fix(ci): pin release workflow to npm 11 (#609)

npm@latest now resolves to npm 12, whose install-time security defaults break the release pipeline.
2026-07-09 23:49:17 -07:00
parent e8c8ab0d78
commit 4c76a5f1d2
1 changed files with 2 additions and 2 deletions
@@ -23,9 +23,9 @@ jobs:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'

-      # Ensure npm 11.5.1 or later is installed
+      # Stay on the latest npm 11 release
      - name: Update npm
-        run: npm install -g npm@latest
+        run: npm install -g npm@11

      - name: Install dependencies
        run: npm ci