[v22.x] deps: upgrade npm to 10.9.3

[npm-cli-bot]

10.9.3 (2025-06-25)

Bug Fixes

• 7cff878 #8343 powershell: use Invoke-Expression to pass args (#8343) (@alexsch01)
• 78dc057 #8378 stop working around bug fixed in npm-package-arg@12.0.2 (@TrevorBurnham)
• e510f14 #8248 docs: 'pacakge' -> 'package' (#8248) (@t3hmrman)

Dependencies

• c38ec84 #8378 validate-npm-package-name@6.0.1
• 72564c5 #8378 spdx-license-ids@3.0.21
• 20fa199 #8378 socks@2.8.5
• 48c193a #8378 socks-proxy-agent@8.0.5
• 00fccfb #8378 semver@7.7.2
• 5ab8aac #8378 read@4.1.0
• 224c69e #8378 p-map@7.0.3
• 1e41678 #8378 npm-package-arg@12.0.2
• e9cf30e #8378 nopt@8.1.0
• 2bedf25 #8378 minizlib@3.0.2
• a795ee0 #8378 minipass-fetch@4.0.1
• 8ed043c #8378 https-proxy-agent@7.0.6
• 74518d0 #8378 http-cache-semantics@4.2.0
• cc7dcfc #8378 hosted-git-info@8.1.0
• 13aea40 #8378 foreground-child@3.3.1
• 9c81599 #8378 exponential-backoff@3.1.2
• b59097f #8378 node-gyp@11.2.0
• 8b29435 #8378 debug@4.4.1
• 4c8e170 #8378 cidr-regex@4.1.3
• 9bb94a3 #8378 is-cidr@5.1.1
• a1dbb0b #8378 ci-info@4.2.0
• 0a5f2ff #8378 chalk@5.4.1
• 7912c9c #8378 brace-expansion@2.0.2
• 19028b8 #8378 agent-base@7.1.3
• fd26776 #8378 abbrev@3.0.1
• dbb23ab #8378 sigstore@3.1.0
• 92feb9b #8378 @sigstore/protobuf-specs@0.4.3
• 4fd7174 #8378 @sigstore/tuf@3.1.1
• b327bc2 #8378 @npmcli/run-script@9.1.0
• 04e7e1c #8378 @npmcli/redact@3.2.2.
• 90d2aab #8378 @npmcli/query@4.0.1
• 2e47537 #8378 @npmcli/package-json@6.2.0
• a5eb5dd #8378 @npmcli/git@6.0.3

Chores

• 15e545b #8384 @npmcli/template-oss@4.24.4 (#8384) (@wraithgar)
• fb5a9f2 #8378 @npmcli/template-oss@4.24.3 (@wraithgar)
• 19da79a #8378 dev dependency updates (@wraithgar)
• workspace: @npmcli/arborist@8.0.1
• workspace: libnpmdiff@7.0.1
• workspace: libnpmexec@9.0.1
• workspace: libnpmfund@6.0.1
• workspace: libnpmpack@8.0.1

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[github-actions]

Fast-track has been requested by @nodejs-github-bot. Please 👍 to approve.

[wraithgar]

If we want this to land in v20 do we make a separate PR to its staging branch or will this be able to backport there too?

[aduh95]

If we want this to land in v20 do we make a separate PR to its staging branch or will this be able to backport there too?

It's not necessary, although I doubt we can land it on 20.x as npm 10.8.3 changes the Python requirement, npm updates have been blocked on that release line, see #55170 (comment)

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/67720/