[v26.x] deps: upgrade npm to 11.20.0

[npm-cli-bot]

11.20.0 (2026-09-21)

Features

• 0b3c699 #9994 token: support read-write-stage-only granular access tokens (#9994) (@github-actions[bot], @Tayvon, @Copilot)
• b872816 #9920 stage: display staged package status (#9920) (@github-actions[bot], @joelverhagen)

Bug Fixes

• ddbadfc #9947 provenance-file takes precedence over OIDC auto-generated provenance (#9947) (@github-actions[bot], @yunseo-kim)
• 64d4b4b #9937 config: avoid exporting persistent allow-scripts (#9937) (@github-actions[bot], @Fnine59)
• 70317da #9930 arborist: reject uninstall args that carry a version (#9930) (@github-actions[bot], @lazerg)
• 55ae484 #9929 arborist: match allowScripts keys for local paths (#9929) (@github-actions[bot], @martinrrm, @Copilot)
• 7f1f2b7 #9928 keep dry-run output valid json (#9928) (@github-actions[bot], @martinrrm)
• f28cca9 #9927 don't print the funding message for global installs (#9927) (@github-actions[bot], @lazerg)

Chores

• 6ff3000 #10010 pack: select workspace through config (#10010) (@github-actions[bot], @reggi)
• afdc5bd #9932 pass nodedir to node-gyp via npm_package_config env in node integration (#9932) (@reggi)
• 83f95ff #9931 update node-integration workflow template to latest actions (#9931) (@reggi)
• f020fba #9925 recognize prefixed Node.js PR titles (#9925) (@github-actions[bot], @reggi)

Dependencies

• workspace: @npmcli/arborist@9.9.2
• workspace: @npmcli/config@10.13.0
• workspace: libnpmdiff@8.1.13
• workspace: libnpmexec@10.3.3
• workspace: libnpmfund@7.0.27
• workspace: libnpmpack@9.1.14
• workspace: libnpmpublish@11.2.1

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[reggi]

per recommendation of @ MikeMcC399 #66245 (comment)

I've opened this as a replacement for #66245
freeing up npm@12 #66212 to land on main without conflict

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/77893/

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.90%. Comparing base (ca26282) to head (0c92c8b).
⚠️ Report is 1037 commits behind head on v26.x-staging.

Additional details and impacted files

@@                Coverage Diff                @@
##           v26.x-staging   #66259      +/-   ##
=================================================
+ Coverage          90.24%   93.90%   +3.65%     
=================================================
  Files                729      420     -309     
  Lines             242760   193217   -49543     
  Branches           46044    36359    -9685     
=================================================
- Hits              219073   181432   -37641     
+ Misses             15133    11529    -3604     
+ Partials            8554      256    -8298     

see 620 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[richardlau]

Landed in 6c924ee.

[MikeMcC399]

@reggi

per recommendation of @ MikeMcC399 #66245 (comment)

I've opened this as a replacement for #66245 freeing up npm@12 #66212 to land on main without conflict

Thanks for the submissions and it's good to see that both have now gone through. I had purposely not added a commit-queue label to #66212 for npm@12.1.0 in order to leave the decision to the release team. It seems it was accidently left on by them after deciding to prioritize 11.20.0 and so npm@12.1.0 made it into the main branch first.

Anyway, it's all looking good. npm@11.20.0 is ready for the next Node.js 26 release, and npm@12.1.0 is prepped for the future Node.js 27!