From 6a4dc518c896fd941e40adefa3b9f6c76ac18ff2 Mon Sep 17 00:00:00 2001 From: Mahmoud Elmorabea Date: Thu, 30 Jul 2026 19:06:39 +0300 Subject: [PATCH] fix: pin npm to 11.x in the npm deploy job The 6.6.0 deploy created its git tag then failed to publish: the job installs npm globally with @latest, which has moved to 12.0.2, and npm 12 requires node ^22.22.2 || ^24.15.0 || >=26.0.0 while the job sets up node 20. npm error code EBADENGINE npm error notsup Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"} npm error notsup Actual: {"npm":"10.8.2","node":"v20.20.2"} The step exists to get OIDC support, which needs >= 11.5.1, so @latest was asking for more than the job needs and would have broken every deploy from the day npm 12 shipped. Pinning to 11.x keeps OIDC working and makes moving to npm 12 a deliberate change made together with node-version. Typed as fix rather than ci so that merging this cuts a release: 6.6.0 is tagged but was never published to npm, and the release it triggers is what actually ships the inbox that already landed on main. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/deploy-sdk.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/deploy-sdk.yml b/.github/workflows/deploy-sdk.yml index 624f4722..a5754b41 100644 --- a/.github/workflows/deploy-sdk.yml +++ b/.github/workflows/deploy-sdk.yml @@ -138,8 +138,11 @@ jobs: cache: 'npm' registry-url: 'https://registry.npmjs.org' + # Pinned to the 11.x line rather than @latest. OIDC needs >= 11.5.1, which 11.x satisfies, + # while npm 12 requires node >= 22.22.2 and so fails EBADENGINE against the node 20 above. + # Raise this deliberately alongside node-version, not by drifting with @latest. - name: Install npm 11.5.1+ for OIDC support - run: npm install -g npm@latest + run: npm install -g npm@11 - name: Install dependencies run: npm ci