[hakshu25]

Why

The npm devDependency was added in #1170 so that publishing would run with npm 11.5.1 or later, which trusted publishing requires. pnpm publish runs npm from a temporary directory and does not pick up the copy in node_modules, so since #1177 the release workflow installs npm globally and publishes with that one.

No script uses the devDependency anymore. It is still installed on every pnpm install, and Renovate keeps opening update PRs for it (for example #1543) that have no effect on the release.

What

Removes npm from the devDependencies. The release workflow keeps publishing with the npm 11 it installs globally, so the published package and the release process do not change. Also removes the license check exception that only covered npm, because no package named npm remains in the dependency tree.

Implementation decisions

• The npm@11 pin in the release workflow stays as it is. Whether to move publishing to npm 12 is a separate decision from removing an unused dependency.

How to test

pnpm install --frozen-lockfile
pnpm why npm          # prints nothing
pnpm license:analyze
pnpm build
pnpm lint
pnpm typecheck
pnpm test

Checklist

• Read CONTRIBUTING.md
• Updated documentation if it is required.
• Added/updated tests if it is required. (or tested manually)
• Passed pnpm lint and pnpm test on the root directory.

🤖 Generated with Claude Code