chore: upgrade to NPM v12

[coderbyheart]

Require npm >=12.0.2 <13 for this project (Node.js stays at >=22). It is enforced via
check-node-version on npm install and npm ci.

Why

npm v12 turns three code-execution paths off by default — most notably the
unauthorized execution of install scripts, which is the primary vector for
supply-chain attacks via compromised dependencies
(GitHub changelog):

• allowScripts now defaults to off, so npm install no longer executes
  preinstall, install or postinstall scripts from dependencies unless they
  are explicitly allowed in package.json. This also covers prepare scripts
  from git, file and link dependencies.
• --allow-git now defaults to none, which closes a code-execution path
  where a git dependency's .npmrc could override the git executable, even with
  --ignore-scripts.
• --allow-remote now defaults to none, blocking dependencies from remote
  URLs such as HTTPS tarballs.

Pinning engines.npm to >=12.0.2 <13 and failing the install when it is not
met means these protections cannot be silently bypassed by running an older npm
locally or in CI.

How

• engines.npm is set to >=12.0.2 <13. engines.node is left untouched.
• check-node-version --package runs from the prepare script, which npm
  executes on npm install and npm ci.
• CI installs the npm version declared in engines.npm through the new
  .github/actions/install-npm composite action, added after each
  actions/setup-node step.

The check is skipped during npm publish and npm pack, because semantic-release bundles its own npm (@semantic-release/npm depends on npm@^11.6.2) and runs the publish with that version rather than the one installed in CI.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	check-node-version@​4.2.1

View full report