deps: upgrade npm to 12.2.2

PR-URL: https://github.com/nodejs/node/pull/67265
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

deps/npm/docs/content/commands/npm-ls.md

@@ -23,7 +23,7 @@ Note that nested packages will *also* show the paths to the specified packages.
 For example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-npm@12.1.0 /path/to/npm
+npm@12.2.2 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 ```

deps/npm/docs/content/commands/npm-stage.md

@@ -40,6 +40,7 @@ Key behaviors:
   version for that package.
 * You can still publish packages normally while you have staged packages
   pending.
+* Staged publishing will allow you to create a new package if it does not exist.
 * You can stage multiple versions of the same package.
 * `npm stage publish` has parity with `npm publish` and will respect
   `"private": true` in `package.json`, refusing to stage the package.
@@ -50,8 +51,6 @@ Before using `npm stage` commands, ensure the following requirements are met:
 
 * **Write permissions on the package:** You must have write access to the
   package you're configuring.
-* **Package must exist:** The package you're configuring must already exist
-  on the npm registry.
 * **2FA enabled on your account:** Commands that require 2FA will prompt you
   to authenticate. If you don't already have 2FA enabled on your account,
   you must enable it before using these commands.

deps/npm/docs/content/commands/npm.md

@@ -14,7 +14,7 @@ Note: This command is unaware of workspaces.
 
 ### Version
 
-12.1.0
+12.2.2
 
 ### Description
 

deps/npm/docs/output/commands/npm-access.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-access----1210">
+<h1 id="----npm-access----1222">
     <span>npm-access</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Set access level on published packages</span>
 </header>

deps/npm/docs/output/commands/npm-approve-scripts.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-approve-scripts----1210">
+<h1 id="----npm-approve-scripts----1222">
     <span>npm-approve-scripts</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Approve install scripts for specific dependencies</span>
 </header>

deps/npm/docs/output/commands/npm-audit.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-audit----1210">
+<h1 id="----npm-audit----1222">
     <span>npm-audit</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Run a security audit</span>
 </header>

deps/npm/docs/output/commands/npm-bugs.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-bugs----1210">
+<h1 id="----npm-bugs----1222">
     <span>npm-bugs</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Report bugs for a package in a web browser</span>
 </header>

deps/npm/docs/output/commands/npm-cache.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-cache----1210">
+<h1 id="----npm-cache----1222">
     <span>npm-cache</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Manipulates packages cache</span>
 </header>

deps/npm/docs/output/commands/npm-ci.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ci----1210">
+<h1 id="----npm-ci----1222">
     <span>npm-ci</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Clean install a project</span>
 </header>

deps/npm/docs/output/commands/npm-completion.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-completion----1210">
+<h1 id="----npm-completion----1222">
     <span>npm-completion</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Tab Completion for npm</span>
 </header>

deps/npm/docs/output/commands/npm-config.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-config----1210">
+<h1 id="----npm-config----1222">
     <span>npm-config</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Manage the npm configuration files</span>
 </header>

deps/npm/docs/output/commands/npm-dedupe.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-dedupe----1210">
+<h1 id="----npm-dedupe----1222">
     <span>npm-dedupe</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Reduce duplication in the package tree</span>
 </header>

deps/npm/docs/output/commands/npm-deny-scripts.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-deny-scripts----1210">
+<h1 id="----npm-deny-scripts----1222">
     <span>npm-deny-scripts</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Deny install scripts for specific dependencies</span>
 </header>

deps/npm/docs/output/commands/npm-deprecate.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-deprecate----1210">
+<h1 id="----npm-deprecate----1222">
     <span>npm-deprecate</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Deprecate a version of a package</span>
 </header>

deps/npm/docs/output/commands/npm-diff.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-diff----1210">
+<h1 id="----npm-diff----1222">
     <span>npm-diff</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">The registry diff command</span>
 </header>

deps/npm/docs/output/commands/npm-dist-tag.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-dist-tag----1210">
+<h1 id="----npm-dist-tag----1222">
     <span>npm-dist-tag</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Modify package distribution tags</span>
 </header>

deps/npm/docs/output/commands/npm-docs.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-docs----1210">
+<h1 id="----npm-docs----1222">
     <span>npm-docs</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Open documentation for a package in a web browser</span>
 </header>

deps/npm/docs/output/commands/npm-doctor.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-doctor----1210">
+<h1 id="----npm-doctor----1222">
     <span>npm-doctor</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Check the health of your npm environment</span>
 </header>

deps/npm/docs/output/commands/npm-edit.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-edit----1210">
+<h1 id="----npm-edit----1222">
     <span>npm-edit</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Edit an installed package</span>
 </header>

deps/npm/docs/output/commands/npm-exec.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-exec----1210">
+<h1 id="----npm-exec----1222">
     <span>npm-exec</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Run a command from a local or remote npm package</span>
 </header>

deps/npm/docs/output/commands/npm-explain.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-explain----1210">
+<h1 id="----npm-explain----1222">
     <span>npm-explain</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Explain installed packages</span>
 </header>

deps/npm/docs/output/commands/npm-explore.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-explore----1210">
+<h1 id="----npm-explore----1222">
     <span>npm-explore</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Browse an installed package</span>
 </header>

deps/npm/docs/output/commands/npm-find-dupes.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-find-dupes----1210">
+<h1 id="----npm-find-dupes----1222">
     <span>npm-find-dupes</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Find duplication in the package tree</span>
 </header>

deps/npm/docs/output/commands/npm-fund.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-fund----1210">
+<h1 id="----npm-fund----1222">
     <span>npm-fund</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Retrieve funding information</span>
 </header>

deps/npm/docs/output/commands/npm-get.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-get----1210">
+<h1 id="----npm-get----1222">
     <span>npm-get</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Get a value from the npm configuration</span>
 </header>

deps/npm/docs/output/commands/npm-help-search.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-help-search----1210">
+<h1 id="----npm-help-search----1222">
     <span>npm-help-search</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Search npm help documentation</span>
 </header>

deps/npm/docs/output/commands/npm-help.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-help----1210">
+<h1 id="----npm-help----1222">
     <span>npm-help</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Get help on npm</span>
 </header>

deps/npm/docs/output/commands/npm-init.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-init----1210">
+<h1 id="----npm-init----1222">
     <span>npm-init</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Create a package.json file</span>
 </header>

deps/npm/docs/output/commands/npm-install-ci-test.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-ci-test----1210">
+<h1 id="----npm-install-ci-test----1222">
     <span>npm-install-ci-test</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Install a project with a clean slate and run tests</span>
 </header>

deps/npm/docs/output/commands/npm-install-scripts.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-scripts----1210">
+<h1 id="----npm-install-scripts----1222">
     <span>npm-install-scripts</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Manage install-script approvals for dependencies</span>
 </header>

deps/npm/docs/output/commands/npm-install-test.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-test----1210">
+<h1 id="----npm-install-test----1222">
     <span>npm-install-test</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Install package(s) and run tests</span>
 </header>

deps/npm/docs/output/commands/npm-install.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install----1210">
+<h1 id="----npm-install----1222">
     <span>npm-install</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Install a package</span>
 </header>

deps/npm/docs/output/commands/npm-link.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-link----1210">
+<h1 id="----npm-link----1222">
     <span>npm-link</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Symlink a package folder</span>
 </header>

deps/npm/docs/output/commands/npm-ll.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ll----1210">
+<h1 id="----npm-ll----1222">
     <span>npm-ll</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">List installed packages</span>
 </header>

deps/npm/docs/output/commands/npm-login.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-login----1210">
+<h1 id="----npm-login----1222">
     <span>npm-login</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Login to a registry user account</span>
 </header>

deps/npm/docs/output/commands/npm-logout.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-logout----1210">
+<h1 id="----npm-logout----1222">
     <span>npm-logout</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Log out of the registry</span>
 </header>

deps/npm/docs/output/commands/npm-ls.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ls----1210">
+<h1 id="----npm-ls----1222">
     <span>npm-ls</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">List installed packages</span>
 </header>
@@ -209,7 +209,7 @@ alias: list
 <p>Positional arguments are <code>name@version-range</code> identifiers, which will limit the results to only the paths to the packages named.
 Note that nested packages will <em>also</em> show the paths to the specified packages.
 For example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
-<pre><code class="language-bash">npm@12.1.0 /path/to/npm
+<pre><code class="language-bash">npm@12.2.2 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 </code></pre>

deps/npm/docs/output/commands/npm-org.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-org----1210">
+<h1 id="----npm-org----1222">
     <span>npm-org</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Manage orgs</span>
 </header>

deps/npm/docs/output/commands/npm-outdated.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-outdated----1210">
+<h1 id="----npm-outdated----1222">
     <span>npm-outdated</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Check for outdated packages</span>
 </header>

deps/npm/docs/output/commands/npm-owner.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-owner----1210">
+<h1 id="----npm-owner----1222">
     <span>npm-owner</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Manage package owners</span>
 </header>

deps/npm/docs/output/commands/npm-pack.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-pack----1210">
+<h1 id="----npm-pack----1222">
     <span>npm-pack</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Create a tarball from a package</span>
 </header>

deps/npm/docs/output/commands/npm-patch.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-patch----1210">
+<h1 id="----npm-patch----1222">
     <span>npm-patch</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Apply local patches to installed dependencies</span>
 </header>

deps/npm/docs/output/commands/npm-ping.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ping----1210">
+<h1 id="----npm-ping----1222">
     <span>npm-ping</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Ping npm registry</span>
 </header>

deps/npm/docs/output/commands/npm-pkg.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-pkg----1210">
+<h1 id="----npm-pkg----1222">
     <span>npm-pkg</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Manages your package.json</span>
 </header>

deps/npm/docs/output/commands/npm-prefix.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-prefix----1210">
+<h1 id="----npm-prefix----1222">
     <span>npm-prefix</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Display prefix</span>
 </header>

deps/npm/docs/output/commands/npm-profile.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-profile----1210">
+<h1 id="----npm-profile----1222">
     <span>npm-profile</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Change settings on your registry profile</span>
 </header>

deps/npm/docs/output/commands/npm-prune.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-prune----1210">
+<h1 id="----npm-prune----1222">
     <span>npm-prune</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Remove extraneous packages</span>
 </header>

deps/npm/docs/output/commands/npm-publish.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-publish----1210">
+<h1 id="----npm-publish----1222">
     <span>npm-publish</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Publish a package</span>
 </header>

deps/npm/docs/output/commands/npm-query.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-query----1210">
+<h1 id="----npm-query----1222">
     <span>npm-query</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Dependency selector query</span>
 </header>

deps/npm/docs/output/commands/npm-rebuild.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-rebuild----1210">
+<h1 id="----npm-rebuild----1222">
     <span>npm-rebuild</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Rebuild a package</span>
 </header>

deps/npm/docs/output/commands/npm-repo.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-repo----1210">
+<h1 id="----npm-repo----1222">
     <span>npm-repo</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Open package repository page in the browser</span>
 </header>

deps/npm/docs/output/commands/npm-restart.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-restart----1210">
+<h1 id="----npm-restart----1222">
     <span>npm-restart</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Restart a package</span>
 </header>

deps/npm/docs/output/commands/npm-root.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-root----1210">
+<h1 id="----npm-root----1222">
     <span>npm-root</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Display npm root</span>
 </header>

deps/npm/docs/output/commands/npm-run.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-run----1210">
+<h1 id="----npm-run----1222">
     <span>npm-run</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Run arbitrary package scripts</span>
 </header>

deps/npm/docs/output/commands/npm-sbom.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-sbom----1210">
+<h1 id="----npm-sbom----1222">
     <span>npm-sbom</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Generate a Software Bill of Materials (SBOM)</span>
 </header>

deps/npm/docs/output/commands/npm-search.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-search----1210">
+<h1 id="----npm-search----1222">
     <span>npm-search</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Search for packages</span>
 </header>

deps/npm/docs/output/commands/npm-set.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-set----1210">
+<h1 id="----npm-set----1222">
     <span>npm-set</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Set a value in the npm configuration</span>
 </header>

deps/npm/docs/output/commands/npm-stage.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-stage----1210">
+<h1 id="----npm-stage----1222">
     <span>npm-stage</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Stage packages for publishing</span>
 </header>
@@ -226,6 +226,7 @@ packages — you cannot publish a version that already exists as a staged
 version for that package.</li>
 <li>You can still publish packages normally while you have staged packages
 pending.</li>
+<li>Staged publishing will allow you to create a new package if it does not exist.</li>
 <li>You can stage multiple versions of the same package.</li>
 <li><code>npm stage publish</code> has parity with <code>npm publish</code> and will respect
 <code>"private": true</code> in <code>package.json</code>, refusing to stage the package.</li>
@@ -235,8 +236,6 @@ pending.</li>
 <ul>
 <li><strong>Write permissions on the package:</strong> You must have write access to the
 package you're configuring.</li>
-<li><strong>Package must exist:</strong> The package you're configuring must already exist
-on the npm registry.</li>
 <li><strong>2FA enabled on your account:</strong> Commands that require 2FA will prompt you
 to authenticate. If you don't already have 2FA enabled on your account,
 you must enable it before using these commands.</li>

deps/npm/docs/output/commands/npm-start.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-start----1210">
+<h1 id="----npm-start----1222">
     <span>npm-start</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Start a package</span>
 </header>

deps/npm/docs/output/commands/npm-stop.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-stop----1210">
+<h1 id="----npm-stop----1222">
     <span>npm-stop</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Stop a package</span>
 </header>

deps/npm/docs/output/commands/npm-team.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-team----1210">
+<h1 id="----npm-team----1222">
     <span>npm-team</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Manage organization teams and team memberships</span>
 </header>

deps/npm/docs/output/commands/npm-test.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-test----1210">
+<h1 id="----npm-test----1222">
     <span>npm-test</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Test a package</span>
 </header>

deps/npm/docs/output/commands/npm-token.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-token----1210">
+<h1 id="----npm-token----1222">
     <span>npm-token</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Manage your authentication tokens</span>
 </header>

deps/npm/docs/output/commands/npm-trust.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-trust----1210">
+<h1 id="----npm-trust----1222">
     <span>npm-trust</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Manage trusted publishing relationships between packages and CI/CD providers</span>
 </header>

deps/npm/docs/output/commands/npm-undeprecate.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-undeprecate----1210">
+<h1 id="----npm-undeprecate----1222">
     <span>npm-undeprecate</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Undeprecate a version of a package</span>
 </header>

deps/npm/docs/output/commands/npm-uninstall.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-uninstall----1210">
+<h1 id="----npm-uninstall----1222">
     <span>npm-uninstall</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Remove a package</span>
 </header>

deps/npm/docs/output/commands/npm-unpublish.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-unpublish----1210">
+<h1 id="----npm-unpublish----1222">
     <span>npm-unpublish</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Remove a package from the registry</span>
 </header>

deps/npm/docs/output/commands/npm-update.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-update----1210">
+<h1 id="----npm-update----1222">
     <span>npm-update</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Update packages</span>
 </header>

deps/npm/docs/output/commands/npm-version.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-version----1210">
+<h1 id="----npm-version----1222">
     <span>npm-version</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Bump a package version</span>
 </header>

deps/npm/docs/output/commands/npm-view.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-view----1210">
+<h1 id="----npm-view----1222">
     <span>npm-view</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">View registry info</span>
 </header>

deps/npm/docs/output/commands/npm-whoami.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-whoami----1210">
+<h1 id="----npm-whoami----1222">
     <span>npm-whoami</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Display npm username</span>
 </header>

deps/npm/docs/output/commands/npm.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm----1210">
+<h1 id="----npm----1222">
     <span>npm</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">javascript package manager</span>
 </header>
@@ -203,7 +203,7 @@ npm command-line interface
 </code></pre>
 <p>Note: This command is unaware of workspaces.</p>
 <h3 id="version">Version</h3>
-<p>12.1.0</p>
+<p>12.2.2</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.
 It puts modules in place so that node can find them, and manages dependency conflicts intelligently.</p>

deps/npm/docs/output/commands/npx.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npx----1210">
+<h1 id="----npx----1222">
     <span>npx</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Run a command from a local or remote npm package</span>
 </header>

deps/npm/docs/output/configuring-npm/folders.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----folders----1210">
+<h1 id="----folders----1222">
     <span>Folders</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Folder structures used by npm</span>
 </header>

deps/npm/docs/output/configuring-npm/install.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----install----1210">
+<h1 id="----install----1222">
     <span>Install</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Download and install node and npm</span>
 </header>

deps/npm/docs/output/configuring-npm/npm-extension.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-extension----1210">
+<h1 id="----npm-extension----1222">
     <span>.npm-extension</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Imperative, root-owned manifest repairs</span>
 </header>

deps/npm/docs/output/configuring-npm/npm-global.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----folders----1210">
+<h1 id="----folders----1222">
     <span>Folders</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Folder structures used by npm</span>
 </header>

deps/npm/docs/output/configuring-npm/npm-json.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----packagejson----1210">
+<h1 id="----packagejson----1222">
     <span>package.json</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Specifics of npm's package.json handling</span>
 </header>

deps/npm/docs/output/configuring-npm/npmrc.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----npmrc----1210">
+<h1 id="----npmrc----1222">
     <span>.npmrc</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">The npm config files</span>
 </header>

deps/npm/docs/output/configuring-npm/package-json.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----packagejson----1210">
+<h1 id="----packagejson----1222">
     <span>package.json</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Specifics of npm's package.json handling</span>
 </header>

deps/npm/docs/output/configuring-npm/package-lock-json.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----package-lockjson----1210">
+<h1 id="----package-lockjson----1222">
     <span>package-lock.json</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">A manifestation of the manifest</span>
 </header>

deps/npm/docs/output/using-npm/config.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----config----1210">
+<h1 id="----config----1222">
     <span>Config</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">About npm configuration</span>
 </header>

deps/npm/docs/output/using-npm/dependency-selectors.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----dependency-selectors----1210">
+<h1 id="----dependency-selectors----1222">
     <span>Dependency Selectors</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Dependency Selector Syntax &amp; Querying</span>
 </header>

deps/npm/docs/output/using-npm/developers.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----developers----1210">
+<h1 id="----developers----1222">
     <span>Developers</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Developer guide</span>
 </header>

deps/npm/docs/output/using-npm/logging.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----logging----1210">
+<h1 id="----logging----1222">
     <span>Logging</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Why, What &amp; How we Log</span>
 </header>

deps/npm/docs/output/using-npm/orgs.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----organizations----1210">
+<h1 id="----organizations----1222">
     <span>Organizations</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Working with teams &amp; organizations</span>
 </header>

deps/npm/docs/output/using-npm/package-spec.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----package-spec----1210">
+<h1 id="----package-spec----1222">
     <span>Package spec</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Package name specifier</span>
 </header>

deps/npm/docs/output/using-npm/registry.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----registry----1210">
+<h1 id="----registry----1222">
     <span>Registry</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">The JavaScript Package Registry</span>
 </header>

deps/npm/docs/output/using-npm/removal.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----removal----1210">
+<h1 id="----removal----1222">
     <span>Removal</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Cleaning the slate</span>
 </header>

deps/npm/docs/output/using-npm/scope.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----scope----1210">
+<h1 id="----scope----1222">
     <span>Scope</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Scoped packages</span>
 </header>

deps/npm/docs/output/using-npm/scripts.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----scripts----1210">
+<h1 id="----scripts----1222">
     <span>Scripts</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">How npm handles the "scripts" field</span>
 </header>

deps/npm/docs/output/using-npm/workspaces.html

@@ -186,9 +186,9 @@ npm command-line interface
 
 <section id="content">
 <header class="title">
-<h1 id="----workspaces----1210">
+<h1 id="----workspaces----1222">
     <span>Workspaces</span>
-    <span class="version">@12.1.0</span>
+    <span class="version">@12.2.2</span>
 </h1>
 <span class="description">Working with workspaces</span>
 </header>

deps/npm/lib/cli/entry.js

@@ -26,7 +26,7 @@ module.exports = async (process, validateEngines) => {
 
   // It is now safe to log a warning if they are using a version of node that is not going to fail on syntax errors but is still unsupported and untested and might not work reliably.
   // This is safe to use the logger now which we want since this will show up in the error log too.
-  if (!satisfies(validateEngines.node, validateEngines.engines)) {
+  if (!satisfies(validateEngines.node, validateEngines.engines, { includePrerelease: true })) {
     log.warn('cli', validateEngines.unsupportedMessage)
   }
 

deps/npm/lib/commands/dist-tag.js

@@ -3,6 +3,7 @@ const npmFetch = require('npm-registry-fetch')
 const semver = require('semver')
 const { log, output } = require('proc-log')
 const { otplease } = require('../utils/auth.js')
+const { oidc } = require('../utils/oidc.js')
 const pkgJson = require('@npmcli/package-json')
 const BaseCommand = require('../base-cmd.js')
 
@@ -101,6 +102,7 @@ class DistTag extends BaseCommand {
       throw new Error('Tag name must not be a valid SemVer range: ' + t)
     }
 
+    await this.#oidc(spec, opts)
     const tags = await this.fetchTags(spec, opts)
     if (tags[t] === version) {
       log.warn('dist-tag add', t, 'is already set to version', version)
@@ -130,6 +132,7 @@ class DistTag extends BaseCommand {
       throw this.usageError()
     }
 
+    await this.#oidc(spec, opts)
     const tags = await this.fetchTags(spec, opts)
     if (!tags[tag]) {
       log.info('dist-tag del', tag, 'is not a dist-tag on', spec.name)
@@ -163,6 +166,7 @@ class DistTag extends BaseCommand {
     spec = npa(spec)
 
     try {
+      await this.#oidc(spec, opts)
       const tags = await this.fetchTags(spec, opts)
       const msg =
         Object.keys(tags).map(k => `${k}: ${tags[k]}`).sort().join('\n')
@@ -202,6 +206,16 @@ class DistTag extends BaseCommand {
 
     return data
   }
+
+  async #oidc (spec, opts) {
+    const registry = npmFetch.pickRegistry(spec, opts)
+    await oidc({
+      packageName: spec.name,
+      registry,
+      opts,
+      config: this.npm.config,
+    })
+  }
 }
 
 module.exports = DistTag

deps/npm/lib/commands/patch.js

@@ -408,7 +408,7 @@ class Patch extends BaseCommand {
         pkgJson, patched, entry, name: entry.name, newVersion, newKey, diff, installedVersions,
       })
     } finally {
-      await rm(rebase.work, { recursive: true, force: true })
+      await this.#removeWork(rebase.work)
     }
   }
 
@@ -561,13 +561,24 @@ class Patch extends BaseCommand {
       }
       return { work, repo, newDir, conflicted }
     } catch (er) {
-      await rm(work, { recursive: true, force: true })
+      await this.#removeWork(work)
       throw er
     }
   }
 
+  // Remove the throwaway rebase workdir.
+  // Retries because git can briefly hold files there, and never throws so a cleanup failure cannot mask the real error.
+  async #removeWork (work) {
+    try {
+      await rm(work, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 })
+    } catch (er) {
+      log.verbose('patch', `could not remove ${work}: ${er.message}`)
+    }
+  }
+
   #git (args, cwd) {
-    return git.spawn(args, {
+    // The throwaway repo never needs maintenance and a detached auto-gc would race the workdir cleanup.
+    return git.spawn(['-c', 'gc.auto=0', '-c', 'maintenance.auto=false', ...args], {
       cwd,
       env: { ...process.env, GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_SYSTEM: '/dev/null' },
     })

deps/npm/lib/commands/publish.js

@@ -149,7 +149,13 @@ class Publish extends BaseCommand {
 
     const registry = npmFetch.pickRegistry(resolved, opts)
 
-    await oidc({ packageName: manifest.name, registry, opts, config: this.npm.config })
+    await oidc({
+      packageName: manifest.name,
+      registry,
+      opts,
+      config: this.npm.config,
+      enableProvenanceAutoConfiguration: true,
+    })
 
     const creds = this.npm.config.getCredentialsByURI(registry)
     const noCreds = !(creds.token || creds.username || creds.certfile && creds.keyfile)

deps/npm/lib/utils/allow-scripts-cmd.js

@@ -221,15 +221,13 @@ class AllowScriptsCmd extends BaseCommand {
     // edge name. A version or range on the arg narrows the match to installed
     // versions that satisfy it. Bundled deps are excluded for the same reason
     // as --all. Args that match nothing are returned in `unmatched`.
+    // Links stay matchable by their edge name (e.g. `foo` -> `file:./local-foo`), but each match is dereferenced to its target and deduplicated, since scripts only run on the target and keying policy off a Link's resolved spec writes store paths under install-strategy=linked (npm/cli#9939).
     const matched = []
     const unmatched = []
     for (const arg of args) {
       const { name: wantName, range } = parsePositional(arg)
-      const found = []
+      const found = new Set()
       for (const node of arb.actualTree.inventory.values()) {
-        if (node.isProjectRoot || node.isWorkspace || node.inBundle) {
-          continue
-        }
         const { name, version } = trustedDisplay(node)
         if (!name || name !== wantName) {
           continue
@@ -237,9 +235,13 @@ class AllowScriptsCmd extends BaseCommand {
         if (range && (!version || !semver.satisfies(version, range, { loose: true }))) {
           continue
         }
-        found.push(node)
+        const target = node.isLink ? node.target : node
+        if (!target || target.isProjectRoot || target.isWorkspace || target.inBundle) {
+          continue
+        }
+        found.add(target)
       }
-      if (found.length === 0) {
+      if (found.size === 0) {
         unmatched.push(arg)
       } else {
         matched.push(...found)

deps/npm/lib/utils/allow-scripts-prune.js

@@ -29,7 +29,8 @@ const classifyUnusedEntries = (allowScripts, nodes) => {
       continue
     }
 
-    const matching = nodes.filter(({ node }) => matches(node, key))
+    // Pass deny intent so an unverifiable version fails closed: an active versioned deny must not be classified as unused while its broad allow survives.
+    const matching = nodes.filter(({ node }) => matches(node, key, value === false))
     if (matching.length === 0) {
       removed.push({ key, value, reason: 'not-installed' })
       continue

deps/npm/lib/utils/oidc.js

@@ -5,6 +5,62 @@ const fetch = require('make-fetch-happen')
 const npa = require('npm-package-arg')
 const libaccess = require('libnpmaccess')
 
+/**
+ * Caches the runtime state of the active OIDC token exchange
+ * so it can be cleared on subsequent OIDC attempts in workflows
+ * that run OIDC multiple times within one runtime execution,
+ * preventing the previous exchange token from being reused.
+ */
+let activeExchangeRecord
+
+const setOidcToken = ({ config, opts, authTokenKey, token }) => {
+  activeExchangeRecord = {
+    config,
+    authTokenKey,
+    token,
+    previousCliToken: config.get(authTokenKey, 'cli'),
+    opts,
+    previousOptsToken: opts[authTokenKey],
+  }
+  opts[authTokenKey] = token
+  config.set(authTokenKey, token, 'cli')
+  log.verbose('oidc', 'Successfully retrieved and set token')
+}
+
+const clearOidcToken = ({ config, opts }) => {
+  if (!activeExchangeRecord) {
+    return
+  }
+
+  const {
+    config: previousConfig,
+    authTokenKey,
+    token,
+    previousCliToken,
+    opts: previousOpts,
+    previousOptsToken,
+  } = activeExchangeRecord
+  if (previousConfig.get(authTokenKey, 'cli') === token) {
+    if (previousCliToken === undefined) {
+      previousConfig.delete(authTokenKey, 'cli')
+    } else {
+      previousConfig.set(authTokenKey, previousCliToken, 'cli')
+    }
+  }
+  for (const requestOpts of new Set([previousOpts, opts])) {
+    if (requestOpts[authTokenKey] === token) {
+      const fallback = requestOpts === previousOpts ? previousOptsToken : config.get(authTokenKey)
+      if (fallback === undefined) {
+        delete requestOpts[authTokenKey]
+      } else {
+        requestOpts[authTokenKey] = fallback
+      }
+    }
+  }
+  activeExchangeRecord = undefined
+  log.verbose('oidc', 'Cleared previous exchange token')
+}
+
 /**
  * Handles OpenID Connect (OIDC) token retrieval and exchange for CI environments.
  *
@@ -13,18 +69,35 @@ const libaccess = require('libnpmaccess')
  *
  * This function is intended to never throw, as it mutates the state of the `opts` and `config` objects on success.
  * OIDC is always an optional feature, and the function should not throw if OIDC is not configured by the registry.
+ * Before each attempt, it restores credentials replaced by the previous exchange so package-specific tokens are never used as fallback credentials.
  *
  * @see https://github.com/watson/ci-info for CI environment detection.
  * @see https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect for GitHub Actions OIDC.
  * @see https://circleci.com/docs/openid-connect-tokens/ for CircleCI OIDC.
  */
-async function oidc ({ packageName, registry, opts, config }) {
+async function oidc ({
+  // Selects the package-specific npm token exchange endpoint.
+  packageName,
+  // Determines the OIDC audience, exchange host, and registry-scoped auth key.
+  registry,
+  // Mutable request options for the current command, often called flatOptions.
+  // The exchanged token is added here so subsequent registry requests use it immediately.
+  opts,
+  // npm's live configuration state. This is also updated so credential lookups see the token.
+  config,
+  // Publish and stage publish can infer provenance from trusted-publishing claims and package
+  // visibility so users do not need to set --provenance. Other commands that use OIDC, such as
+  // npm dist-tag, only need token exchange and must not enable unrelated publish provenance.
+  enableProvenanceAutoConfiguration = false,
+}) {
   /*
    * This code should never run when people try to publish locally on their machines.
    * It is designed to execute only in Continuous Integration (CI) environments.
    */
 
   try {
+    clearOidcToken({ config, opts })
+
     if (!(
       /** @see https://github.com/watson/ci-info/blob/v4.2.0/vendors.json#L152 */
       ciInfo.GITHUB_ACTIONS ||
@@ -133,13 +206,17 @@ async function oidc ({ packageName, registry, opts, config }) {
     }
 
     /*
-     * The "opts" object is a clone of npm.flatOptions and is passed through the `publish` command, eventually reaching `otplease`.
-     * To ensure the token is accessible during the publishing process, it must be directly attached to the `opts` object.
-     * Additionally, the token is required by the "live" configuration or getters within `config`.
+     * `opts` is derived from npm.flatOptions and carried through the current command.
+     * Publish and dist-tag pass it to later registry requests, including mutations wrapped by
+     * `otplease`, so the exchanged token must be attached directly to this object.
+     * The non-persistable cli layer also makes the token available to credential lookups without
+     * modifying any file-backed configuration.
      */
-    opts[authTokenKey] = response.token
-    config.set(authTokenKey, response.token, 'user')
-    log.verbose('oidc', `Successfully retrieved and set token`)
+    setOidcToken({ config, opts, authTokenKey, token: response.token })
+
+    if (!enableProvenanceAutoConfiguration) {
+      return undefined
+    }
 
     try {
       const isDefaultProvenance = config.isDefault('provenance')

deps/npm/man/man1/npm-access.1

@@ -1,4 +1,4 @@
-.TH "NPM-ACCESS" "1" "September 2026" "NPM@12.1.0" ""
+.TH "NPM-ACCESS" "1" "November 2026" "NPM@12.2.2" ""
 .SH "NAME"
 \fBnpm-access\fR - Set access level on published packages
 .SS "Synopsis"