docs: add instructions to upgrade npm

[MikeMcC399]

Description

Add instructions to docs/BestPractices on how to upgrade the version of npm from the one packaged with Node.js.

Motivation and Context

npm is bundled with Node.js as described in the Node.js Distribution Policy document.

Although new semver-minor npm releases flow into their related new Node.js releases as a matter of course, factors such as release cadence and stability policies, mean that npm releases regularly experience a delay before they appear packaged in Node.js. This can pose a problem for users urgently needing npm fixes.

The Node.js backporting policy specifies a minimum of 2 weeks' availability in the current release line before a commit is backported to the Active LTS release line. Current releases have a cadence of 2 weeks, Active LTS is based on a 4 week cadence (see release plans in https://github.com/nodejs/Release/issues). This adds up to 8 weeks settling-in time.

Whether npm semver-major updates are backported to existing Node.js release lines, is subject to decision making.

The latest major version of npm is 12.x and this is the subject of an open request under nodejs/Release#1161. Node.js currently bundles npm as shown below.

Node.js	npm
22.x	10.x
24.x	11.x
26.x	11.x

npm 12.x blocks unapproved lifecycle scripts by default - see npm install-scripts. Users may want to have access to this functionality before it is deployed packaged with Node.js

Adding instructions to the documentation assists node Docker users to take advantage of newer npm releases that may include bug fixes, vulnerability remediations or new features. If a bundled version of npm causes compatibility issues for a user, they can also use the same method to downgrade npm to a lower compatible version.

Testing Details

docker run --rm --entrypoint npm node:lts --version
cat > Dockerfile <<EOT
FROM node:lts
RUN npm install --global npm@latest
EOT
docker build -t npm-upgrade .
docker run --rm --entrypoint npm npm-upgrade --version

Testing logs

$ docker run --rm --entrypoint npm node:lts --version
cat > Dockerfile <<EOT
FROM node:lts
RUN npm install --global npm@latest
EOT
docker build -t npm-upgrade .
docker run --rm --entrypoint npm npm-upgrade --version
11.16.0
[+] Building 16.1s (6/6) FINISHED                                                                        docker:default
 => [internal] load build definition from Dockerfile                                                               0.0s
 => => transferring dockerfile: 87B                                                                                0.0s
 => [internal] load metadata for docker.io/library/node:lts                                                        0.2s
 => [internal] load .dockerignore                                                                                  0.0s
 => => transferring context: 2B                                                                                    0.0s
 => CACHED [1/2] FROM docker.io/library/node:lts@sha256:5711a0d445a1af54af9589066c646df387d1831a608226f4cd694fc59  0.0s
 => => resolve docker.io/library/node:lts@sha256:5711a0d445a1af54af9589066c646df387d1831a608226f4cd694fc59e745059  0.0s
 => [2/2] RUN npm install --global npm@latest                                                                     14.2s
 => exporting to image                                                                                             1.6s
 => => exporting layers                                                                                            1.1s
 => => exporting manifest sha256:8cf3ca61682d21963e5a93d2841bcf883910b8f2414500951bdf1406623567ce                  0.0s
 => => exporting config sha256:8855bfbf738028cbe4274238a8dea5bdf73043379110dd47c74e56a9f86f2759                    0.0s
 => => exporting attestation manifest sha256:da3083d98a42720435470e546bc85a533f50436fb1b6a4569411e239aa53af90      0.0s
 => => exporting manifest list sha256:feb39858e1059471fe14881892459587d71c1d327bce9c109426327e12e33a63             0.0s
 => => naming to docker.io/library/npm-upgrade:latest                                                              0.0s
 => => unpacking to docker.io/library/npm-upgrade:latest                                                           0.4s
12.0.1

Types of changes

• Documentation
• Version change (Update, remove or add more Node.js versions)
• Variant change (Update, remove or add more variants, or versions of variants)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Other (none of the above)

Checklist

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING.md document.
• All new and existing tests passed.

[MikeMcC399]

Preview

• https://github.com/MikeMcC399/docker-node/blob/docs/upgrade-npm/docs/BestPractices.md#upgrading-npm

[MikeMcC399]

Could we get this reviewed and landed?

This is an FAQ, and an example of where it's relevant is currently:

CVE-2026-59873

The security release Node.js 22.23.2 contains a critical vulnerability CVE-2026-59873 in tar@7.5.11, bundled in npm@10.9.8, bundled in Node.js 22.23.2

I already reported this through npm/cli#9801 and they have released npm@10.9.9 on 2026-07-28.

I haven't seen a PR from npm to Node.js yet for npm@10.9.9 and in any case releasing has built-in delays.

It would be good to be able to point users to the information about how to update npm, if they urgently want to remediate the vulnerability. That is what this PR provides.