From 5fb501eb81c5ff279d49bdb0a5e1399811c6eab5 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 10 Jul 2026 10:52:20 +0000 Subject: [PATCH 1/2] fix: handle npm 12 versions --json output in beta release script npm 12 changed `npm show versions --json` to wrap the version array in an outer array ([[...]]), which broke before-beta-release.js with "TypeError: v.startsWith is not a function". Since the publish workflow force-installs npm@latest, this silently regressed once npm 12 was released. Normalize the parsed output by flattening and keeping only strings, which also covers the case where npm returns a bare string for a single-version package. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01S3skLbP3YnDAYp124zzaS5 --- .github/scripts/before-beta-release.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/scripts/before-beta-release.js b/.github/scripts/before-beta-release.js index 560d8d5..1550ab5 100644 --- a/.github/scripts/before-beta-release.js +++ b/.github/scripts/before-beta-release.js @@ -19,7 +19,9 @@ writeFileSync(PKG_JSON_PATH, `${JSON.stringify(pkgJson, null, 2)}\n`); function addBetaSuffixToVersion(version) { const versionString = execSync(`npm show ${PACKAGE_NAME} versions --json`, { encoding: 'utf8' }); - const versions = JSON.parse(versionString); + // Normalize npm's output: npm 12 wraps the versions in an extra array ([[...]]), + // and npm returns a bare string for packages with a single published version. + const versions = [JSON.parse(versionString)].flat(Infinity).filter((v) => typeof v === 'string'); if (versions.some((v) => v === version)) { console.error( From e5e8b1e7694907fb385d30d2060bce6dabad743a Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 10 Jul 2026 11:43:45 +0000 Subject: [PATCH 2/2] fix: pin npm to v11 in publish workflow to avoid broken provenance npm 12.0.0's bundled libnpmpublish requires the top-level `sigstore` module but no longer bundles it, so `npm publish --provenance` fails with "Cannot find module 'sigstore'". Pin the global npm install to v11, which bundles sigstore and publishes correctly. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01S3skLbP3YnDAYp124zzaS5 --- .github/workflows/manual_publish_to_npm.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/manual_publish_to_npm.yaml b/.github/workflows/manual_publish_to_npm.yaml index b4a2619..f26f0b9 100644 --- a/.github/workflows/manual_publish_to_npm.yaml +++ b/.github/workflows/manual_publish_to_npm.yaml @@ -37,7 +37,9 @@ jobs: cache: 'npm' cache-dependency-path: 'package-lock.json' - name: Update npm - run: npm install -g npm@latest + # Pin to npm 11: npm 12.0.0 ships a broken `libnpmpublish` that requires the + # top-level `sigstore` module without bundling it, breaking `npm publish --provenance`. + run: npm install -g npm@11 - name: Install dependencies run: npm ci - name: Bump pre-release version