deps: upgrade npm to 11.8.0

PR-URL: #61466
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

Author: npm-cli-bot

deps/npm/docs/content/commands/npm-dedupe.md

@@ -48,7 +48,7 @@ a
 ```
 
 During the installation process, the `c@1.0.3` dependency for `b` was placed in the root of the tree.
-Though `d`'s dependency on `c@1.x` could have been satisfied by `c@1.0.3`, the newer `c@1.9.0` dependency was used, because npm favors updates by default, even when doing so causes duplication.
+Though `d`'s dependency on `c@1.x` could have been satisfied by `c@1.0.3`, the newer `c@1.9.9` dependency was used, because npm favors updates by default, even when doing so causes duplication.
 
 Running `npm dedupe` will cause npm to note the duplication and re-evaluate, deleting the nested `c` module, because the one in the root is sufficient.
 

deps/npm/docs/content/commands/npm-install.md

@@ -23,6 +23,18 @@ If the package has a package-lock, or an npm shrinkwrap file, or a yarn lock fil
 
 See [package-lock.json](/configuring-npm/package-lock-json) and [`npm shrinkwrap`](/commands/npm-shrinkwrap).
 
+#### How `npm install` uses `package-lock.json`
+
+When you run `npm install` without arguments, npm compares `package.json` and `package-lock.json`:
+
+* **If the lockfile's resolved versions satisfy the `package.json` ranges:** npm uses the exact versions from `package-lock.json` to ensure reproducible builds across environments.
+
+* **If the ranges don't match:** npm resolves new versions that satisfy the `package.json` ranges and updates `package-lock.json` accordingly. This happens when you modify version ranges in `package.json` (e.g., changing `^7.0.0` to `^8.0.0`). Note that changing a range within the same major version (e.g., `^7.0.0` to `^7.1.0`) will only update the metadata in the lockfile if the currently installed version still satisfies the new range.
+
+In essence, `package-lock.json` locks your dependencies to specific versions, but `package.json` is the source of truth for acceptable version ranges. When the lockfile's versions satisfy the `package.json` ranges, the lockfile wins. When they conflict, `package.json` wins and the lockfile is updated.
+
+If you want to install packages while ensuring that `package.json` is not modified and that both files are strictly in sync, use [`npm ci`](/commands/npm-ci) instead.
+
 A `package` is:
 
 * a) a folder containing a program described by a [`package.json`](/configuring-npm/package-json) file

deps/npm/docs/content/commands/npm-ls.md

@@ -23,7 +23,7 @@ Note that nested packages will *also* show the paths to the specified packages.
 For example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-npm@11.7.0 /path/to/npm
+npm@11.8.0 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 ```

deps/npm/docs/content/commands/npm.md

@@ -14,7 +14,7 @@ Note: This command is unaware of workspaces.
 
 ### Version
 
-11.7.0
+11.8.0
 
 ### Description
 

deps/npm/docs/output/commands/npm-access.html

@@ -141,9 +141,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-access----1170">
+<h1 id="----npm-access----1180">
     <span>npm-access</span>
-    <span class="version">@11.7.0</span>
+    <span class="version">@11.8.0</span>
 </h1>
 <span class="description">Set access level on published packages</span>
 </header>

deps/npm/docs/output/commands/npm-adduser.html

@@ -141,9 +141,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-adduser----1170">
+<h1 id="----npm-adduser----1180">
     <span>npm-adduser</span>
-    <span class="version">@11.7.0</span>
+    <span class="version">@11.8.0</span>
 </h1>
 <span class="description">Add a registry user account</span>
 </header>

deps/npm/docs/output/commands/npm-audit.html

@@ -141,9 +141,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-audit----1170">
+<h1 id="----npm-audit----1180">
     <span>npm-audit</span>
-    <span class="version">@11.7.0</span>
+    <span class="version">@11.8.0</span>
 </h1>
 <span class="description">Run a security audit</span>
 </header>

deps/npm/docs/output/commands/npm-bugs.html

@@ -141,9 +141,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-bugs----1170">
+<h1 id="----npm-bugs----1180">
     <span>npm-bugs</span>
-    <span class="version">@11.7.0</span>
+    <span class="version">@11.8.0</span>
 </h1>
 <span class="description">Report bugs for a package in a web browser</span>
 </header>

deps/npm/docs/output/commands/npm-cache.html

@@ -141,9 +141,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-cache----1170">
+<h1 id="----npm-cache----1180">
     <span>npm-cache</span>
-    <span class="version">@11.7.0</span>
+    <span class="version">@11.8.0</span>
 </h1>
 <span class="description">Manipulates packages cache</span>
 </header>

deps/npm/docs/output/commands/npm-ci.html

@@ -141,9 +141,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ci----1170">
+<h1 id="----npm-ci----1180">
     <span>npm-ci</span>
-    <span class="version">@11.7.0</span>
+    <span class="version">@11.8.0</span>
 </h1>
 <span class="description">Clean install a project</span>
 </header>