deps: upgrade npm to 11.12.1

PR-URL: #62448
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Author: npm-cli-bot

deps/npm/docs/content/commands/npm-audit.md

@@ -44,6 +44,16 @@ The `audit signatures` command will also verify the provenance attestations of d
 Because provenance attestations are such a new feature, security features may be added to (or changed in) the attestation format over time.
 To ensure that you're always able to verify attestation signatures check that you're running the latest version of the npm CLI. Please note this often means updating npm beyond the version that ships with Node.js.
 
+To include the full sigstore attestation bundles in JSON output, use:
+
+```bash
+$ npm audit signatures --json --include-attestations
+```
+
+This adds a `verified` array to the JSON output containing the attestation
+bundles (DSSE envelopes, verification material, and transparency log entries)
+for each verified package.
+
 The npm CLI supports registry signatures and signing keys provided by any registry if the following conventions are followed:
 
 1. Signatures are provided in the package's `packument` in each published version within the `dist` object:
@@ -357,6 +367,18 @@ run any pre- or post-scripts.
 
 
 
+#### `include-attestations`
+
+* Default: false
+* Type: Boolean
+
+When used with `npm audit signatures --json`, includes the full sigstore
+attestation bundles in the JSON output for each verified package. The
+bundles contain DSSE envelopes, verification material, and transparency log
+entries.
+
+
+
 #### `workspace`
 
 * Default:

deps/npm/docs/content/commands/npm-install-test.md

@@ -281,6 +281,8 @@ of a relative number of days.
 
 This config cannot be used with: `before`
 
+This value is not exported to the environment for child processes.
+
 #### `bin-links`
 
 * Default: true

deps/npm/docs/content/commands/npm-install.md

@@ -623,6 +623,8 @@ of a relative number of days.
 
 This config cannot be used with: `before`
 
+This value is not exported to the environment for child processes.
+
 #### `bin-links`
 
 * Default: true

deps/npm/docs/content/commands/npm-ls.md

@@ -23,7 +23,7 @@ Note that nested packages will *also* show the paths to the specified packages.
 For example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-npm@11.11.1 /path/to/npm
+npm@11.12.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 ```

deps/npm/docs/content/commands/npm-outdated.md

@@ -182,6 +182,8 @@ of a relative number of days.
 
 This config cannot be used with: `before`
 
+This value is not exported to the environment for child processes.
+
 ### See Also
 
 * [package spec](/using-npm/package-spec)

deps/npm/docs/content/commands/npm-publish.md

@@ -54,6 +54,8 @@ A `package` is interpreted the same way as other commands (like `npm install`) a
 * f) a `<name>` that has a "latest" tag satisfying (e)
 * g) a `<git remote url>` that resolves to (a)
 
+If either (a) or (b) is specified as a relative path, it should begin with an explicit `./` prefix.
+
 The publish will fail if the package name and version combination already exists in the specified registry.
 
 Once a package is published with a given name and version, that specific name and version combination can never be used again, even if it is removed with [`npm unpublish`](/commands/npm-unpublish).

deps/npm/docs/content/commands/npm-trust.md

@@ -6,10 +6,6 @@ description: Manage trusted publishing relationships between packages and CI/CD
 
 ### Synopsis
 
-```bash
-
-```
-
 Note: This command is unaware of workspaces.
 
 ### Prerequisites

deps/npm/docs/content/commands/npm-update.md

@@ -347,6 +347,8 @@ of a relative number of days.
 
 This config cannot be used with: `before`
 
+This value is not exported to the environment for child processes.
+
 #### `bin-links`
 
 * Default: true

deps/npm/docs/content/commands/npm.md

@@ -14,7 +14,7 @@ Note: This command is unaware of workspaces.
 
 ### Version
 
-11.11.1
+11.12.1
 
 ### Description
 

deps/npm/docs/content/using-npm/config.md

@@ -770,6 +770,18 @@ the order in which omit/include are specified on the command-line.
 
 
 
+#### `include-attestations`
+
+* Default: false
+* Type: Boolean
+
+When used with `npm audit signatures --json`, includes the full sigstore
+attestation bundles in the JSON output for each verified package. The
+bundles contain DSSE envelopes, verification material, and transparency log
+entries.
+
+
+
 #### `include-staged`
 
 * Default: false
@@ -1086,6 +1098,8 @@ of a relative number of days.
 
 This config cannot be used with: `before`
 
+This value is not exported to the environment for child processes.
+
 #### `name`
 
 * Default: null