Use Case

As a... Node driver user and maintainer
I want... our packages to install and run correctly under npm 12
So that... users on the latest npm are not silently broken

npm 12 blocks dependency install scripts by default. Our native addons (zstd, kerberos, mongodb-client-encryption) fetch their binary via a prebuild-install install script, so under npm 12 the install "succeeds" but no binary is delivered and the module fails to load at runtime. They are optional peer deps of the driver, so any user enabling compression, Kerberos, or CSFLE/QE is affected. This cannot be fixed publish-side (allowScripts is the consumer's setting), so we need a delivery model that does not rely on an install script. prebuild-install is deprecated anyway.

Minor, separate: npm 12 also blocks git-URL deps by default, which breaks js-bson's npm ci on its dbx-js-tools devDependency.

References:

• https://github.com/prebuild/prebuild-install/issues/216#issuecomment-3666500733
• https://github.com/npm/cli/issues/8153

User Experience

• Optional native addons install and load under npm 12 with no manual allowScripts approval.
• No user-facing change for the git-dep problem (dev/CI only).

Risks/Unknowns

n/a

Acceptance Criteria

Implementation Requirements

• zstd, kerberos, and mongodb-client-encryption install and load under npm 12 with no install-script approval, via a no-install-script delivery model.
• js-bson npm ci and build succeed under npm 12 - addressed in NODE-7681

Testing Requirements

• CI for each affected repo runs on npm 12 and all builds succeed.

Documentation Requirements

• N/A

Follow Up Requirements

• Follow up as promised in https://github.com/mongodb-js/mongodb-client-encryption/pull/127#issuecomment-4542886393

Out of Scope / Follow-ups

• Build-from-source path (exotic platforms with no bundled prebuild, or FIPS/security policies that forbid downloaded binaries) still requires the consumer to opt into install scripts under npm 12; the --build-from-source flag is also dead on npm 12 (EUNKNOWNCONFIG). Tracked separately in NODE-6795. Mitigate by shipping a wide prebuild matrix (linux glibc+musl x64/arm64, macOS x64/arm64, Windows x64/arm64) so few users land here.
• Minor: npm 12 lockfile-format bumps may churn committed package-lock.json; sweep repos/docs for any usage of now-rejected CLI flags (e.g. --build-from-source).