chore(release): prepare 2.1.0

.github/workflows/ci.yml

@@ -23,6 +23,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
         with:
@@ -31,8 +36,8 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
-      - name: Audit critical JavaScript dependencies
-        run: bun audit --audit-level=critical
+      - name: Audit JavaScript dependencies
+        run: bun run audit:security
 
       - name: Build web application
         run: bun run build:www
@@ -65,6 +70,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
         with:
@@ -109,6 +119,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
         with:

.github/workflows/release.yml

@@ -20,6 +20,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
         with:
@@ -35,9 +40,6 @@ jobs:
         run: bun install --frozen-lockfile
 
       - name: Audit JavaScript dependencies
-        # extract-zip has no patched release and is only reachable through the
-        # @wordpress/scripts Puppeteer browser downloader, which this workflow
-        # does not invoke or ship. SECURITY.md documents the temporary exception.
         run: bun run audit:security
 
       - name: Install PHP development dependencies
@@ -52,6 +54,9 @@ jobs:
         working-directory: packages/www
         run: bunx jest --coverage --detectOpenHandles --watchman=false
 
+      - name: Test Figma plugin
+        run: bun run --filter './packages/figma' test
+
       - name: Test WordPress PHP
         working-directory: packages/wp
         run: vendor/bin/phpunit Tests
@@ -86,6 +91,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
         with:

CHANGELOG.md

@@ -4,14 +4,17 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
-## [2.1.0]
+## [2.1.0] - 2026-10-28
 
 ### Changed
 
 - Core Framework now requires WordPress 6.6 or newer. The block editor integration is built against the `react-jsx-runtime` script that WordPress first ships in 6.6. Sites on WordPress 6.0 to 6.5 should stay on Core Framework 2.0.2.
 
 ### Fixed
 
+- Fixed Oxygen 6 returning HTTP 500 when WordPress debugging is enabled. Builder detection now reads version metadata without loading translations before WordPress is ready.
+- Fixed the first dark-mode preview click doing nothing in Oxygen Classic and Oxygen 6 when the project defaults to Dark. The toolbar and canvas now stay in sync, including automatic themes and saved browser preferences.
+
 - Restored the missing 2.0.2 release notes in the WordPress plugin readme. Future WordPress packages now require a changelog entry for their version so update notes remain available in WordPress's plugin details.
 - Fixed importing a local font into WordPress failing with a Google Font download error. Custom fonts now upload the selected file directly instead of trying to find it on Google Fonts.
 - Fixed Figma synchronization stopping when a RAW color referenced another variable without a dark-mode value. Light and dark colors now resolve independently, so mixed literal and referenced colors keep their correct values.

CONTRIBUTING.md

@@ -11,7 +11,7 @@ Thanks for helping improve Core Framework. Contributions should keep projects po
 
 ## Local Development
 
-Use Bun for JavaScript dependencies and project commands:
+Use Bun 1.3.11 for JavaScript dependencies and project commands. WordPress build tooling also requires Node.js 22.19 or newer; CI uses Node.js 24:
 
 ```sh
 bun install

SECURITY.md

@@ -41,10 +41,10 @@ Out of scope:
 - reports against third-party builders, WordPress, Figma, Google Fonts, or hosting providers that do not involve Core Framework code
 - denial-of-service reports that only exhaust intentionally local resources without a realistic deployment impact
 
-## Dependency Audit Exception
+## Dependency Audits
 
-CI rejects new high- or critical-severity JavaScript dependency advisories. It temporarily allows `GHSA-jmr9-qjv8-65gv` in `extract-zip` because upstream has not published a patched release. The package is present only through the `@wordpress/scripts` Puppeteer browser-download tooling; Core Framework's release workflow does not invoke that path, and neither the WordPress nor Figma release archive contains the package.
+PR CI and release verification both reject high- or critical-severity JavaScript dependency advisories. Run `bun run audit:security` to reproduce the gate locally. There are no advisory exceptions.
 
-Remove the exception as soon as a compatible patched upstream release is available. Run `bun run audit:security` to reproduce the enforced audit locally.
+The former `extract-zip` exception was removed after updating the WordPress build tooling to a dependency chain that no longer includes `extract-zip` or `basic-ftp`.
 
 Maintainers will acknowledge valid private reports, assess their impact, and coordinate a fix and disclosure when appropriate.