fix(arborist): reject uninstall args that carry a version #9930

• follows on from https://github.com/npm/cli/issues/9806

Is there an existing issue for this?

• [x] I have searched the existing issues

This issue exists in the latest npm version

• [x] I am using the latest npm

This is not just a request to bump a dependency for a CVE

• [x] This is not solely a request to bump a dependency for a CVE

Current Behavior

Incorrectly attempting to uninstall a package using npm uninstall <name>@<version> neither fails, nor uninstalls:

$ npm uninstall [email protected]

up to date, audited 16 packages in 2s

8 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities
$ npm ls
tmp.Uwe8XKve3h@ /tmp/tmp.Uwe8XKve3h
└── [email protected]

Expected Behavior

If an attempt is made to uninstall a package using npm uninstall <name>@<version> either:

1. the command should fail with a syntax error or similar OR
2. the <version> should be ignored and the uninstall command should use only the package <name> to uninstall

Steps To Reproduce

cd $(mktemp -d)
npm install vite@8
npm uninstall vite@8
npm ls

Environment

• npm: 12.0.2
• Node.js: 26.7.0
• OS Name: Ubuntu 24.04.4 LTS
• npm config: ini ; node bin location = /home/mike/n/bin/node ; node version = v26.7.0 ; npm local prefix = /tmp/tmp.Uwe8XKve3h ; npm version = 12.0.2 ; cwd = /tmp/tmp.Uwe8XKve3h ; HOME = /home/mike ; Run `npm config ls -l` to show all defaults.