deps: upgrade npm to 11.20.0

[npm-cli-bot]

11.20.0 (2026-09-21)

Features

• 0b3c699 #9994 token: support read-write-stage-only granular access tokens (#9994) (@github-actions[bot], @Tayvon, @Copilot)
• b872816 #9920 stage: display staged package status (#9920) (@github-actions[bot], @joelverhagen)

Bug Fixes

• ddbadfc #9947 provenance-file takes precedence over OIDC auto-generated provenance (#9947) (@github-actions[bot], @yunseo-kim)
• 64d4b4b #9937 config: avoid exporting persistent allow-scripts (#9937) (@github-actions[bot], @Fnine59)
• 70317da #9930 arborist: reject uninstall args that carry a version (#9930) (@github-actions[bot], @lazerg)
• 55ae484 #9929 arborist: match allowScripts keys for local paths (#9929) (@github-actions[bot], @martinrrm, @Copilot)
• 7f1f2b7 #9928 keep dry-run output valid json (#9928) (@github-actions[bot], @martinrrm)
• f28cca9 #9927 don't print the funding message for global installs (#9927) (@github-actions[bot], @lazerg)

Chores

• 6ff3000 #10010 pack: select workspace through config (#10010) (@github-actions[bot], @reggi)
• afdc5bd #9932 pass nodedir to node-gyp via npm_package_config env in node integration (#9932) (@reggi)
• 83f95ff #9931 update node-integration workflow template to latest actions (#9931) (@reggi)
• f020fba #9925 recognize prefixed Node.js PR titles (#9925) (@github-actions[bot], @reggi)

Dependencies

• workspace: @npmcli/arborist@9.9.2
• workspace: @npmcli/config@10.13.0
• workspace: libnpmdiff@8.1.13
• workspace: libnpmexec@10.3.3
• workspace: libnpmfund@7.0.27
• workspace: libnpmpack@9.1.14
• workspace: libnpmpublish@11.2.1

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[reggi]

👋 hey node release squad, tea from npm here.

let me know if this should have been opened on main for release with 26 / 24 or i should have targeted the staging branches. Or if things will change after #66212 lands.

[richardlau]

👋 hey node release squad, tea from npm here.

let me know if this should have been opened on main for release with 26 / 24 or i should have targeted the staging branches. Or if things will change after #66212 lands.

This and #66212 will be in conflict (i.e. if this land first #66212 would need to be rebased and if #66212 lands first this cannot).

Our options are either:

• Land this first on main and then normally pick it for v26.x-staging (and later v24.x-staging). deps: upgrade npm to 12.1.0 #66212 would then need to be rebased.
• Open this update against v26.x-staging and keep deps: upgrade npm to 12.1.0 #66212 targeted at main.

cc @nodejs/releasers

[aduh95]

Given that #66212 hasn't landed yet, I'd suggest we land this PR (#66245) first. Eventually, once main is on npm 12, PRs to update npm 11 would need to be sent against v26.x-staging.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/77806/

[reggi]

I'm unable to login to see this ci failure

[MikeMcC399]

I'm unable to login to see this ci failure

Due to a change in security policy as documented also in the Pull requests > Continuous integration testing guide section, Jenkins CI testing located at https://ci.nodejs.org/ is only accessible to team members.

The problem is not related to the content of your PR. It's a Jenkins issue.

https://ci.nodejs.org/job/node-test-commit-arm-fanned/50182/console shows the same issue reported in nodejs/build#4481 as a Jenkins incident with the comment from @richardlau

I've wiped out the workspace.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/77825/

[MikeMcC399]

I retriggered Jenkins and it now succeeded.

[MikeMcC399]

• Open this update against v26.x-staging and keep deps: upgrade npm to 12.1.0 #66212 targeted at main.

This option would have the advantage that the approved #66212 to bundle npm@12.1.0 in the main branch would not be delayed further. The Node.js 27 Alpha first release date is coming up next month.

[reggi]

@MikeMcC399 that sounds good to me, feel free to close this one and I can reopen npm@v11 against v26.x-staging.

[reggi]

i'm opening up a new pr npm@v11 against v26.x-staging please close this one to avoid confusion

[reggi]

new replacement -> #66259

[aduh95]

No let's land this one first on main

[aduh95]

Well #66212 has landed