Update Node.js to >= 24.0 and Yarn to 4.18.1 for View Modes Inventory - Bootstrap Ready

Problem/Motivation

Node.js 20 reached end of life on 30 April 2026, and Drupal core main now requires "node": ">= 24.0" in core/package.json. View Modes Inventory - Bootstrap Ready still declares "node": ">= 18.0" and "yarn": ">= 1.6" on 3.0.x, 4.0.x, 5.0.x and 8.x-2.x, with a Yarn Classic yarn.lock everywhere, even where packageManager says yarn@4.9.1. The 5.0.x GitLab CI installs Node 20.

Node 24 is the LTS line, latest v24.22.2, and it is one of the lines the November 2026 security releases will patch. Pinning the major picks those patches up with no further change. Local systems should use Node.js 24 or 26.

Steps to reproduce

1. On any of 3.0.x, 4.0.x, 5.0.x or 8.x-2.x, open package.json: the engines say "node": ">= 18.0" and "yarn": ">= 1.6", and yarn.lock is a Yarn Classic lockfile.
2. On 4.0.x and 5.0.x, packageManager is yarn@4.9.1.
3. On 5.0.x, open .gitlab-ci.yml: the browser test jobs install NodeSource setup_20.x. .gitlab-ci-local.yml runs node:20.

Proposed resolution

• package.json engines: "node": ">= 24.0". On every branch.
• 3.0.x, 4.0.x and 5.0.x: Yarn moves to yarn@4.18.1 with the floor ">= 4.18.1", and .yarnrc.yml follows the Varbase standard (approvedGitRepositories, enableScripts, nodeLinker: node-modules, npmMinimalAgeGate: 0), which Yarn before 4.14.0 rejects.
• 5.0.x: .gitlab-ci.yml installs NodeSource setup_24.x for the browser test jobs, which already set YARN_ENABLE_IMMUTABLE_INSTALLS to "false". .gitlab-ci-local.yml runs node:24.
• 5.0.x: .gitlab-ci.yml: .composer-base, which every composer job extends, and stylelint set YARN_RC_FILENAME: .yarnrc.core.yml and YARN_NODE_LINKER: node-modules, so Drupal core's own Yarn 4.9.1 in those jobs does not read the project .yarnrc.yml, whose keys need Yarn 4.14.
• 5.0.x: the test scripts run node ./node_modules/@cucumber/cucumber/bin/cucumber.js: Yarn 4 does not expose the cucumber-js bin of a dependency of @vardot/varbase-e2e to yarn run, so yarn test failed. CI calls it through npx, which still works.
• 8.x-2.x stays on Yarn Classic: Yarn 4 cannot install the farbtastic GitHub tarball, which has no package.json (Manifest not found).
• yarn.lock is removed on every branch and .gitignore now ignores yarn.lock, package-lock.json and pnpm-lock.yaml (.yarn/ too on the Yarn 4 branches), so installs resolve from package.json.
• Dependency ranges in package.json use carets, the way Drupal core writes them: exact versions, ~ and .x ranges become ^MAJOR.MINOR.PATCH, with no major bump.

AI-Generated: Yes

Remaining tasks

• ✅ File an issue
• ✅ Addition/Change/Update/Fix
• ❌ Testing to ensure no regression
• ❌ Move 8.x-2.x to Yarn 4 once farbtastic comes from a package that has a package.json
• ➖ Automated unit testing coverage
• ➖ Automated functional testing coverage
• ➖ UX/UI designer responsibilities
• ➖ Readability
• ➖ Accessibility
• ➖ Performance
• ➖ Security
• ➖ Developer Documentation
• ➖ User Guide Documentation
• ❌ Reviewed by human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Release notes snippet
• ✅ Release

User interface changes

• N/A

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• Node.js 24 or newer is now required, in the engines and CI. Yarn 4.18.1 is the package manager.