fix: skip npm self-upgrade when version unspecified

.github/actions/install-deps/action.yaml

@@ -8,10 +8,10 @@ inputs:
     required: false
     default: '18.x'
   npm-version:
-    description: NPM version to be installed and used
+    description: NPM version to install globally before `npm ci`. Leave empty (default) to use the npm bundled with the selected node version. Set to a specific version (e.g. '10.9.7') to pin. Avoid 'latest' — it triggers npm/cli#9151 on Node 22.
     type: string
     required: false
-    default: 'latest'
+    default: ''
 
 runs:
   using: 'composite'
@@ -21,7 +21,9 @@ runs:
       with:
         node-version: ${{ inputs.node-version }}
         cache: 'npm'
-    - run: npm i -g npm@${{ inputs.npm-version }}
+    - name: Upgrade npm
+      if: inputs.npm-version != ''
+      run: npm i -g npm@${{ inputs.npm-version }}
       shell: bash
     - run: node --version
       shell: bash

.github/workflows/nodejs-build.yaml

@@ -30,15 +30,15 @@ on:
       npm-version:
         type: string
         required: false
-        default: 'latest'
+        default: ''
 jobs:
   build:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - name: Install dependencies
-        uses: dvsa/.github/.github/actions/install-deps@v5.0.4
+        uses: dvsa/.github/.github/actions/install-deps@v5.0.11
         with:
           node-version: ${{ inputs.node-version }}
           npm-version: ${{ inputs.npm-version }}

.github/workflows/nodejs-lint.yaml

@@ -13,7 +13,7 @@ on:
       npm-version:
         type: string
         required: false
-        default: 'latest'
+        default: ''
       biome:
         type: boolean
         required: false
@@ -26,7 +26,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install dependencies
-        uses: dvsa/.github/.github/actions/install-deps@v5.0.4
+        uses: dvsa/.github/.github/actions/install-deps@v5.0.11
         with:
           node-version: ${{ inputs.node-version }}
           npm-version: ${{ inputs.npm-version }}

.github/workflows/nodejs-test.yaml

@@ -14,15 +14,15 @@ on:
       npm-version:
         required: false
         type: string
-        default: 'latest'
+        default: ''
 jobs:
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - name: Install dependencies
-        uses: dvsa/.github/.github/actions/install-deps@v4.1.1
+        uses: dvsa/.github/.github/actions/install-deps@v5.0.11
         with:
           node-version: ${{ inputs.node-version }}
           npm-version: ${{ inputs.npm-version }}

README.md

@@ -109,13 +109,13 @@ Publishing to NPM requires permissions and the relevant token to be stored in th
     - optional argument:
         - `max-warnings`: Sets how many warnings are allowed. Only applies when not using Biome. No default value.
         - `node-version`: Defines the version of NodeJS is used for actions/install-deps. Default is `20.x`.
-        - `npm-version`: Defines the version of NPM that is used for actions/install-deps. Default is `latest`.
+        - `npm-version`: Global npm version to install before `npm ci`. Default is `''` (use the npm bundled with the selected node version). Avoid `'latest'` — triggers npm/cli#9151 on Node 22.
         - `biome`: Boolean flag to indicate if Biome linter is being used. Default is `false`.
 1. Test
     - optional argument:
         - `test-command`: Sets the command used during the Test step. Default is `npm run test`.
         - `node-version`: Defines the version of NodeJS is used for actions/install-deps. Default is `18.x`.
-        - `npm-version`: Defines the version of NPM that is used for actions/install-deps. Default is `latest`.
+        - `npm-version`: Global npm version to install before `npm ci`. Default is `''` (use the npm bundled with the selected node version). Avoid `'latest'` — triggers npm/cli#9151 on Node 22.
 1. Security
     - required secret `SNYK_TOKEN` requires the organization or repo Snyk token secret
     - optional argument `args` allows passing in any extra args to the Snyk command. Note, the default behavior is to test all projects including all dev dependencies. If you don't want to test dev dependencies, pass in args: `--all-projects` to override the default args.
@@ -130,7 +130,7 @@ Publishing to NPM requires permissions and the relevant token to be stored in th
         - `retention-days`: How many days to save the archive for if it's stored. (upload-artifact: `true`). Default is `7` days.
         - `build-command`: The command to run to build the project. Defaults to `npm run package`.
         - `node-version`: Defines the version of NodeJS is used for actions/install-deps. Default is `18.x`.
-        - `npm-version`: Defines the version of NPM that is used for actions/install-deps. Default is `latest`.
+        - `npm-version`: Global npm version to install before `npm ci`. Default is `''` (use the npm bundled with the selected node version). Avoid `'latest'` — triggers npm/cli#9151 on Node 22.
 1. Upload to s3
 
     Workflow downloads the archive created from the build workflow and pushes it to s3 with the commit id as a tag. Default only running on master branch. See examples before for more information.