From a346d5b43d5d487085ccd867b0b658111601a207 Mon Sep 17 00:00:00 2001 From: SanabriaRusso Date: Thu, 30 Jul 2026 14:01:19 +0200 Subject: [PATCH] ci(publish): pin npm to 11.x so the publish job works on Node 20 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `npm install -g npm@latest` now resolves to npm 12.0.2, whose engine requirement is ^22.22.2 || ^24.15.0 || >=26.0.0. The publish job pins node-version: '20', so the step fails EBADENGINE before dependencies are installed, before tests, and before npm publish. This broke the v0.0.9 release (run 30540591005) and would break any tag pushed from today onward, regardless of what is being released. npm@11 is 11.19.0 with engines ^20.17.0 || >=22.9.0 — satisfied by the job's Node 20.20.2 and well past the 11.5.1 that trusted publishing needs. Pinning the major keeps patch updates flowing without another silent engine break. Bumping to Node 22 is the more future-proof fix, but the publish job also runs the full npm test, so that changes the runtime the release is validated against. #194 is already open for that upgrade. Closes #206 Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/publish-npm.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index 71d22c2b..3cbfc795 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -32,9 +32,11 @@ jobs: with: node-version: '20' - # Ensure npm 11.5.1 or later is installed + # Trusted publishing needs npm 11.5.1 or later. Pin the major rather than + # tracking `latest`: npm 12 requires Node >= 22.22.2, so `npm@latest` + # fails EBADENGINE against the Node 20 pinned above. - name: Update npm - run: npm install -g npm@latest + run: npm install -g npm@11 - run: npm ci - run: npm run build --if-present