Update npm to v12 #96
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: bb_if_produktiv/psitrail#96
Reference in new issue
Block a user
This PR contains the following updates:
10.9.9→12.2.1Release Notes
npm/cli (npm)
v12.2.1Compare Source
Bug Fixes
b317f16#9941 write registry allowScripts keys under install-strategy=linked (#9941) (@manzoorwanijk)Dependencies
7b0c2e8#10088http-cache-semantics@4.3.0(@reggi)e9e99b4#10088undici@6.29.0(@reggi)857d7df#10088postcss-selector-parser@7.1.6(@reggi)bc7bb3a#10088ip-address@10.7.2(@reggi)7614360#10088brace-expansion@5.0.12(@reggi)@npmcli/arborist@10.0.4libnpmdiff@9.0.4libnpmexec@11.0.4libnpmfund@8.0.4libnpmpack@10.0.4v12.2.0Compare Source
Features
9741b64#10038 dist-tag: support OIDC authentication (#10038) (@reggi, @Copilot)Documentation
0c3b82a#10017 update npm stage docs to reflect that it can create new packages (#10017) (@shmam, @Copilot)Dependencies
@npmcli/config@11.2.0v12.1.0Compare Source
Features
6400533#9948 token: support read-write-stage-only granular access tokens (#9948) (@Tayvon, @Copilot)8723f53#9898 stage: display staged package status (#9898) (@joelverhagen)Bug Fixes
c9876d7#9882 provenance-file takes precedence over OIDC auto-generated provenance (#9882) (@yunseo-kim)b016aa2#9913 config: avoid exporting persistent allow-scripts (#9913) (@Fnine59)d6c6122#9914 arborist: match allowScripts keys for local paths (#9914) (@martinrrm, @Copilot)a8c9b2f#9823 keep dry-run output valid json (#9823) (@martinrrm)da50c34#9881 arborist: reject uninstall args that carry a version (#9881) (@lazerg)71915e8#9756 exempt explicit pack targets from allow-directory (#9756) (@ychampion, @ychampion)51c2bf8#9864 don't print the funding message for global installs (#9864) (@lazerg)Documentation
bea9066#9838 document npm 12 install script blocking (#9838) (@reggi)Dependencies
6e40f73#9871undici@6.28.0(@martinrrm, @Copilot)05bd2a4#9871ip-address@10.5.0(@martinrrm, @Copilot)b7c490d#9871brace-expansion@5.0.9(@martinrrm, @Copilot)75a943d#9843tar@7.5.22(#9843) (@martinrrm, @Copilot)Chores
7b50811#9961 pack: select workspace through config (#9961) (@reggi)81a901c#9915 recognize prefixed Node.js PR titles (#9915) (@reggi)4cdccea#9836 updatenode-integrationworkflow template to latest actions (#9836) (@MikeMcC399)278df04#9822 pass nodedir to node-gyp via npm_package_config env in node integration (#9822) (@reggi, @Copilot)@npmcli/arborist@10.0.3@npmcli/config@11.1.0libnpmdiff@9.0.3libnpmexec@11.0.3libnpmfund@8.0.3libnpmpack@10.0.3libnpmpublish@12.0.1v12.0.2Compare Source
Bug Fixes
834408e#9760 pack: honor min-release-age-exclude (#9760) (@martinrrm, @Copilot)ef6cfea#9786 owner: use scoped registry for user lookup (#9786) (@martinrrm, @Copilot)Documentation
9e17dc0#9805 clarify npm 12 unknown-config breaking change in changelogs (#9805) (@Hashim1999164)Chores
7b1f6c1#9747 parse pack --json object output in node integration (#9747) (@reggi, @Copilot)Dependencies
@npmcli/arborist@10.0.2@npmcli/config@11.0.1libnpmdiff@9.0.2libnpmexec@11.0.2libnpmfund@8.0.2libnpmpack@10.0.2v12.0.1Compare Source
Features
6400533#9948 token: support read-write-stage-only granular access tokens (#9948) (@Tayvon, @Copilot)8723f53#9898 stage: display staged package status (#9898) (@joelverhagen)Bug Fixes
c9876d7#9882 provenance-file takes precedence over OIDC auto-generated provenance (#9882) (@yunseo-kim)b016aa2#9913 config: avoid exporting persistent allow-scripts (#9913) (@Fnine59)d6c6122#9914 arborist: match allowScripts keys for local paths (#9914) (@martinrrm, @Copilot)a8c9b2f#9823 keep dry-run output valid json (#9823) (@martinrrm)da50c34#9881 arborist: reject uninstall args that carry a version (#9881) (@lazerg)71915e8#9756 exempt explicit pack targets from allow-directory (#9756) (@ychampion, @ychampion)51c2bf8#9864 don't print the funding message for global installs (#9864) (@lazerg)Documentation
bea9066#9838 document npm 12 install script blocking (#9838) (@reggi)Dependencies
6e40f73#9871undici@6.28.0(@martinrrm, @Copilot)05bd2a4#9871ip-address@10.5.0(@martinrrm, @Copilot)b7c490d#9871brace-expansion@5.0.9(@martinrrm, @Copilot)75a943d#9843tar@7.5.22(#9843) (@martinrrm, @Copilot)Chores
7b50811#9961 pack: select workspace through config (#9961) (@reggi)81a901c#9915 recognize prefixed Node.js PR titles (#9915) (@reggi)4cdccea#9836 updatenode-integrationworkflow template to latest actions (#9836) (@MikeMcC399)278df04#9822 pass nodedir to node-gyp via npm_package_config env in node integration (#9822) (@reggi, @Copilot)@npmcli/arborist@10.0.3@npmcli/config@11.1.0libnpmdiff@9.0.3libnpmexec@11.0.3libnpmfund@8.0.3libnpmpack@10.0.3libnpmpublish@12.0.1v12.0.0Compare Source
⚠️ BREAKING CHANGES
npm sbom --sbom-format=cyclonedxnow reports thenamefield from each package'spackage.jsoninstead of the on-disk directory name. Thename,bom-ref, andpurlof the root component and of aliased dependencies may change.man npm-installwill no longer work, butnpm help installis unaffected.npm pkgoutput is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly tonpm view.npm shrinkwrapis removed, theshrinkwrapconfig alias is removed, andnpm-shrinkwrap.jsonis no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-rootnpm-shrinkwrap.jsontopackage-lock.json; usebundleDependenciesif you need to ship a locked dependency tree.npm packandnpm publishhave changed. They are now always consistent, and in the same format.star,starsandunstarcommands have been removednpm addusercommand has been removed. Create and manage user accounts on the npm website, and usenpm loginto authenticate on the command line.npm inithas been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.npmnow supports node^22.22.2 || ^24.15.0 || >=26.0.0.npmrcconfigs still warn by default; opt into erroring with the newstrict-npmrcconfig.)allowScriptspolicy. After installing, runnpm install-scripts approveto record approvals andnpm rebuildto execute newly approved scripts.Chores
b77b532#9735 remove pre-release mode from npm 12 and workspaces (#9735) (@reggi, @Copilot)Dependencies
@npmcli/arborist@10.0.0@npmcli/config@11.0.0libnpmaccess@11.0.0libnpmdiff@9.0.0libnpmexec@11.0.0libnpmfund@8.0.0libnpmorg@9.0.0libnpmpack@10.0.0libnpmpublish@12.0.0libnpmsearch@10.0.0libnpmteam@9.0.0libnpmversion@9.0.0v11.21.1Compare Source
Bug Fixes
1c7b661#10059 write registry allowScripts keys under install-strategy=linked (#10059) (@github-actions[bot], @manzoorwanijk)Dependencies
8cec7c9#10089http-cache-semantics@4.3.0(@reggi)fd105c7#10089undici@6.29.0(@reggi)fc2a0dd#10089postcss-selector-parser@7.1.6(@reggi)bae8cd7#10089ip-address@10.7.2(@reggi)4a9d14d#10089brace-expansion@5.0.12(@reggi)@npmcli/arborist@9.9.3libnpmdiff@8.1.14libnpmexec@10.3.4libnpmfund@7.0.28libnpmpack@9.1.15v11.21.0Compare Source
Features
1f38f64#10056 dist-tag: support OIDC authentication (#10056) (@github-actions[bot], @reggi, @Copilot)Documentation
0a8b905#10050 update npm stage docs to reflect that it can create new packages (#10050) (@github-actions[bot], @shmam, @Copilot)Dependencies
@npmcli/config@10.14.0v11.20.0Compare Source
Features
0b3c699#9994 token: support read-write-stage-only granular access tokens (#9994) (@github-actions[bot], @Tayvon, @Copilot)b872816#9920 stage: display staged package status (#9920) (@github-actions[bot], @joelverhagen)Bug Fixes
ddbadfc#9947 provenance-file takes precedence over OIDC auto-generated provenance (#9947) (@github-actions[bot], @yunseo-kim)64d4b4b#9937 config: avoid exporting persistent allow-scripts (#9937) (@github-actions[bot], @Fnine59)70317da#9930 arborist: reject uninstall args that carry a version (#9930) (@github-actions[bot], @lazerg)55ae484#9929 arborist: match allowScripts keys for local paths (#9929) (@github-actions[bot], @martinrrm, @Copilot)7f1f2b7#9928 keep dry-run output valid json (#9928) (@github-actions[bot], @martinrrm)f28cca9#9927 don't print the funding message for global installs (#9927) (@github-actions[bot], @lazerg)Chores
6ff3000#10010 pack: select workspace through config (#10010) (@github-actions[bot], @reggi)afdc5bd#9932 pass nodedir to node-gyp via npm_package_config env in node integration (#9932) (@reggi)83f95ff#9931 updatenode-integrationworkflow template to latest actions (#9931) (@reggi)f020fba#9925 recognize prefixed Node.js PR titles (#9925) (@github-actions[bot], @reggi)Dependencies
@npmcli/arborist@9.9.2@npmcli/config@10.13.0libnpmdiff@8.1.13libnpmexec@10.3.3libnpmfund@7.0.27libnpmpack@9.1.14libnpmpublish@11.2.1v11.19.1Compare Source
Bug Fixes
83b750d#9916 exempt explicit pack targets from allow-directory (#9916) (@github-actions[bot], @ychampion, @ychampion)Dependencies
4791b27#9872undici@6.28.0(@martinrrm, @Copilot)823d647#9872ip-address@10.5.0(@martinrrm, @Copilot)04f8efe#9872brace-expansion@5.0.9(@martinrrm, @Copilot)1610280#9842tar@7.5.22(#9842) (@martinrrm, @Copilot)libnpmpack@9.1.13v11.19.0Compare Source
Features
7d39aa6#9698 install-scripts: use install-scripts as the warning log title (@manzoorwanijk)Bug Fixes
3529ca2#9811 pack: honor min-release-age-exclude (#9811) (@github-actions[bot], @martinrrm, @Copilot)67f12ae#9810 owner: use scoped registry for user lookup (#9810) (@github-actions[bot], @martinrrm, @Copilot)Dependencies
@npmcli/arborist@9.9.1libnpmdiff@8.1.12libnpmexec@10.3.2libnpmfund@7.0.26libnpmpack@9.1.12v11.18.0Compare Source
Features
3021ad6#9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)abd8c6b#9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)9420673#9662 install-scripts: prune unused allowScripts entries (#9662) (@github-actions[bot], @JamieMagee)fc9d4c7#9635 namespace install-script approval commands under npm install-scripts (#9635) (@manzoorwanijk)073253f#9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)Bug Fixes
598ffdb#9693 sbom: percent-encode vcs_url qualifier in generated purls (#9693) (@github-actions[bot], @ubeddulla)05793d0#9691 output all the required parameters for npm token list (#9691) (@github-actions[bot], @rijildaniel)cd57139#9669 arborist: surface undeclared workspaces under the linked strategy (backport release/v11) (#9669) (@manzoorwanijk)5b6ff9c#9667 reify: report added count for fresh linked installs (#9667) (@github-actions[bot], @manzoorwanijk, @owlstronaut)8f13beb#9664 query: report logical dep location under linked strategy (#9664) (@github-actions[bot], @manzoorwanijk)168ba30#9663 allowScripts: close enforcement gaps (#9652) (backport release/v11) (#9663) (@JamieMagee)ae64f88#9648 exec: resolve workspace-local bin under the linked install strategy (#9648) (@github-actions[bot], @manzoorwanijk)784cbe9#9636 ls: restore 100% coverage on release/v11 after #9633 (#9636) (@manzoorwanijk)70f0ea5#9607 approve-scripts: approve deps with no resolved URL by name (#9607) (@github-actions[bot], @JamieMagee)b2e6338#9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)6ad5715#9595 link: scopenpm link --workspaceto the workspace, not the root (#9595) (@github-actions[bot], @manzoorwanijk)Documentation
3658bb5#9690 recommend install-strategy=linked to catch phantom dependencies (#9690) (@github-actions[bot], @manzoorwanijk)Dependencies
54656b6#9696undici@6.27.031c4773#9696brace-expansion@5.0.7e773c77#9696tar@7.5.19f05f6af#9696semver@7.8.5804f9ba#9580npm-profile@12.0.2Chores
f79b37f#9696 dev dependency updates (@owlstronaut)a04cd84#9584 add web-login proxy doneUrl regression for npm-profile fix (#9584) (@github-actions[bot], @manzoorwanijk)@npmcli/arborist@9.9.0@npmcli/config@10.12.0libnpmdiff@8.1.11libnpmexec@10.3.1libnpmfund@7.0.25libnpmpack@9.1.11arborist: 9.9.0
9.9.0 (2026-06-29)
Features
3021ad6#9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)abd8c6b#9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)9420673#9662 install-scripts: prune unused allowScripts entries (#9662) (@github-actions[bot], @JamieMagee)073253f#9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)Bug Fixes
774875b#9686 arborist: keep bin links for allowScripts-denied packages (#9686) (@JamieMagee)719de1e#9673 arborist: apply overrides across a file: link (backport release/v11) (#9673) (@manzoorwanijk)cd57139#9669 arborist: surface undeclared workspaces under the linked strategy (backport release/v11) (#9669) (@manzoorwanijk)ede32d3#9668 arborist: forward transitive overrides through linked store links (#9658) (backport release/v11) (#9668) (@manzoorwanijk)f503b07#9666 correct dev/prod dep flags for workspaces under the linked strategy (#9666) (@github-actions[bot], @manzoorwanijk)f580889#9665 arborist: load transitive optional deps into linked actual tree (#9665) (@github-actions[bot], @manzoorwanijk)8f13beb#9664 query: report logical dep location under linked strategy (#9664) (@github-actions[bot], @manzoorwanijk)168ba30#9663 allowScripts: close enforcement gaps (#9652) (backport release/v11) (#9663) (@JamieMagee)4c9eacb#9649 arborist: clean up stale .store and hoisted dirs on strategy switch (#9649) (@github-actions[bot], @manzoorwanijk)d2c680e#9645 arborist: invalid filterNode crash under the linked strategy (#9645) (@github-actions[bot], @manzoorwanijk)4e40b1c#9644 arborist: repair wrong-but-existing symlink target in linked strategy (#9644) (@github-actions[bot], @manzoorwanijk)9d1774e#9643 arborist: remove stale .bin shims after uninstall under linked (#9643) (@github-actions[bot], @manzoorwanijk)ed37d24#9642 arborist: record the linked .store layout in the hidden lockfile (backport #9630) (#9642) (@manzoorwanijk)e601d4a#9641 arborist: validate peerOptional conflicts in no-save mutations (#9641) (@owlstronaut, @dale-lakes, @dale-lakes)03cee43#9638 arborist: fix audit-report determinism due to dropped via links (#9638) (@github-actions[bot], @arjun-vegeta)a30d855#9633 arborist: don't load store packages' devDependencies as required edges (#9633) (@manzoorwanijk)887ca97#9631 arborist: audit the non-isolated tree under the linked strategy (#9631) (@github-actions[bot], @manzoorwanijk)b2e6338#9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)390ebfa#9593 arborist: symlink workspace file: deps on non-workspace local packages (#9593) (@github-actions[bot], @manzoorwanijk)aaeb2f1#9578 arborist: expose store node_modules via NODE_PATH for linked-strategy install scripts (#9578) (@github-actions[bot], @manzoorwanijk)05b6f0f#9577 arborist: allow-remote exemption for proxy/mirror-fronted registry tarballs (#9577) (@github-actions[bot], @manzoorwanijk)config: 10.12.0
10.12.0 (2026-06-29)
Features
3021ad6#9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)abd8c6b#9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)073253f#9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)Bug Fixes
b2e6338#9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)Documentation
3658bb5#9690 recommend install-strategy=linked to catch phantom dependencies (#9690) (@github-actions[bot], @manzoorwanijk)libnpmdiff: 8.1.11
Dependencies
@npmcli/arborist@9.9.0libnpmexec: 10.3.1
10.3.1 (2026-06-29)
Bug Fixes
f3f2465#9692 exec: prevent shared binPaths pollution across workspace runs (#9692) (@github-actions[bot], @arjun-vegeta)b2e6338#9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)Dependencies
@npmcli/arborist@9.9.0libnpmfund: 7.0.25
Dependencies
@npmcli/arborist@9.9.0libnpmpack: 9.1.11
Dependencies
@npmcli/arborist@9.9.0v11.17.0Compare Source
Features
ae8ac4e#9534 add min-release-age-exclude config (@JamieMagee, @caseyjhol)8ff3e48#9483 allowScripts tooling and inBundle hardening (#9483) (@github-actions[bot], @JamieMagee)Bug Fixes
847cdf8#9541 match dotted and versioned args in approve-scripts/deny-scripts (@owlstronaut)d99f7cb#9535 emit valid JSON from approve-scripts/deny-scripts --json (@owlstronaut)351a309#9499 pass script-shell to publish lifecycle hooks (#9499) (@github-actions[bot])4fa81df#9497 recognize allowScripts for local link targets (#9497) (@github-actions[bot], @cyphercodes, @cyphercodes)95cf2e9#9489 validate registry path for allow-remote tarballs (@Abhinav-143x)9dd219b#9462 respect allowScripts policy in prune, dedupe, uninstall, audit, and link (#9462) (@github-actions[bot], @JamieMagee)cd8d18a#9482 list pending scripts in approve-scripts when ignore-scripts is set (#9482) (@github-actions[bot], @JamieMagee)c14e87c#9481 suggest --allow-scripts for global installs in unreviewed-scripts warnings (#9481) (@github-actions[bot], @JamieMagee)7ade52e#9465 invalid issue template YAML indentation (#9465) (@github-actions[bot], @fallintoplace)c069622#9464 show full parent command path in subcommand usage errors (#9464) (@owlstronaut)1bb62bb#9454 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@JamieMagee)84eeb5f#9431 audit: don't apply min-release-age before filter when verifying installed signatures (@JamieMagee)3bd3377#9426 block forbidden keys in Queryable setter to prevent prototype pollution (@12122J, @claude)Documentation
a86a7a9#9522 approve-scripts only throws EGLOBAL when run with -g (@JamieMagee)693bb3d#9508 clarify package.json override value specs (#9508) (@github-actions[bot], @ded-furby)ccffe4a#9501 use the latest version for global update and outdated'swanted(#9501) (@github-actions[bot], @liangmiQwQ)66e97c2#9478 update minimum npm required for npm trust (@meeech)Dependencies
bd09b87#9542postcss-selector-parser@7.1.495bfc4c#9542tinyglobby@0.2.178c0d5fd#9542tar@7.5.16967d377#9542semver@7.8.4cdaac1b#9542pacote@21.5.125c8a9e#9542node-gyp@12.4.0Chores
2922fa4#9542 dev dependency updates (@owlstronaut)@npmcli/arborist@9.8.0@npmcli/config@10.11.0libnpmdiff@8.1.10libnpmexec@10.3.0libnpmfund@7.0.24libnpmpack@9.1.10v11.16.0Compare Source
Features
4b67f6e#9416 publish --access=private alias for restricted (#9416) (@github-actions[bot], @reggi, @Copilot)a10c7ca#9415 Phase 1 ofallowScriptsopt-in install-script policy (#9360) (#9415) (@owlstronaut, @JamieMagee)Bug Fixes
1f7869b#9411 fix typo of fullMetadata (@owlstronaut)cde03ba#9390 config: pause progress spinner during interactive editor spawn (#9388) (@github-actions[bot], @Zelys-DFKH, @claude)Documentation
c5e9d73#9390 Documentnpm_old_versionandnpm_new_versionenvironment variables (#9389) (@github-actions[bot], @36degrees)Dependencies
cdd7bbc#9421undici@6.26.0fde87c9#9421sigstore@4.1.12779793#9421lru-cache@11.5.1dea702d#9421@sigstore/verify@3.1.14eab03f#9421@sigstore/core@3.2.174c7323#9421@npmcli/agent@4.0.2edc4ab3#9421semver@7.8.15f6ce33#9421make-fetch-happen@15.0.6Chores
bd04976#9421 dev dependency updates (@owlstronaut)aeceb23#9407 sanitize newlines in flags table default and type values (#9407) (@reggi, @Copilot)@npmcli/arborist@9.7.0@npmcli/config@10.10.0libnpmdiff@8.1.9libnpmexec@10.2.9libnpmfund@7.0.23libnpmpack@9.1.9libnpmversion@8.0.4v11.15.0Compare Source
Features
0d5d899#9379 npm stage (@reggi, @Copilot)1433740#9376 add permissions support to trust commands (#9376) (@github-actions[bot], @reggi, @Copilot)8df10f5#9339 add allow-git/allow-file/allow-directory/allow-remote configs (@owlstronaut)Bug Fixes
39b625e#9381 key stage download --json output by package name (#9381) (@reggi, @Copilot)6aa332d#9339 allow min-release-age in npmrc to coexist with --before (@raazkhnl)468550f#9339 refactor #failureNode, adjust tests and safety (@owlstronaut)cabe249#9339 allow-remote=none does not block registry tarballs (@owlstronaut)Dependencies
8416a60#9383socks@2.8.95e5a25b#9383lru-cache@11.5.0a6f9ad2#9383ip-address@10.2.063f8114#9383brace-expansion@5.0.66918b4c#9383bin-links@6.0.2bf84079#9383tar@7.5.15bdef82c#9383semver@7.8.03f38a67#9383hosted-git-info@9.0.3Chores
816f3bf#9383 dev dependency updates (@owlstronaut)@npmcli/arborist@9.6.0@npmcli/config@10.9.1libnpmdiff@8.1.8libnpmexec@10.2.8libnpmfund@7.0.22libnpmpack@9.1.8libnpmpublish@11.2.0v11.14.1Compare Source
Bug Fixes
dca12cb#9328 remove settings (#9328) (@github-actions[bot], @owlstronaut)v11.14.0Compare Source
Features
45fc5e0#9288 add allow-directory, allow-file, and allow-remote (#9288) (@github-actions[bot], @wraithgar)Bug Fixes
6c17544#9318 sbom: dedupe per-node dependsOn / relationships (#9318) (@github-actions[bot], @mikaelkristiansson)Dependencies
840fe18#9322socks@10.1.1b771289#9322ip-address@10.1.1addffcb#9322cidr-regex@5.0.5Chores
041fd58#9322 dev dependency updates (@owlstronaut)89c505a#9320 add cli-triage team as codeowner (#9320) (@github-actions[bot], @owlstronaut)@npmcli/arborist@9.5.0@npmcli/config@10.9.0libnpmdiff@8.1.7libnpmexec@10.2.7libnpmfund@7.0.21libnpmpack@9.1.7v11.13.0Compare Source
Features
8e8dadb#9246 adduas alias forupdatecommand (#9246) (@github-actions[bot], @Ausoj)Bug Fixes
ecd161b#9258 ignore intended error code (@owlstronaut)Dependencies
8d2fdcd#9272lru-cache@11.3.5e603d36#9272node-gyp@12.3.0d48b7da#9272is-cidr@6.0.4032a5ca#9240@sigstore/protobuf-specs@0.5.133a81e7#9240tinyglobby@0.2.1668dc4a0#9240picomatch@4.0.41bb6703#9240lru-cache@11.3.337059e4#9240diff@8.0.4fb450ab#9240minimatch@10.2.57c4bbbf#9240tar@7.5.13703a3bc#9240minipass-flush@1.0.6Chores
e0724ac#9272 dev dependency updates (@owlstronaut)d249341#9230 don't run npm update in CI (@owlstronaut)@npmcli/arborist@9.4.3libnpmdiff@8.1.6libnpmexec@10.2.6libnpmfund@7.0.20libnpmpack@9.1.6v11.12.1Compare Source
Bug Fixes
596706a#9148 revert prefer-offline/prefer-online exclusivity (#9129) (@owlstronaut)Documentation
d1ee8a5#9140 Add note on relative path prefix for npm publish (#9140) (@pydsigner)Dependencies
@npmcli/config@10.8.1v11.12.0Compare Source
Features
8eff5fb#9049 audit: add --include-attestations flag to output sigstore bundles (#9049) (@mitchdenny)Bug Fixes
03af94d#9123 skip synopsis code block when command has no usage (@owlstronaut)21ea382#9110 arborist: resolve sibling override sets via common ancestor (#9110) (@manzoorwanijk)Dependencies
03f4c3a#9131@sigstore/tuf@4.0.24d5f7d9#9131@gar/promise-retry@1.0.38dcfe69#9131@sigstore/sign@4.1.1e5a7e22#9127lru-cache@11.2.782deab6#9127make-fetch-happen@15.0.5ce195dc#9127cacache@20.0.4Chores
95fa7f4#9132 fix docs test snapshot (#9132) (@wraithgar)7e9d538#9127 dev dependency updates (@wraithgar)920e5ed#9127 test snapshots (@wraithgar)98ccf92#9125 fix snap tests (@owlstronaut)@npmcli/arborist@9.4.2@npmcli/config@10.8.0libnpmdiff@8.1.5libnpmexec@10.2.5libnpmfund@7.0.19libnpmpack@9.1.5v11.11.1Compare Source
Bug Fixes
a9d242b#9099 include all subcommands on main command help (#9099) (@wraithgar)29b8407#9087 unwrap comments and lines meant for output (#9087) (@wraithgar)b56986a#9095 ls: suppress false UNMET DEPENDENCYs in linked strategy (#9095) (@manzoorwanijk)76c76e5#9083 ci: don't error on optional deps in the lockfile (#9083) (@wraithgar)a29aeee#9028 arborist: retry bin-links on Windows EPERM (#9028) (@manzoorwanijk)6565eeb#9045 bypass packument cache to prevent ETARGET errors after publish (#9045) (@Jadu07)Documentation
3b96929#9074 scripts: remove mention of obsolete root user behavior (#9074) (@mohd-akram)16ac4e0#9054 fix workspace cross-dependency documentation (@owlstronaut)Dependencies
075ae23#9086tar@7.5.1113fa40d#9086pacote@21.5.0bf7ea2b#9060brace-expansion@5.0.42000d2c#9060minimatch@10.2.4d86b260#9060tar@7.5.10dff1853#9060@npmcli/run-script@10.0.493c3365#9060write-file-atomic@7.0.1Chores
d1996a7#9060 dev dependency updates (@wraithgar)@npmcli/arborist@9.4.1libnpmdiff@8.1.4libnpmexec@10.2.4libnpmfund@7.0.18libnpmpack@9.1.4v11.11.0Compare Source
Features
4fcd352#9017 add :type(registry) to query selector syntax (#9017) (@wraithgar)e1b21f0#8909 adds circleci to trust command (#8909) (@owlstronaut)9a33ad0#8925 adds circleci to oidc (#8925) (@owlstronaut)Bug Fixes
4426411#9026 npm audit signatures for keyless attestation registries (#9026) (@ajayk)658b323#9010 handle legacy licenses array in sbom output (#9010) (@JNC4)Documentation
143f8cd#9007 docs shouldn't wrap yaml description (#9007) (@owlstronaut)Dependencies
7798b6e#9027@gar/promise-retry@1.0.24838864#9027balanced-match@4.0.40c200dd#9027brace-expansion@5.0.3f0606bb#9027spdx-license-ids@3.0.23d43f350#9027make-fetch-happen@15.0.44d0918a#9027@npmcli/git@7.0.28912ca7#9027minipass-fetch@5.0.2450ff35#9027npm-packlist@10.0.420ef5a5#9027pacote@21.4.060f332c#9008 remove promise-retrycb8b9c7#9008 add@gar/promise-retry@1.0.0@npmcli/arborist@9.4.0libnpmdiff@8.1.3libnpmexec@10.2.3libnpmfund@7.0.17libnpmpack@9.1.3v11.10.1Compare Source
Bug Fixes
9fac412#8995 improve unknown config warning with .npmrc section hint (#8995) (@umeshmore45)bb135cc#8981 arborist: fixpeerOptionaldependency resolution inbuildIdealTree(#8981) (@Saibamen, @cursoragent)5c03826#8993 remove tabular output from "npm view" (@wraithgar)4648f26#8993 remove tabular output from "npm team" (@wraithgar)Documentation
0a5756d#8998 clarify unsupported custom .npmrc keys and recommend alternatives (#8998) (@maitrawebtech)22c9153#8985 fix typo and grammar in README (#8985) (@csmit195, Chris)Dependencies
aa8ffbf#9002init-package-json@8.2.5(#9002)67a0f09#9001glob@13.0.656b8fd4#9001minimatch@10.2.2aa7fef5#9001minipass@7.1.3d3a4161#9000@npmcli/package-json@7.0.5(#9000)7aa9338#8993 remove cli-columnsf7f7c53#8991 hoist balanced-match10cb575#8991 hoist latest yallist1b3dc9a#8991cidr-regex@5.0.34307af6#8991glob@13.0.513b4d6a#8991minimatch@10.2.145d4000#8991tar@7.5.9Chores
40fcab4#8991@npmcli/template-oss@4.29.0(@wraithgar)1598adb#8991 dev dependency updates (@wraithgar)@npmcli/arborist@9.3.1@npmcli/config@10.7.1libnpmdiff@8.1.2libnpmexec@10.2.2libnpmfund@7.0.16libnpmpack@9.1.2v11.10.0Compare Source
Features
cf56a1e#8899 npm trust, per-command config (@reggi)cf56a1e#8899 npm trust (@reggi)66d6e11#8965 add min-release-age (#8965) (@wraithgar)Dependencies
aae84bf#8973pacote@21.3.18bcb675#8973cidr-regex@5.0.2f87aaab#8973lru-cache@11.2.6acec871#8973ssri@13.0.11e42a86#8973glob@13.0.2e1c08a4#8973is-cidr@6.0.3dfb0e34#8973semver@7.7.40ee7776#8973which@6.0.1Chores
eb81df8#8973 dev dependency updates (@wraithgar)995e757#8966 Clean up some todos, add tests for previously skipped blocks (@owlstronaut)@npmcli/arborist@9.3.0@npmcli/config@10.7.0libnpmdiff@8.1.1libnpmexec@10.2.1libnpmfund@7.0.15libnpmpack@9.1.1v11.9.0Compare Source
Features
f5f6cf7#8943 config: add --allow-git (@wraithgar)Bug Fixes
2242f25#8952 webauth: improve error messages around webauth in non-TTY (#8952) (@Andarist)Dependencies
332c9f3#8960glob@13.0.1eca02c7#8960minimatch@10.1.2@isaacs/brace-expansion@5.0.1b3f8475#8951minipass-fetch@5.0.1924171b#8951is-cidr@6.0.24404002#8951ci-info@4.4.0b65af73#8951lru-cache@11.2.5164c355#8951tar@7.5.7a74a19c#8951node-gyp@12.2.0e0bc212#8943pacote@21.1.0Chores
4a82a8f#8951 dev dependency updates (@wraithgar)@npmcli/arborist@9.2.0@npmcli/config@10.6.0libnpmdiff@8.1.0libnpmexec@10.2.0libnpmfund@7.0.14libnpmpack@9.1.0v11.8.0Compare Source
Features
545e861#8828 show proxy environment variables in npm config list (Max Black)Bug Fixes
c2f784d#8859 preserve serialNumber UUID in CycloneDX SBOM output #8837 (#8859) (@saksham-malhotra-27)f2c3af7#8840 more intuitive byte formatting boundaries for rounding (#8840) (@watilde)Documentation
3474ec3#8866 fix typo/logic error in npm-dedupe docs (#8866) (@Schweinepriester)5552e46#8797 npm-install: explain package-lock.json behavior (#8797) (@MaxBlack-dev, Max Black)Dependencies
f478ca0#8919postcss-selector-parser@7.1.12b6a71f#8919path-scurry@2.0.119096f2#8919sigstore@4.1.0e7f5d1e#8919lru-cache@11.2.49e756ae#8919ip-address@10.1.0f951820#8919common-ancestor-path@2.0.07a949ad#8919@sigstore/verify@3.1.06979ce1#8919@sigstore/sign@4.1.0b4a6a41#8919@sigstore/core@3.1.0dc8a8e8#8919@sigstore/tuf@4.0.1be221ea#8919validate-npm-package-name@7.0.2149823d#8919diff@8.0.332b2001#8919tar@7.5.4Chores
8f599df#8919 pin jsdom to 27.0.0 (@wraithgar)f4f1161#8919 dev dependency updates (@wraithgar)@npmcli/arborist@9.1.10@npmcli/config@10.5.0libnpmdiff@8.0.13libnpmexec@10.1.12libnpmfund@7.0.13libnpmpack@9.0.13v11.7.0Compare Source
Features
b380d15#8697 add deduping to notices unless in verbose+ mode (@owlstronaut)Bug Fixes
4ebb831#8839 updates hints to use cli paradigm (@owlstronaut)7896e51#8838 update the token list text (@owlstronaut)8ab8668#8836 query: support package-lock-only in workspaces (@watilde)35e8d38#8322 properly handle newlines with input when using the spinner (#8322) (@mbtools)0c0faae#8780 adduser: improve email prompt (#8780) (@mbtools)Documentation
7f2ab9d#8810 scripts: replace deprecated prepublish and install examples with prepare (Max Black)91ebab7#8847 remove note about token create being disabled (@owlstronaut)2030250#8822 scripts: clarify prepare script runs with --production (Max Black)33a50d7#8821 scripts: update npm_package_* environment variables documentation (Max Black)50508f9#8793 package-json: add documentation for type field (#8793) (@MaxBlack-dev, Max Black)aa1dd7e#8823 scripts: document that prepare scripts run concurrently in workspaces (Max Black)3f48487#8820 package-spec: fix alias syntax in examples (Max Black)dd104da#8812 version: add note about git version requirements (Max Black)58afdcc#8792 install: clarify prerelease version range behavior (Max Black)9f818e8#8795 npm-view: clarify object property access syntax and provide examples (Max Black)39c2f2e#8791 add examples for command line flags including --prefix (Max Black)1298530#8790 clarify version field can be omitted in package-lock (Max Black)090b6ca#8794 npx: clarify that arguments are passed to executed command (Max Black)a864f80#8787 document gypfile field in package.json (Max Black)2fc689d#8788 add field access patterns to npm view (Max Black)4850639#8796 package-json: add examples for replacing dependencies with forks in overrides (Max Black)4864dd4#8798 npm-install: document engines field priority when installing packages (Max Black)95d25cd#8799 package-json: clarify repository field normalization during publish (Max Black)a367f9b#8800 package-lock-json: clarify that version field may be omitted for certain dependencies (Max Black)ffc9b71#8801 npm-install: clarify --tag does not override package.json (#8801) (@MaxBlack-dev, Max Black)73688ca#8735 clarify npm version behavior with prerelease versions (#8735) (@yashwantbezawada)4a32606#8785 updates the token create documentation (#8785) (@owlstronaut, @wraithgar)Chores
54929ce#8836 update baseline-browser-mapping (@watilde)Dependencies
@npmcli/arborist@9.1.9@npmcli/config@10.4.5libnpmdiff@8.0.12libnpmexec@10.1.11libnpmfund@7.0.12libnpmpack@9.0.12v11.6.4Compare Source
Documentation
dfb83c7#8749 add example for keywords field (#8749) (@MaxBlack-dev, Max Black)1b1e227#8750 remove outdated roadmap link (#8750) (@MaxBlack-dev, Max Black)1333d57#8752 clarify .npmrc naming convention for environment variable overrides (#8752) (@MaxBlack-dev)22cddb8#8755 add workspace dependencies example to workspaces (Max Black)17e154c#8756 standardize env vars to uppercase convention (Max Black)1e51a25#8754 fix lifecycle event order for prepare script (Max Black)8d72bc9#8753 add os, cpu, and funding fields to package-lock.json (Max Black)Dependencies
f56bb13#8779proc-log@6.1.0(#8779)f963223#8770proggy@4.0.0f51e4aa#8770nopt@9.0.02d15040#8770@npmcli/query@5.0.09d77b84#8770@npmcli/installed-package-contents@4.0.0e2ac092#8770read@5.0.16e5bfd9#8770init-package-json@8.2.47f8e237#8770p-map@7.0.4a4aa218#8770npm-user-validate@4.0.06430446#8770npm-audit-report@7.0.058650dc#8770@npmcli/fs@5.0.04a11146#8770glob@13.0.000511d4#8770@npmcli/cacache@20.0.3224afa2#8770@npmcli/map-workspaces@5.0.3664ac34#8770@npmcli/package-json@7.0.4@npmcli/arborist@9.1.8@npmcli/config@10.4.4libnpmdiff@8.0.11libnpmexec@10.1.10libnpmfund@7.0.11libnpmpack@9.0.11v11.6.3Compare Source
Bug Fixes
c6242d9#8706 change npm profile to create tokens with GAT support (#8706) (@owlstronaut, @wraithgar)cbc6fa9#8731 order of version information in error message (#8731) (@piotrd, @pd-be)11dbd7e#8709 display full token when creating authentication tokens (#8709) (@MaxBlack-dev, Max Black)49a4eef#8676 use look behind regex for trailing slash stripping (#8676) (@wraithgar)b1aee62#8645 dep flag calculation (#8645) (@liamcmitchell)Documentation
ca53c21#8745 add workspace usage examples (#8745) (@MaxBlack-dev, Max Black)e71ca0e#8746 add --save flag to documentation (#8746) (@MaxBlack-dev, Max Black)06510a8#8683 add ignore-scripts option to npm version help and docs (#8683) (@Tejas242)Dependencies
7f72238#8723cacache@20.0.27ac9db8#8723init-package-json@8.2.341e97c6#8723validate-npm-package-name@7.0.06b1fbe1#8723npm-package-arg@13.0.2aa1d486#8723@npmcli/promise-spawn@9.0.1599c819#8723which@6.0.0e49286e#8723ini@5.0.0b7c9f96#8723@npmcli/promise-spawn@9.0.08cc9f70#8723ssri@13.0.00b7274f#8723pacote@21.0.459b3c6a#8723@npmcli/redact@4.0.0578abad#8723node-gyp@12.1.089c4151#8723@npmcli/git@7.0.1c6d109d#8723make-fetch-happen@15.0.334d8599#8723npm-registry-fetch@19.1.14811a86#8723@npmcli/run-script@10.0.36cb77df#8723@npmcli/installed-package-contents@4.0.005ac7a7#8723proc-log@6.0.00a74f6d#8723bin-links@6.0.0c02ce5c#8723@npmcli/package-json@7.0.29c0cefa#8723json-parse-even-better-errors@5.0.0041b9b2#8723parse-conflict-json@5.0.1a1b0fea#8723@npmcli/name-from-folder@4.0.0a085745#8723abbrev@4.0.000d9c7d#8723nopt@9.0.03404dca#8723npm-install-checks@8.0.0542fcf3#8723@npmcli/node-gyp@5.0.089e14d3#8723tar@7.5.25383f3a#8723npm-registry-fetch@19.1.01bb9a7d#8723npm-profile@12.0.1de619a4#8723npm-pick-manifest@11.0.30e042ec#8723npm-packlist@10.0.32a3c338#8723node-gyp@11.5.0b96e86c#8723minimatch@10.1.1d347329#8723exponential-backoff@3.1.3d6830f4#8723@npmcli/run-script@10.0.2bcc7ec8#8723@npmcli/metavuln-calculator@9.0.37a419df#8723@npmcli/map-workspaces@5.0.1Chores
32bdd83#8723 fix package-lock (@wraithgar)4bff14b#8670 write tarball to testDir (#8670) (@wraithgar)679486b#8672 fix lockfile (#8672) (@wraithgar)@npmcli/arborist@9.1.7@npmcli/config@10.4.3libnpmdiff@8.0.10libnpmexec@10.1.9libnpmfund@7.0.10libnpmpack@9.0.10libnpmpublish@11.1.3libnpmversion@8.0.3v11.6.2Compare Source
Bug Fixes
c54d1e9#8633 progress bar code cleanup (#8633) (@wraithgar)d352e27#8629 do not redact notice logs going to stdout (#8629) (@wraithgar)5ac3678#8617 spelling in ./lib and ./test/lib (#8617) (@jsoref)9197995#8619 spelling (#8619) (@jsoref)dd884e3#8618 spelling (#8618) (@jsoref)f6028e6#8614 skip redacting urls meant for opening by the user (#8614) (@wraithgar, @jolyndenning)54fd27f#8602 refactor node.ideallyInert to node.inert (#8602) (@liamcmitchell)79e3c1e#8593 use @npmcli/package-json to normalize package data (@wraithgar)Documentation
0469c5e#8639 rewrap markdown (#8639) (@jsoref)9ceb9c1#8636 rewrap markdown (#8636) (@jsoref)6324370#8616 fix spelling (#8616) (@jsoref)1b0429a#8607 Fix spelling (#8607) (@jsoref)7fbe07a#8603 clean up deprecatednpm accesscommands (#8603) (@jsoref)Dependencies
fa7cc6f#8662ci-info@4.3.1(#8662)b05461b#8663@sigstore/sign@4.0.1(#8663)c31de22#8661 downgrade ci-info to 4.3.0 (#8661) (@wraithgar)c5191b5#8659ci-info@4.3.1f255c92#8659hosted-git-info@9.0.2bdaf323#8659is-cidr@6.0.1a33f106#8659lru-cache@11.2.28044e07#8659npm-package-arg@13.0.1f577504#8659npm-packlist@10.0.29aa4fa6#8659semver@7.7.3fe9484a#8593 remove normalize-package-dataChores
b3409f4#8659 dev dependency updates (@wraithgar)e8de81b#8643 Add automatically generated annotation to dependencies.md (#8643) (@jsoref)67cfaf3#8627 fix spelling: different (#8627) (@jsoref)17ddc0d#8622 fix spelling (#8622) (@jsoref)c3e1790#8605 Remove reference to nonexistent calendar (#8605) (@jsoref)ac9143e#8604 Improve link accessibility for screen reader users (#8604) (@jsoref)62d73e7#8601 remove references to benchmarks workflow (#8601) (@jsoref)bb4b739#8598 remove stale comment (#8598) (@jsoref)f73e65d#8592 fix build url code for remark-github@12 (#8592) (@wraithgar)@npmcli/arborist@9.1.6@npmcli/config@10.4.2libnpmaccess@10.0.3libnpmdiff@8.0.9libnpmexec@10.1.8libnpmfund@7.0.9libnpmpack@9.0.9libnpmpublish@11.1.2v11.6.1Compare Source
Bug Fixes
d389614#8579 corrects peer dependency flag propagation (@owlstronaut)5db81c3#8512 allow concurrent non-local npx calls (#8512) (@jenseng, @wraithgar)Documentation
7a09902#8582 bring back certfile (#8582) (@jenseng)Dependencies
849dcb6#8589tar@7.5.1(#8589)ea15731#8576binary-extensions@3.1.00f41bac#8576tiny-relative-date@2.0.207bf540#8576is-cidr@6.0.0ef87ec6#8576diff@8.0.248285e0#8576 add fdir, isexe, and picomatch to node_modules099238a#8576fdir@6.5.06e4d673#8576isexe@3.1.109a7494#8576supports-color@10.2.2c5157c9#8576chalk@5.6.246035db#8576debug@4.4.35f6664b#8576spdx-license-ids@3.0.225516583#8576socks@2.8.76a392f3#8576tinyglobby@0.2.159519f18#8576npm-install-checks@7.1.234bafd1#8576node-gyp@11.4.2dfd034e#8576@npmcli/promise-spawn@8.0.3d4eef14#8576rimraf@6.0.1566f1b7#8576minimatch@10.0.3ac33497#8576mkdirp@3.0.11676626#8576glob@11.0.3817f0b1#8576ignore-walk@8.0.079a4e67#8576minizlib@3.0.238fa2c2#8576negotiator@1.0.024252a1#8576@npmcli/agent@4.0.0ea7ca5f#8576lru-cache@11.2.1521823b#8576@npmcli/git@7.0.0bf6b686#8576npm-package-arg@13.0.09392488#8576npm-package-manifest@11.0.10082083#8576normalize-package-data@8.0.0633c4ed#8576hosted-git-info@9.0.066f64eb#8576make-fetch-happen@15.0.21f85f94#8576@sigstore/tuf@4.0.0a2bdecc#8576sigstore@4.0.01149971#8576npm-registry-fetch@19.0.0b5bd5e3#8576npm-profile@12.0.06221e27#8576@npmcli/metavuln-calculator@9.0.2da81a37#8576cacache@20.0.16b4c5f9#8576@npmcli/run-script@10.0.0cb36a8a#8576init-package-json@8.2.2b6bb9ae#8576pacote@21.0.31b4433f#8576@npmcli/map-workspaces@5.0.0ceae674#8576@npmcli/package-json@7.0.14f37534#8576 remove read-package-json-fastChores
7eb5c09#8576 update package-lock with peer flag fixes (@wraithgar)0d00fd8#8576jsdom@27.0.0(@wraithgar)420a569#8576unified@11.0.5(@wraithgar)064deb3#8576remark-rehype@11.1.2(@wraithgar)30fe3ba#8576remark-man@9.0.0(@wraithgar)1c6bb4c#8576rehype-stringify@10.0.1(@wraithgar)208cb93#8576remark-gfm@4.0.1(@wraithgar)4a46b5a#8576remark-github@12.0.0(@wraithgar)93d190b#8576remark-parse@11.0.0(@wraithgar)05301a4#8576remark@15.0.1(@wraithgar)6afdda9#8576ajv-formats@3.0.1(@wraithgar)402a0ab#8576@npmcli/template-oss@4.25.1(@wraithgar)3b43bf7#8576 dev dependency updates (@wraithgar)9f9146f#8576@tufjs/repo-mock@4.0.0(@wraithgar)eed8a10#8576 use latest/local arborist in mock-registry (@wraithgar)@npmcli/arborist@9.1.5@npmcli/config@10.4.1libnpmaccess@10.0.2libnpmdiff@8.0.8libnpmexec@10.1.7libnpmfund@7.0.8libnpmorg@8.0.1libnpmpack@9.0.8libnpmpublish@11.1.1libnpmsearch@9.0.1libnpmteam@8.0.2libnpmversion@8.0.2v11.6.0Compare Source
Features
bdcc10d#8359 add support for optional env var replacements in .npmrc (#8359) (@aczekajski, @owlstronaut)Bug Fixes
dd4cee9#8539 powershell: improve argument parsing (#8539) (@alexsch01)5f18557#8532 powershell: fix issue with modified InvocationName (#8532) (@alexsch01)9e5abf1#8529 add redaction to log format egress (#8529) (@wraithgar)75ce64a#8524 revert handle signal exits gracefully (#8524) (@owlstronaut)5d82d0b#8469 ps1 scripts in powershell 5.1 (#8469) (@splatteredbits)Dependencies
@npmcli/arborist@9.1.4@npmcli/config@10.4.0libnpmdiff@8.0.7libnpmexec@10.1.6libnpmfund@7.0.7libnpmpack@9.0.7v11.5.2Compare Source
Bug Fixes
7d900c4#8467 oidc visibility check for provenance (#8467) (@reggi, @wraithgar)Documentation
d4e56b2#8459 update snapshot generation command (#8459) (@MikeMcC399)v11.5.1Compare Source
⚠️ BREAKING CHANGES
npm inithas been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.npmnow supports node^22.22.2 || ^24.15.0 || >=26.0.0.npmrcconfigs still warn by default; opt into erroring with the newstrict-npmrcconfig.)Features
ce7681f#9496 packageExtensions for root-owned dependency manifest repairs (#9496) (@manzoorwanijk)1db885c#9439 native dependency patching (npm patch add/commit/update/ls/rm) (#9439) (@manzoorwanijk)fc80bb3#9234 remove default license for npm init (@owlstronaut)be8053c#9544 warn when min-release-age blocks an audit fix (#9544) (@JamieMagee)18eb967#9559 bump to new node engine range (@owlstronaut)c3e1a71#9532 add min-release-age-exclude config (@JamieMagee, @caseyjhol)5cd5150#9424 default-deny install scripts (allowScripts opt-in) [v12] (@JamieMagee)64e3f79#9480 allowScripts tooling and inBundle hardening (#9480) (@JamieMagee)caa3295#9466 default allow-git and allow-remote to none (@owlstronaut)f2e4a28#9351 add a global npmignore file (#9351) (@ljharb)c9be2d1#9153 publish --access=private alias for restricted (#9153) (@reggi, @Copilot)7068d42#9360 Phase 1 ofallowScriptsopt-in install-script policy (#9360) (@JamieMagee)979518d#9276 error on unknown configs, flags, and abbreviations (#9276) (@owlstronaut)Bug Fixes
e96a7de#8703 Preserve https protocol when working with git (#8703) (@oldium)a847d28#9575 patch: warn whenpatch update --totargets an uninstalled version (#9575) (@manzoorwanijk)62b0694#9576 patch: explain out-of-sync lockfile after --ignore-patch-failures (#9576) (@manzoorwanijk)5ddf6cc#9567 patch: keep the update marker on a no-op commit so a retry finalizes (#9567) (@manzoorwanijk)fc3ef5a#9559 adapt to @npmcli/run-script@11 breaking changes (@owlstronaut)abf78b3#9540 match dotted and versioned args in approve-scripts/deny-scripts (@owlstronaut)f6270d1#9531 emit valid JSON from approve-scripts/deny-scripts --json (@owlstronaut)0e55f97#9492 pass script-shell to publish lifecycle hooks (@Zelys-DFKH)2cbb13b#9490 recognize allowScripts for local link targets (#9490) (@cyphercodes, @cyphercodes)bf623e0#9473 validate registry path for allow-remote tarballs (@Abhinav-143x)6be874b#9479 list pending scripts in approve-scripts when ignore-scripts is set (#9479) (@JamieMagee)6603b2c#9469 suggest --allow-scripts for global installs in unreviewed-scripts warnings (#9469) (@JamieMagee)fe820b6#9442 invalid issue template YAML indentation (#9442) (@fallintoplace)fe41ae7#9404 show full parent command path in subcommand usage errors (#9404) (@shaanmajid)75bf7de#9456 respect allowScripts policy in prune, dedupe, uninstall, audit fix, and link (@JamieMagee)6efac6e#9453 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@JamieMagee)b97edc0#9430 audit: don't apply min-release-age before filter when verifying installed signatures (@JamieMagee)080e3b2#9425 block forbidden keys in Queryable setter to prevent prototype pollution (@12122J, @claude)c5292fa#9422 use prerelease strategy without a bug (@owlstronaut)33aebaa#9410 fix typo of fullMetadata (@owlstronaut)2a03860#9267 run root preinstall before reify (@owlstronaut)c0fc549#9372 config: pause progress spinner during interactive editor spawn (#9372) (@Zelys-DFKH, @claude)Documentation
357e8cd#9520 approve-scripts only throws EGLOBAL when run with -g (@JamieMagee)bcf01c6#9505 clarify package.json override value specs (#9505) (@ded-furby)455aa4a#9401 use the latest version for global update and outdated'swanted(#9401) (@liangmiQwQ)aac80dc#9470 update minimum npm required for npm trust (@meeech)d124c08#9385 Documentnpm_old_versionandnpm_new_versionenvironment variables (#9385) (@36degrees)Dependencies
9cbba72#9579npm-profile@13.0.1d4e0a70#9559@tufjs/repo-mock@5.0.03ef66bb#9559 bundle arborist runtime deps for bootstrap5dce6fb#9559npm-packlist@11.2.0ad05528#9559@npmcli/git@8.0.0cc45055#9559@npmcli/node-gyp@6.0.0a12e2c8#9559@npmcli/name-from-folder@5.0.0cc96d57#9559@npmcli/installed-package-contents@5.0.03dc18e5#9559@npmcli/git@8.0.0428afa6#9559sigstore@5.0.095ed19c#9559 regenerate bundled dependenciesb62db95#9559bin-links@7.0.02f5da83#9559@npmcli/fs@6.0.0370f9c6#9559node-gyp@13.0.0e459d7a#9559which@7.0.05032af3#9559validate-npm-package-name@8.0.013d97ac#9559tar@7.5.161502286#9559ssri@14.0.068eb39c#9559semver@7.8.43484d7f#9559read@6.0.021df0ab#9559proc-log@7.0.08f85646#9559parse-conflict-json@6.0.0a44c1cf#9559pacote@22.0.0171bba3#9559npm-user-validate@5.0.01f9c567#9559npm-registry-fetch@20.0.11fd247a#9559npm-profile@13.0.0998ff1d#9559npm-pick-manifest@12.0.0d80859a#9559npm-package-arg@14.0.05e1d513#9559npm-install-checks@9.0.0faf97e5#9559npm-audit-report@8.0.0471309f#9559nopt@10.0.140395b8#9559make-fetch-happen@16.0.130e89d9#9559json-parse-even-better-errors@6.0.0d44db96#9559is-cidr@7.0.0350fb18#9559init-package-json@9.0.0406820a#9559ini@7.0.0d867351#9559hosted-git-info@10.1.166d46bc#9559cacache@21.0.10d15aec#9559abbrev@5.0.09bbdefb#9559@sigstore/tuf@5.0.09d13ebf#9559@npmcli/run-script@11.0.027c4dcc#9559@npmcli/redact@5.0.0f0eaef3#9559@npmcli/promise-spawn@10.0.00be6ae2#9559@npmcli/package-json@8.0.0f86a019#9559@npmcli/metavuln-calculator@10.0.04d234b2#9559@npmcli/map-workspaces@6.0.0d28783e#9420undici@6.26.07f6c6ef#9420sigstore@4.1.1ee61b6e#9420lru-cache@11.5.1d5ddef2#9420@sigstore/verify@3.1.111e7ac7#9420@sigstore/core@3.2.111cd66e#9420@npmcli/agent@4.0.28be4c04#9420semver@7.8.1577d61d#9420make-fetch-happen@15.0.6Chores
059c06e#9560 add web-login proxy doneUrl regression for npm-profile fix (#9560) (@manzoorwanijk)1453954#9559nock@14.0.0(@owlstronaut)0323f2d#9559 template-oss-apply (@owlstronaut)ee3d87f#9559@npmcli/template-oss@5.1.1(@owlstronaut)d25a179#9559 template-oss-apply (@owlstronaut)acdd6d5#9559 bumping @npmcli/template-oss from 4.29.0 to 5.1.0 (@owlstronaut)4e2496a#9513 update issue templates - better language (@owlstronaut)7a997ac#9512 update issue templates (#9512) (@owlstronaut)da63c79#9420 dev dependency updates (@owlstronaut)5fc9bc0#9393 sanitize newlines in flags table default and type values (#9393) (@reggi, @Copilot)@npmcli/arborist@10.0.0-pre.1@npmcli/config@11.0.0-pre.1libnpmaccess@11.0.0-pre.0libnpmdiff@9.0.0-pre.0libnpmexec@11.0.0-pre.0libnpmfund@8.0.0-pre.0libnpmorg@9.0.0-pre.0libnpmpack@10.0.0-pre.1libnpmpublish@12.0.0-pre.0libnpmsearch@10.0.0-pre.0libnpmteam@9.0.0-pre.0libnpmversion@9.0.0-pre.1v11.5.0Compare Source
⚠️ BREAKING CHANGES
npm sbom --sbom-format=cyclonedxnow reports thenamefield from each package'spackage.jsoninstead of the on-disk directory name. Thename,bom-ref, andpurlof the root component and of aliased dependencies may change.man npm-installwill no longer work, butnpm help installis unaffected.npm pkgoutput is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly tonpm view.npm shrinkwrapis removed, theshrinkwrapconfig alias is removed, andnpm-shrinkwrap.jsonis no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-rootnpm-shrinkwrap.jsontopackage-lock.json; usebundleDependenciesif you need to ship a locked dependency tree.npm packandnpm publishhave changed. They are now always consistent, and in the same format.star,starsandunstarcommands have been removednpm addusercommand has been removed. Create and manage user accounts on the npm website, and usenpm loginto authenticate on the command line.Features
254809e#9201 npm stage (#9201) (@reggi, @Copilot)cf94dbe#9248 add permissions support to trust commands (#9248) (@reggi, @Copilot)e0f12f7#9348 add allow-git/allow-file/allow-directory/allow-remote configs (@owlstronaut)916cb4b#9287 add allow-directory, allow-file, and allow-remote (#9287) (@wraithgar)2e5dcad#9262 drop npm-shrinkwrap.json support (@owlstronaut)2397196#9265 Remove Twitter and Freenode profile fields (@owlstronaut)738be10#9196 remove star commands (#9196) (@wraithgar)db7c1f8#9163 adduas alias forupdatecommand (#9163) (@Ausoj)45e44dd#9228 adds a backport script (@owlstronaut)Bug Fixes
2a13550#9380 key stage download --json output by package name (#9380) (@reggi, @Copilot)ca585c8#9368 allow min-release-age in npmrc to coexist with --before (@raazkhnl)f550eb4#9348 refactor #failureNode, adjust tests and safety (@owlstronaut)1f17566#9348 allow-remote=none does not block registry tarballs (@owlstronaut)70af7b3#9327 remove settings (#9327) (@owlstronaut)d623988#9311 sbom: dedupe per-node dependsOn / relationships (#9311) (@mikaelkristiansson)d36945d#9160 do not unwrap single-item arrays in --json output (@yetanotheraryan)faf7348#9284 align CycloneDX SBOM component names with SPDX (#9284) (@cyphercodes, @cyphercodes)e20424b#9035 don't install man pages in system locations (@owlstronaut)01d9acd#9269 pkg: output like npm view does, do not force json output (@wraithgar)27567ab#9257 ignore intended error code (@owlstronaut)4ef5b6e#9039 stop resolving node path via whichnode (@owlstronaut)2e9b26e#9247 sync json output of pack and publish (#9247) (@wraithgar)7357d7f#9036 remove npm adduser command (@owlstronaut)Documentation
c97b39b#9363 add example to optionalDependencies section (#9363) (@verifizieren)6704ab2#9335 npm view with json outputs array docs update (#9335) (@yetanotheraryan)Dependencies
d151521#9382socks@2.8.9a77416e#9382lru-cache@11.5.0b2717e4#9382ip-address@10.2.01c4a796#9382brace-expansion@5.0.6e36a4e3#9382bin-links@6.0.291bd674#9382tar@7.5.1566c7ff1#9382semver@7.8.0514c71b#9382hosted-git-info@9.0.3fbe1dd0#9316socks@10.1.1af65766#9316ip-address@10.1.137bd0c6#9316cidr-regex@5.0.55af02ec#9270lru-cache@11.3.5799866f#9270node-gyp@12.3.079d394e#9270is-cidr@6.0.49669d31#9207@sigstore/protobuf-specs@0.5.1b09a5ac#9207tinyglobby@0.2.16150231d#9207picomatch@4.0.4413e0a0#9207lru-cache@11.3.36faa25e#9207diff@8.0.487bb9d0#9207minimatch@10.2.52501dd8#9207tar@7.5.13ccce5f6#9207minipass-flush@1.0.6Chores
f502c4f#9382 dev dependency updates (@owlstronaut)4259e57#9316 dev dependency updates (@owlstronaut)d68bd36#9317 add cli-triage team as codeowner (#9317) (@owlstronaut)b9332e6#9270 dev dependency updates (@owlstronaut)cc468a8#9269 refactor tests (@wraithgar)2ca36c4#9261 fixed non-functional typos throughout the codebase (@opensourcezeal)8131de4#9239 add action permission for backport workflow (@owlstronaut)6df5f91#9232 backports can trigger CI (@owlstronaut)07552f5#9224 don't run npm update in CI (@owlstronaut)05dbba5#9195 enable prerelease mode (#9195) (@wraithgar)@npmcli/arborist@10.0.0-pre.0.0@npmcli/config@11.0.0-pre.0.0libnpmdiff@8.1.6-pre.0.0libnpmexec@10.2.6-pre.0.0libnpmfund@7.0.20-pre.0.0libnpmpack@10.0.0-pre.0.0libnpmpublish@11.2.0-pre.0.0libnpmversion@9.0.0-pre.0.0v11.4.2Compare Source
Bug Fixes
d389614#8579 corrects peer dependency flag propagation (@owlstronaut)5db81c3#8512 allow concurrent non-local npx calls (#8512) (@jenseng, @wraithgar)Documentation
7a09902#8582 bring back certfile (#8582) (@jenseng)Dependencies
849dcb6#8589tar@7.5.1(#8589)ea15731#8576binary-extensions@3.1.00f41bac#8576tiny-relative-date@2.0.207bf540#8576is-cidr@6.0.0ef87ec6#8576diff@8.0.248285e0#8576 add fdir, isexe, and picomatch to node_modules099238a#8576fdir@6.5.06e4d673#8576isexe@3.1.109a7494#8576supports-color@10.2.2c5157c9#8576chalk@5.6.246035db#8576debug@4.4.35f6664b#8576spdx-license-ids@3.0.225516583#8576socks@2.8.76a392f3#8576tinyglobby@0.2.159519f18#8576npm-install-checks@7.1.234bafd1#8576node-gyp@11.4.2dfd034e#8576@npmcli/promise-spawn@8.0.3d4eef14#8576rimraf@6.0.1566f1b7#8576minimatch@10.0.3ac33497#8576mkdirp@3.0.11676626#8576glob@11.0.3817f0b1#8576ignore-walk@8.0.079a4e67#8576minizlib@3.0.238fa2c2#8576negotiator@1.0.024252a1#8576@npmcli/agent@4.0.0ea7ca5f#8576lru-cache@11.2.1521823b#8576@npmcli/git@7.0.0bf6b686#8576npm-package-arg@13.0.09392488#8576npm-package-manifest@11.0.10082083#8576normalize-package-data@8.0.0633c4ed#8576hosted-git-info@9.0.066f64eb#8576make-fetch-happen@15.0.21f85f94#8576@sigstore/tuf@4.0.0a2bdecc#8576sigstore@4.0.01149971#8576npm-registry-fetch@19.0.0b5bd5e3#8576npm-profile@12.0.06221e27#8576@npmcli/metavuln-calculator@9.0.2da81a37#8576cacache@20.0.16b4c5f9#8576@npmcli/run-script@10.0.0cb36a8a#8576init-package-json@8.2.2b6bb9ae#8576pacote@21.0.31b4433f#8576@npmcli/map-workspaces@5.0.0ceae674#8576@npmcli/package-json@7.0.14f37534#8576 remove read-package-json-fastChores
7eb5c09#8576 update package-lock with peer flag fixes (@wraithgar)0d00fd8#8576jsdom@27.0.0(@wraithgar)420a569#8576unified@11.0.5(@wraithgar)064deb3#8576remark-rehype@11.1.2(@wraithgar)30fe3ba#8576remark-man@9.0.0(@wraithgar)1c6bb4c#8576rehype-stringify@10.0.1(@wraithgar)208cb93#8576remark-gfm@4.0.1(@wraithgar)4a46b5a#8576remark-github@12.0.0(@wraithgar)93d190b#8576remark-parse@11.0.0(@wraithgar)05301a4#8576remark@15.0.1(@wraithgar)6afdda9#8576ajv-formats@3.0.1(@wraithgar)402a0ab#8576@npmcli/template-oss@4.25.1(@wraithgar)3b43bf7#8576 dev dependency updates (@wraithgar)9f9146f#8576@tufjs/repo-mock@4.0.0(@wraithgar)eed8a10#8576 use latest/local arborist in mock-registry (@wraithgar)@npmcli/arborist@9.1.5@npmcli/config@10.4.1libnpmaccess@10.0.2libnpmdiff@8.0.8libnpmexec@10.1.7libnpmfund@7.0.8libnpmorg@8.0.1libnpmpack@9.0.8libnpmpublish@11.1.1libnpmsearch@9.0.1libnpmteam@8.0.2libnpmversion@8.0.2v11.4.1Compare Source
Documentation
3ed764a#8308 Clarify script working directory behavior (fixes #8305) (#8308) (@tarekwfa0110, @owlstronaut)Chores
2f30251#8314 remove references to skimdb.npmjs.com (#8314) (@shmam)9cb9d50#8298 add contributor to changelog entry (#8298) (@wraithgar)Dependencies
@npmcli/arborist@9.1.1libnpmdiff@8.0.4libnpmexec@10.1.3libnpmfund@7.0.4libnpmpack@9.0.4v11.4.0Compare Source
Features
a0e60fb#8246 added init-private option (@owlstronaut)57aa89f#8265 use run by default and run-script as the alias (#8265) (@owlstronaut)0d4c023#8234 install: add package info to json output (#8234) (@wraithgar)Bug Fixes
8794fd9#8297 powershell: support pipeline input with Invoke-Expression (#8297) (@alexsch01)b5173d1#8293 docs: corrected github_path (#8293) (@xaos7991)2210d7a#8278 powershell: use Invoke-Expression to pass args (#8278) (@alexsch01, @mbtools)8669d09#8228 add otplease for enable-2fa, disable-2fa, access (#8228) (@reggi, @wraithgar)78b5a6f#8269 correctly handle scenario where prefix is the cwd (#8269) (@owlstronaut, @ficocelliguy)fdc3413#8221 exec: Fails to Execute Binaries Named After Shell Keywords (#8221) (@13sfaith)4b08e2e#8245 docs: prepare script runs for local package links (@milaninfy)1622ac4#8241 handle missingtimein packument to prevent crash onnpm view(@owlstronaut)db8f5da#8110 outdated: add dependent location in long output (#8110) (@milaninfy, @wraithgar)Documentation
d2498df#8295 RemoveCHANGELOGfrom never-ignored list (#8295) (@mrazauskas)4d5c3c1#8283 fixoverridesexample in package-json.md (#8283) (@glasser)96cc4f9#8226 format publish as code to highlight it (@LiangYingC)4990ea0#8226 clarify legacy token creation in npm login and adduser commands (@LiangYingC)Dependencies
c97ef8a#8246init-package-json@8.2.1f48613d#8292@sigstore/verify@2.1.1a4c5e74#8292tinyglobby@0.2.13b9156d2#8292http-cache-semantics@4.2.0472a685#8292binary-extensions@3.1.0988696e#8292@sigstore/tuf@3.1.1569ac84#8292semver@7.7.22521c9b#8233@sigstore/protobuf-specs@0.4.13274d68#8233@npmcli/query@4.0.1c263626#8233abbrev@3.0.178df711#8233hosted-git-info@8.1.0Chores
e80e38e#8292 dev dependency updates (@wraithgar)3231ee9#8244 update snapshots (@owlstronaut)c561a33#8233 dev dependency updates (@owlstronaut)7eca19c#8215 update workflow permissions for updating Node PR (@owlstronaut)@npmcli/arborist@9.1.0@npmcli/config@10.3.0libnpmaccess@10.0.1libnpmdiff@8.0.3libnpmexec@10.1.2libnpmfund@7.0.3libnpmpack@9.0.3libnpmteam@8.0.1libnpmversion@8.0.1v11.3.0Compare Source
Features
b51d156#9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@u2mejc)86416a6#9674 graduate the linked install strategy from experimental to stable (#9674) (@manzoorwanijk)c4e5356#9651 install-scripts: prune unused allowScripts entries (#9651) (@JamieMagee)0c4dd41#9629 namespace install-script approval commands under npm install-scripts (#9629) (@manzoorwanijk)58cd8f5#9586.npm-extensiontransformManifest for imperative manifest repairs (#9586) (@manzoorwanijk)Bug Fixes
024e6d9#9670 sbom: percent-encode vcs_url qualifier in generated purls (#9670) (@ubeddulla)6da6555#9588 output all the required parameters for npm token list (#9588) (@rijildaniel)ae6dbeb#9657 arborist: surface undeclared workspaces under the linked strategy (#9657) (@manzoorwanijk)0c33947#9661 reify: report added count for fresh linked installs (#9661) (@manzoorwanijk)803ba70#9656 query: report logical dep location under linked strategy (#9656) (@manzoorwanijk)60d0d3d#9652 allowScripts: close three enforcement gaps (#9652) (@JamieMagee)d6fbb55#9639 exec: resolve workspace-local bin under the linked install strategy (#9639) (@manzoorwanijk)7e29a19#9646 ls: restore 100% coverage on latest after #9626 (#9646) (@manzoorwanijk)971500f#9606 approve-scripts: approve deps with no resolved URL by name (#9606) (@JamieMagee)7655822#9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@JamieMagee)1a9ce8e#9592 link: scopenpm link <path> --workspaceto the workspace, not the root (#9592) (@manzoorwanijk)Documentation
fdcfcee#9678 recommend install-strategy=linked to catch phantom dependencies (#9678) (@manzoorwanijk)Dependencies
f055ce6#9695undici@6.27.02d74bfb#9695tinyglobby@0.2.17c1edadd#9695postcss-selector-parser@7.1.42b7c6a4#9695cmd-shim@9.0.2c1d0a10#9695brace-expansion@5.0.78e6ba7a#9695@sigstore/verify@4.1.009ce72f#9695@sigstore/core@4.0.1a18679a#9695@npmcli/agent@5.0.252349de#9695tar@7.5.190f77bb1#9695semver@7.8.5ce11dcf#9596npm-packlist@11.3.0Chores
bbd640d#9695 dev dependency updates (@owlstronaut)@npmcli/arborist@10.0.0-pre.2@npmcli/config@11.0.0-pre.2libnpmdiff@9.0.0-pre.1libnpmexec@11.0.0-pre.1libnpmfund@8.0.0-pre.1libnpmpack@10.0.0-pre.2v11.2.0Compare Source
Features
9741b64#10038 dist-tag: support OIDC authentication (#10038) (@reggi, @Copilot)Documentation
0c3b82a#10017 update npm stage docs to reflect that it can create new packages (#10017) (@shmam, @Copilot)Dependencies
@npmcli/config@11.2.0v11.1.0Compare Source
Features
6400533#9948 token: support read-write-stage-only granular access tokens (#9948) (@Tayvon, @Copilot)8723f53#9898 stage: display staged package status (#9898) (@joelverhagen)Bug Fixes
c9876d7#9882 provenance-file takes precedence over OIDC auto-generated provenance (#9882) (@yunseo-kim)b016aa2#9913 config: avoid exporting persistent allow-scripts (#9913) (@Fnine59)d6c6122#9914 arborist: match allowScripts keys for local paths (#9914) (@martinrrm, @Copilot)a8c9b2f#9823 keep dry-run output valid json (#9823) (@martinrrm)da50c34#9881 arborist: reject uninstall args that carry a version (#9881) (@lazerg)71915e8#9756 exempt explicit pack targets from allow-directory (#9756) (@ychampion, @ychampion)51c2bf8#9864 don't print the funding message for global installs (#9864) (@lazerg)Documentation
bea9066#9838 document npm 12 install script blocking (#9838) (@reggi)Dependencies
6e40f73#9871undici@6.28.0(@martinrrm, @Copilot)05bd2a4#9871ip-address@10.5.0(@martinrrm, @Copilot)b7c490d#9871brace-expansion@5.0.9(@martinrrm, @Copilot)75a943d#9843tar@7.5.22(#9843) (@martinrrm, @Copilot)Chores
7b50811#9961 pack: select workspace through config (#9961) (@reggi)81a901c#9915 recognize prefixed Node.js PR titles (#9915) (@reggi)4cdccea#9836 updatenode-integrationworkflow template to latest actions (#9836) (@MikeMcC399)278df04#9822 pass nodedir to node-gyp via npm_package_config env in node integration (#9822) (@reggi, @Copilot)@npmcli/arborist@10.0.3@npmcli/config@11.1.0libnpmdiff@9.0.3libnpmexec@11.0.3libnpmfund@8.0.3libnpmpack@10.0.3libnpmpublish@12.0.1v11.0.0Compare Source
⚠️ BREAKING CHANGES
npm sbom --sbom-format=cyclonedxnow reports thenamefield from each package'spackage.jsoninstead of the on-disk directory name. Thename,bom-ref, andpurlof the root component and of aliased dependencies may change.man npm-installwill no longer work, butnpm help installis unaffected.npm pkgoutput is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly tonpm view.npm shrinkwrapis removed, theshrinkwrapconfig alias is removed, andnpm-shrinkwrap.jsonis no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-rootnpm-shrinkwrap.jsontopackage-lock.json; usebundleDependenciesif you need to ship a locked dependency tree.npm packandnpm publishhave changed. They are now always consistent, and in the same format.star,starsandunstarcommands have been removednpm addusercommand has been removed. Create and manage user accounts on the npm website, and usenpm loginto authenticate on the command line.npm inithas been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.npmnow supports node^22.22.2 || ^24.15.0 || >=26.0.0.npmrcconfigs still warn by default; opt into erroring with the newstrict-npmrcconfig.)allowScriptspolicy. After installing, runnpm install-scripts approveto record approvals andnpm rebuildto execute newly approved scripts.Chores
b77b532#9735 remove pre-release mode from npm 12 and workspaces (#9735) (@reggi, @Copilot)Dependencies
@npmcli/arborist@10.0.0@npmcli/config@11.0.0libnpmaccess@11.0.0libnpmdiff@9.0.0libnpmexec@11.0.0libnpmfund@8.0.0libnpmorg@9.0.0libnpmpack@10.0.0libnpmpublish@12.0.0libnpmsearch@10.0.0libnpmteam@9.0.0libnpmversion@9.0.0Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
57d1bc074ctoba3c6a40ffba3c6a40fftof2a934f2f6View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.