As @bep already mentioned it’s not possible to call short codes within a a template.
The usage of the highlight short code below
{{< highlight sh >}}
npm install bootstrap@{{ .Site.Params.current_version }}
{{< /highlight >}}
can be translated to
{{ highlight "npm install bootstrap@{{ .Site.Params.current_version }}" "sh" }}
But I would guess that will not be substituted with the actual value. We can circumvent this as follows:
{{ highlight (printf "npm install bootstrap@%s" .Site.Params.current_version) "sh" }}
But this approach isn’t sufficient if the code examples are longer and contain more template variables, e.g. as in the following example:
{{< highlight html >}}
<script src="{{ .Site.Params.cdn.jquery }}" integrity="{{ .Site.Params.cdn.jquery_hash }}" crossorigin="anonymous"></script>
<script src="{{ .Site.Params.cdn.popper }}" integrity="{{ .Site.Params.cdn.popper_hash }}" crossorigin="anonymous"></script>
<script src="{{ .Site.Params.cdn.js }}" integrity="{{ .Site.Params.cdn.js_hash }}" crossorigin="anonymous"></script>
{{< /highlight >}}