Fix npm release runtime

[masnwilliams]

summary

• run release publishing on Node.js 24
• constrain npm to the OIDC-capable 11.x line
• prevent unbounded npm major upgrades from breaking the release job

testing

• bun install --frozen-lockfile
• bun run format:check
• bun run --filter '@onkernel/managed-auth-react' build
• bun run typecheck
• cd packages/managed-auth-react && npm pack --dry-run
• actionlint .github/workflows/release.yaml
• installed npm@^11.5.1 under Node.js 22.23.2 (resolved to npm 11.19.0)

---

Note

Low Risk
CI-only runtime bump for the release job; no application or auth logic changes. A Node/npm mismatch could still fail publishes until verified in a real release.

Overview
Updates the release workflow so npm publishing runs on Node.js 24 (actions/setup-node@v5) instead of Node 20.

Pins the global npm install to npm@^11.5.1 (OIDC trusted publishing) instead of npm@latest, so a future npm major cannot break the job.

^{Reviewed by Cursor Bugbot for commit b5b21e9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
managed-auth-react-demo	Ready	Preview	Aug 20, 2026 8:23pm