From 4de0e83d518f5337730193f694d70277209cdb61 Mon Sep 17 00:00:00 2001 From: Daniel Sogl Date: Mon, 27 Jul 2026 21:33:46 +0200 Subject: [PATCH] ci: run workflows on node 24 Also drops the explicit `npm install -g npm@latest` step: node 24 bundles npm 11.16, well over the >= 11.5.1 that trusted publishing requires. Pulling an unpinned npm@latest right before publishing 258 packages was the larger risk of the two. --- .github/workflows/nodejs.yml | 2 +- .github/workflows/release-please.yml | 7 ++----- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml index 6991d26b4..60ec73f7a 100644 --- a/.github/workflows/nodejs.yml +++ b/.github/workflows/nodejs.yml @@ -20,7 +20,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@v4.4.0 with: - node-version: 22 + node-version: 24 cache: npm - name: Install dependencies diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index d4dafa8a4..eb8dfa240 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -43,14 +43,11 @@ jobs: - name: Setup Node.js uses: actions/setup-node@v4.4.0 with: - node-version: 22 + # node 24 bundles npm 11.16, over the >= 11.5.1 that trusted publishing needs + node-version: 24 cache: npm registry-url: https://registry.npmjs.org - # node 22 ships npm 10.x; trusted publishing (OIDC) requires npm >= 11.5.1 - - name: Update npm - run: npm install -g npm@latest - - name: Install dependencies run: npm ci