release 4.14.0; switch to trusted publishing (#4794)

Refs: #4793

Author: trentm

.github/workflows/release.yml

@@ -10,7 +10,7 @@ on:
 permissions:
   attestations: write
   contents: write
-  id-token: write
+  id-token: write # required for OIDC and provenance (npm publish)
   pull-requests: read
 
 jobs:
@@ -25,7 +25,8 @@ jobs:
 
       - uses: actions/setup-node@v5
         with:
-          node-version: 'v16.20.2'
+          # Require npm 11.5.1 or later for https://docs.npmjs.com/trusted-publishers.
+          node-version: 'v24.8.0'
 
       # Setup a Docker "buildx" builder container, used by "build-push-action"
       # below for multi-platform image builds. Notes on multi-platform images:
@@ -133,9 +134,8 @@ jobs:
 
       - name: npm publish (only for tag release)
         if: startsWith(github.ref, 'refs/tags')
-        run: |-
-          echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > .npmrc
-          npm publish --provenance
+        # https://docs.npmjs.com/trusted-publishers
+        run: npm publish
 
       - if: ${{ always() && startsWith(github.ref, 'refs/tags') }}
         uses: elastic/oblt-actions/slack/notify-result@v1

docs/release-notes/breaking-changes.md

@@ -23,8 +23,8 @@ To learn how to upgrade, check out [Upgrading](/reference/upgrading.md).
 % **Action**<br> Steps for mitigating deprecation impact.
 % ::::
 
-## Next version [next-version]
-**Release date:** REPLACEME Month day, year
+## 4.14.0 [4-14-0]
+**Release date:** Sep 25, 2025
 
 ::::{dropdown} Drop support for directly instrumenting Next.js
 Direct instrumentation of the `next` npm package has been removed.

docs/release-notes/index.md

@@ -21,11 +21,27 @@ To check for security updates, go to [Security announcements for the Elastic sta
 
 % ## Next [next]
 % **Release date:** Month day, year
-
+%
 % ### Features and enhancements [next-features-enhancements]
-
+%
 % ### Fixes [next-fixes]
 
+## 4.14.0 [4-14-0]
+**Release date:** Sep 25, 2025
+
+(See [breaking changes](./breaking-changes.md) in this release.)
+
+### Fixes [4-14-0-fixes]
+
+* Mark the published AWS Lambda layers as supporting the "nodejs22.x" Lambda Runtime (`--compatible-runtimes`). The "nodejs22.x" runtime was released by AWS on 2024-11-21. ([#4795](https://github.com/elastic/apm-agent-nodejs/pull/4795))
+
+    Note that this Node.js APM agent supports Node.js 22.x, so the new AWS Lambda runtime was supported when it was released. However, the metadata stating compatible runtimes (which is advisory) was not updated until now.
+
+### Chores [4-14-0-chores]
+
+* Switch to trusted publishing (https://docs.npmjs.com/trusted-publishers) as a security precaution against supply-chain attacks. ([#4793](https://github.com/elastic/apm-agent-nodejs/pull/4793))
+
+
 ## 4.13.0 [4-13-0]
 **Release date:** May 6, 2025
 
@@ -36,7 +52,7 @@ To check for security updates, go to [Security announcements for the Elastic sta
 ## 4.12.0 [4-12-0]
 **Release date:** April 24, 2025
 
-### Features and enhancements [4-12-0-next-features-enhancements]
+### Features and enhancements [4-12-0-features-enhancements]
 
 * Get sourcemap handling for captured exceptions to work with stack frames in
   ES Modules (ESM). Before this, sourcemap handling would only work for stack

package-lock.json

@@ -1,7 +1,11 @@
 {
   "name": "elastic-apm-node",
-  "version": "4.13.0",
+  "version": "4.14.0",
   "description": "The official Elastic APM agent for Node.js",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "type": "commonjs",
   "main": "index.js",
   "types": "index.d.ts",