fix(deps): update npm to ^10.9.3

[MikeMcC399]

• closes [email protected] unfixable low vulnerability (CVE-2025-5889) #966

Situation

• Before the release of [email protected], installing @semantic-release/npm reported a low severity vulnerability
• For such existing projects, npm audit fix continues to reports that the vulnerability cannot be fixed and refers to GHSA-v6h2-p8h4-qcjw (CVE-2025-5889 - brace-expansion Regular Expression Denial of Service vulnerability)
• Since the release of [email protected], a new installation of @semantic-release/npm reports no vulnerability
• Uninstalling and re-installing semantic-release and / or @semantic-release/npm also works around the issue

Change

Update npm in package.json dependencies from ^10.5.0 to ^10.9.3

[email protected] includes the fixed dependency [email protected]

Note

• PR chore(deps): update npm to v10.9.3 #971 only updated the packageManager field in package.json to [email protected] not the dependencies field

[travi]

Thanks!

[github-actions]

🎉 This PR is included in version 12.0.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[MikeMcC399]

@travi

Thanks!

Thanks also for merging! I've checked it out on two repos that were previously reporting the vulnerability and everything is now fine 👍🏻