Motivation

The release job has been failing on every push to main — most recently run 30535460404:

🦋  info anipres is being published because our local version (0.13.0) has not been published on npm
🦋  error 403 Forbidden - PUT https://registry.npmjs.org/anipres - You cannot publish over the previously published versions: 0.13.0.
🦋  error 403 Forbidden - PUT https://registry.npmjs.org/slidev-addon-anipres - ... 0.8.11.

Both versions have been on npm since 2026-05-11, so changeset publish should have skipped them entirely.

Root cause

This is not caused by #485 — that PR left the release job byte-for-byte unchanged. It is a coincidence of timing: this was the first push to main since 2026-05-26, and the breakage landed in between.

npm 12 (released 2026-07-08) changed npm info --json to always return an array, even for a single package spec:

$ npx -y npm@11 info anipres --json | jq type
"object"
$ npx -y npm@12 info anipres --json | jq type
"array"

The release job runs npm install -g npm@latest — required for npm trusted publishing (needs >= 11.5.1) — which now resolves to 12.x.

@changesets/cli 2.29.7 reads pkgInfo.versions straight off the parsed JSON. On an array that is undefined, so publishedVersions falls back to [], every package is treated as unpublished, and changeset publish attempts to republish already-released versions.

For contrast, the last green release run (2026-05-26, same changesets version, npm 11) correctly logged:

🦋  warn anipres is not being published because version 0.13.0 is already published on npm
🦋  warn No unpublished projects to publish

Upstream: changesets/changesets#2164, fixed by changesets/changesets#2159, shipped in @changesets/cli 2.31.1.

Key changes

• Bump @changesets/cli ^2.29.7 → ^2.31.1. 2.31.1 adds normalizeInfoJson() (Array.isArray(parsed) ? parsed[0] : parsed), which works under both npm 11 and npm 12.

No changeset is included — this is release tooling only, with no user-facing or API change.

Note on lockfile size

The lockfile diff is larger than a one-line dep bump suggests. Two legitimate causes:

• pnpm 11 records libc: fields that the previously-committed (pnpm 10-era) lockfile lacks;
• the new subtree causes debug's optional supports-color peer to resolve tree-wide, adding (supports-color@10.2.2) peer suffixes.

pnpm install --frozen-lockfile passes and the supply-chain policy check is clean (1631 entries).

Testing done

Verified the exact predicate that fails in CI, against real npm 12 output:

anipres@0.13.0              json=array  2.29.7 sees published=false  2.31.1 sees published=true
slidev-addon-anipres@0.8.11 json=array  2.29.7 sees published=false  2.31.1 sees published=true

Also run locally:

• pnpm install --frozen-lockfile — clean, lockfile unmodified by install
• pnpm --filter anipres test — 21 passed (4 files)
• pnpm --filter anipres lint — clean
• pnpm --filter anipres build — succeeds

The release job itself only runs on pushes to main, so it cannot be exercised by this PR's CI; it will be validated when this merges.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the Changesets command-line tooling to a newer version for release workflow maintenance.