feat: Bump Node version, npm audit fix

[khvn26]

This will fix the publish failure. Tested locally.

[rolodato]

I'm guessing this is the error you're talking about: https://github.com/Flagsmith/serverless-plugin-canary-deployments/actions/runs/11251575359/job/31282960668

If so, we might be able to get away with not updating the required Node version by installing the latest npm in CI, instead of upgrading both Node and npm together.

Something like npm i -g npm@latest in CI after Node is set up? That way we can avoid introducing a technically-breaking change.

[khvn26]

Something like npm i -g npm@latest in CI after Node is set up?

The question is why doesn't the action install latest NPM straight away. My guess was that NPM dropped support for Node below LTS, but I didn't confirm it, to be honest.

Bumping NPM manually in CI does seem ugly considering the setup-node action is expected to provide the latest possible version out of the box. That being said, I believe only the .nvmrc change actually affects the error in CI; the engine version bump happened to freshen up dependencies and alleviate NPM's audit warnings.

I do agree that depending on node >=18.0 is a bit radical, considering that serverless' current constraint is >=12.0. I think we could loosen the constraint to match the serverless one. I definitely don't want to keep the >=4.0 one to avoid outdated dependencies.

[rolodato]

The question is why doesn't the action install latest NPM straight away

Node.js always comes bundled with NPM at a specific version - the latest NPM is never installed automatically. In the action logs you can see the actual Node 14 dependency that is downloaded (https://github.com/actions/node-versions/releases/download/14.21.3-4202774076/node-14.21.3-linux-x64.tar.gz). This tarball contains NPM 6.14.18.

I'm fairly sure we could fix this issue by only adding npm install npm@latest in CI and not changing anything else, though I've not tested it.