deps: upgrade npm to 12.0.2

[npm-cli-bot]

This PR contains changes from: npm@12.0.0 npm@12.0.1 npm@12.0.2

---

12.0.0

12.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm view --json now always returns an array.
• npm sbom --sbom-format=cyclonedx now reports the name field from each package's package.json instead of the on-disk directory name. The name, bom-ref, and purl of the root component and of aliased dependencies may change.
• npm no longer registers man pages with the system when installed globally. man npm-install will no longer work, but npm help install is unaffected.
• The npm pkg output is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly to npm view.
• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• The Twitter and Freenode profile fields have been removed from the npm registry. This means that users will no longer be able to set or view these fields in their npm profiles.
• npm will no longer attempt to resolve the path to node via whichnode. process.execPath is already set by Node to the resolved real path of the node binary, so the lookup was redundant. Scripts that expected npm to override process.execPath with a PATH-resolved (potentially symlinked) node path may be affected.
• the --json output of npm pack and npm publish have changed. They are now always consistent, and in the same format.
• the star, stars and unstar commands have been removed
• The npm adduser command has been removed. Create and manage user accounts on the npm website, and use npm login to authenticate on the command line.
• Preserve https protocol when working with git (#8703)
• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• root `preinstall` now runs before dependencies are installed.
• unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning.

Chores

• b77b532 #9735 remove pre-release mode from npm 12 and workspaces (#9735) (@reggi, @Copilot)

Dependencies

• workspace: @npmcli/arborist@10.0.0
• workspace: @npmcli/config@11.0.0
• workspace: libnpmaccess@11.0.0
• workspace: libnpmdiff@9.0.0
• workspace: libnpmexec@11.0.0
• workspace: libnpmfund@8.0.0
• workspace: libnpmorg@9.0.0
• workspace: libnpmpack@10.0.0
• workspace: libnpmpublish@12.0.0
• workspace: libnpmsearch@10.0.0
• workspace: libnpmteam@9.0.0
• workspace: libnpmversion@9.0.0

12.0.1

12.0.1 (2026-07-10)

Bug Fixes

• ecb02a8 #9745 view: avoid wrapping array results (#9745) (@reggi, @martinrrm, @Copilot)
• 47fc8b1 #9740 correct bundled sigstore from dev dependency conflict (#9740) (@james-pre)

Dependencies

• workspace: @npmcli/arborist@10.0.1
• workspace: libnpmdiff@9.0.1
• workspace: libnpmexec@11.0.1
• workspace: libnpmfund@8.0.1
• workspace: libnpmpack@10.0.1

12.0.2

12.0.2 (2026-07-27)

Bug Fixes

• 834408e #9760 pack: honor min-release-age-exclude (#9760) (@martinrrm, @Copilot)
• ef6cfea #9786 owner: use scoped registry for user lookup (#9786) (@martinrrm, @Copilot)

Documentation

• 9e17dc0 #9805 clarify npm 12 unknown-config breaking change in changelogs (#9805) (@Hashim1999164)

Chores

• 7b1f6c1 #9747 parse pack --json object output in node integration (#9747) (@reggi, @Copilot)

Dependencies

• workspace: @npmcli/arborist@10.0.2
• workspace: @npmcli/config@11.0.1
• workspace: libnpmdiff@9.0.2
• workspace: libnpmexec@11.0.2
• workspace: libnpmfund@8.0.2
• workspace: libnpmpack@10.0.2

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/75361/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/75367/

[marco-ippolito]

Possibly this should just be labeled with semver-major PRs that contain breaking changes and should be released in the next major version.

Anyway, pending the outcome of nodejs/Release#1161

The outcome is that npm 12 wont be backported. That has been discussed and decided by the release wg
nodejs/Release#1161 (comment)

[marco-ippolito]

The outcome is that npm 12 wont be backported. That has been discussed and decided by the release wg nodejs/Release#1161 (comment)

I'm fine with that decision, but it should be clearly documented into that issue. The comment that you referred to, I interpreted as the decision still being open, even if the Releasers Team had formed a preferred opinion.

This does appear to be the consensus ...

is not the same as writing "We have decided ..."

Since the decision is owned by the release team, and the final consensus of the release team is to ship it as semver major, I think it is pretty much decided.