deps: upgrade npm to 11.20.0

deps/npm/docs/content/commands/npm-ci.md

@@ -290,7 +290,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. `--ignore-scripts` and
 `--dangerously-allow-all-scripts` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### `strict-allow-scripts`
 

deps/npm/docs/content/commands/npm-exec.md

@@ -178,7 +178,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. `--ignore-scripts` and
 `--dangerously-allow-all-scripts` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### `strict-allow-scripts`
 

deps/npm/docs/content/commands/npm-install-ci-test.md

@@ -243,7 +243,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. `--ignore-scripts` and
 `--dangerously-allow-all-scripts` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### `strict-allow-scripts`
 

deps/npm/docs/content/commands/npm-install-test.md

@@ -320,7 +320,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. `--ignore-scripts` and
 `--dangerously-allow-all-scripts` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### `strict-allow-scripts`
 

deps/npm/docs/content/commands/npm-install.md

@@ -662,7 +662,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. `--ignore-scripts` and
 `--dangerously-allow-all-scripts` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### `strict-allow-scripts`
 

deps/npm/docs/content/commands/npm-ls.md

@@ -23,7 +23,7 @@ Note that nested packages will *also* show the paths to the specified packages.
 For example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-npm@11.19.1 /path/to/npm
+npm@11.20.0 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 ```

deps/npm/docs/content/commands/npm-publish.md

@@ -222,6 +222,9 @@ This value is not exported to the environment for child processes.
 When publishing from a supported cloud CI/CD system, the package will be
 publicly linked to where it was built and published from.
 
+When the `provenance-file` config is set, it takes precedence and automatic
+provenance generation (including via trusted publishing/OIDC) is skipped.
+
 This config cannot be used with: `provenance-file`
 
 #### `provenance-file`
@@ -231,6 +234,9 @@ This config cannot be used with: `provenance-file`
 
 When publishing, the provenance bundle at the given path will be used.
 
+This takes precedence over automatic provenance generation in trusted
+publishing flows.
+
 This config cannot be used with: `provenance`
 
 ### See Also

deps/npm/docs/content/commands/npm-rebuild.md

@@ -120,7 +120,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. `--ignore-scripts` and
 `--dangerously-allow-all-scripts` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### `strict-allow-scripts`
 

deps/npm/docs/content/commands/npm-stage.md

@@ -158,7 +158,7 @@ npm stage publish <package-spec>
 | `--workspace`, `-w` |  | String (can be set multiple times) | Enable running a command in the context of the configured workspaces of the       current project while filtering by running only the workspaces defined by       this configuration option.        Valid values for the `workspace` config are either:        * Workspace names       * Path to a workspace directory       * Path to a parent workspace directory (will result in selecting all         workspaces within that folder)        When set for the `npm init` command, this may be set to the folder of       a workspace which does not yet exist, to create the folder and set it       up as a brand new workspace within the project. |
 | `--workspaces` | null | null or Boolean | Set to true to run the command in the context of **all** configured       workspaces.        Explicitly setting this to false will cause commands like `install` to       ignore workspaces altogether.       When not set explicitly:        - Commands that operate on the `node_modules` tree (install, update,         etc.) will link workspaces into the `node_modules` folder.       - Commands that do other things (test, exec, publish, etc.) will operate         on the root project, _unless_ one or more workspaces are specified in         the `workspace` config. |
 | `--include-workspace-root` | false | Boolean | Include the workspace root when workspaces are enabled for a command.        When false, specifying individual workspaces via the `workspace` config,       or all workspaces via the `workspaces` flag, will cause npm to operate only       on the specified workspaces, and not on the root project. |
-| `--provenance` | false | Boolean | When publishing from a supported cloud CI/CD system, the package will be       publicly linked to where it was built and published from. |
+| `--provenance` | false | Boolean | When publishing from a supported cloud CI/CD system, the package will be       publicly linked to where it was built and published from.        When the `provenance-file` config is set, it takes precedence and       automatic provenance generation (including via trusted publishing/OIDC)       is skipped. |
 
 ### `npm stage list`
 

deps/npm/docs/content/commands/npm-token.md

@@ -110,11 +110,14 @@ the token access to specific organizations.
 #### `packages-and-scopes-permission`
 
 * Default: null
-* Type: null, "read-only", "read-write", or "no-access"
+* Type: null, "read-only", "read-write", "read-write-stage-only", or
+  "no-access"
 
 When creating a Granular Access Token with `npm token create`, sets the
 permission level for packages and scopes. Options are "read-only",
-"read-write", or "no-access".
+"read-write", "read-write-stage-only", or "no-access".
+"read-write-stage-only" grants publish access that stages releases instead
+of publishing them directly.
 
 
 

deps/npm/docs/content/commands/npm-update.md

@@ -330,7 +330,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. `--ignore-scripts` and
 `--dangerously-allow-all-scripts` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### `strict-allow-scripts`
 

deps/npm/docs/content/commands/npm.md

@@ -14,7 +14,7 @@ Note: This command is unaware of workspaces.
 
 ### Version
 
-11.19.1
+11.20.0
 
 ### Description
 

deps/npm/docs/content/using-npm/config.md

@@ -271,7 +271,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. `--ignore-scripts` and
 `--dangerously-allow-all-scripts` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### `allow-scripts-pending`
 
@@ -1473,11 +1473,14 @@ token access to all packages instead of limiting to specific packages.
 #### `packages-and-scopes-permission`
 
 * Default: null
-* Type: null, "read-only", "read-write", or "no-access"
+* Type: null, "read-only", "read-write", "read-write-stage-only", or
+  "no-access"
 
 When creating a Granular Access Token with `npm token create`, sets the
 permission level for packages and scopes. Options are "read-only",
-"read-write", or "no-access".
+"read-write", "read-write-stage-only", or "no-access".
+"read-write-stage-only" grants publish access that stages releases instead
+of publishing them directly.
 
 
 
@@ -1575,6 +1578,9 @@ Set to `false` to suppress the progress bar.
 When publishing from a supported cloud CI/CD system, the package will be
 publicly linked to where it was built and published from.
 
+When the `provenance-file` config is set, it takes precedence and automatic
+provenance generation (including via trusted publishing/OIDC) is skipped.
+
 This config cannot be used with: `provenance-file`
 
 #### `provenance-file`
@@ -1584,6 +1590,9 @@ This config cannot be used with: `provenance-file`
 
 When publishing, the provenance bundle at the given path will be used.
 
+This takes precedence over automatic provenance generation in trusted
+publishing flows.
+
 This config cannot be used with: `provenance`
 
 #### `proxy`

deps/npm/docs/output/commands/npm-access.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-access----11191">
+<h1 id="----npm-access----11200">
     <span>npm-access</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Set access level on published packages</span>
 </header>

deps/npm/docs/output/commands/npm-adduser.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-adduser----11191">
+<h1 id="----npm-adduser----11200">
     <span>npm-adduser</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Add a registry user account</span>
 </header>

deps/npm/docs/output/commands/npm-approve-scripts.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-approve-scripts----11191">
+<h1 id="----npm-approve-scripts----11200">
     <span>npm-approve-scripts</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Approve install scripts for specific dependencies</span>
 </header>

deps/npm/docs/output/commands/npm-audit.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-audit----11191">
+<h1 id="----npm-audit----11200">
     <span>npm-audit</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Run a security audit</span>
 </header>

deps/npm/docs/output/commands/npm-bugs.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-bugs----11191">
+<h1 id="----npm-bugs----11200">
     <span>npm-bugs</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Report bugs for a package in a web browser</span>
 </header>

deps/npm/docs/output/commands/npm-cache.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-cache----11191">
+<h1 id="----npm-cache----11200">
     <span>npm-cache</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Manipulates packages cache</span>
 </header>

deps/npm/docs/output/commands/npm-ci.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ci----11191">
+<h1 id="----npm-ci----11200">
     <span>npm-ci</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Clean install a project</span>
 </header>
@@ -414,6 +414,7 @@ <h4 id="allow-scripts"><code>allow-scripts</code></h4>
 <p>Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. <code>--ignore-scripts</code> and
 <code>--dangerously-allow-all-scripts</code> both override this setting.</p>
+<p>This value is not exported to the environment for child processes.</p>
 <h4 id="strict-allow-scripts"><code>strict-allow-scripts</code></h4>
 <ul>
 <li>Default: false</li>

deps/npm/docs/output/commands/npm-completion.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-completion----11191">
+<h1 id="----npm-completion----11200">
     <span>npm-completion</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Tab Completion for npm</span>
 </header>

deps/npm/docs/output/commands/npm-config.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-config----11191">
+<h1 id="----npm-config----11200">
     <span>npm-config</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Manage the npm configuration files</span>
 </header>

deps/npm/docs/output/commands/npm-dedupe.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-dedupe----11191">
+<h1 id="----npm-dedupe----11200">
     <span>npm-dedupe</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Reduce duplication in the package tree</span>
 </header>

deps/npm/docs/output/commands/npm-deny-scripts.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-deny-scripts----11191">
+<h1 id="----npm-deny-scripts----11200">
     <span>npm-deny-scripts</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Deny install scripts for specific dependencies</span>
 </header>

deps/npm/docs/output/commands/npm-deprecate.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-deprecate----11191">
+<h1 id="----npm-deprecate----11200">
     <span>npm-deprecate</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Deprecate a version of a package</span>
 </header>

deps/npm/docs/output/commands/npm-diff.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-diff----11191">
+<h1 id="----npm-diff----11200">
     <span>npm-diff</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">The registry diff command</span>
 </header>

deps/npm/docs/output/commands/npm-dist-tag.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-dist-tag----11191">
+<h1 id="----npm-dist-tag----11200">
     <span>npm-dist-tag</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Modify package distribution tags</span>
 </header>

deps/npm/docs/output/commands/npm-docs.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-docs----11191">
+<h1 id="----npm-docs----11200">
     <span>npm-docs</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Open documentation for a package in a web browser</span>
 </header>

deps/npm/docs/output/commands/npm-doctor.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-doctor----11191">
+<h1 id="----npm-doctor----11200">
     <span>npm-doctor</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Check the health of your npm environment</span>
 </header>

deps/npm/docs/output/commands/npm-edit.html

@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-edit----11191">
+<h1 id="----npm-edit----11200">
     <span>npm-edit</span>
-    <span class="version">@11.19.1</span>
+    <span class="version">@11.20.0</span>
 </h1>
 <span class="description">Edit an installed package</span>
 </header>