From 268a3a15ab60d60101f78c7afc6e49d9eadfbed7 Mon Sep 17 00:00:00 2001
From: VickyXAI <115643921+VickyXAI@users.noreply.github.com>
Date: Tue, 20 Oct 2026 14:24:25 -0500
Subject: [PATCH] ci(publish): npm >= 11.5.1 for trusted publishing (OIDC)

With the package's Trusted Publisher pointed at this repo's publish.yml on
npmjs.com, npm exchanges the job's id-token for a one-off publish credential,
so publishing stops depending on a long-lived NPM_TOKEN (npm is restricting
2FA-bypass tokens). NODE_AUTH_TOKEN stays as the fallback until every package
is switched.
---
 .github/workflows/publish.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2bc272a..5702996 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -122,6 +122,13 @@ jobs:
           npm test
 
       # ---- npm ----
+      # npm trusted publishing (OIDC): with this package's Trusted Publisher set
+      # to this repo + publish.yml on npmjs.com, npm >= 11.5.1 exchanges the
+      # job's id-token for a one-off publish credential, so no long-lived
+      # NPM_TOKEN is needed. The token stays below as a fallback until every
+      # package is switched over.
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@^11.5.1
       - name: Publish to npm
         id: npm
         if: steps.v.outputs.pkg != steps.v.outputs.npm