chore(toolchain): node 24.19.0, @kno2 release-age exclude, drop dead Travis config

[dapperdandev]

Toolchain changes, plus removal of the dead Travis config they exposed. (Folds in what was previously split out as #61.)

.nvmrc: 24.18.0 -> 24.19.0

.npmrc: adds min-release-age-exclude[]=@kno2/*

min-release-age=1 is a supply-chain guard aimed at third-party packages, but it applies to our own scoped packages too. When a fresh @kno2 version is inside the window, npm does not error. It silently resolves an older version at exit 0, so a dependency bump looks successful while pinning a stale build.

Measured against @kno2/sdk@1.184.3 (published inside the window) on node 24.19.0 / npm 11.17.0:

.npmrc	resolves to	exit
min-release-age=1	1.184.2 (stale)	0
min-release-age=1 + min-release-age-exclude[]=@kno2/*	1.184.3	0

This replaces the blunter workaround of passing --min-release-age=0, which disables the guard for every package in that install. The exclude exempts only matching names, and per npm's docs an exempted package's own dependencies still follow the policy.

Why the runtime bump is required

min-release-age-exclude needs npm >= 11.17.0, which first ships with node 24.19.0. On 24.18.0 (npm 11.16.0) the config does not exist and is silently ignored. Confirmed across every locally installed runtime:

node	npm	min-release-age-exclude
22.22.2	10.9.7	no (no release-age config at all)
24.11.0	11.6.1	no
24.15.0	11.12.1	no
24.18.0	11.16.0	no
24.19.0	11.17.0	yes

Node 24 is the active LTS line, so this stays on LTS.

Removes .travis.yml

Raised by Copilot on this PR (comment 4031277375): the file pins node_js: 14 and so would not follow the toolchain bump above.

The finding was half right. The file does pin node 14, but it is not a live CI path:

• Travis posts no status checks on this repo. Checks here are Analyze (actions), Analyze (javascript) and CodeQL.
• Nothing in the repo references it (grep -rl travis, excluding node_modules, returns nothing).
• Last touched 2021-04-19 (0121655).

So nothing was running on node 14 and there is no behaviour change. The problem is that the file reads as though it were live, which is exactly what prompted the review comment. Real CI is .github/workflows/npm-publish.yml, which resolves node from .nvmrc and so moves with this PR.

Removing it leaves one source of truth for the CI runtime.

Verification

• npm config ls -l in this repo now reports min-release-age = 1 and min-release-age-exclude = ["@kno2/*"].
• The lockfile is unaffected by the npm change. A fresh npm install under npm 11.17.0 is a no-op and rewrites nothing, so no lockfile churn rides along with the runtime bump. That was the main risk worth checking, since a different npm can otherwise rewrite a lockfile.
• npm run build (webpack) succeeds.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Update or remove the Travis Node 14 runtime so the toolchain bump applies consistently.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates Node.js to 24.19.0 and exempts internal @kno2/* packages from npm’s release-age guard.

Changes:

• Bumps .nvmrc from Node 24.18.0 to 24.19.0.
• Adds the @kno2/* npm release-age exclusion.

File summaries

File	Summary
.nvmrc	Pins Node.js 24.19.0; .travis.yml still explicitly uses Node 14.
.npmrc	Exempts @kno2/* packages from the release-age guard.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

All reviewed changes have no unresolved blocking issues.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite