refactor: Bump npm from 10.9.9 to 11.20.0

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Resolves the security advisories of the dependencies bundled in npm 10.9.9 for the development dependency tree (release tooling):

• ip-address: GHSA-mwp4-54f8-5fhr (high, fixed in 10.3.1; https://github.com/parse-community/parse-dashboard/security/dependabot/416) and GHSA-v2v4-37r5-5v8g (medium, fixed in 10.1.1; https://github.com/parse-community/parse-dashboard/security/dependabot/329)
• brace-expansion: GHSA-3jxr-9vmj-r5cp (high, fixed in 2.1.2; https://github.com/parse-community/parse-dashboard/security/dependabot/396)
• sigstore: GHSA-52v5-jr5w-gjxr (high, fixed in 4.1.1; https://github.com/parse-community/parse-dashboard/security/dependabot/388)
• @sigstore/core: GHSA-jfc7-64v2-mr8c (medium, fixed in 3.2.1; https://github.com/parse-community/parse-dashboard/security/dependabot/383)
• picomatch: GHSA-3v7f-55p6-f55p (medium, fixed in 4.0.4; https://github.com/parse-community/parse-dashboard/security/dependabot/274)
• postcss-selector-parser: GHSA-w9m9-85wc-3x92 (low, fixed in 7.1.3; https://github.com/parse-community/parse-dashboard/security/dependabot/438)

Approach

npm 10.9.9 is required as npm ^10.5.0 by @semantic-release/npm 11.0.3, which is a dependency of semantic-release 22 under @saithodev/semantic-release-backmerge 4.0.1. npm 10.9.9 is the latest 10.x release, and @saithodev/semantic-release-backmerge 4.0.1 is its final release (the repository is archived), so the bundled dependencies can only be updated with an override.

This adds a scoped override so that npm resolves to 11.20.0 inside the @saithodev/semantic-release-backmerge dependency tree only:

"overrides": {
  "@saithodev/semantic-release-backmerge": {
    "npm": "11.20.0"
  }
}

@semantic-release/npm 13.1.4 already requires npm ^11.6.2 and uses npm 11.20.0, so both now share one npm 11.20.0 copy:

• node_modules/npm: 10.9.9 → 11.20.0 (the same package and bundled dependencies as the existing npm 11.20.0 copy)
• node_modules/@semantic-release/npm/node_modules/npm 11.20.0: removed (deduplicated)

@saithodev/semantic-release-backmerge does not run npm or load @semantic-release/npm 11; it only runs git and imports semantic-release/lib/get-git-auth-url.js.

Releases will publish with npm 11.20.0. The release workflow's @semantic-release/npm 13.1.4 runs npm whoami, npm publish and npm dist-tag through the root node_modules/.bin/npm, which currently resolves to npm 10.9.9 and after this change resolves to npm 11.20.0.

Changes

• npm 11.0.0: Supports Node ^20.17.0 || >=22.9.0. Publishing a pre-release version requires an explicit --tag, and applying the default latest tag requires a version above the latest published version. --ignore-scripts also applies to prepare.
• npm 11.1.0 – 11.20.0: New opt-in features (trusted publishing via OIDC, allow-scripts, allow-git / allow-file / allow-directory / allow-remote, min-release-age) and bundled dependency updates (ip-address 10.5.0, brace-expansion 5.0.9, sigstore 4.1.1, @sigstore/core 3.2.1, picomatch 4.0.4, postcss-selector-parser 7.1.4, tar 7.5.22)

Breaking Changes

None for this repository. Publishing with npm 11.20.0 matches the npm ^11.6.2 that @semantic-release/npm 13.1.4 requires. @semantic-release/npm always passes an explicit --tag to npm publish, so the npm 11 tag requirements do not apply. The release workflow does not grant id-token: write, so publishing continues to use NPM_TOKEN. npm 11.20.0 supports all Node versions in the CI matrix.

Code Changes Required

None. The change is limited to an overrides entry in package.json and the lock file.

Tasks

No tasks apply; this PR only changes development dependency resolution.

Summary by CodeRabbit

• Chores
  • Applied a small internal maintenance update. No changes to app functionality or the end-user experience are included in this release.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: d35ef216-921d-448f-8aae-a2f4cbabc842

📥 Commits

Reviewing files that changed from the base of the PR and between c23655a and 9df13d1.

📒 Files selected for processing (2)

• package-lock.json
• package.json

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 4 remain after this review.

---

📝 Walkthrough

Walkthrough

package.json adds an override that pins the npm dependency of @saithodev/semantic-release-backmerge to version 11.20.0.

Changes

Dependency Override

Layer / File(s)	Summary
Pin nested npm dependency package.json	The override sets @saithodev/semantic-release-backmerge’s npm dependency to version 11.20.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to 9df13

The dependency override has no established release-workflow blocker; the PR is mergeable after normal checks.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title begins with the allowed prefix refactor: and uses a capitalized first letter in the summary, Bump. It accurately describes the dependency version change.
Description check	✅ Passed	The description includes the required Pull Request, Issue, Approach, and Tasks sections. It explains the security advisories, scoped override, dependency effects, compatibility assessment, and testing…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	The pull request changes only package manifests and the lockfile. The override replaces npm 10.9.9 with the registry-pinned npm 11.20.0 copy. The lockfile shows the related bundled packages at the rep…
Engage In Review Feedback	✅ Passed	No review feedback comments or actionable findings are present. Therefore, the pull request had no feedback that required engagement, implementation, or discussion before resolution.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}