TRP-914 Updated runtime to Node 24 and resolved vulnerabilities

[samdagnall]

• Changed CI job to Node 24 and removed support for Node 20/22
• Changed required engine version in package.json to node 24 and removed support for Node 20/22
• Added .nvmrc with v24.14.0
• Updated mocha and sinon versions
• Updated dependency hmpo-model to 7.0.1 with Node 24 support
• Added transitive dependencies overrides for serialize-javascript to suppress vulnerabilities
• Added .npmrc to set a minimum release age of 2 days before being able to be installed to this repository

[samdagnall]

Tested through publishing version of web-middleware 2.4.422-ha87451 and then installing that locally within web-apply

  3647 passing (3s)


=============================== Coverage summary ===============================
Statements   : 100% ( 2202/2202 )
Branches     : 100% ( 1160/1160 )
Functions    : 100% ( 406/406 )
Lines        : 100% ( 2122/2122 )
================================================================================
----------------------------------------|---------|----------|---------|---------|-------------------
File                                    | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s 
----------------------------------------|---------|----------|---------|---------|-------------------
----------------------------------------|---------|----------|---------|---------|-------------------

[samdagnall]

Tested as well with hmpo-countries-lib as another dependency

  86 passing (326ms)


=============================== Coverage summary ===============================
Statements   : 100% ( 82/82 )
Branches     : 100% ( 40/40 )
Functions    : 100% ( 36/36 )
Lines        : 100% ( 80/80 )
================================================================================

[Copilot]

Pull request overview

This PR updates the project’s runtime/tooling baseline to Node.js 24 and refreshes core dependencies to versions compatible with Node 24, with additional steps intended to reduce known vulnerability exposure.

Changes:

• Updated CI and package.json engines to require Node 24 (dropping Node 20/22).
• Upgraded key dependencies/devDependencies (notably hmpo-model, mocha, sinon, hmpo-logger) for Node 24 compatibility.
• Added .nvmrc, .npmrc, and an npm overrides entry to address dependency/vulnerability concerns.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
package.json	Switches engine to Node 24, updates deps, changes audit invocation, adds overrides.
package-lock.json	Refreshes the lockfile to reflect updated dependency graph under Node 24/npm.
.nvmrc	Pins local Node version to v24.14.0.
.npmrc	Adds npm config intended to enforce a minimum package release age.
.github/workflows/ci.yaml	Updates CI matrix to run on Node 24 only.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.