Publish workflow broken: npm@latest (12.x) dropped Node 20 support

[SanabriaRusso]

Symptom

The v0.0.9 tag push triggered Publish Package and it failed at the Update npm step, before installing dependencies, before tests, and before npm publish — run 30540591005:

npm error code EBADENGINE
npm error engine Unsupported engine
npm error Not compatible with your version of node/npm: npm@12.0.2
npm error notsup Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error notsup Actual:   {"npm":"10.8.2","node":"v20.20.2"}

Nothing was published — npm still shows only 0.0.6.

Root cause

.github/workflows/publish-npm.yml does:

- uses: actions/setup-node@v4
  with:
    node-version: '20'

# Ensure npm 11.5.1 or later is installed
- name: Update npm
  run: npm install -g npm@latest

npm@latest has moved to 12.0.2, whose engine requirement is ^22.22.2 || ^24.15.0 || >=26.0.0. The job runs Node v20.20.2, so the install is refused.

This is an upstream change, not a regression in this repo — it breaks any tag pushed from today onward, independent of what is being released.

Fix

Pin the major instead of tracking latest:

- name: Update npm
  run: npm install -g npm@11

npm@11 is currently 11.19.0 with engines ^20.17.0 || >=22.9.0 — satisfied by Node 20.20.2, and well past the 11.5.1 the existing comment calls for (trusted publishing / OIDC support). The unqualified npm@latest is what made this a time bomb; pinning the major keeps patch updates flowing without another silent engine break.

Why not bump Node to 22 instead

That is the more future-proof direction, but it is a wider change: the publish job also runs the full npm test, so bumping its Node version changes the runtime the release is validated against. #194 (P1: Upgrade to graphql-yoga 5 and Node 22 LTS) is already open and is the right place for that. This issue is scoped to unblocking releases on the current Node 20 baseline; once #194 lands, the pin can be revisited.

Recovery for v0.0.9

The v0.0.9 tag already exists at 3d254f7 but published nothing. Since no npm version was consumed, the tag can be moved to the commit containing this fix and re-pushed to retrigger a clean publish. Re-running the existing failed run does not help — a tag-push event runs the workflow file as it exists at the tagged commit, which still has the broken step.