ci: pin npm to v12 on release workflow and bump changesets

[brunomenezes]

Summary

The release workflow installed npm@latest, which became npm 12 on 2026-07-08. npm 12 changed what npm info <pkg> --json returns: npm 11 returns the package object, and npm 12 returns an array that wraps it.

npx -y npm@11 info @cartesi/mock-verifying-paymaster --json | jq -c '.versions'   # ["0.1.0","0.2.0","0.2.1"]
npx -y npm@12 info @cartesi/mock-verifying-paymaster --json | jq -c '.versions'   # error: cannot index array

@changesets/cli 2.29.8 reads .versions straight from that result. With npm 12 it got [], so every package looked unpublished and changesets tried to publish versions that were already on npm. The 2.0.0-alpha.36 release failed this way on @cartesi/mock-verifying-paymaster@0.2.1.

Changes

• Bump @changesets/cli to 2.31.1. 2.31.1 unwraps npm 12's array (Array.isArray(parsed) ? parsed[0] : parsed), which fixes the root cause.
• Pin npm to v12 in release.yaml instead of @latest. The release keeps the latest npm major, and a future major can't change publish behaviour without warning.

[changeset-bot]

⚠️ No Changeset found

Latest commit: ba8c98c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​changesets/​cli@​2.29.8 ⏵ 2.31.1			+1	-1

View full report