Bump version to 2.0.0 (#711)

## Why

`v2.0.0-beta.1` shipped on 13 October. Ten commits have reached trunk since then (#667 to #707), and milestone `v2.0.0` has 8 closed issues and none open. This is a stable release: it takes `releases/latest` from `v1.2.1`.

`electron-builder` names the artifacts after `package.json`, so the version has to move before the tag and artifacts exist.

## What changes

- **The version.** The three root version fields in `package.json` and `package-lock.json` move from `2.0.0-beta.1` to `2.0.0`. No dependency versions change.
- **Translations.** `npm run i18n:download` refreshed the seven existing catalogs and added `lo`, `sr` and `tr`. None was removed, and no right-to-left locale was held back.
- **Chromium locales.** Since #707 the same script keeps `build.electronLanguages` in line with the shipped catalogs, so it added `sr` and `tr` there. `lo` has no Chromium locale of its own.

| Locale | Translated | Strings |
| --- | --- | --- |
| cs | 94% | 1037 |
| en-ca | 95% | 1050 |
| en-gb | 100% | 1100 |
| gl | 96% | 1066 |
| hu | 95% | 1050 |
| lo | 95% | 1050 |
| nl | 100% | 1100 |
| pl | 99% | 1090 |
| sr | 100% | 1100 |
| tr | 100% | 1100 |

## How to test this

**Platforms:** any for steps 1 to 3. Step 4 needs macOS for `Info.plist` and Windows for the `.exe`. Steps 4 and 5 use the Buildkite build for the current head.

**Starting state:** this branch checked out with `node_modules` installed. Run every command from the repository root.

1. `npm run lint` is clean and `npm test` passes.
2. `node -e "console.log(require('./package.json').version)"` prints `2.0.0`.
3. `python3 -c "import json;d=json.load(open('package-lock.json'));print(d['version'], d['packages']['']['version'])"` prints `2.0.0 2.0.0`.
4. On the Buildkite build for the current head, the artifacts are named `wordpress-contributor-toolkit-2.0.0-*`. The `app.asar` root holds exactly `node_modules`, `package.json` and `src`, with npm 11 under `node_modules/npm` and no `.codesigning`. On macOS, `CFBundleShortVersionString` reads `2.0.0`.
5. In the installed app, set the language to Turkish in the settings and relaunch. The interface is in Turkish.

**What must not have happened:** no dependency version may change. `git diff trunk -- . ':!src/languages'` shows five changed lines: the three root version fields and the two new `electronLanguages` entries.

## Risks and limitations

None known. RELEASING.md still says to expect exactly three changed lines outside `src/languages/`. Since #707 a release that adds a locale with a Chromium locale changes `electronLanguages` too. #710 rewrites RELEASING.md and can update that line.

## Related

Milestone `v2.0.0`. Release notes follow on the release.

---

<details>
<summary>Review outcome (required — see AGENTS.md)</summary>

0 [fix here] · 0 [follow-up]. Automatic checks only, as in #681: this change has no logic to review.

- **Review:** completed, deterministic layer, in session; head `9df142b` / base `630253f` (trunk). `npm run lint` passes, `npm test` passes (2214 tests, 0 failures, 2 skipped), both files are valid JSON, and the diff outside `src/languages/` is the three root version fields plus the two `electronLanguages` entries. Outcome: nothing to fix.
- **Since review:** none.

</details>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Bump version to 2.0.0-beta.1 (#681)

## Why

41 commits have reached trunk since `v1.2.1`, and milestone
`v2.0.0-beta.1` has 77 closed issues and none open. The main changes are
the redesign on the WordPress Design System (#591), a settings dialog
with language, theme, PHP version and debug flags (#638 to #651), and
translation of the whole interface (#634 to #664). This is a beta: it
ships with `--prerelease`, so `releases/latest` stays on `v1.2.1`.

`electron-builder` names the artifacts after `package.json`, so the
version has to move before the tag and artifacts exist.

## What changes

- **The version.** The three root version fields in `package.json` and
`package-lock.json` move from `1.2.1` to `2.0.0-beta.1`. No dependency
versions change.
- **The first shipped translations.** `npm run i18n:download` added a
catalog for each of the seven locales at 80% or more on
translate.wordpress.org. None was removed, and no right-to-left locale
was held back.

| Locale | Translated | Strings |
| --- | --- | --- |
| cs | 94% | 1001 |
| en-ca | 100% | 1062 |
| en-gb | 100% | 1062 |
| gl | 100% | 1062 |
| hu | 100% | 1062 |
| nl | 100% | 1062 |
| pl | 96% | 1028 |

## How to test this

**Platforms:** any for steps 1 to 3. The artifact checks need macOS for
`Info.plist` and Windows for the `.exe`.

**Starting state:** this branch checked out with `node_modules`
installed. Run every command from the repository root.

1. `npm run lint` is clean and `npm test` passes.
2. `node -e "console.log(require('./package.json').version)"` prints
`2.0.0-beta.1`.
3. `python3 -c "import
json;d=json.load(open('package-lock.json'));print(d['version'],
d['packages']['']['version'])"` prints `2.0.0-beta.1 2.0.0-beta.1`.
4. On the Buildkite build for the current head, the artifacts are named
`wordpress-contributor-toolkit-2.0.0-beta.1-*`. The `app.asar` root
holds exactly `node_modules`, `package.json` and `src`, with npm 11
under `node_modules/npm` and no `.codesigning`. On macOS,
`CFBundleShortVersionString` reads `2.0.0-beta.1`.
5. In the installed app, set the language to Dutch in the settings and
relaunch. The interface is in Dutch.

**What must not have happened:** no dependency version may change. `git
diff trunk -- . ':!src/languages'` shows exactly three changed lines,
all of them the root version.

## Risks and limitations

`npm test` run from an interactive terminal fails two integration tests
on macOS. That is a test bug, fixed separately in #680. It does not
affect CI or the app.

## Related

Milestone `v2.0.0-beta.1`. Release notes follow on the release.

---

<details>
<summary>Review outcome (required — see AGENTS.md)</summary>

0 [fix here] · 0 [follow-up]. Automatic checks only, as in #533: this
change has no logic to review.

- **Review:** completed, deterministic layer, in session; head `9853082`
/ base `5d5f701` (trunk). `npm run lint` passes, `npm test` passes (2098
tests, 0 failures, 2 skipped), both files are valid JSON, and the diff
outside `src/languages/` is the three root version fields. Outcome:
nothing to fix.
- **Since review:** none.

</details>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Bump version to 1.2.1 (#589)

Bump version to 1.2.0 (#533)

## Why

`v1.2.0-beta.2` shipped on 23 September. Five commits reach trunk since
then: #524, #528, #530 and #532 fix what the beta.2 testing turned up
(files another branch ignored counted as changes after a switch,
`NODE_OPTIONS` lost in the macOS shims, and a trunk-only Gutenberg route
left behind by a switch to an older pull request, which broke
`wp-build`), and #531 makes the manual **Real WordPress setup** workflow
pass again, green on both platforms and both targets on trunk's app
code. Milestone `v1.2.0` holds only the umbrella #251.

`electron-builder` derives artifact names from `package.json`, so the
version has to move before the tag and the artifacts exist. This is a
stable release: it takes `releases/latest` from `v1.1.0`.

## What changes

Only the version. All three package-version fields in `package.json` and
`package-lock.json` move together from `1.2.0-beta.2` to `1.2.0`. No
dependency versions change, and there is no application behaviour change
in this PR.

## How to test this

Platforms: any for the suite; macOS and Windows for the artifact checks
that follow the merge.

1. `npm run lint` is clean and `npm test` passes, from the repository
root.
2. `node -e "console.log(require('./package.json').version)"` prints
`1.2.0`.
3. `python3 -c "import
json;d=json.load(open('package-lock.json'));print(d['version'],
d['packages']['']['version'])"` prints `1.2.0 1.2.0`.

**What must not have happened:** no dependency version may change. `git
diff` must show exactly three changed lines, all of them the root
package version.

After merge, the release build must produce artifacts named
`wordpress-contributor-toolkit-1.2.0-*`; the asar root must be exactly
`node_modules`, `package.json`, `src`, with npm 11 under
`node_modules/npm` and no `.codesigning` directory; on macOS
`CFBundleShortVersionString` reads `1.2.0`.

## Risks and limitations

No UI change. The risk is a mis-scoped edit in `package-lock.json`,
where dependencies also carry version fields; the replacement was
confined to the first 2000 bytes of the file, which hold the two root
entries and nothing else, and both files were re-parsed as JSON
afterwards.

Manual passes on what reached trunk after beta.2: #528 and #530 on macOS
in their PRs; #530 plus #532 on Windows on #532's artifact (c7ec033),
including the case that failed on e0a3faa.

## Related

Part of #251. Release notes follow on the release; docs publish for the
tag per #487.

---

<details>
<summary>Review outcome (required, see AGENTS.md)</summary>

0 [fix here] · 0 [follow-up]. Deterministic layer only: lint clean, 1667
tests pass, both files valid JSON, diff confined to the three root
version fields. No judgement pass was run: this change has no logic to
review.

- **Review:** completed, deterministic layer, in session; head is the
single bump commit / base `4c3b05a` (trunk); evidence above; outcome:
nothing to fix.
- **Since review:** none.

</details>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Bump version to 1.2.0-beta.2 (#520)

## Why

`v1.2.0-beta.1` shipped on 20 September. Eight commits reach trunk since
then, all of them what the beta.1 pass and the review of its fixes
turned up, on macOS and on Windows: a Gutenberg trunk update and a
work-item switch no longer rebuild twice, the applied banner follows the
watch, Windows no longer opens console windows for a Gutenberg build nor
hangs on an orphaned worker, and macOS no longer fills the Dock with a
tile per build worker. The `v1.2.0-beta.2` milestone is empty.

`electron-builder` derives artifact names from `package.json`, so the
version has to move before the tag and the artifacts exist. A beta is a
pre-release, so `releases/latest` stays on `v1.1.0`.

## What changes

Only the version. All three package-version fields in `package.json` and
`package-lock.json` move together from `1.2.0-beta.1` to `1.2.0-beta.2`.
No dependency versions change, and there is no application behaviour
change in this PR.

## How to test this

Platforms: any for the suite; macOS and Windows for the artifact checks
that follow the merge.

1. `npm run lint` is clean and `npm test` passes, from the repository
root.
2. `node -e "console.log(require('./package.json').version)"` prints
`1.2.0-beta.2`.
3. `python3 -c "import
json;d=json.load(open('package-lock.json'));print(d['version'],
d['packages']['']['version'])"` prints `1.2.0-beta.2 1.2.0-beta.2`.

**What must not have happened:** no dependency version may change. `git
diff` must show exactly three changed lines, all of them the root
package version.

After merge, the release build must produce artifacts named
`wordpress-contributor-toolkit-1.2.0-beta.2-*`; the asar root must be
exactly `node_modules`, `package.json`, `src`, with npm 11 under
`node_modules/npm` and no `.codesigning` directory; on macOS
`CFBundleShortVersionString` reads `1.2.0-beta.2`.

## Risks and limitations

No UI change. The risk is a mis-scoped edit in `package-lock.json`,
where dependencies also carry version fields; the replacement was
confined to the first 2000 bytes of the file, which hold the two root
entries and nothing else, and both files were re-parsed as JSON
afterwards.

Verified locally on this branch: lint clean, `npm test` 1646 pass / 0
fail, `git diff` is 3 insertions and 3 deletions across the two files.

## Related

Part of #251. Release notes follow on the pre-release; docs publish for
the tag per #487.

---

<details>
<summary>Review outcome (required — see AGENTS.md)</summary>

0 [fix here] · 0 [follow-up]. Deterministic layer only: lint clean, 1646
tests pass, both files valid JSON, diff confined to the three root
version fields. No judgement pass was run: this change has no logic to
review.

- **Review:** completed — deterministic layer, in session; head is the
single bump commit / base `229d3eb` (trunk); evidence above; outcome:
nothing to fix.
- **Since review:** none.

</details>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Bump version to 1.2.0-beta.1 (#505)

## Why

`v1.1.0` shipped on 16 September. Sixteen commits since then reach
trunk, and this beta is the first build that carries the Gutenberg
contribution target (#251): a site can now be a checkout of
`WordPress/gutenberg`, served through Playground as a plugin in a stock
WordPress, with a GitHub issue as its work item, pull request checkout
from that issue, and a pull request opened against `WordPress/gutenberg`
from the app. The manual pass of that work ran on macOS and on Windows
over 18 to 20 September and found six issues; the four that affected the
first-run path are fixed on trunk (#489, #493, #496, #500, #504, and
#491 for the hint), the rest are on the `v1.2.0-beta.2` milestone.

`electron-builder` derives artifact names from `package.json`, so the
version has to move before the tag and the artifacts exist. A beta is a
pre-release, so `releases/latest` stays on `v1.1.0`.

## What changes

Only the version. All three package-version fields in `package.json` and
`package-lock.json` move together from `1.1.0` to `1.2.0-beta.1`. No
dependency versions change, and there is no application behaviour change
in this PR.

## How to test this

Platforms: any for the suite; macOS and Windows for the artifact checks
that follow the merge.

1. `npm run lint` is clean and `npm test` passes.
2. `node -e "console.log(require('./package.json').version)"` prints
`1.2.0-beta.1`.
3. `python3 -c "import
json;d=json.load(open('package-lock.json'));print(d['version'],
d['packages']['']['version'])"` prints `1.2.0-beta.1 1.2.0-beta.1`.

**What must not have happened:** no dependency version may change. `git
diff` must show exactly three changed lines, all of them the root
package version.

After merge, the release build must produce artifacts named
`wordpress-contributor-toolkit-1.2.0-beta.1-*`; the asar root must be
exactly `node_modules`, `package.json`, `src`, with npm 11 under
`node_modules/npm` and no `.codesigning` directory; on macOS
`CFBundleShortVersionString` reads `1.2.0-beta.1`.

## Risks and limitations

No UI change. The risk is a mis-scoped edit in `package-lock.json`,
where dependencies also carry version fields; the replacement was
confined to the first 2000 bytes of the file, which hold the two root
entries and nothing else, and both files were re-parsed as JSON
afterwards.

Verified locally on this branch: lint clean, `npm test` 1596 pass / 0
fail.

## Related

Part of #251. Release notes follow on the pre-release; docs publish for
the tag per #487.

---

<details>
<summary>Review outcome (required — see AGENTS.md)</summary>

0 [fix here] · 0 [follow-up]. Deterministic layer only: lint clean, 1596
tests pass, both files valid JSON, diff confined to the three root
version fields. No judgement pass was run: this change has no logic to
review.

- **Review:** completed — deterministic layer, in session; head is the
single bump commit / base `b5ca272` (trunk); evidence above; outcome:
nothing to fix.
- **Since review:** none.

</details>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Bump the version to 1.1.0 (#483)

## Why

This is the **stable 1.1.0**. `v1.1.0-beta.1` shipped on 12 September
and `v1.1.0-beta.2` on 14 September; between them they were downloaded
33 times across macOS, Windows and Linux, and no issue was filed against
either. The v1.1.0 milestone is closed, 21 of 21.

Shipping sooner rather than later is itself part of the reasoning: a
site created by 1.0 cannot be written to by 1.1, so every day 1.0.1
remains the stable release is another day of sites being created that
the next version can only read.

Four commits reach this tag that no beta carried: the Linux target list
narrowed to the one artifact that is actually published and probed
(#467), the apply panel moved above the site's other tickets (#472), the
applied-patch record now travelling with carried work (#473), and the
sidebar heading renamed (#482). Three of the four are visible on screen,
so the artifact gets a manual pass before the release is published
rather than the packaging check alone.

The version reaches two places a contributor sees, and both must carry
the real build: electron-builder embeds it in the artifact names
(`wordpress-contributor-toolkit-1.1.0-*`), and `src/logging.js` writes
`app <version>` as the log's first line, so a problem report names the
build it came from. That is why the bump merges before the tag.

## What changes

Only the version. All three package-version fields in `package.json` and
`package-lock.json` move together from `1.1.0-beta.2` to `1.1.0`. No
dependency versions change, and there is no application behaviour change
in this PR.

## How to test this

Platforms: any for the suite; macOS or Windows for the artifact check
that follows the merge.

In the repository root:

1. `npm run lint` is clean and `npm test` passes.
2. `node -e "console.log(require('./package.json').version)"` prints
`1.1.0`.
3. `python3 -c "import
json;d=json.load(open('package-lock.json'));print(d['version'],
d['packages']['']['version'])"` prints `1.1.0 1.1.0`.

**What must not have happened:** no dependency version may change. `git
diff trunk` shows exactly three changed lines, all of them the root
package version.

After merge, the release build must produce artifacts named
`wordpress-contributor-toolkit-1.1.0-*`, and the first line of a fresh
app log must read `app 1.1.0`.

## Risks and limitations

No UI change. The risk is a mis-scoped edit in `package-lock.json`,
where dependencies also carry version strings; the replacement was
confined to the first 2000 bytes of the file, which holds the two root
entries, and both files were re-parsed as JSON afterwards.

Unlike the betas, this tag becomes `releases/latest`, so it is what the
README badge and every "download the toolkit" link resolve to.

## Related

Same shape as #397 (v1.0.1), #457 (v1.1.0-beta.1) and #466
(v1.1.0-beta.2). The Gutenberg stack for v1.2.0 is held as a draft at
#468 until this tag is pushed, so it cannot reach trunk and ship inside
a release it has never been tested in; #479 waits for the same reason.

---

<details>
<summary>Review outcome (required — see AGENTS.md)</summary>

Version-only change, three lines. Verified locally on this branch: `npm
run lint` clean, `npm test` 1454 pass, 0 fail, 2 expected skips; `git
diff --stat` shows two files, three insertions, three deletions; both
JSON files parse. Nothing to fix, nothing deferred.

</details>

<details>
<summary>Screenshots or recording</summary>

Nothing on screen changes.

</details>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0121dia1RzfskutrzA8iSK1K

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Bump the version to 1.1.0-beta.2 (#466)

## Why

`v1.1.0-beta.1` shipped on 12 September. Trunk carries five commits
since, and this is the **second beta for 1.1.0**, published so
contributors can keep testing before the stable tag. The headline is
checking out a pull request as a real branch, with the author's commits
intact, in place of the unattributed diff the Apply panel produced
(#459, #460, #461, #463, closing #290 and #458); it also gives the app
an address a browser can hand a ticket to, `wpct://ticket/<id>` (#465,
closing #464).

The version reaches two places a contributor sees, and both must carry
the real build: electron-builder embeds it in the artifact names
(`wordpress-contributor-toolkit-1.1.0-beta.2-*`), and `src/logging.js`
writes `app <version>` as the log's first line, so a problem report
names the build it came from. That is why the bump merges before the
tag.

## What changes

Only the version. All three package-version fields in `package.json` and
`package-lock.json` move together from `1.1.0-beta.1` to `1.1.0-beta.2`.
No dependency versions change, and there is no application behaviour
change in this PR.

## How to test this

Platforms: any for the suite; macOS or Windows for the artifact check
that follows the merge.

In the repository root:

1. `npm run lint` is clean and `npm test` passes.
2. `node -e "console.log(require('./package.json').version)"` prints
`1.1.0-beta.2`.
3. `python3 -c "import
json;d=json.load(open('package-lock.json'));print(d['version'],
d['packages']['']['version'])"` prints `1.1.0-beta.2 1.1.0-beta.2`.

**What must not have happened:** no dependency version may change. `git
diff trunk` shows exactly three changed lines, all of them the root
package version.

After merge, the release build must produce artifacts named
`wordpress-contributor-toolkit-1.1.0-beta.2-*`, and the first line of a
fresh app log must read `app 1.1.0-beta.2`.

## Risks and limitations

No UI change. The risk is a mis-scoped edit in `package-lock.json`,
where dependencies also carry `1.1.0-beta.1`; the replacement was
confined to the first 2000 bytes of the file, which holds the two root
entries, and both files were re-parsed as JSON afterwards.

## Related

Same shape as #397 (v1.0.1) and #457 (v1.1.0-beta.1).

---

<details>
<summary>Review outcome (required — see AGENTS.md)</summary>

Version-only change, three lines. Verified locally on this branch: `npm
run lint` clean, `npm test` 1451 pass, 0 fail, 2 expected skips; `git
diff --stat` shows two files, three insertions, three deletions; both
JSON files parse. Nothing to fix, nothing deferred.

</details>

<details>
<summary>Screenshots or recording</summary>

Nothing on screen changes.

</details>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0121dia1RzfskutrzA8iSK1K

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Bump the version to 1.1.0-beta.1 (#457)

## Why

`v1.0.1` shipped on 21 August. Trunk carries 45 commits since, and this
is the **beta for 1.1.0**, published so contributors can test it before
the stable tag. The headline is the bundled Git: the app ships its own
Git binary and every checkout operation runs on it, so a contributor no
longer needs Git installed (#401 to #411, #418, #420). It also ships the
packaging allow-list (#450) and the fixes closed under the v1.1.0
milestone.

The version reaches two places a contributor sees, and both must carry
the real build: electron-builder embeds it in the artifact names
(`wordpress-contributor-toolkit-1.1.0-beta.1-*`), and `src/logging.js`
writes `app <version>` as the log's first line, so a problem report
names the build it came from. That is why the bump merges before the
tag.

## What changes

Only the version. All three package-version fields in `package.json` and
`package-lock.json` move together from `1.0.1` to `1.1.0-beta.1`. No
dependency versions change, and there is no application behaviour change
in this PR.

## How to test this

Platforms: any for the suite; macOS or Windows for the artifact check
that follows the merge.

In the repository root:

1. `npm run lint` is clean and `npm test` passes.
2. `node -e "console.log(require('./package.json').version)"` prints
`1.1.0-beta.1`.
3. `python3 -c "import
json;d=json.load(open('package-lock.json'));print(d['version'],
d['packages']['']['version'])"` prints `1.1.0-beta.1 1.1.0-beta.1`.

**What must not have happened:** no dependency version may change. `git
diff trunk` shows exactly three changed lines, all of them the root
package version.

After merge, the release build must produce artifacts named
`wordpress-contributor-toolkit-1.1.0-beta.1-*`, and the first line of a
fresh app log must read `app 1.1.0-beta.1`.

## Risks and limitations

No UI change. The risk is a mis-scoped edit in `package-lock.json`,
where dependencies also carry `1.0.1`; the replacement was confined to
the first 2000 bytes of the file, which holds the two root entries, and
both files were re-parsed as JSON afterwards.

## Related

Same shape as #244 (v1.0.0-beta.1) and #397 (v1.0.1).

---

<details>
<summary>Review outcome (required — see AGENTS.md)</summary>

Version-only change, three lines. Verified locally on this branch: `npm
run lint` clean, `npm test` 1316 pass, 0 fail; `git diff --stat` shows
two files, three insertions, three deletions; both JSON files parse.
Nothing to fix, nothing deferred.

</details>

<details>
<summary>Screenshots or recording</summary>

Nothing on screen changes.

</details>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0123opUnXoxs1CAN7YQ7q8KU

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Bump version to 1.0.1 (#397)

## Why

`v1.0.0` shipped on 14 August. Two of the thirteen commits since then
reach the packaged app:

- [#382](#382) — a
site can be deleted when Git marked it read-only, and the app says so
when it cannot.
- [#390](#390) —
the macOS signing step no longer writes the App Store Connect key into
the project, so it stops being packaged.

The other eleven are tests and documentation.

`electron-builder` derives artifact names from `package.json`, so the
version has to move before the tag and the artifacts exist.

There is a second reason this release is needed rather than optional.
Every macOS artifact published so far carries the notarization key
inside `app.asar` — the incident behind #390. The key is already
revoked, so it is inert, but the download still hands it out, and the
docs site's download button resolves against `releases/latest`.
Publishing v1.0.1 is what stops that button serving the compromised
build; v1.0.0's macOS asset is then deleted.

## What changes

Only the version. All three package-version fields in `package.json` and
`package-lock.json` move together from `1.0.0` to `1.0.1`. No dependency
versions change, and there is no application behaviour change in this
PR.

## How to test this

Platforms: any for the suite; macOS for the artifact check that follows
the merge.

1. `npm run lint` is clean and `npm test` passes.
2. `node -e "console.log(require('./package.json').version)"` prints
`1.0.1`.
3. `python3 -c "import
json;d=json.load(open('package-lock.json'));print(d['version'],
d['packages']['']['version'])"` prints `1.0.1 1.0.1` — both root entries
move together, and no dependency pinned at 1.0.0 was touched.

**What must not have happened:** no dependency version may change. `git
diff` must show exactly three lines, all of them the root package
version.

After merge, the release build must produce artifacts named
`wordpress-contributor-toolkit-1.0.1-*`, and the macOS one must contain
no `.codesigning` directory and no `apple_api_key`.

## Risks and limitations

No UI change. The risk is a mis-scoped edit in `package-lock.json`,
where several dependencies also sit at version `1.0.0`; the replacement
was confined to the first 2000 bytes of the file, which covers the two
root entries and nothing else, and both files were re-parsed as JSON
afterwards.

Verified locally on this branch: lint clean, `npm test` 1046 pass / 0
fail.

---

Review outcome (required — see AGENTS.md)

0 `[fix here]` · 0 `[follow-up]`. Deterministic layer only: lint clean,
1046 tests pass, both files valid JSON, diff confined to the three root
version fields. No judgement pass was run — this change has no logic to
review.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>