[ankita10119]

Changes

Pins the npm version used by the release workflow's publish step on v4:

• .github/actions/npm-publish/action.yml: npm install -g npm@latest → npm install -g npm@^11

npm@latest now resolves to npm 12, which requires Node ^22.22.2 || ^24.15.0 || >=26.0.0. The publish job runs on Node 20, so the v4.37.2 release failed at this step with EBADENGINE, before anything was published or tagged. npm 11 supports Node ^20.17.0 || >=22.9.0, so it works with the current runner.

This is the same change as #1367 on v5. It only affects how the CI job installs npm; no SDK code, endpoints, classes or methods change.

After this is merged, the v4.37.2 release can be re-run manually with workflow_dispatch on v4. The release commit (#1443) is already on v4, and no v4.37.2 tag or npm version exists yet.

References

• Failed release run: https://github.com/auth0/node-auth0/actions/runs/43262641426
• Same fix on v5: fix: pin npm to ^11 to avoid broken npm@12 bundled dependencies #1367
• Release PR: Release v4.37.2 #1443

Testing

This can't be tested locally, since it only runs inside the release workflow. Checked locally:

• the YAML still parses
• npm@^11 currently resolves to npm 11.16.0, whose engines.node is ^20.17.0 || >=22.9.0, which includes the runner's Node 20.20.2
• there are no other npm@latest installs in .github

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors