Use Case

As a... Node driver user and maintainer
I want... our packages to install and run correctly under npm 12
So that... users on the latest npm are not silently broken

npm 12 blocks dependency install scripts by default. Our native addons (zstd, kerberos, mongodb-client-encryption) fetch their binary via a prebuild-install install script, so under npm 12 the install "succeeds" but no binary is delivered and the module fails to load at runtime. They are optional peer deps of the driver, so any user enabling compression, Kerberos, or CSFLE/QE is affected. This cannot be fixed publish-side (allowScripts is the consumer's setting), so we need a delivery model that does not rely on an install script. prebuild-install is deprecated anyway.

Minor, separate: npm 12 also blocks git-URL deps by default, which breaks js-bson's npm ci on its dbx-js-tools devDependency.

References:

• https://github.com/prebuild/prebuild-install/issues/216#issuecomment-3666500733
• https://github.com/npm/cli/issues/8153

User Experience

• Optional native addons (zstd, kerberos, mongodb-client-encryption) install and load under npm 12 with no manual allowScripts approval, once the per-platform packages are released.
• No user-facing change for the git-dep problem (dev/CI only).

Risks/Unknowns

n/a

Acceptance Criteria

Implementation Requirements

• zstd, kerberos, and mongodb-client-encryption are delivered as per-platform npm packages and install and load under npm 12 with no install-script approval. Tracked in NODE-7678, NODE-7679 and NODE-7680.
• The driver keeps @mongodb-js/zstd as the fallback when Node's built-in zstd is unavailable, including in the v8 line. Tracked in NODE-7097.
• js-bson npm ci and build succeed under npm 12 - addressed in NODE-7681

Testing Requirements

• The driver and mongodb-connection-string-url CI run on npm 12 and all builds succeed.
• zstd, kerberos, and mongodb-client-encryption CI install the packed packages into a fresh project with npm 12 and load the addon without approving install scripts. This is covered by NODE-7678, NODE-7679 and NODE-7680.

Documentation Requirements

• N/A

Follow Up Requirements

• Follow up as promised in https://github.com/mongodb-js/mongodb-client-encryption/pull/127#issuecomment-4542886393

Out of Scope / Follow-ups

• Build-from-source path (exotic platforms with no bundled prebuild, or FIPS/security policies that forbid downloaded binaries) still requires the consumer to opt into install scripts under npm 12; the --build-from-source flag is also dead on npm 12 (EUNKNOWNCONFIG). Tracked separately in NODE-6795. Mitigate by shipping a wide prebuild matrix (linux glibc+musl x64/arm64, macOS x64/arm64, Windows x64/arm64) so few users land here.
• Minor: npm 12 lockfile-format bumps may churn committed package-lock.json; sweep repos/docs for any usage of now-rejected CLI flags (e.g. --build-from-source).