fix(deps): update npm to ^10.9.3

[MikeMcC399]

• closes brace-expansion@2.0.1 unfixable low vulnerability (CVE-2025-5889) #966

Situation

• Before the release of npm@10.9.3, installing @semantic-release/npm reported a low severity vulnerability
• For such existing projects, npm audit fix continues to reports that the vulnerability cannot be fixed and refers to GHSA-v6h2-p8h4-qcjw (CVE-2025-5889 - brace-expansion Regular Expression Denial of Service vulnerability)
• Since the release of npm@10.9.3, a new installation of @semantic-release/npm reports no vulnerability
• Uninstalling and re-installing semantic-release and / or @semantic-release/npm also works around the issue

Change

Update npm in package.json dependencies from ^10.5.0 to ^10.9.3

npm@10.9.3 includes the fixed dependency brace-expansion@2.0.2

Note

• Renovate's automatically generated PR chore(deps): update npm to v10.9.3 #971 only updated the packageManager field in package.json to npm@10.9.3 not the dependencies field

[travi]

Thanks!

[github-actions]

🎉 This PR is included in version 12.0.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[MikeMcC399]

@travi

Thanks!

Thanks also for merging! I've checked it out on two repos that were previously reporting the vulnerability and everything is now fine 👍🏻

[github-actions]

🎉 This PR is included in version 13.0.0-beta.2 🎉

The release is available on:

• npm package (@beta dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[github-actions]

🎉 This PR is included in version 13.0.0-alpha.16 🎉

The release is available on:

• npm package (@alpha dist-tag)
• GitHub release

Your semantic-release bot 📦🚀