Update npm to v11 in Node.js v22

[mcollina]

We should update NPM to v11 in Node.js v22 to work around this bug npm/cli#8184.

It's causing some friction with a lot of users.

What are the breaking changes? According to https://github.com/npm/cli/blob/latest/CHANGELOG.md doesn't look like there are many.

cc @nodejs/npm @nodejs/releasers

[richardlau]

What are the breaking changes?

• deps: upgrade npm to 11.0.0 #56274 (comment)
• deps: upgrade npm to 11.0.0 #56274 (comment)

Also from #58347 (comment) it sounds like there's some sort of issue on Windows with npm 11.4.0?

[wraithgar]

I'll isolate the (relevant) breaking changes here just to help keep folks on one page:

• Upon publishing, in order to apply a default "latest" dist tag, the command now retrieves all prior versions of the package. It will require that the version you're trying to publish is above the latest semver version in the registry, not including pre-release tags.
• npm init now has a type prompt, and sorts the entries the created packages differently
• bun.lockb files are now included in the strict ignore list during packing
• When publishing a package with a pre-release version, you must explicitly specify a tag.
• --ignore-scripts now applies to all lifecycle scripts, include prepare
• npm will no longer fall back to the old audit endpoint if the bulk advisory request fails.
• npm will no longer switch to global mode if aliased to "npmg" or "npm-g" etc.
• The npm hook command has been removed
• Attestations made by this package will no longer validate in npm versions prior to 10.6.0

The Windows issue is isolated to Powershell users, and is being worked on. The bugs that the new code is trying to fix exists in npm 10 already, and we are waiting on backports till it is all worked out.

[alexsch01]

The biggest breaking change / annoyance is the deprecation warning for non-NPM config options in .npmrc files

@wraithgar for that Windows issue, I just finished fixing the redirection

[ljharb]

I agree; all the rest of them are preventing footguns, so even if users are annoyed, they'll figure out the explicit better path easily. That config one, though, might cause some friction.

[alexsch01]

npm/cli#8332