fix: pin npm to specific version in create-release workflow

[dgilmanuni]

Summary

Pin npm@latest to npm@11.7.0 in the create-release workflow to prevent automatically pulling compromised versions of npm or its dependencies.

What changed

• .github/workflows/create-release.yaml: Changed npm install -g npm@latest to npm install -g npm@11.7.0

Motivation

The axios npm supply chain compromise (2026-03-30) demonstrated the risk of using unpinned @latest tags in CI pipelines. An attacker who publishes a malicious version to npm can immediately compromise any workflow that installs @latest. Pinning to a known-good version eliminates this attack vector.

Test plan

• Verify the create-release workflow still runs successfully with the pinned npm version
• Confirm npm@11.7.0 is a valid, uncompromised release

🤖 Generated with Claude Code

[semgrep-code-uniswap]

Semgrep found 1 npm-package-in-action-not-pinned-to-commit-sha finding:

• .github/workflows/create-release.yaml
  • L157 - Triage

$...LIB
An npm script inside an action on GitHub is not pinned to a full length commit SHA. Pinning the npm package to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

[semgrep-code-uniswap]

$...LIB
An npm script inside an action on GitHub is not pinned to a full length commit SHA. Pinning the npm package to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

⭐ Fixed in commit 3efa945 ⭐

[dgilmanuni]

/ar Pinning npm itself to a git commit SHA is not practical — it's the package manager, not a third-party dependency. Version pinning to @11.7.0 is sufficient.

[semgrep-code-uniswap]

$...LIB
An npm script inside an action on GitHub is not pinned to a full length commit SHA. Pinning the npm package to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

🌟 Fixed in commit 3efa945 🌟

[semgrep-code-uniswap]

Semgrep found 1 npm-package-in-action-not-pinned-to-commit-sha finding:

• .github/workflows/create-release.yaml
  • L157 - Triage

$...LIB
An npm script inside an action on GitHub is not pinned to a full length commit SHA. Pinning the npm package to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.