[mtrezza]

Bumps the transitive dev dependency npm (the npm CLI) from 11.20.0 to 11.21.1 (lock file only).

This is a security update for a development-only dependency. The vulnerable packages are bundled inside npm (inBundle), so they cannot be updated on their own. npm 11.21.1 bundles patched versions:

Bundled package	11.20.0	11.21.1	Advisory	Severity	First patched
brace-expansion	5.0.9	5.0.12	GHSA-q2hr-2g5m-vwhr	medium	5.0.12
ip-address	10.5.0	10.7.2	GHSA-rpw4-54j3-4h4q	medium	10.5.1
ip-address	10.5.0	10.7.2	GHSA-j6r3-76f7-8jcv	medium	10.7.1
ip-address	10.5.0	10.7.2	GHSA-2vr4-cq9g-pvrc	medium	10.5.1
postcss-selector-parser	7.1.4	7.1.6	GHSA-rj75-hqrm-r3gf	medium	7.1.6
undici	6.28.0	6.29.0	GHSA-r53p-7pc4-xj5r	low	6.28.1

npm is only required by @semantic-release/npm@13.1.5 (range ^11.6.2), which runs it in the release workflow. It is not in the production dependency tree, so this does not trigger a release. 11.21.1 is the newest 11.x release; 12.x is outside ^11.6.2.

Changes

• 11.21.0:
  • Feature: npm dist-tag supports OIDC authentication (feat(dist-tag): support OIDC authentication npm/cli#10056). It shares the OIDC token exchange with npm publish, which keeps its provenance auto-configuration. An exchanged token is now set in the non-persisted cli config layer instead of the user layer.
  • Docs: npm stage docs updated (docs: update npm stage docs to reflect that it can create new packages npm/cli#10050)
  • Dependencies: @npmcli/config@10.14.0 (deleting a config override now invalidates cached flattened options, part of feat(dist-tag): support OIDC authentication npm/cli#10056)
• 11.21.1:
  • Fix: write registry allowScripts keys under install-strategy=linked (fix: write registry allowScripts keys under install-strategy=linked npm/cli#10059)
  • Dependencies (deps: resolve production audit vulnerabilities npm/cli#10089): brace-expansion@5.0.12, ip-address@10.7.2, postcss-selector-parser@7.1.6, undici@6.29.0, http-cache-semantics@4.3.0
  • Workspaces: @npmcli/arborist@9.9.3 (fix: write registry allowScripts keys under install-strategy=linked npm/cli#10059, and ETARGET instead of ERESOLVE for unresolvable peer targets, fix(arborist): report ETARGET instead of ERESOLVE for unresolvable peer targets npm/cli#10118); libnpmdiff@8.1.14, libnpmexec@10.3.4, libnpmfund@7.0.28, libnpmpack@9.1.15 (arborist bump only)

Lock file diff: only node_modules/npm (version, resolved, integrity, dependency ranges) and its bundled node_modules/npm/node_modules/* entries change. No entries are added or removed. The bundled versions match npm/cli's package-lock.json at tag v11.21.1.

Breaking Changes

None

Code Changes Required

None — the upgrade is a drop-in replacement.

@semantic-release/npm runs npm whoami, npm version, npm publish and npm dist-tag add from the local node_modules (preferLocal). The release workflow (release-automated.yml) authenticates with NPM_TOKEN, does not grant id-token: write and does not enable provenance. So for both publish and dist-tag, npm's OIDC exchange returns early ("Skipped because incorrect permissions for id-token within GitHub workflow") and token authentication is unchanged. The bundled undici is only used by node-gyp, not by the registry or publish code path. The engines requirement (^20.17.0 || >=22.9.0) is the same as in 11.20.0 and is satisfied by the release workflow (Node 24) and the CI matrix (Node 20.18, 20.19, 22.12, 24.11). PR CI does not run these commands.

Summary by CodeRabbit

• Chores
  • Updated the project’s package-management tooling and bundled components. These maintenance updates do not change the app’s user-facing features or behavior.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: fe667098-228f-4928-a00f-cec470ee9546

📥 Commits

Reviewing files that changed from the base of the PR and between 529e837 and faaf30f.

📒 Files selected for processing: 1

• package-lock.json

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

📝 Walkthrough

The lockfile updates npm from 11.20.0 to 11.21.1, advances several npm dependency ranges, and refreshes versions of bundled dependencies.

Changes: npm Lockfile Refresh

Layer / File(s)	Summary
npm and bundled dependency updates package-lock.json	The lockfile updates npm and its Arborist, config, and libnpm* dependency versions and ranges. It also updates bundled brace-expansion, http-cache-semantics, ip-address, postcss-selector-parser, and undici versions.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Merge Risk: ⚪ Minimal · up to faaf3

The npm tooling update remains development-only and compatible with supported Node versions, so it does not change the production dependency tree. No merge-blocking risk is evident; normal CI checks remain appropriate.

Pre-merge checks: 7

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title begins with the allowed prefix "refactor:" and uses a capitalized first word. It accurately describes the npm version update in the lockfile.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		The pull request changes only package-lock.json. It upgrades the bundled, development-only npm 11.20.0 to 11.21.1 and raises bundled dependency versions, including brace-expansion, ip-address, postcss…
Engage In Review Feedback		No review feedback required engagement. The supplied review data shows zero actionable findings and no posted review threads.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Security Check

Explanation

The pull request changes only package-lock.json. It upgrades the bundled, development-only npm 11.20.0 to 11.21.1 and raises bundled dependency versions, including brace-expansion, ip-address, postcss-selector-parser, http-cache-semantics, and undici. No application source, workflow, authentication, or exported behavior changes are present. The diff introduces no security-vulnerability code pattern; it applies dependency security fixes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.77%. Comparing base (529e837) to head (faaf30f).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #630   +/-   ##
=======================================
  Coverage   97.77%   97.77%           
=======================================
  Files           2        2           
  Lines         225      225           
=======================================
  Hits          220      220           
  Misses          5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.