build(deps-dev): bump @semantic-release/npm from 12.0.2 to 13.1.5

[dependabot]

Bumps @semantic-release/npm from 12.0.2 to 13.1.5.

Release notes

Sourced from @​semantic-release/npm's releases.

v13.1.5

13.1.5 (2026-03-01)

Bug Fixes

• deps: update dependency normalize-url to v9 (#1095) (daec492)

v13.1.4

13.1.4 (2026-02-06)

Bug Fixes

• deps: update dependency @​actions/core to v3 (#1085) (17abfe1)

v13.1.3

13.1.3 (2025-12-12)

Bug Fixes

• deps: update dependency @​actions/core to v2 (#1055) (fa4a3ab)

v13.1.2

13.1.2 (2025-11-14)

Bug Fixes

• deps: update dependency read-pkg to v10 (#1032) (f3f1a00)

v13.1.1

13.1.1 (2025-10-19)

Bug Fixes

• publish-dry-run: temporarily remove the addition of dry-running the publish step (30bd176)

v13.1.0

13.1.0 (2025-10-19)

Features

• trusted-publishing: verify auth, considering OIDC vs tokens from various registries (e3319f1), closes #958
• trusted-publishing: refine the messages for related errors (316ce21), closes #958
• trusted-publishing: make request to verify if OIDC token exchange can succeed (c80ecb0), closes #958
• trusted-publishing: pass id-token as bearer header for github actions (d83b727), closes #958
• trusted-publishing: pass id-token as bearer header for gitlab pipelines (6d1c3cf), closes #958

... (truncated)

Commits

• daec492 fix(deps): update dependency normalize-url to v9 (#1095)
• af8362f chore(deps): update dependency strip-ansi to v7.2.0 (#1098)
• 7354e11 chore(deps): update node.js to v24 (#1027)
• 2c4d2c9 chore(deps): update npm to v11.11.0 (#1097)
• 95ba689 chore(deps): update dependency c8 to v11 (#1096)
• 5d32912 chore(deps): update npm to v11.10.1 (#1094)
• 54f908c chore(deps): lock file maintenance (#1093)
• 91e1f14 chore(deps): update npm to v11.10.0 (#1092)
• 0d7d37e chore(deps): lock file maintenance (#1089)
• c5411cc chore(deps): update npm to v11.9.0 (#1088)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​semantic-release/npm since your current version.

[github-actions]

Single Commit Policy — COMPLIANT

Status: 1 commit | Valid format | No merge commits | Ready for merge

Commit details

• Hash: ecb1a874ee5907a34e67b5e78155cfe72db027eb
• Message: build(deps-dev): bump @semantic-release/npm from 12.0.2 to 13.1.5
• Author: dependabot[bot]

---

Automated validation — dopamine single-commit enforcement

[murdore]

Reviewed at head ecb1a874 (package.json:87 "@semantic-release/npm": "^13.1.5", bumped from ^12.0.2 — a semver-major jump).

This repo has a track record of routine-looking dependency major bumps breaking things CI doesn't catch (Express 4→5 in #21, the yama-action v3 config-shape break in #45), so I checked what actually changed in v13 rather than trusting the changelog summary. The headline breaking change is new OIDC/"trusted publishing" auth verification (verifyNpmAuth) added into verifyConditions/prepare/publish — but it's gated behind pluginConfig.npmPublish !== false && pkg.private !== true (verified against the v13.1.5 source). This repo's .releaserc.json sets ["@semantic-release/npm", { "npmPublish": false }] and package.json has "private": true — either guard alone would already skip the new auth path, and both are set here, so it's never invoked. release.yml also never configures an NPM_TOKEN, consistent with that.

CI already exercises this end-to-end and is green: Build & Test, TypeScript Strict Check, and the repo's own "Validate semantic-release config" check all pass on this commit.

No blockers from me — approvable. Side note: mergeStateStatus currently shows BEHIND base main; a rebase-merge will pick that up automatically per the repo's single-commit workflow, no action needed beyond that.