Update Node.js to >= 24.0 and Yarn to 4.18.1 for Varbase Layout Builder

Problem/Motivation

Node.js 20 reached end of life on 30 April 2026, and Drupal core main now requires "node": ">= 24.0" in core/package.json. Varbase Layout Builder still pins Node 20 or older in its engines and GitLab CI.

Node 24 is the LTS line, latest v24.22.2, and it is one of the lines the November 2026 security releases will patch. Pinning the major picks those patches up with no further change. Local systems should use Node.js 24 or 26.

Steps to reproduce

1. On 10.2.x and 10.0.x, open package.json: the engines say "node": ">= 20.0" and packageManager is yarn@4.9.3. On 10.2.x, modules/varbase_cta_block/package.json says "node": ">= 16.0" and "yarn": ">= 1.6".
2. Open .gitlab-ci.yml on 10.2.x and 10.0.x: the browser job installs NodeSource setup_20.x. On 10.2.x, .gitlab-ci-local.yml runs node:20.
3. On 9.0.x, package.json and themes/claro/package.json say "node": ">= 18.0" and ">= 16.0", with Yarn Classic yarn.lock files in both.

Proposed resolution

• 10.2.x and 10.0.x: package.json engines: "node": ">= 24.0". Yarn moves to yarn@4.18.1 with the floor ">= 4.18.1", and .yarnrc.yml follows the Varbase standard (approvedGitRepositories, enableScripts, nodeLinker: node-modules, npmMinimalAgeGate: 0), which Yarn before 4.14.0 rejects. On 10.2.x, modules/varbase_cta_block/package.json moves to ">= 24.0" and ">= 4.18.1" too.
• 10.2.x and 10.0.x: .gitlab-ci.yml NodeSource setup_24.x. .gitlab-ci-local.yml on 10.2.x: node:24.
• 10.2.x and 10.0.x: .gitlab-ci.yml: the composer and stylelint jobs set YARN_RC_FILENAME: .yarnrc.core.yml and YARN_NODE_LINKER: node-modules, so Drupal core's own Yarn 4.9.1 in those jobs does not read the project .yarnrc.yml, whose keys need Yarn 4.14.
• 10.2.x and 10.0.x: yarn.lock is removed (10.0.x) and .gitignore now ignores yarn.lock, package-lock.json and pnpm-lock.yaml, so installs resolve from package.json. CI already sets YARN_ENABLE_IMMUTABLE_INSTALLS to "false".
• 9.0.x: engines "node": ">= 24.0" in both package.json files, and both yarn.lock files removed and ignored. It stays on Yarn Classic: Yarn 4 cannot resolve the farbtastic tarball dependency, which has no package.json.
• Dependency ranges in package.json use carets, the way Drupal core writes them: ~ ranges and exact versions become ^MAJOR.MINOR.PATCH, with no major bump. This covers the nested package.json files too.

AI-Generated: Yes

Remaining tasks

• ✅ File an issue
• ✅ Addition/Change/Update/Fix
• ❌ Testing to ensure no regression
• ➖ Automated unit testing coverage
• ➖ Automated functional testing coverage
• ➖ UX/UI designer responsibilities
• ➖ Readability
• ➖ Accessibility
• ➖ Performance
• ➖ Security
• ➖ Developer Documentation
• ➖ User Guide Documentation
• ❌ Move 9.0.x to Yarn 4.18.1 once the farbtastic tarball dependency is replaced or dropped
• ❌ Reviewed by human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Release notes snippet
• ✅ Release

User interface changes

• N/A

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• Node.js 24 or newer is now required, in the engines and CI. Node 20 is end of life.