[htnabe]

Summary

• Fix npm publish 404 failures during the Publish Release workflow

Changes

• Explicitly upgrade npm to ^11.5.1 after actions/setup-node in publish.yml, since Node 22 bundles npm 10.9.x which does not perform the OIDC token exchange required for Trusted Publishing
• Document the npm version requirement and the need for a registered Trusted Publisher entry on npmjs.com in docs/development/publishing.md

Root cause

Node 22's bundled npm (10.9.3) predates automatic OIDC token exchange support (requires npm >= 11.5.1). Without it, npm publish sent an unauthenticated request, and npm returns 404 (not 401/403) for scoped packages when unauthenticated, masking the real auth failure.

Validation

• YAML syntax validated with python3 yaml.safe_load
• bun run format:check

Risks

• None expected; this only affects the manual publish workflow.

Checklist

• Conventional commit(s) with gitemoji used
• Commit granularity is meaningful
• Tests and lint were run as appropriate
• Documentation updated if needed

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!