force (lockfile only)	85 (0 critical)
@wordpress/scripts ^34 → ^36.1.0, lockfile regenerated from a clean resolve	38
lint-staged ^15 → ^17.6.0	37 (0 critical, 20 high)

• prettier is now npm:wp-prettier@^3.9.6. wp-scripts 36's format refuses to run unless node_modules/prettier is the WordPress fork. The plain prettier@^3.1.1 from the first commit took that spot once the lockfile was regenerated. Removing it wasn't enough, because @wordpress/prettier-config and the ESLint plugin peer-depend on prettier. The alias satisfies both, as WordPress's docs recommend. The pre-commit hook caught this.
• engines.node copies @wordpress/scripts 36's requirement (^22.22.2 || ^24.15.0 || >=26.0.0), so an old local Node warns instead of failing obscurely.
• Docs: CLAUDE.md, README and ROADMAP (new §7, v1.3.0).

Why

• Move CI and release workflows off deprecated Node.js 20 #27: Node 20 reached end of life in April 2026, and every run warned that checkout, setup-node and cache v4 target it. It already caused a CI failure in Add lint/test tooling and CI, make GTM configurable, document bindings #25: node --test globs need Node 21+.
• Clear npm audit findings in dev dependencies (@wordpress/scripts tree) #26: npm ci reported 2 critical and 35 high findings. They're dev-only (npm ls --omit=dev is empty) but run on every install, locally and in CI.

Left as-is, on purpose. The 20 remaining high findings are all inside @wordpress/scripts 36.1.0, the latest release:

• braces <=3.0.3 (GHSA-vfj7-8cjw-p6xm) has no patched release; 3.0.3 is the latest. micromatch, fast-glob, globby, chokidar, stylelint and npm-package-json-lint are flagged only for depending on it.
• serialize-javascript <7.0.5 is pinned at 6.x by copy-webpack-plugin / the terser plugin. An overrides entry would force a major version into webpack's minifier. This plugin never runs webpack (there's no src/), so CI couldn't catch it if that broke.

None of these are reachable from what this plugin runs: format, lint-pkg-json and plugin-zip.

How to test

nvm use                 # 24
npm ci && composer install
npm test                # 27 node + 57 PHPUnit
npm run lint:pkg-json
npm run format && git diff --exit-code   # no drift
npm audit               # 37: 0 critical, 20 high

Release zip: composer install --no-dev && npm run zip && unzip -Z1 jc-core-functionality.zip. It has the same 148 entries as before the upgrade, including the single jc-core-functionality/ root folder, vendor/, acf-json/ and LICENSE. Restore dev dependencies with composer install.

CI: this PR is the first run on Node 24 and the new action majors. All three jobs should pass with no Node.js deprecation warning.

Release workflow: not exercised by this PR. Before relying on it for a real release, push a vX.Y.Z-rc.N tag. It should publish a Pre-release with jc-core-functionality.zip attached, which confirms action-gh-release v3 and the .nvmrc read.

Breaking changes

• Local development needs Node 22.22.2+ or 24.15.0+. npm install warns on older versions, and nvm use picks up .nvmrc.
• prettier resolves to wp-prettier. That's the formatter WordPress's own tooling expects, and it changes no files in this repo.

Migration steps

• Run nvm use (or install Node 24), then npm ci.

🤖 Generated with Claude Code