[cacieprins]

Moves @cypress/request publishing to npm trusted publishing, so releases no longer need the shared NPM_TOKEN.

The trusted publisher is already registered on npm (CircleCI, this project, restricted to the org-npm-credentials context), so this is safe to merge.

• The release step exports a CircleCI OIDC token (NPM_ID_TOKEN) for @semantic-release/npm to exchange for a short-lived publish token. CircleCI support needs @semantic-release/npm 13.2.0, which semantic-release 25 pulls in, so it's now pinned to semantic-release@25.0.9.
• The release image moves from cimg/node:22.7.0 to 22.21.0, since semantic-release 25 needs Node >= 22.14.
• The config moves from version: 2 to 2.1. CircleCI stopped compiling version 2 configs in July, so the next pipeline on master would fail without this regardless. The last master pipeline ran on 2026-05-28.
• The job keeps org-npm-credentials, since the trusted publisher is restricted to that context.

🤖 Generated with Claude Code

---

Note

Medium Risk
Release publishing path and toolchain change (OIDC + pinned semantic-release/Node); failure modes are mostly broken releases rather than app runtime, but npm publish auth is security-sensitive.

Overview
Updates CircleCI so npm releases use trusted publishing instead of a long-lived NPM_TOKEN. The release job fetches an OIDC token as NPM_ID_TOKEN in the same step as semantic-release@25.0.9, which exchanges it for a short-lived publish credential.

Also bumps the CircleCI config to version: 2.1 (dropping the obsolete workflows version: 2) and moves the release runner from cimg/node:22.7.0 to 22.21.0 to satisfy Node requirements for semantic-release 25. The release job still uses the existing org-npm-credentials context for the trusted publisher restriction.

^{Reviewed by Cursor Bugbot for commit b8ec03b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit b8ec03b. Configure here.}

[cursor]

Release image ships too-old npm

High Severity

cimg/node:22.21.0 bundles npm 10.9.4, but npm trusted publishing needs npm CLI 11.5.1+ to read NPM_ID_TOKEN and exchange it during publish. @semantic-release/npm skips writing an _authToken when OIDC is available and relies on that CLI, so the release job is likely to fail authentication.

 

^{Reviewed by Cursor Bugbot for commit b8ec03b. Configure here.}