fix(deps): update @semantic-release/npm to ^12.0.2

[MikeMcC399]

• closes brace-expansion@2.0.1 unfixable low vulnerability (CVE-2025-5889) #3777

Situation

• Before the release of npm@10.9.3, installing semantic-release reported a low severity vulnerability
• For such existing projects, npm audit fix may continue to report that the vulnerability cannot be fixed and refers to GHSA-v6h2-p8h4-qcjw (CVE-2025-5889 - brace-expansion Regular Expression Denial of Service vulnerability)
• Since the release of npm@10.9.3, a complete new installation of semantic-release reports no vulnerability
• Uninstalling and re-installing semantic-release also works around the issue
• Executing npm ci in this repo https://github.com/semantic-release/semantic-release/ also displays the above unfixable vulnerability

Change

Update @semantic-release/npm in package.json dependencies from ^12.0.0 to ^12.0.2

@semantic-release/npm@12.0.2 contains the update to

npm@10.9.3 which includes the fixed dependency

brace-expansion@2.0.2

Note

The update was carried out as follows on Ubuntu 24.04.2 LTS, with Node.js 22.17.0 LTS, Corepack 0.33.0

rm -rf node_modules
corepack enable npm
npm update @semantic-release/npm --save

[travi]

Thanks!

[github-actions]

🎉 This PR is included in version 24.2.6 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀