From b19d21387f783446e4d1dffda7302164581d1c30 Mon Sep 17 00:00:00 2001
From: Gabriel Stein <steindleve@gmail.com>
Date: Fri, 17 Jul 2026 12:05:52 -0700
Subject: [PATCH] fix(ci): pin npm bump to v10 to match node 20 engine
 requirement

---
 .github/actions/setup-publish/action.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/actions/setup-publish/action.yml b/.github/actions/setup-publish/action.yml
index 3f96b10b..a0b0c85e 100644
--- a/.github/actions/setup-publish/action.yml
+++ b/.github/actions/setup-publish/action.yml
@@ -21,9 +21,9 @@ runs:
         cache: 'pnpm' # package manager for caching
         registry-url: 'https://registry.npmjs.org'
 
-    # Update npm to latest for provenance
+    # Update npm to latest release compatible with our pinned Node version, for provenance
     - name: Update npm
-      run: npm install -g npm@latest
+      run: npm install -g npm@10
       shell: bash
 
     - name: Install dependencies from lockfile