fix: pin npm to ^11 to avoid broken npm@12 bundled dependencies

[ankita10119]

Changes

Pins npm in the publish action from @latest to @^11 to avoid breakage from npm@12.0.0, which ships with missing bundled dependencies (sigstore, promise-retry) that cause npm publish --provenance to fail.

npm@^11 is the latest stable major that correctly supports provenance publishing. Using @latest meant any new npm major release could silently break the release pipeline, as happened here with npm@12.0.0.

No SDK code, public API, or functionality is affected, this is a CI-only change.

References

• nodejs/node#62425 - related bundled dependency regression in Node.js
• npm/cli#9722 - npm@12 missing sigstore module, breaking npm publish --provenance (open)

Testing

Verified by triggering the release workflow and confirming npm publish --provenance completes successfully with npm@^11 on Node 22.23.1.

• This change adds unit test coverage
• This change adds integration test coverage

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.62%. Comparing base (2df0239) to head (3f3185a).

Additional details and impacted files

@@           Coverage Diff            @@
##           master    #1367    +/-   ##
========================================
  Coverage   89.62%   89.62%            
========================================
  Files         428      428            
  Lines       19886    19886            
  Branches     9400     9757   +357     
========================================
  Hits        17823    17823            
  Misses       2063     2063            

Flag	Coverage Δ
alltests	89.62% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.