deps: upgrade npm to 11.20.0

Author: npm-cli-bot

deps/npm/docs/content/commands/npm-ci.md

@@ -290,7 +290,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. `--ignore-scripts` and
 `--dangerously-allow-all-scripts` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### `strict-allow-scripts`
 

deps/npm/docs/content/commands/npm-exec.md

@@ -178,7 +178,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. `--ignore-scripts` and
 `--dangerously-allow-all-scripts` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### `strict-allow-scripts`
 

deps/npm/docs/content/commands/npm-install-ci-test.md

@@ -243,7 +243,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. `--ignore-scripts` and
 `--dangerously-allow-all-scripts` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### `strict-allow-scripts`
 

deps/npm/docs/content/commands/npm-install-test.md

@@ -320,7 +320,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. `--ignore-scripts` and
 `--dangerously-allow-all-scripts` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### `strict-allow-scripts`
 

deps/npm/docs/content/commands/npm-install.md

@@ -662,7 +662,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. `--ignore-scripts` and
 `--dangerously-allow-all-scripts` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### `strict-allow-scripts`
 

deps/npm/docs/content/commands/npm-ls.md

@@ -23,7 +23,7 @@ Note that nested packages will *also* show the paths to the specified packages.
 For example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-npm@11.19.1 /path/to/npm
+npm@11.20.0 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 ```

deps/npm/docs/content/commands/npm-publish.md

@@ -222,6 +222,9 @@ This value is not exported to the environment for child processes.
 When publishing from a supported cloud CI/CD system, the package will be
 publicly linked to where it was built and published from.
 
+When the `provenance-file` config is set, it takes precedence and automatic
+provenance generation (including via trusted publishing/OIDC) is skipped.
+
 This config cannot be used with: `provenance-file`
 
 #### `provenance-file`
@@ -231,6 +234,9 @@ This config cannot be used with: `provenance-file`
 
 When publishing, the provenance bundle at the given path will be used.
 
+This takes precedence over automatic provenance generation in trusted
+publishing flows.
+
 This config cannot be used with: `provenance`
 
 ### See Also

deps/npm/docs/content/commands/npm-rebuild.md

@@ -120,7 +120,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. `--ignore-scripts` and
 `--dangerously-allow-all-scripts` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### `strict-allow-scripts`
 

deps/npm/docs/content/commands/npm-stage.md

@@ -158,7 +158,7 @@ npm stage publish <package-spec>
 | `--workspace`, `-w` |  | String (can be set multiple times) | Enable running a command in the context of the configured workspaces of the       current project while filtering by running only the workspaces defined by       this configuration option.        Valid values for the `workspace` config are either:        * Workspace names       * Path to a workspace directory       * Path to a parent workspace directory (will result in selecting all         workspaces within that folder)        When set for the `npm init` command, this may be set to the folder of       a workspace which does not yet exist, to create the folder and set it       up as a brand new workspace within the project. |
 | `--workspaces` | null | null or Boolean | Set to true to run the command in the context of **all** configured       workspaces.        Explicitly setting this to false will cause commands like `install` to       ignore workspaces altogether.       When not set explicitly:        - Commands that operate on the `node_modules` tree (install, update,         etc.) will link workspaces into the `node_modules` folder.       - Commands that do other things (test, exec, publish, etc.) will operate         on the root project, _unless_ one or more workspaces are specified in         the `workspace` config. |
 | `--include-workspace-root` | false | Boolean | Include the workspace root when workspaces are enabled for a command.        When false, specifying individual workspaces via the `workspace` config,       or all workspaces via the `workspaces` flag, will cause npm to operate only       on the specified workspaces, and not on the root project. |
-| `--provenance` | false | Boolean | When publishing from a supported cloud CI/CD system, the package will be       publicly linked to where it was built and published from. |
+| `--provenance` | false | Boolean | When publishing from a supported cloud CI/CD system, the package will be       publicly linked to where it was built and published from.        When the `provenance-file` config is set, it takes precedence and       automatic provenance generation (including via trusted publishing/OIDC)       is skipped. |
 
 ### `npm stage list`
 

deps/npm/docs/content/commands/npm-token.md

@@ -110,11 +110,14 @@ the token access to specific organizations.
 #### `packages-and-scopes-permission`
 
 * Default: null
-* Type: null, "read-only", "read-write", or "no-access"
+* Type: null, "read-only", "read-write", "read-write-stage-only", or
+  "no-access"
 
 When creating a Granular Access Token with `npm token create`, sets the
 permission level for packages and scopes. Options are "read-only",
-"read-write", or "no-access".
+"read-write", "read-write-stage-only", or "no-access".
+"read-write-stage-only" grants publish access that stages releases instead
+of publishing them directly.