ci: pin npm 11 so dep bumps stop desyncing the lockfile

.github/workflows/ci.yml

@@ -37,6 +37,11 @@ jobs:
         with:
           node-version: 22
           cache: "npm"
+      # Node 22 bundles npm 10.9.x, which writes and requires a different lockfile shape
+      # than the npm 11 used locally (packageManager pins it) — npm 10 demands entries npm
+      # 11 prunes, so a lockfile regenerated on a dev machine failed `npm ci` here. Pin the
+      # same npm the repo declares, so CI and local agree. Keep in sync with release.yml.
+      - run: npm i -g npm@11.13.0
       - run: npm ci
       - run: npm run typecheck
       - run: npm run typecheck:examples

.github/workflows/release.yml

@@ -23,6 +23,12 @@ jobs:
           node-version: 22
           cache: "npm"
 
+      # release-it's version bump rewrites package-lock.json with whatever npm this job
+      # has (see the before:git:release hook in config/.release-it.json), so it must match
+      # the npm CI uses or every release desyncs the lockfile and breaks `npm ci` on
+      # master. Keep in sync with ci.yml.
+      - run: npm i -g npm@11.13.0
+
       - run: npm ci
       - run: npm run build
 

package.json

@@ -4,6 +4,10 @@
   "description": "Trustless pubsub voting over a shared libp2p/Helia node.",
   "type": "module",
   "license": "GPL-3.0-or-later",
+  "packageManager": "npm@11.13.0",
+  "engines": {
+    "npm": ">=11"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/bitsocialnet/pubsub-voting.git"