chore: upgrade to NPM v12

Require npm >=12.0.2 <13, enforced via check-node-version on npm install and
npm ci. CI installs the version from engines.npm via the new
.github/actions/install-npm composite action.

The motivation is that npm v12 turns three code-execution paths off by
default, most notably the unauthorized execution of install scripts:

- allowScripts now defaults to off, so npm install no longer executes
  preinstall, install or postinstall scripts from dependencies unless they
  are explicitly allowed in package.json. This also covers prepare scripts
  from git, file and link dependencies.
- --allow-git now defaults to none, which closes a code-execution path where
  a git dependency's .npmrc could override the git executable, even with
  --ignore-scripts.
- --allow-remote now defaults to none, blocking dependencies from remote
  URLs such as HTTPS tarballs.

See
https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/

The check is skipped during npm publish and npm pack, because
semantic-release bundles its own npm (@semantic-release/npm depends on
npm@^11.6.2) and runs the publish with that version rather than the one
installed in CI.

The Node.js requirement is left unchanged.

Author: coderbyheart

.github/actions/install-npm/action.yml

@@ -0,0 +1,14 @@
+name: Install NPM
+description: >
+  Installs the NPM version required by the `engines.npm` directive in
+  package.json, which is required for the project to build correctly.
+
+runs:
+  using: composite
+  steps:
+    - name: Install NPM
+      shell: bash
+      run: |
+        npmVersion="$(node -p 'require(`${process.env.GITHUB_WORKSPACE}/package.json`).engines.npm')"
+        echo "Installing npm@${npmVersion}"
+        npm install -g "npm@${npmVersion}"

.github/workflows/test-and-release.yaml

@@ -22,6 +22,9 @@ jobs:
           node-version: ">=24.18.1 <25"
           cache: "npm"
 
+      - name: Install NPM version specified in package.json
+        uses: ./.github/actions/install-npm
+
       - name: Install dependencies
         run: npm ci --no-audit
 

README.md

@@ -23,3 +23,13 @@ const fetch = fetchWithDebug(
 
 const res = await fetch(new URL("https://example.com"));
 ```
+
+## Node & NPM
+
+This project requires npm `>=12.0.2 <13` (enforced via `check-node-version` on
+`npm install` and `npm ci`).
+
+The check is skipped during `npm publish` and `npm pack`, because
+`semantic-release` bundles its own npm (`@semantic-release/npm` depends on
+`npm@^11.6.2`) and runs the publish with that version rather than the one
+installed in CI.

package-lock.json

@@ -12,13 +12,15 @@
   },
   "author": "Nordic Semiconductor ASA | nordicsemi.no",
   "scripts": {
-    "test": "node --no-warnings --experimental-transform-types --test \"./*.spec.ts\""
+    "test": "node --no-warnings --experimental-transform-types --test \"./*.spec.ts\"",
+    "prepare": "case \"$npm_command\" in install|ci) check-node-version --package ;; esac"
   },
   "license": "BSD-3-Clause",
   "type": "module",
   "main": "export.ts",
   "devDependencies": {
     "@bifravst/prettier-config": "1.1.17",
+    "check-node-version": "4.2.1",
     "nock": "14.0.17",
     "prettier": "3.9.6"
   },
@@ -33,5 +35,8 @@
       "@semantic-release/release-notes-generator",
       "@sebbo2002/semantic-release-jsr"
     ]
+  },
+  "engines": {
+    "npm": ">=12.0.2 <13"
   }
 }