Could Node.js 24 be installed on the wordpress.org build server? At the time of publishing, the latest version is 24.15.0 paired with npm version 11.12.1.

wordpress-develop and gutenberg are currently using version 20.x, which reached end-of-life (EOL) on April 30, 2026 (final release being published on March 24, 2026) and has a number of known security vulnerabilities that will not be patched. 24.x have Active or Maintenance LTS status through April 30, 2028.

A good amount of discussion has taken place already as there are a number of features in recent versions of Node.js/npm that the CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. & Security teams are hoping to take advantage of:

• Full native support for ES modules, including interop between ES and CommonJS modules.
• The ability to configure a min-release-age value within .npmrc for defensive supply-chain configurations (npm >= 11.0.0).
• Running TypeScript files natively, with built-in type stripping, with no need for transpilation (experimental warning removed in 24.11.0).
• Trusted publishing for npm packages to eliminate the need for long-lived npm tokens in favor of OpenID Connect  (npm >= 11.5.1).

Older Branches

Node.js 20.x is being used back through the 6.4 branch. Early testing shows those branches can be updated to 24.x without any dependency updates required with no resulting changes to the built WordPress files. More testing is needed, but ideally all of these branches would be upgraded in addition to trunk.

cc/ @aduth, @sirreal, @jsnajdr, @manzoorwanijk.

#nodejs, #prio2