Repository navigation
feat: namespace install-script approval commands under npm install-scripts - #9635
Merged
owlstronaut merged 1 commit intoJun 24, 2026
Conversation
manzoorwanijk
changed the title
manzoorwanijk
force-pushed
the
backport/install-scripts-namespace-v11
branch
2 times, most recently
from
June 24, 2026 15:22
2faac6f to
c45e8b9
Compare
Merged
…ripts (npm#9629) Add a namespaced `npm install-scripts` command that groups the install-script approval operations, following npm's existing `npm cache <cmd>` / `npm token <cmd>` convention: - `npm install-scripts approve <pkg>... | --all` - `npm install-scripts deny <pkg>... | --all` - `npm install-scripts ls` (list packages with unreviewed install scripts) The shipped `npm approve-scripts` and `npm deny-scripts` commands keep working as aliases for `approve` and `deny`, so this is additive and backwards compatible. The shared `AllowScriptsCmd` base now dispatches through `runMode(mode, args)`; the standalone commands route through it via `static verb`. The `--allow-scripts-pending` flag is only honored by the commands that declare it, so the namespace lists exclusively through `ls`. Closes npm#9545 Follow-up from RFC npm/rfcs#868.
manzoorwanijk
force-pushed
the
backport/install-scripts-namespace-v11
branch
from
June 24, 2026 17:10
c45e8b9 to
cea039c
Compare
manzoorwanijk
marked this pull request as ready for review
June 24, 2026 17:12
owlstronaut
approved these changes
Jun 24, 2026
renovate Bot
added a commit
to gwennlbh/swarpc
that referenced
this pull request
Oct 7, 2026
##### [v11.21.0](npm/cli@v11.20.0...5fd1e17) ##### [v11.20.0](https://github.com/npm/cli/releases/tag/v11.20.0) ##### Features - [`0b3c699`](npm/cli@0b3c699) [#9994](npm/cli#9994) token: support read-write-stage-only granular access tokens ([#9994](npm/cli#9994)) ([@github-actions](https://github.com/github-actions)\[bot], [@Tayvon](https://github.com/Tayvon), [@Copilot](https://github.com/Copilot)) - [`b872816`](npm/cli@b872816) [#9920](npm/cli#9920) stage: display staged package status ([#9920](npm/cli#9920)) ([@github-actions](https://github.com/github-actions)\[bot], [@joelverhagen](https://github.com/joelverhagen)) ##### Bug Fixes - [`ddbadfc`](npm/cli@ddbadfc) [#9947](npm/cli#9947) provenance-file takes precedence over OIDC auto-generated provenance ([#9947](npm/cli#9947)) ([@github-actions](https://github.com/github-actions)\[bot], [@yunseo-kim](https://github.com/yunseo-kim)) - [`64d4b4b`](npm/cli@64d4b4b) [#9937](npm/cli#9937) config: avoid exporting persistent allow-scripts ([#9937](npm/cli#9937)) ([@github-actions](https://github.com/github-actions)\[bot], [@Fnine59](https://github.com/Fnine59)) - [`70317da`](npm/cli@70317da) [#9930](npm/cli#9930) arborist: reject uninstall args that carry a version ([#9930](npm/cli#9930)) ([@github-actions](https://github.com/github-actions)\[bot], [@lazerg](https://github.com/lazerg)) - [`55ae484`](npm/cli@55ae484) [#9929](npm/cli#9929) arborist: match allowScripts keys for local paths ([#9929](npm/cli#9929)) ([@github-actions](https://github.com/github-actions)\[bot], [@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) - [`7f1f2b7`](npm/cli@7f1f2b7) [#9928](npm/cli#9928) keep dry-run output valid json ([#9928](npm/cli#9928)) ([@github-actions](https://github.com/github-actions)\[bot], [@martinrrm](https://github.com/martinrrm)) - [`f28cca9`](npm/cli@f28cca9) [#9927](npm/cli#9927) don't print the funding message for global installs ([#9927](npm/cli#9927)) ([@github-actions](https://github.com/github-actions)\[bot], [@lazerg](https://github.com/lazerg)) ##### Chores - [`6ff3000`](npm/cli@6ff3000) [#10010](npm/cli#10010) pack: select workspace through config ([#10010](npm/cli#10010)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi)) - [`afdc5bd`](npm/cli@afdc5bd) [#9932](npm/cli#9932) pass nodedir to node-gyp via npm_package_config env in node integration ([#9932](npm/cli#9932)) ([@reggi](https://github.com/reggi)) - [`83f95ff`](npm/cli@83f95ff) [#9931](npm/cli#9931) update `node-integration` workflow template to latest actions ([#9931](npm/cli#9931)) ([@reggi](https://github.com/reggi)) - [`f020fba`](npm/cli@f020fba) [#9925](npm/cli#9925) recognize prefixed Node.js PR titles ([#9925](npm/cli#9925)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi)) ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.2): `@npmcli/arborist@9.9.2` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.13.0): `@npmcli/config@10.13.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.13): `libnpmdiff@8.1.13` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.3): `libnpmexec@10.3.3` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.27): `libnpmfund@7.0.27` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.14): `libnpmpack@9.1.14` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v11.2.1): `libnpmpublish@11.2.1` ##### [v11.19.1](https://github.com/npm/cli/releases/tag/v11.19.1) ##### Bug Fixes - [`83b750d`](npm/cli@83b750d) [#9916](npm/cli#9916) exempt explicit pack targets from allow-directory ([#9916](npm/cli#9916)) ([@github-actions](https://github.com/github-actions)\[bot], [@ychampion](https://github.com/ychampion), [@ychampion](https://github.com/ychampion)) ##### Dependencies - [`4791b27`](npm/cli@4791b27) [#9872](npm/cli#9872) `undici@6.28.0` ([@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) - [`823d647`](npm/cli@823d647) [#9872](npm/cli#9872) `ip-address@10.5.0` ([@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) - [`04f8efe`](npm/cli@04f8efe) [#9872](npm/cli#9872) `brace-expansion@5.0.9` ([@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) - [`1610280`](npm/cli@1610280) [#9842](npm/cli#9842) `tar@7.5.22` ([#9842](npm/cli#9842)) ([@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.13): `libnpmpack@9.1.13` ##### [v11.19.0](https://github.com/npm/cli/releases/tag/v11.19.0) ##### Features - [`7d39aa6`](npm/cli@7d39aa6) [#9698](npm/cli#9698) install-scripts: use install-scripts as the warning log title ([@manzoorwanijk](https://github.com/manzoorwanijk)) ##### Bug Fixes - [`3529ca2`](npm/cli@3529ca2) [#9811](npm/cli#9811) pack: honor min-release-age-exclude ([#9811](npm/cli#9811)) ([@github-actions](https://github.com/github-actions)\[bot], [@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) - [`67f12ae`](npm/cli@67f12ae) [#9810](npm/cli#9810) owner: use scoped registry for user lookup ([#9810](npm/cli#9810)) ([@github-actions](https://github.com/github-actions)\[bot], [@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.1): `@npmcli/arborist@9.9.1` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.12): `libnpmdiff@8.1.12` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.2): `libnpmexec@10.3.2` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.26): `libnpmfund@7.0.26` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.12): `libnpmpack@9.1.12` ##### [v11.18.0](https://github.com/npm/cli/releases/tag/v11.18.0) ##### Features - [`3021ad6`](npm/cli@3021ad6) [#9694](npm/cli#9694) arborist: extend replace-registry-host with URL prefix matching ([#6110](npm/cli#6110)) ([#9694](npm/cli#9694)) ([@github-actions](https://github.com/github-actions)\[bot], [@u2mejc](https://github.com/u2mejc)) - [`abd8c6b`](npm/cli@abd8c6b) [#9677](npm/cli#9677) graduate the linked install strategy from experimental to stable ([#9677](npm/cli#9677)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`9420673`](npm/cli@9420673) [#9662](npm/cli#9662) install-scripts: prune unused allowScripts entries ([#9662](npm/cli#9662)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`fc9d4c7`](npm/cli@fc9d4c7) [#9635](npm/cli#9635) namespace install-script approval commands under npm install-scripts ([#9635](npm/cli#9635)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`073253f`](npm/cli@073253f) [#9564](npm/cli#9564) warn when min-release-age blocks an audit fix ([#9564](npm/cli#9564)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) ##### Bug Fixes - [`598ffdb`](npm/cli@598ffdb) [#9693](npm/cli#9693) sbom: percent-encode vcs_url qualifier in generated purls ([#9693](npm/cli#9693)) ([@github-actions](https://github.com/github-actions)\[bot], [@ubeddulla](https://github.com/ubeddulla)) - [`05793d0`](npm/cli@05793d0) [#9691](npm/cli#9691) output all the required parameters for npm token list ([#9691](npm/cli#9691)) ([@github-actions](https://github.com/github-actions)\[bot], [@rijildaniel](https://github.com/rijildaniel)) - [`cd57139`](npm/cli@cd57139) [#9669](npm/cli#9669) arborist: surface undeclared workspaces under the linked strategy (backport release/v11) ([#9669](npm/cli#9669)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`5b6ff9c`](npm/cli@5b6ff9c) [#9667](npm/cli#9667) reify: report added count for fresh linked installs ([#9667](npm/cli#9667)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk), [@owlstronaut](https://github.com/owlstronaut)) - [`8f13beb`](npm/cli@8f13beb) [#9664](npm/cli#9664) query: report logical dep location under linked strategy ([#9664](npm/cli#9664)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`168ba30`](npm/cli@168ba30) [#9663](npm/cli#9663) allowScripts: close enforcement gaps ([#9652](npm/cli#9652)) (backport release/v11) ([#9663](npm/cli#9663)) ([@JamieMagee](https://github.com/JamieMagee)) - [`ae64f88`](npm/cli@ae64f88) [#9648](npm/cli#9648) exec: resolve workspace-local bin under the linked install strategy ([#9648](npm/cli#9648)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`784cbe9`](npm/cli@784cbe9) [#9636](npm/cli#9636) ls: restore 100% coverage on release/v11 after [#9633](npm/cli#9633) ([#9636](npm/cli#9636)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`70f0ea5`](npm/cli@70f0ea5) [#9607](npm/cli#9607) approve-scripts: approve deps with no resolved URL by name ([#9607](npm/cli#9607)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`b2e6338`](npm/cli@b2e6338) [#9602](npm/cli#9602) arborist: don't flag inert optional deps in strict-allow-scripts ([#9602](npm/cli#9602)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`6ad5715`](npm/cli@6ad5715) [#9595](npm/cli#9595) link: scope `npm link --workspace` to the workspace, not the root ([#9595](npm/cli#9595)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) ##### Documentation - [`3658bb5`](npm/cli@3658bb5) [#9690](npm/cli#9690) recommend install-strategy=linked to catch phantom dependencies ([#9690](npm/cli#9690)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) ##### Dependencies - [`54656b6`](npm/cli@54656b6) [#9696](npm/cli#9696) `undici@6.27.0` - [`31c4773`](npm/cli@31c4773) [#9696](npm/cli#9696) `brace-expansion@5.0.7` - [`e773c77`](npm/cli@e773c77) [#9696](npm/cli#9696) `tar@7.5.19` - [`f05f6af`](npm/cli@f05f6af) [#9696](npm/cli#9696) `semver@7.8.5` - [`804f9ba`](npm/cli@804f9ba) [#9580](npm/cli#9580) `npm-profile@12.0.2` ##### Chores - [`f79b37f`](npm/cli@f79b37f) [#9696](npm/cli#9696) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [`a04cd84`](npm/cli@a04cd84) [#9584](npm/cli#9584) add web-login proxy doneUrl regression for npm-profile fix ([#9584](npm/cli#9584)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.12.0): `@npmcli/config@10.12.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.11): `libnpmdiff@8.1.11` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.1): `libnpmexec@10.3.1` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.25): `libnpmfund@7.0.25` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.11): `libnpmpack@9.1.11` arborist: 9.9.0 #### [9.9.0](npm/cli@arborist-v9.8.0...arborist-v9.9.0) (2026-06-29) ##### Features - [`3021ad6`](npm/cli@3021ad6) [#9694](npm/cli#9694) arborist: extend replace-registry-host with URL prefix matching ([#6110](npm/cli#6110)) ([#9694](npm/cli#9694)) ([@github-actions](https://github.com/github-actions)\[bot], [@u2mejc](https://github.com/u2mejc)) - [`abd8c6b`](npm/cli@abd8c6b) [#9677](npm/cli#9677) graduate the linked install strategy from experimental to stable ([#9677](npm/cli#9677)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`9420673`](npm/cli@9420673) [#9662](npm/cli#9662) install-scripts: prune unused allowScripts entries ([#9662](npm/cli#9662)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`073253f`](npm/cli@073253f) [#9564](npm/cli#9564) warn when min-release-age blocks an audit fix ([#9564](npm/cli#9564)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) ##### Bug Fixes - [`774875b`](npm/cli@774875b) [#9686](npm/cli#9686) arborist: keep bin links for allowScripts-denied packages ([#9686](npm/cli#9686)) ([@JamieMagee](https://github.com/JamieMagee)) - [`719de1e`](npm/cli@719de1e) [#9673](npm/cli#9673) arborist: apply overrides across a file: link (backport release/v11) ([#9673](npm/cli#9673)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`cd57139`](npm/cli@cd57139) [#9669](npm/cli#9669) arborist: surface undeclared workspaces under the linked strategy (backport release/v11) ([#9669](npm/cli#9669)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`ede32d3`](npm/cli@ede32d3) [#9668](npm/cli#9668) arborist: forward transitive overrides through linked store links ([#9658](npm/cli#9658)) (backport release/v11) ([#9668](npm/cli#9668)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`f503b07`](npm/cli@f503b07) [#9666](npm/cli#9666) correct dev/prod dep flags for workspaces under the linked strategy ([#9666](npm/cli#9666)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`f580889`](npm/cli@f580889) [#9665](npm/cli#9665) arborist: load transitive optional deps into linked actual tree ([#9665](npm/cli#9665)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`8f13beb`](npm/cli@8f13beb) [#9664](npm/cli#9664) query: report logical dep location under linked strategy ([#9664](npm/cli#9664)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`168ba30`](npm/cli@168ba30) [#9663](npm/cli#9663) allowScripts: close enforcement gaps ([#9652](npm/cli#9652)) (backport release/v11) ([#9663](npm/cli#9663)) ([@JamieMagee](https://github.com/JamieMagee)) - [`4c9eacb`](npm/cli@4c9eacb) [#9649](npm/cli#9649) arborist: clean up stale .store and hoisted dirs on strategy switch ([#9649](npm/cli#9649)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`d2c680e`](npm/cli@d2c680e) [#9645](npm/cli#9645) arborist: invalid filterNode crash under the linked strategy ([#9645](npm/cli#9645)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`4e40b1c`](npm/cli@4e40b1c) [#9644](npm/cli#9644) arborist: repair wrong-but-existing symlink target in linked strategy ([#9644](npm/cli#9644)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`9d1774e`](npm/cli@9d1774e) [#9643](npm/cli#9643) arborist: remove stale .bin shims after uninstall under linked ([#9643](npm/cli#9643)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`ed37d24`](npm/cli@ed37d24) [#9642](npm/cli#9642) arborist: record the linked .store layout in the hidden lockfile (backport [#9630](npm/cli#9630)) ([#9642](npm/cli#9642)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`e601d4a`](npm/cli@e601d4a) [#9641](npm/cli#9641) arborist: validate peerOptional conflicts in no-save mutations ([#9641](npm/cli#9641)) ([@owlstronaut](https://github.com/owlstronaut), [@dale-lakes](https://github.com/dale-lakes), [@dale-lakes](https://github.com/dale-lakes)) - [`03cee43`](npm/cli@03cee43) [#9638](npm/cli#9638) arborist: fix audit-report determinism due to dropped via links ([#9638](npm/cli#9638)) ([@github-actions](https://github.com/github-actions)\[bot], [@arjun-vegeta](https://github.com/arjun-vegeta)) - [`a30d855`](npm/cli@a30d855) [#9633](npm/cli#9633) arborist: don't load store packages' devDependencies as required edges ([#9633](npm/cli#9633)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`887ca97`](npm/cli@887ca97) [#9631](npm/cli#9631) arborist: audit the non-isolated tree under the linked strategy ([#9631](npm/cli#9631)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`b2e6338`](npm/cli@b2e6338) [#9602](npm/cli#9602) arborist: don't flag inert optional deps in strict-allow-scripts ([#9602](npm/cli#9602)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`390ebfa`](npm/cli@390ebfa) [#9593](npm/cli#9593) arborist: symlink workspace file: deps on non-workspace local packages ([#9593](npm/cli#9593)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`aaeb2f1`](npm/cli@aaeb2f1) [#9578](npm/cli#9578) arborist: expose store node_modules via NODE_PATH for linked-strategy install scripts ([#9578](npm/cli#9578)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`05b6f0f`](npm/cli@05b6f0f) [#9577](npm/cli#9577) arborist: allow-remote exemption for proxy/mirror-fronted registry tarballs ([#9577](npm/cli#9577)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) config: 10.12.0 #### [10.12.0](npm/cli@config-v10.11.0...config-v10.12.0) (2026-06-29) ##### Features - [`3021ad6`](npm/cli@3021ad6) [#9694](npm/cli#9694) arborist: extend replace-registry-host with URL prefix matching ([#6110](npm/cli#6110)) ([#9694](npm/cli#9694)) ([@github-actions](https://github.com/github-actions)\[bot], [@u2mejc](https://github.com/u2mejc)) - [`abd8c6b`](npm/cli@abd8c6b) [#9677](npm/cli#9677) graduate the linked install strategy from experimental to stable ([#9677](npm/cli#9677)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`073253f`](npm/cli@073253f) [#9564](npm/cli#9564) warn when min-release-age blocks an audit fix ([#9564](npm/cli#9564)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) ##### Bug Fixes - [`b2e6338`](npm/cli@b2e6338) [#9602](npm/cli#9602) arborist: don't flag inert optional deps in strict-allow-scripts ([#9602](npm/cli#9602)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) ##### Documentation - [`3658bb5`](npm/cli@3658bb5) [#9690](npm/cli#9690) recommend install-strategy=linked to catch phantom dependencies ([#9690](npm/cli#9690)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) libnpmdiff: 8.1.11 ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0` libnpmexec: 10.3.1 #### [10.3.1](npm/cli@libnpmexec-v10.3.0...libnpmexec-v10.3.1) (2026-06-29) ##### Bug Fixes - [`f3f2465`](npm/cli@f3f2465) [#9692](npm/cli#9692) exec: prevent shared binPaths pollution across workspace runs ([#9692](npm/cli#9692)) ([@github-actions](https://github.com/github-actions)\[bot], [@arjun-vegeta](https://github.com/arjun-vegeta)) - [`b2e6338`](npm/cli@b2e6338) [#9602](npm/cli#9602) arborist: don't flag inert optional deps in strict-allow-scripts ([#9602](npm/cli#9602)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0` libnpmfund: 7.0.25 ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0` libnpmpack: 9.1.11 ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0` ##### [v11.17.0](https://github.com/npm/cli/releases/tag/v11.17.0) ##### Features - [`ae8ac4e`](npm/cli@ae8ac4e) [#9534](npm/cli#9534) add min-release-age-exclude config ([@JamieMagee](https://github.com/JamieMagee), [@caseyjhol](https://github.com/caseyjhol)) - [`8ff3e48`](npm/cli@8ff3e48) [#9483](npm/cli#9483) allowScripts tooling and inBundle hardening ([#9483](npm/cli#9483)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) ##### Bug Fixes - [`847cdf8`](npm/cli@847cdf8) [#9541](npm/cli#9541) match dotted and versioned args in approve-scripts/deny-scripts ([@owlstronaut](https://github.com/owlstronaut)) - [`d99f7cb`](npm/cli@d99f7cb) [#9535](npm/cli#9535) emit valid JSON from approve-scripts/deny-scripts --json ([@owlstronaut](https://github.com/owlstronaut)) - [`351a309`](npm/cli@351a309) [#9499](npm/cli#9499) pass script-shell to publish lifecycle hooks ([#9499](npm/cli#9499)) ([@github-actions](https://github.com/github-actions)\[bot]) - [`4fa81df`](npm/cli@4fa81df) [#9497](npm/cli#9497) recognize allowScripts for local link targets ([#9497](npm/cli#9497)) ([@github-actions](https://github.com/github-actions)\[bot], [@cyphercodes](https://github.com/cyphercodes), [@cyphercodes](https://github.com/cyphercodes)) - [`95cf2e9`](npm/cli@95cf2e9) [#9489](npm/cli#9489) validate registry path for allow-remote tarballs ([@Abhinav-143x](https://github.com/Abhinav-143x)) - [`9dd219b`](npm/cli@9dd219b) [#9462](npm/cli#9462) respect allowScripts policy in prune, dedupe, uninstall, audit, and link ([#9462](npm/cli#9462)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`cd8d18a`](npm/cli@cd8d18a) [#9482](npm/cli#9482) list pending scripts in approve-scripts when ignore-scripts is set ([#9482](npm/cli#9482)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`c14e87c`](npm/cli@c14e87c) [#9481](npm/cli#9481) suggest --allow-scripts for global installs in unreviewed-scripts warnings ([#9481](npm/cli#9481)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`7ade52e`](npm/cli@7ade52e) [#9465](npm/cli#9465) invalid issue template YAML indentation ([#9465](npm/cli#9465)) ([@github-actions](https://github.com/github-actions)\[bot], [@fallintoplace](https://github.com/fallintoplace)) - [`c069622`](npm/cli@c069622) [#9464](npm/cli#9464) show full parent command path in subcommand usage errors ([#9464](npm/cli#9464)) ([@owlstronaut](https://github.com/owlstronaut)) - [`1bb62bb`](npm/cli@1bb62bb) [#9454](npm/cli#9454) config: clarify --all help so it's accurate for approve-scripts and deny-scripts ([@JamieMagee](https://github.com/JamieMagee)) - [`84eeb5f`](npm/cli@84eeb5f) [#9431](npm/cli#9431) audit: don't apply min-release-age before filter when verifying installed signatures ([@JamieMagee](https://github.com/JamieMagee)) - [`3bd3377`](npm/cli@3bd3377) [#9426](npm/cli#9426) block forbidden keys in Queryable setter to prevent prototype pollution ([@12122J](https://github.com/12122J), [@claude](https://github.com/claude)) ##### Documentation - [`a86a7a9`](npm/cli@a86a7a9) [#9522](npm/cli#9522) approve-scripts only throws EGLOBAL when run with -g ([@JamieMagee](https://github.com/JamieMagee)) - [`693bb3d`](npm/cli@693bb3d) [#9508](npm/cli#9508) clarify package.json override value specs ([#9508](npm/cli#9508)) ([@github-actions](https://github.com/github-actions)\[bot], [@ded-furby](https://github.com/ded-furby)) - [`ccffe4a`](npm/cli@ccffe4a) [#9501](npm/cli#9501) use the latest version for global update and outdated's `wanted` ([#9501](npm/cli#9501)) ([@github-actions](https://github.com/github-actions)\[bot], [@liangmiQwQ](https://github.com/liangmiQwQ)) - [`66e97c2`](npm/cli@66e97c2) [#9478](npm/cli#9478) update minimum npm required for npm trust ([@meeech](https://github.com/meeech)) ##### Dependencies - [`bd09b87`](npm/cli@bd09b87) [#9542](npm/cli#9542) `postcss-selector-parser@7.1.4` - [`95bfc4c`](npm/cli@95bfc4c) [#9542](npm/cli#9542) `tinyglobby@0.2.17` - [`8c0d5fd`](npm/cli@8c0d5fd) [#9542](npm/cli#9542) `tar@7.5.16` - [`967d377`](npm/cli@967d377) [#9542](npm/cli#9542) `semver@7.8.4` - [`cdaac1b`](npm/cli@cdaac1b) [#9542](npm/cli#9542) `pacote@21.5.1` - [`25c8a9e`](npm/cli@25c8a9e) [#9542](npm/cli#9542) `node-gyp@12.4.0` ##### Chores - [`2922fa4`](npm/cli@2922fa4) [#9542](npm/cli#9542) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.8.0): `@npmcli/arborist@9.8.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.11.0): `@npmcli/config@10.11.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.10): `libnpmdiff@8.1.10` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.0): `libnpmexec@10.3.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.24): `libnpmfund@7.0.24` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.10): `libnpmpack@9.1.10` ##### [v11.16.0](https://github.com/npm/cli/releases/tag/v11.16.0) ##### Features - [`4b67f6e`](npm/cli@4b67f6e) [#9416](npm/cli#9416) publish --access=private alias for restricted ([#9416](npm/cli#9416)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [`a10c7ca`](npm/cli@a10c7ca) [#9415](npm/cli#9415) Phase 1 of `allowScripts` opt-in install-script policy ([#9360](npm/cli#9360)) ([#9415](npm/cli#9415)) ([@owlstronaut](https://github.com/owlstronaut), [@JamieMagee](https://github.com/JamieMagee)) ##### Bug Fixes - [`1f7869b`](npm/cli@1f7869b) [#9411](npm/cli#9411) fix typo of fullMetadata ([@owlstronaut](https://github.com/owlstronaut)) - [`cde03ba`](npm/cli@cde03ba) [#9390](npm/cli#9390) config: pause progress spinner during interactive editor spawn ([#9388](npm/cli#9388)) ([@github-actions](https://github.com/github-actions)\[bot], [@Zelys-DFKH](https://github.com/Zelys-DFKH), [@claude](https://github.com/claude)) ##### Documentation - [`c5e9d73`](npm/cli@c5e9d73) [#9390](npm/cli#9390) Document `npm_old_version` and `npm_new_version` environment variables ([#9389](npm/cli#9389)) ([@github-actions](https://github.com/github-actions)\[bot], [@36degrees](https://github.com/36degrees)) ##### Dependencies - [`cdd7bbc`](npm/cli@cdd7bbc) [#9421](npm/cli#9421) `undici@6.26.0` - [`fde87c9`](npm/cli@fde87c9) [#9421](npm/cli#9421) `sigstore@4.1.1` - [`2779793`](npm/cli@2779793) [#9421](npm/cli#9421) `lru-cache@11.5.1` - [`dea702d`](npm/cli@dea702d) [#9421](npm/cli#9421) `@sigstore/verify@3.1.1` - [`4eab03f`](npm/cli@4eab03f) [#9421](npm/cli#9421) `@sigstore/core@3.2.1` - [`74c7323`](npm/cli@74c7323) [#9421](npm/cli#9421) `@npmcli/agent@4.0.2` - [`edc4ab3`](npm/cli@edc4ab3) [#9421](npm/cli#9421) `semver@7.8.1` - [`5f6ce33`](npm/cli@5f6ce33) [#9421](npm/cli#9421) `make-fetch-happen@15.0.6` ##### Chores - [`bd04976`](npm/cli@bd04976) [#9421](npm/cli#9421) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [`aeceb23`](npm/cli@aeceb23) [#9407](npm/cli#9407) sanitize newlines in flags table default and type values ([#9407](npm/cli#9407)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/arborist@9.7.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.10.0): `@npmcli/config@10.10.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.9): `libnpmdiff@8.1.9` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.9): `libnpmexec@10.2.9` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.23): `libnpmfund@7.0.23` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.9): `libnpmpack@9.1.9` - [workspace](https://github.com/npm/cli/releases/tag/libnpmversion-v8.0.4): `libnpmversion@8.0.4` ##### [v11.15.0](https://github.com/npm/cli/releases/tag/v11.15.0) ##### Features - [`0d5d899`](npm/cli@0d5d899) [#9379](npm/cli#9379) npm stage ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [`1433740`](npm/cli@1433740) [#9376](npm/cli#9376) add permissions support to trust commands ([#9376](npm/cli#9376)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [`8df10f5`](npm/cli@8df10f5) [#9339](npm/cli#9339) add allow-git/allow-file/allow-directory/allow-remote configs ([@owlstronaut](https://github.com/owlstronaut)) ##### Bug Fixes - [`39b625e`](npm/cli@39b625e) [#9381](npm/cli#9381) key stage download --json output by package name ([#9381](npm/cli#9381)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [`6aa332d`](npm/cli@6aa332d) [#9339](npm/cli#9339) allow min-release-age in npmrc to coexist with --before ([@raazkhnl](https://github.com/raazkhnl)) - [`468550f`](npm/cli@468550f) [#9339](npm/cli#9339) refactor #failureNode, adjust tests and safety ([@owlstronaut](https://github.com/owlstronaut)) - [`cabe249`](npm/cli@cabe249) [#9339](npm/cli#9339) allow-remote=none does not block registry tarballs ([@owlstronaut](https://github.com/owlstronaut)) ##### Dependencies - [`8416a60`](npm/cli@8416a60) [#9383](npm/cli#9383) `socks@2.8.9` - [`5e5a25b`](npm/cli@5e5a25b) [#9383](npm/cli#9383) `lru-cache@11.5.0` - [`a6f9ad2`](npm/cli@a6f9ad2) [#9383](npm/cli#9383) `ip-address@10.2.0` - [`63f8114`](npm/cli@63f8114) [#9383](npm/cli#9383) `brace-expansion@5.0.6` - [`6918b4c`](npm/cli@6918b4c) [#9383](npm/cli#9383) `bin-links@6.0.2` - [`bf84079`](npm/cli@bf84079) [#9383](npm/cli#9383) `tar@7.5.15` - [`bdef82c`](npm/cli@bdef82c) [#9383](npm/cli#9383) `semver@7.8.0` - [`3f38a67`](npm/cli@3f38a67) [#9383](npm/cli#9383) `hosted-git-info@9.0.3` ##### Chores - [`816f3bf`](npm/cli@816f3bf) [#9383](npm/cli#9383) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.1): `@npmcli/config@10.9.1` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.8): `libnpmdiff@8.1.8` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.8): `libnpmexec@10.2.8` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.22): `libnpmfund@7.0.22` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.8): `libnpmpack@9.1.8` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v11.2.0): `libnpmpublish@11.2.0` ##### [v11.14.1](https://github.com/npm/cli/releases/tag/v11.14.1) ##### Bug Fixes - [`dca12cb`](npm/cli@dca12cb) [#9328](npm/cli#9328) remove settings ([#9328](npm/cli#9328)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut)) ##### [v11.14.0](https://github.com/npm/cli/releases/tag/v11.14.0) ##### Features - [`45fc5e0`](npm/cli@45fc5e0) [#9288](npm/cli#9288) add allow-directory, allow-file, and allow-remote ([#9288](npm/cli#9288)) ([@github-actions](https://github.com/github-actions)\[bot], [@wraithgar](https://github.com/wraithgar)) ##### Bug Fixes - [`6c17544`](npm/cli@6c17544) [#9318](npm/cli#9318) sbom: dedupe per-node dependsOn / relationships ([#9318](npm/cli#9318)) ([@github-actions](https://github.com/github-actions)\[bot], [@mikaelkristiansson](https://github.com/mikaelkristiansson)) ##### Dependencies - [`840fe18`](npm/cli@840fe18) [#9322](npm/cli#9322) `socks@10.1.1` - [`b771289`](npm/cli@b771289) [#9322](npm/cli#9322) `ip-address@10.1.1` - [`addffcb`](npm/cli@addffcb) [#9322](npm/cli#9322) `cidr-regex@5.0.5` ##### Chores - [`041fd58`](npm/cli@041fd58) [#9322](npm/cli#9322) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [`89c505a`](npm/cli@89c505a) [#9320](npm/cli#9320) add cli-triage team as codeowner ([#9320](npm/cli#9320)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.0): `@npmcli/config@10.9.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.7): `libnpmdiff@8.1.7` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.7): `libnpmexec@10.2.7` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.21): `libnpmfund@7.0.21` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.7): `libnpmpack@9.1.7` ##### [v11.13.0](https://github.com/npm/cli/releases/tag/v11.13.0) ##### Features - [`8e8dadb`](npm/cli@8e8dadb) [#9246](npm/cli#9246) add `u` as alias for `update` command ([#9246](npm/cli#9246)) ([@github-actions](https://github.com/github-actions)\[bot], [@Ausoj](https://github.com/Ausoj)) ##### Bug Fixes - [`ecd161b`](npm/cli@ecd161b) [#9258](npm/cli#9258) ignore intended error code ([@owlstronaut](https://github.com/owlstronaut)) ##### Dependencies - [`8d2fdcd`](npm/cli@8d2fdcd) [#9272](npm/cli#9272) `lru-cache@11.3.5` - [`e603d36`](npm/cli@e603d36) [#9272](npm/cli#9272) `node-gyp@12.3.0` - [`d48b7da`](npm/cli@d48b7da) [#9272](npm/cli#9272) `is-cidr@6.0.4` - [`032a5ca`](npm/cli@032a5ca) [#9240](npm/cli#9240) `@sigstore/protobuf-specs@0.5.1` - [`33a81e7`](npm/cli@33a81e7) [#9240](npm/cli#9240) `tinyglobby@0.2.16` - [`68dc4a0`](npm/cli@68dc4a0) [#9240](npm/cli#9240) `picomatch@4.0.4` - [`1bb6703`](npm/cli@1bb6703) [#9240](npm/cli#9240) `lru-cache@11.3.3` - [`37059e4`](npm/cli@37059e4) [#9240](npm/cli#9240) `diff@8.0.4` - [`fb450ab`](npm/cli@fb450ab) [#9240](npm/cli#9240) `minimatch@10.2.5` - [`7c4bbbf`](npm/cli@7c4bbbf) [#9240](npm/cli#9240) `tar@7.5.13` - [`703a3bc`](npm/cli@703a3bc) [#9240](npm/cli#9240) `minipass-flush@1.0.6` ##### Chores - [`e0724ac`](npm/cli@e0724ac) [#9272](npm/cli#9272) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [`d249341`](npm/cli@d249341) [#9230](https://github.com/npm/cli/pull/9230) don't run npm update in CI ([@owlstronaut](https://github.com/owlstronaut)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.4.3): `@npmcli/arborist@9.4.3` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.6): `libnpmdiff@8.1.6` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.6): `libnpmexec@10.2.6` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.20): `libnpmfund@7.0.20` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.6): `libnpmpack@9.1.6`
renovate Bot
added a commit
to gwennlbh/swarpc
that referenced
this pull request
Oct 22, 2026
##### [v11.21.1](https://github.com/npm/cli/releases/tag/v11.21.1) ##### Bug Fixes - [`1c7b661`](https://github.com/npm/cli/commit/1c7b6618d003eaa272aca7ac7f306ab252564697) [#10059](https://github.com/npm/cli/pull/10059) write registry allowScripts keys under install-strategy=linked ([#10059](https://github.com/npm/cli/issues/10059)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) ##### Dependencies - [`8cec7c9`](https://github.com/npm/cli/commit/8cec7c97a16639d3a816b9741ff376c58a16b4f1) [#10089](https://github.com/npm/cli/pull/10089) `http-cache-semantics@4.3.0` ([@reggi](https://github.com/reggi)) - [`fd105c7`](https://github.com/npm/cli/commit/fd105c783dbd92b62a8c15febe028353cf64321c) [#10089](https://github.com/npm/cli/pull/10089) `undici@6.29.0` ([@reggi](https://github.com/reggi)) - [`fc2a0dd`](https://github.com/npm/cli/commit/fc2a0dd3477213871b6245b6be7e9d16bd6da3f1) [#10089](https://github.com/npm/cli/pull/10089) `postcss-selector-parser@7.1.6` ([@reggi](https://github.com/reggi)) - [`bae8cd7`](https://github.com/npm/cli/commit/bae8cd7719f855d7dd4ec70e14f13ea4af8677c1) [#10089](https://github.com/npm/cli/pull/10089) `ip-address@10.7.2` ([@reggi](https://github.com/reggi)) - [`4a9d14d`](https://github.com/npm/cli/commit/4a9d14d386895f699dafb2e01d874f4196ab0083) [#10089](https://github.com/npm/cli/pull/10089) `brace-expansion@5.0.12` ([@reggi](https://github.com/reggi)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.3): `@npmcli/arborist@9.9.3` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.14): `libnpmdiff@8.1.14` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.4): `libnpmexec@10.3.4` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.28): `libnpmfund@7.0.28` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.15): `libnpmpack@9.1.15` ##### [v11.21.0](https://github.com/npm/cli/releases/tag/v11.21.0) ##### Features - [`1f38f64`](https://github.com/npm/cli/commit/1f38f649d79dec546a240af9ee707b4f32597ba2) [#10056](https://github.com/npm/cli/pull/10056) dist-tag: support OIDC authentication ([#10056](https://github.com/npm/cli/issues/10056)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) ##### Documentation - [`0a8b905`](https://github.com/npm/cli/commit/0a8b905f9320068083508cc59ff214f6bf8d948f) [#10050](https://github.com/npm/cli/pull/10050) update npm stage docs to reflect that it can create new packages ([#10050](https://github.com/npm/cli/issues/10050)) ([@github-actions](https://github.com/github-actions)\[bot], [@shmam](https://github.com/shmam), [@Copilot](https://github.com/Copilot)) ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/config-v10.14.0): `@npmcli/config@10.14.0` ##### [v11.20.0](https://github.com/npm/cli/releases/tag/v11.20.0) ##### Features - [`0b3c699`](https://github.com/npm/cli/commit/0b3c699b120b262931542b685424eab971917a48) [#9994](https://github.com/npm/cli/pull/9994) token: support read-write-stage-only granular access tokens ([#9994](https://github.com/npm/cli/issues/9994)) ([@github-actions](https://github.com/github-actions)\[bot], [@Tayvon](https://github.com/Tayvon), [@Copilot](https://github.com/Copilot)) - [`b872816`](https://github.com/npm/cli/commit/b872816e657fef0cc4235626916724b1a9bcb40a) [#9920](https://github.com/npm/cli/pull/9920) stage: display staged package status ([#9920](https://github.com/npm/cli/issues/9920)) ([@github-actions](https://github.com/github-actions)\[bot], [@joelverhagen](https://github.com/joelverhagen)) ##### Bug Fixes - [`ddbadfc`](https://github.com/npm/cli/commit/ddbadfcf02f156fe98d5c3ccc8cdc28c61ab1de4) [#9947](https://github.com/npm/cli/pull/9947) provenance-file takes precedence over OIDC auto-generated provenance ([#9947](https://github.com/npm/cli/issues/9947)) ([@github-actions](https://github.com/github-actions)\[bot], [@yunseo-kim](https://github.com/yunseo-kim)) - [`64d4b4b`](https://github.com/npm/cli/commit/64d4b4be3f2bc49bddaa085467f1bc18912c0182) [#9937](https://github.com/npm/cli/pull/9937) config: avoid exporting persistent allow-scripts ([#9937](https://github.com/npm/cli/issues/9937)) ([@github-actions](https://github.com/github-actions)\[bot], [@Fnine59](https://github.com/Fnine59)) - [`70317da`](https://github.com/npm/cli/commit/70317da6328fb19e662f13427be09d9c5e2d344f) [#9930](https://github.com/npm/cli/pull/9930) arborist: reject uninstall args that carry a version ([#9930](https://github.com/npm/cli/issues/9930)) ([@github-actions](https://github.com/github-actions)\[bot], [@lazerg](https://github.com/lazerg)) - [`55ae484`](https://github.com/npm/cli/commit/55ae4844e2cee4c293939ecdb6010dc6d779e009) [#9929](https://github.com/npm/cli/pull/9929) arborist: match allowScripts keys for local paths ([#9929](https://github.com/npm/cli/issues/9929)) ([@github-actions](https://github.com/github-actions)\[bot], [@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) - [`7f1f2b7`](https://github.com/npm/cli/commit/7f1f2b77f5aa9f3dfe3f649cf2df0b02f6423c13) [#9928](https://github.com/npm/cli/pull/9928) keep dry-run output valid json ([#9928](https://github.com/npm/cli/issues/9928)) ([@github-actions](https://github.com/github-actions)\[bot], [@martinrrm](https://github.com/martinrrm)) - [`f28cca9`](https://github.com/npm/cli/commit/f28cca95d46668837d2cf9df2754b2a550c57dfb) [#9927](https://github.com/npm/cli/pull/9927) don't print the funding message for global installs ([#9927](https://github.com/npm/cli/issues/9927)) ([@github-actions](https://github.com/github-actions)\[bot], [@lazerg](https://github.com/lazerg)) ##### Chores - [`6ff3000`](https://github.com/npm/cli/commit/6ff3000a8fc791685c7008b070420ed95b435b53) [#10010](https://github.com/npm/cli/pull/10010) pack: select workspace through config ([#10010](https://github.com/npm/cli/issues/10010)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi)) - [`afdc5bd`](https://github.com/npm/cli/commit/afdc5bd5884b8ee97f5245f680e5a7cfc1b0e579) [#9932](https://github.com/npm/cli/pull/9932) pass nodedir to node-gyp via npm_package_config env in node integration ([#9932](https://github.com/npm/cli/issues/9932)) ([@reggi](https://github.com/reggi)) - [`83f95ff`](https://github.com/npm/cli/commit/83f95ff69e69500c854c371dc7065a413caec907) [#9931](https://github.com/npm/cli/pull/9931) update `node-integration` workflow template to latest actions ([#9931](https://github.com/npm/cli/issues/9931)) ([@reggi](https://github.com/reggi)) - [`f020fba`](https://github.com/npm/cli/commit/f020fba35b368ffc20352cd8d5e73058f4267c84) [#9925](https://github.com/npm/cli/pull/9925) recognize prefixed Node.js PR titles ([#9925](https://github.com/npm/cli/issues/9925)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi)) ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.2): `@npmcli/arborist@9.9.2` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.13.0): `@npmcli/config@10.13.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.13): `libnpmdiff@8.1.13` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.3): `libnpmexec@10.3.3` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.27): `libnpmfund@7.0.27` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.14): `libnpmpack@9.1.14` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v11.2.1): `libnpmpublish@11.2.1` ##### [v11.19.1](https://github.com/npm/cli/releases/tag/v11.19.1) ##### Bug Fixes - [`83b750d`](https://github.com/npm/cli/commit/83b750dbbc0b32f498da760396542f83d4069100) [#9916](https://github.com/npm/cli/pull/9916) exempt explicit pack targets from allow-directory ([#9916](https://github.com/npm/cli/issues/9916)) ([@github-actions](https://github.com/github-actions)\[bot], [@ychampion](https://github.com/ychampion), [@ychampion](https://github.com/ychampion)) ##### Dependencies - [`4791b27`](https://github.com/npm/cli/commit/4791b27f15c81d474a68daabb10b3ba6d20a0e71) [#9872](https://github.com/npm/cli/pull/9872) `undici@6.28.0` ([@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) - [`823d647`](https://github.com/npm/cli/commit/823d647e0d4b28b0a491db12b3b75b78103dc407) [#9872](https://github.com/npm/cli/pull/9872) `ip-address@10.5.0` ([@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) - [`04f8efe`](https://github.com/npm/cli/commit/04f8efea927c7fea72652d81b3ebe1745fba74af) [#9872](https://github.com/npm/cli/pull/9872) `brace-expansion@5.0.9` ([@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) - [`1610280`](https://github.com/npm/cli/commit/161028035ceb491138fe2727ab918f0275ba42c5) [#9842](https://github.com/npm/cli/pull/9842) `tar@7.5.22` ([#9842](https://github.com/npm/cli/issues/9842)) ([@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.13): `libnpmpack@9.1.13` ##### [v11.19.0](https://github.com/npm/cli/releases/tag/v11.19.0) ##### Features - [`7d39aa6`](https://github.com/npm/cli/commit/7d39aa6956117ed2af95e8ecba3533f66c4bc050) [#9698](https://github.com/npm/cli/pull/9698) install-scripts: use install-scripts as the warning log title ([@manzoorwanijk](https://github.com/manzoorwanijk)) ##### Bug Fixes - [`3529ca2`](https://github.com/npm/cli/commit/3529ca24ff9ab96c912740a6be0bfaa608dc4d1d) [#9811](https://github.com/npm/cli/pull/9811) pack: honor min-release-age-exclude ([#9811](https://github.com/npm/cli/issues/9811)) ([@github-actions](https://github.com/github-actions)\[bot], [@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) - [`67f12ae`](https://github.com/npm/cli/commit/67f12aee5de037dcf51f9e59c18cab2333a38252) [#9810](https://github.com/npm/cli/pull/9810) owner: use scoped registry for user lookup ([#9810](https://github.com/npm/cli/issues/9810)) ([@github-actions](https://github.com/github-actions)\[bot], [@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.1): `@npmcli/arborist@9.9.1` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.12): `libnpmdiff@8.1.12` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.2): `libnpmexec@10.3.2` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.26): `libnpmfund@7.0.26` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.12): `libnpmpack@9.1.12` ##### [v11.18.0](https://github.com/npm/cli/releases/tag/v11.18.0) ##### Features - [`3021ad6`](https://github.com/npm/cli/commit/3021ad60d9a381ac8c64617843de661b2a0d4620) [#9694](https://github.com/npm/cli/pull/9694) arborist: extend replace-registry-host with URL prefix matching ([#6110](https://github.com/npm/cli/issues/6110)) ([#9694](https://github.com/npm/cli/issues/9694)) ([@github-actions](https://github.com/github-actions)\[bot], [@u2mejc](https://github.com/u2mejc)) - [`abd8c6b`](https://github.com/npm/cli/commit/abd8c6b0ce01f2c2c964b1b14e53b37db90be2f5) [#9677](https://github.com/npm/cli/pull/9677) graduate the linked install strategy from experimental to stable ([#9677](https://github.com/npm/cli/issues/9677)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`9420673`](https://github.com/npm/cli/commit/9420673bcdc59c4acb35c406308bb641c2aef635) [#9662](https://github.com/npm/cli/pull/9662) install-scripts: prune unused allowScripts entries ([#9662](https://github.com/npm/cli/issues/9662)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`fc9d4c7`](https://github.com/npm/cli/commit/fc9d4c72d8ee300a843e8186c5fc39e9c3e874ae) [#9635](https://github.com/npm/cli/pull/9635) namespace install-script approval commands under npm install-scripts ([#9635](https://github.com/npm/cli/issues/9635)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`073253f`](https://github.com/npm/cli/commit/073253f8642d1177000b8d18ebe0abcad2ac9b1a) [#9564](https://github.com/npm/cli/pull/9564) warn when min-release-age blocks an audit fix ([#9564](https://github.com/npm/cli/issues/9564)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) ##### Bug Fixes - [`598ffdb`](https://github.com/npm/cli/commit/598ffdba4495e9b6ad11a830bb874baa49fd8a25) [#9693](https://github.com/npm/cli/pull/9693) sbom: percent-encode vcs_url qualifier in generated purls ([#9693](https://github.com/npm/cli/issues/9693)) ([@github-actions](https://github.com/github-actions)\[bot], [@ubeddulla](https://github.com/ubeddulla)) - [`05793d0`](https://github.com/npm/cli/commit/05793d05230e99421d3611c919ba5ab4c4f49a8a) [#9691](https://github.com/npm/cli/pull/9691) output all the required parameters for npm token list ([#9691](https://github.com/npm/cli/issues/9691)) ([@github-actions](https://github.com/github-actions)\[bot], [@rijildaniel](https://github.com/rijildaniel)) - [`cd57139`](https://github.com/npm/cli/commit/cd5713990b2436950158120a7306f6e7de84e21c) [#9669](https://github.com/npm/cli/pull/9669) arborist: surface undeclared workspaces under the linked strategy (backport release/v11) ([#9669](https://github.com/npm/cli/issues/9669)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`5b6ff9c`](https://github.com/npm/cli/commit/5b6ff9c23e5fbfdfea3bf4c53e3e8094179197c5) [#9667](https://github.com/npm/cli/pull/9667) reify: report added count for fresh linked installs ([#9667](https://github.com/npm/cli/issues/9667)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk), [@owlstronaut](https://github.com/owlstronaut)) - [`8f13beb`](https://github.com/npm/cli/commit/8f13beb2cae8582b50ab44ef43154c4c6aaf8a27) [#9664](https://github.com/npm/cli/pull/9664) query: report logical dep location under linked strategy ([#9664](https://github.com/npm/cli/issues/9664)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`168ba30`](https://github.com/npm/cli/commit/168ba30915a844075d9217de46030a8f6ce09903) [#9663](https://github.com/npm/cli/pull/9663) allowScripts: close enforcement gaps ([#9652](https://github.com/npm/cli/issues/9652)) (backport release/v11) ([#9663](https://github.com/npm/cli/issues/9663)) ([@JamieMagee](https://github.com/JamieMagee)) - [`ae64f88`](https://github.com/npm/cli/commit/ae64f883f8345f53cb20f968fafffbb2e6d0c9f6) [#9648](https://github.com/npm/cli/pull/9648) exec: resolve workspace-local bin under the linked install strategy ([#9648](https://github.com/npm/cli/issues/9648)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`784cbe9`](https://github.com/npm/cli/commit/784cbe99c3e35b128ee0a5e6ff569517305a5c33) [#9636](https://github.com/npm/cli/pull/9636) ls: restore 100% coverage on release/v11 after [#9633](https://github.com/npm/cli/issues/9633) ([#9636](https://github.com/npm/cli/issues/9636)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`70f0ea5`](https://github.com/npm/cli/commit/70f0ea5a0642919f8d2bee9c3c61490e12846b4e) [#9607](https://github.com/npm/cli/pull/9607) approve-scripts: approve deps with no resolved URL by name ([#9607](https://github.com/npm/cli/issues/9607)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`b2e6338`](https://github.com/npm/cli/commit/b2e63385c991cfc1430e8e5c347f33a7fd47e0e9) [#9602](https://github.com/npm/cli/pull/9602) arborist: don't flag inert optional deps in strict-allow-scripts ([#9602](https://github.com/npm/cli/issues/9602)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`6ad5715`](https://github.com/npm/cli/commit/6ad5715c6500b388c64f76826a5038db990aea3a) [#9595](https://github.com/npm/cli/pull/9595) link: scope `npm link --workspace` to the workspace, not the root ([#9595](https://github.com/npm/cli/issues/9595)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) ##### Documentation - [`3658bb5`](https://github.com/npm/cli/commit/3658bb5354f6c72fd9b1c778bba6e933ba7ec4cc) [#9690](https://github.com/npm/cli/pull/9690) recommend install-strategy=linked to catch phantom dependencies ([#9690](https://github.com/npm/cli/issues/9690)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) ##### Dependencies - [`54656b6`](https://github.com/npm/cli/commit/54656b60361318204a72aca9409c2dd4ce4a2c20) [#9696](https://github.com/npm/cli/pull/9696) `undici@6.27.0` - [`31c4773`](https://github.com/npm/cli/commit/31c4773502b8a3bca5d853270d53d46fe9749ce1) [#9696](https://github.com/npm/cli/pull/9696) `brace-expansion@5.0.7` - [`e773c77`](https://github.com/npm/cli/commit/e773c7792c7611d48a44ef4bb532f627d4e94f7c) [#9696](https://github.com/npm/cli/pull/9696) `tar@7.5.19` - [`f05f6af`](https://github.com/npm/cli/commit/f05f6afbafaaf46e38ac4cc0d4e8ea76c7d7c330) [#9696](https://github.com/npm/cli/pull/9696) `semver@7.8.5` - [`804f9ba`](https://github.com/npm/cli/commit/804f9badd99c5c530db0a6c288b18104512d10c3) [#9580](https://github.com/npm/cli/pull/9580) `npm-profile@12.0.2` ##### Chores - [`f79b37f`](https://github.com/npm/cli/commit/f79b37f01b9c624d9dd3806f2f04b3f5e3434e31) [#9696](https://github.com/npm/cli/pull/9696) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [`a04cd84`](https://github.com/npm/cli/commit/a04cd845e9784ac8a03c1db721dc7a366eadb4f1) [#9584](https://github.com/npm/cli/pull/9584) add web-login proxy doneUrl regression for npm-profile fix ([#9584](https://github.com/npm/cli/issues/9584)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.12.0): `@npmcli/config@10.12.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.11): `libnpmdiff@8.1.11` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.1): `libnpmexec@10.3.1` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.25): `libnpmfund@7.0.25` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.11): `libnpmpack@9.1.11` arborist: 9.9.0 #### [9.9.0](https://github.com/npm/cli/compare/arborist-v9.8.0...arborist-v9.9.0) (2026-06-29) ##### Features - [`3021ad6`](https://github.com/npm/cli/commit/3021ad60d9a381ac8c64617843de661b2a0d4620) [#9694](https://github.com/npm/cli/pull/9694) arborist: extend replace-registry-host with URL prefix matching ([#6110](https://github.com/npm/cli/issues/6110)) ([#9694](https://github.com/npm/cli/issues/9694)) ([@github-actions](https://github.com/github-actions)\[bot], [@u2mejc](https://github.com/u2mejc)) - [`abd8c6b`](https://github.com/npm/cli/commit/abd8c6b0ce01f2c2c964b1b14e53b37db90be2f5) [#9677](https://github.com/npm/cli/pull/9677) graduate the linked install strategy from experimental to stable ([#9677](https://github.com/npm/cli/issues/9677)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`9420673`](https://github.com/npm/cli/commit/9420673bcdc59c4acb35c406308bb641c2aef635) [#9662](https://github.com/npm/cli/pull/9662) install-scripts: prune unused allowScripts entries ([#9662](https://github.com/npm/cli/issues/9662)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`073253f`](https://github.com/npm/cli/commit/073253f8642d1177000b8d18ebe0abcad2ac9b1a) [#9564](https://github.com/npm/cli/pull/9564) warn when min-release-age blocks an audit fix ([#9564](https://github.com/npm/cli/issues/9564)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) ##### Bug Fixes - [`774875b`](https://github.com/npm/cli/commit/774875ba675a4b98e39dd0795e6ab2eb6a0ab8b6) [#9686](https://github.com/npm/cli/pull/9686) arborist: keep bin links for allowScripts-denied packages ([#9686](https://github.com/npm/cli/issues/9686)) ([@JamieMagee](https://github.com/JamieMagee)) - [`719de1e`](https://github.com/npm/cli/commit/719de1e4677086015f66167f15d0b612438de247) [#9673](https://github.com/npm/cli/pull/9673) arborist: apply overrides across a file: link (backport release/v11) ([#9673](https://github.com/npm/cli/issues/9673)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`cd57139`](https://github.com/npm/cli/commit/cd5713990b2436950158120a7306f6e7de84e21c) [#9669](https://github.com/npm/cli/pull/9669) arborist: surface undeclared workspaces under the linked strategy (backport release/v11) ([#9669](https://github.com/npm/cli/issues/9669)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`ede32d3`](https://github.com/npm/cli/commit/ede32d32be5661c45652614603b634d4e7f8fe4c) [#9668](https://github.com/npm/cli/pull/9668) arborist: forward transitive overrides through linked store links ([#9658](https://github.com/npm/cli/issues/9658)) (backport release/v11) ([#9668](https://github.com/npm/cli/issues/9668)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`f503b07`](https://github.com/npm/cli/commit/f503b07d7a2a97660a49c9f2b190d0725450c341) [#9666](https://github.com/npm/cli/pull/9666) correct dev/prod dep flags for workspaces under the linked strategy ([#9666](https://github.com/npm/cli/issues/9666)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`f580889`](https://github.com/npm/cli/commit/f580889b488b44fb7c612ae5146bc9a584e0a640) [#9665](https://github.com/npm/cli/pull/9665) arborist: load transitive optional deps into linked actual tree ([#9665](https://github.com/npm/cli/issues/9665)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`8f13beb`](https://github.com/npm/cli/commit/8f13beb2cae8582b50ab44ef43154c4c6aaf8a27) [#9664](https://github.com/npm/cli/pull/9664) query: report logical dep location under linked strategy ([#9664](https://github.com/npm/cli/issues/9664)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`168ba30`](https://github.com/npm/cli/commit/168ba30915a844075d9217de46030a8f6ce09903) [#9663](https://github.com/npm/cli/pull/9663) allowScripts: close enforcement gaps ([#9652](https://github.com/npm/cli/issues/9652)) (backport release/v11) ([#9663](https://github.com/npm/cli/issues/9663)) ([@JamieMagee](https://github.com/JamieMagee)) - [`4c9eacb`](https://github.com/npm/cli/commit/4c9eacb8e3ebf4485cba5734f1aa16060e271cda) [#9649](https://github.com/npm/cli/pull/9649) arborist: clean up stale .store and hoisted dirs on strategy switch ([#9649](https://github.com/npm/cli/issues/9649)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`d2c680e`](https://github.com/npm/cli/commit/d2c680ea687b535b1fa47dd8512b5d3445d1f56f) [#9645](https://github.com/npm/cli/pull/9645) arborist: invalid filterNode crash under the linked strategy ([#9645](https://github.com/npm/cli/issues/9645)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`4e40b1c`](https://github.com/npm/cli/commit/4e40b1c03cfc3a17c04e81717d420631255d21b9) [#9644](https://github.com/npm/cli/pull/9644) arborist: repair wrong-but-existing symlink target in linked strategy ([#9644](https://github.com/npm/cli/issues/9644)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`9d1774e`](https://github.com/npm/cli/commit/9d1774e6fca23ca16a2817068416c92140c1a48d) [#9643](https://github.com/npm/cli/pull/9643) arborist: remove stale .bin shims after uninstall under linked ([#9643](https://github.com/npm/cli/issues/9643)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`ed37d24`](https://github.com/npm/cli/commit/ed37d24c11622c147b69602ba154286acd662d7a) [#9642](https://github.com/npm/cli/pull/9642) arborist: record the linked .store layout in the hidden lockfile (backport [#9630](https://github.com/npm/cli/issues/9630)) ([#9642](https://github.com/npm/cli/issues/9642)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`e601d4a`](https://github.com/npm/cli/commit/e601d4ad7a8e45e6e2b2f5dcb2bfc264965fbd1b) [#9641](https://github.com/npm/cli/pull/9641) arborist: validate peerOptional conflicts in no-save mutations ([#9641](https://github.com/npm/cli/issues/9641)) ([@owlstronaut](https://github.com/owlstronaut), [@dale-lakes](https://github.com/dale-lakes), [@dale-lakes](https://github.com/dale-lakes)) - [`03cee43`](https://github.com/npm/cli/commit/03cee437c2c2d6d32ed3a8c28753d02dfbe7f9f0) [#9638](https://github.com/npm/cli/pull/9638) arborist: fix audit-report determinism due to dropped via links ([#9638](https://github.com/npm/cli/issues/9638)) ([@github-actions](https://github.com/github-actions)\[bot], [@arjun-vegeta](https://github.com/arjun-vegeta)) - [`a30d855`](https://github.com/npm/cli/commit/a30d8559ca4aa26704c2d962c9c4dbcc0366ef67) [#9633](https://github.com/npm/cli/pull/9633) arborist: don't load store packages' devDependencies as required edges ([#9633](https://github.com/npm/cli/issues/9633)) ([@manzoorwanijk](https://github.com/manzoorwanijk)) - [`887ca97`](https://github.com/npm/cli/commit/887ca9720915de0eeb4f1a24eff6b923b8d39c92) [#9631](https://github.com/npm/cli/pull/9631) arborist: audit the non-isolated tree under the linked strategy ([#9631](https://github.com/npm/cli/issues/9631)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`b2e6338`](https://github.com/npm/cli/commit/b2e63385c991cfc1430e8e5c347f33a7fd47e0e9) [#9602](https://github.com/npm/cli/pull/9602) arborist: don't flag inert optional deps in strict-allow-scripts ([#9602](https://github.com/npm/cli/issues/9602)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`390ebfa`](https://github.com/npm/cli/commit/390ebfa6b89f51259aa2ae1c19b9e13a520b1fb5) [#9593](https://github.com/npm/cli/pull/9593) arborist: symlink workspace file: deps on non-workspace local packages ([#9593](https://github.com/npm/cli/issues/9593)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`aaeb2f1`](https://github.com/npm/cli/commit/aaeb2f19548c47e7bc262e4aa9c76b93376fac82) [#9578](https://github.com/npm/cli/pull/9578) arborist: expose store node_modules via NODE_PATH for linked-strategy install scripts ([#9578](https://github.com/npm/cli/issues/9578)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`05b6f0f`](https://github.com/npm/cli/commit/05b6f0f5bb356891678eb7d3840b6899f04fbfaf) [#9577](https://github.com/npm/cli/pull/9577) arborist: allow-remote exemption for proxy/mirror-fronted registry tarballs ([#9577](https://github.com/npm/cli/issues/9577)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) config: 10.12.0 #### [10.12.0](https://github.com/npm/cli/compare/config-v10.11.0...config-v10.12.0) (2026-06-29) ##### Features - [`3021ad6`](https://github.com/npm/cli/commit/3021ad60d9a381ac8c64617843de661b2a0d4620) [#9694](https://github.com/npm/cli/pull/9694) arborist: extend replace-registry-host with URL prefix matching ([#6110](https://github.com/npm/cli/issues/6110)) ([#9694](https://github.com/npm/cli/issues/9694)) ([@github-actions](https://github.com/github-actions)\[bot], [@u2mejc](https://github.com/u2mejc)) - [`abd8c6b`](https://github.com/npm/cli/commit/abd8c6b0ce01f2c2c964b1b14e53b37db90be2f5) [#9677](https://github.com/npm/cli/pull/9677) graduate the linked install strategy from experimental to stable ([#9677](https://github.com/npm/cli/issues/9677)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) - [`073253f`](https://github.com/npm/cli/commit/073253f8642d1177000b8d18ebe0abcad2ac9b1a) [#9564](https://github.com/npm/cli/pull/9564) warn when min-release-age blocks an audit fix ([#9564](https://github.com/npm/cli/issues/9564)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) ##### Bug Fixes - [`b2e6338`](https://github.com/npm/cli/commit/b2e63385c991cfc1430e8e5c347f33a7fd47e0e9) [#9602](https://github.com/npm/cli/pull/9602) arborist: don't flag inert optional deps in strict-allow-scripts ([#9602](https://github.com/npm/cli/issues/9602)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) ##### Documentation - [`3658bb5`](https://github.com/npm/cli/commit/3658bb5354f6c72fd9b1c778bba6e933ba7ec4cc) [#9690](https://github.com/npm/cli/pull/9690) recommend install-strategy=linked to catch phantom dependencies ([#9690](https://github.com/npm/cli/issues/9690)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk)) libnpmdiff: 8.1.11 ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0` libnpmexec: 10.3.1 #### [10.3.1](https://github.com/npm/cli/compare/libnpmexec-v10.3.0...libnpmexec-v10.3.1) (2026-06-29) ##### Bug Fixes - [`f3f2465`](https://github.com/npm/cli/commit/f3f246580c8fa136ec90c5b7d96b940a6f6a90b0) [#9692](https://github.com/npm/cli/pull/9692) exec: prevent shared binPaths pollution across workspace runs ([#9692](https://github.com/npm/cli/issues/9692)) ([@github-actions](https://github.com/github-actions)\[bot], [@arjun-vegeta](https://github.com/arjun-vegeta)) - [`b2e6338`](https://github.com/npm/cli/commit/b2e63385c991cfc1430e8e5c347f33a7fd47e0e9) [#9602](https://github.com/npm/cli/pull/9602) arborist: don't flag inert optional deps in strict-allow-scripts ([#9602](https://github.com/npm/cli/issues/9602)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0` libnpmfund: 7.0.25 ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0` libnpmpack: 9.1.11 ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0` ##### [v11.17.0](https://github.com/npm/cli/releases/tag/v11.17.0) ##### Features - [`ae8ac4e`](https://github.com/npm/cli/commit/ae8ac4ea39776f74551fc850f4a5e766b81c5545) [#9534](https://github.com/npm/cli/pull/9534) add min-release-age-exclude config ([@JamieMagee](https://github.com/JamieMagee), [@caseyjhol](https://github.com/caseyjhol)) - [`8ff3e48`](https://github.com/npm/cli/commit/8ff3e48113a53576a8d450d7d5a1cb190a1986e1) [#9483](https://github.com/npm/cli/pull/9483) allowScripts tooling and inBundle hardening ([#9483](https://github.com/npm/cli/issues/9483)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) ##### Bug Fixes - [`847cdf8`](https://github.com/npm/cli/commit/847cdf8d2277bc56f6aaef3957f0b9c06fed20e5) [#9541](https://github.com/npm/cli/pull/9541) match dotted and versioned args in approve-scripts/deny-scripts ([@owlstronaut](https://github.com/owlstronaut)) - [`d99f7cb`](https://github.com/npm/cli/commit/d99f7cb1112d311b1f7fc885fb4f692ead8c8e2c) [#9535](https://github.com/npm/cli/pull/9535) emit valid JSON from approve-scripts/deny-scripts --json ([@owlstronaut](https://github.com/owlstronaut)) - [`351a309`](https://github.com/npm/cli/commit/351a309e7c625b79cfb0c9fbaa2dc9a544509f70) [#9499](https://github.com/npm/cli/pull/9499) pass script-shell to publish lifecycle hooks ([#9499](https://github.com/npm/cli/issues/9499)) ([@github-actions](https://github.com/github-actions)\[bot]) - [`4fa81df`](https://github.com/npm/cli/commit/4fa81dfedab4bf39e85d828f217a70210afd6dac) [#9497](https://github.com/npm/cli/pull/9497) recognize allowScripts for local link targets ([#9497](https://github.com/npm/cli/issues/9497)) ([@github-actions](https://github.com/github-actions)\[bot], [@cyphercodes](https://github.com/cyphercodes), [@cyphercodes](https://github.com/cyphercodes)) - [`95cf2e9`](https://github.com/npm/cli/commit/95cf2e9efea892023387f3aec6062b8a7e8f1a60) [#9489](https://github.com/npm/cli/pull/9489) validate registry path for allow-remote tarballs ([@Abhinav-143x](https://github.com/Abhinav-143x)) - [`9dd219b`](https://github.com/npm/cli/commit/9dd219b20ec3a1c7e46b23209b4619b872f1b604) [#9462](https://github.com/npm/cli/pull/9462) respect allowScripts policy in prune, dedupe, uninstall, audit, and link ([#9462](https://github.com/npm/cli/issues/9462)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`cd8d18a`](https://github.com/npm/cli/commit/cd8d18a66832856c5cc2ba90dc7c8b0f3dbe476b) [#9482](https://github.com/npm/cli/pull/9482) list pending scripts in approve-scripts when ignore-scripts is set ([#9482](https://github.com/npm/cli/issues/9482)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`c14e87c`](https://github.com/npm/cli/commit/c14e87c5d84a81ebe14ebe9c68e050ee6ec0fded) [#9481](https://github.com/npm/cli/pull/9481) suggest --allow-scripts for global installs in unreviewed-scripts warnings ([#9481](https://github.com/npm/cli/issues/9481)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`7ade52e`](https://github.com/npm/cli/commit/7ade52ea4059ca75e83f10e892b24581624acef9) [#9465](https://github.com/npm/cli/pull/9465) invalid issue template YAML indentation ([#9465](https://github.com/npm/cli/issues/9465)) ([@github-actions](https://github.com/github-actions)\[bot], [@fallintoplace](https://github.com/fallintoplace)) - [`c069622`](https://github.com/npm/cli/commit/c0696225d8792e461989214ba7d8886dfd862b4a) [#9464](https://github.com/npm/cli/pull/9464) show full parent command path in subcommand usage errors ([#9464](https://github.com/npm/cli/issues/9464)) ([@owlstronaut](https://github.com/owlstronaut)) - [`1bb62bb`](https://github.com/npm/cli/commit/1bb62bb639d1f791a0c51d236fba01c25c58992e) [#9454](https://github.com/npm/cli/pull/9454) config: clarify --all help so it's accurate for approve-scripts and deny-scripts ([@JamieMagee](https://github.com/JamieMagee)) - [`84eeb5f`](https://github.com/npm/cli/commit/84eeb5fe9db14e01ebc44999ebe126224a78eb83) [#9431](https://github.com/npm/cli/pull/9431) audit: don't apply min-release-age before filter when verifying installed signatures ([@JamieMagee](https://github.com/JamieMagee)) - [`3bd3377`](https://github.com/npm/cli/commit/3bd3377f207732b47655ea3a896d53046df199c4) [#9426](https://github.com/npm/cli/pull/9426) block forbidden keys in Queryable setter to prevent prototype pollution ([@12122J](https://github.com/12122J), [@claude](https://github.com/claude)) ##### Documentation - [`a86a7a9`](https://github.com/npm/cli/commit/a86a7a9e3c9ca840d4e7f5f3bb043ec5b9c7e154) [#9522](https://github.com/npm/cli/pull/9522) approve-scripts only throws EGLOBAL when run with -g ([@JamieMagee](https://github.com/JamieMagee)) - [`693bb3d`](https://github.com/npm/cli/commit/693bb3de834f4611bf41785be357dc4598a2aaae) [#9508](https://github.com/npm/cli/pull/9508) clarify package.json override value specs ([#9508](https://github.com/npm/cli/issues/9508)) ([@github-actions](https://github.com/github-actions)\[bot], [@ded-furby](https://github.com/ded-furby)) - [`ccffe4a`](https://github.com/npm/cli/commit/ccffe4a917e1b9faf6e8fa9ab3a2856819e29e3a) [#9501](https://github.com/npm/cli/pull/9501) use the latest version for global update and outdated's `wanted` ([#9501](https://github.com/npm/cli/issues/9501)) ([@github-actions](https://github.com/github-actions)\[bot], [@liangmiQwQ](https://github.com/liangmiQwQ)) - [`66e97c2`](https://github.com/npm/cli/commit/66e97c20003b43d80c464b89fb1e1c8c6b5c9433) [#9478](https://github.com/npm/cli/pull/9478) update minimum npm required for npm trust ([@meeech](https://github.com/meeech)) ##### Dependencies - [`bd09b87`](https://github.com/npm/cli/commit/bd09b87b50fd7a2051cdfedf3c491dbf133e05b6) [#9542](https://github.com/npm/cli/pull/9542) `postcss-selector-parser@7.1.4` - [`95bfc4c`](https://github.com/npm/cli/commit/95bfc4c69593cc85f783c164716d7bca0b453b4b) [#9542](https://github.com/npm/cli/pull/9542) `tinyglobby@0.2.17` - [`8c0d5fd`](https://github.com/npm/cli/commit/8c0d5fd2d72d544267b41f65ee576cc26b080d7c) [#9542](https://github.com/npm/cli/pull/9542) `tar@7.5.16` - [`967d377`](https://github.com/npm/cli/commit/967d3775434dc4d9659aa9d9c3b81771d12be3df) [#9542](https://github.com/npm/cli/pull/9542) `semver@7.8.4` - [`cdaac1b`](https://github.com/npm/cli/commit/cdaac1bed03a0f6aff1115ed7cb0745ca9e9f238) [#9542](https://github.com/npm/cli/pull/9542) `pacote@21.5.1` - [`25c8a9e`](https://github.com/npm/cli/commit/25c8a9ec04fed7f5941af004f7de5ad9b5775bde) [#9542](https://github.com/npm/cli/pull/9542) `node-gyp@12.4.0` ##### Chores - [`2922fa4`](https://github.com/npm/cli/commit/2922fa45f1145c14d7eb0e5796a6854217dd8922) [#9542](https://github.com/npm/cli/pull/9542) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.8.0): `@npmcli/arborist@9.8.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.11.0): `@npmcli/config@10.11.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.10): `libnpmdiff@8.1.10` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.0): `libnpmexec@10.3.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.24): `libnpmfund@7.0.24` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.10): `libnpmpack@9.1.10` ##### [v11.16.0](https://github.com/npm/cli/releases/tag/v11.16.0) ##### Features - [`4b67f6e`](https://github.com/npm/cli/commit/4b67f6ed21a8bf7e47ae78b7fc9cc9fbdfa95057) [#9416](https://github.com/npm/cli/pull/9416) publish --access=private alias for restricted ([#9416](https://github.com/npm/cli/issues/9416)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [`a10c7ca`](https://github.com/npm/cli/commit/a10c7caf3ad9d2d5e17234c5c5e615dbce7717f9) [#9415](https://github.com/npm/cli/pull/9415) Phase 1 of `allowScripts` opt-in install-script policy ([#9360](https://github.com/npm/cli/issues/9360)) ([#9415](https://github.com/npm/cli/issues/9415)) ([@owlstronaut](https://github.com/owlstronaut), [@JamieMagee](https://github.com/JamieMagee)) ##### Bug Fixes - [`1f7869b`](https://github.com/npm/cli/commit/1f7869b4828e24fbacad0d0f4c78d3ed286b0099) [#9411](https://github.com/npm/cli/pull/9411) fix typo of fullMetadata ([@owlstronaut](https://github.com/owlstronaut)) - [`cde03ba`](https://github.com/npm/cli/commit/cde03ba84049124a431cea36e70558256ead7dbe) [#9390](https://github.com/npm/cli/pull/9390) config: pause progress spinner during interactive editor spawn ([#9388](https://github.com/npm/cli/issues/9388)) ([@github-actions](https://github.com/github-actions)\[bot], [@Zelys-DFKH](https://github.com/Zelys-DFKH), [@claude](https://github.com/claude)) ##### Documentation - [`c5e9d73`](https://github.com/npm/cli/commit/c5e9d73b47056c5a901a7100919f4b29fcfb4d0f) [#9390](https://github.com/npm/cli/pull/9390) Document `npm_old_version` and `npm_new_version` environment variables ([#9389](https://github.com/npm/cli/issues/9389)) ([@github-actions](https://github.com/github-actions)\[bot], [@36degrees](https://github.com/36degrees)) ##### Dependencies - [`cdd7bbc`](https://github.com/npm/cli/commit/cdd7bbccf85a5b8f37f41c003c51908d7283e5fc) [#9421](https://github.com/npm/cli/pull/9421) `undici@6.26.0` - [`fde87c9`](https://github.com/npm/cli/commit/fde87c911c3103f0268aa7b912b8180cacea3b56) [#9421](https://github.com/npm/cli/pull/9421) `sigstore@4.1.1` - [`2779793`](https://github.com/npm/cli/commit/2779793e74f742e527449675cab19d1621d3a588) [#9421](https://github.com/npm/cli/pull/9421) `lru-cache@11.5.1` - [`dea702d`](https://github.com/npm/cli/commit/dea702da380f9b64c2c047e238272af81106bf39) [#9421](https://github.com/npm/cli/pull/9421) `@sigstore/verify@3.1.1` - [`4eab03f`](https://github.com/npm/cli/commit/4eab03fd43b7d8e0315efe2ebdf10e1eae5aad47) [#9421](https://github.com/npm/cli/pull/9421) `@sigstore/core@3.2.1` - [`74c7323`](https://github.com/npm/cli/commit/74c73235b22979acd38645e40ae9009154e6ffe5) [#9421](https://github.com/npm/cli/pull/9421) `@npmcli/agent@4.0.2` - [`edc4ab3`](https://github.com/npm/cli/commit/edc4ab3c8a6c3c47ac889a686b3e62e129ba9834) [#9421](https://github.com/npm/cli/pull/9421) `semver@7.8.1` - [`5f6ce33`](https://github.com/npm/cli/commit/5f6ce3385eacd862a5cf137514f583b7501d2f43) [#9421](https://github.com/npm/cli/pull/9421) `make-fetch-happen@15.0.6` ##### Chores - [`bd04976`](https://github.com/npm/cli/commit/bd049763bcc9c6177a3f32b740aa071377f561cc) [#9421](https://github.com/npm/cli/pull/9421) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [`aeceb23`](https://github.com/npm/cli/commit/aeceb23c016afbeb6792844fd77487e531c71ea6) [#9407](https://github.com/npm/cli/pull/9407) sanitize newlines in flags table default and type values ([#9407](https://github.com/npm/cli/issues/9407)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/arborist@9.7.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.10.0): `@npmcli/config@10.10.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.9): `libnpmdiff@8.1.9` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.9): `libnpmexec@10.2.9` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.23): `libnpmfund@7.0.23` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.9): `libnpmpack@9.1.9` - [workspace](https://github.com/npm/cli/releases/tag/libnpmversion-v8.0.4): `libnpmversion@8.0.4` ##### [v11.15.0](https://github.com/npm/cli/releases/tag/v11.15.0) ##### Features - [`0d5d899`](https://github.com/npm/cli/commit/0d5d899ea8a6981a2a1d3c724384d12fd1908a90) [#9379](https://github.com/npm/cli/pull/9379) npm stage ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [`1433740`](https://github.com/npm/cli/commit/1433740a8b42f9359a2178d00a40e3f770b6b1b2) [#9376](https://github.com/npm/cli/pull/9376) add permissions support to trust commands ([#9376](https://github.com/npm/cli/issues/9376)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [`8df10f5`](https://github.com/npm/cli/commit/8df10f5a399048c9d2dd7eba1d65c0b4b6a5b1c8) [#9339](https://github.com/npm/cli/pull/9339) add allow-git/allow-file/allow-directory/allow-remote configs ([@owlstronaut](https://github.com/owlstronaut)) ##### Bug Fixes - [`39b625e`](https://github.com/npm/cli/commit/39b625e60628e7fdc96ee88cbe1c3b613bdc1ac5) [#9381](https://github.com/npm/cli/pull/9381) key stage download --json output by package name ([#9381](https://github.com/npm/cli/issues/9381)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [`6aa332d`](https://github.com/npm/cli/commit/6aa332d4cc37c0981f29cfb7e1efc66eee65578c) [#9339](https://github.com/npm/cli/pull/9339) allow min-release-age in npmrc to coexist with --before ([@raazkhnl](https://github.com/raazkhnl)) - [`468550f`](https://github.com/npm/cli/commit/468550fb8f6ded97df03e6b8a82dbfbcb7b47d30) [#9339](https://github.com/npm/cli/pull/9339) refactor #failureNode, adjust tests and safety ([@owlstronaut](https://github.com/owlstronaut)) - [`cabe249`](https://github.com/npm/cli/commit/cabe2499347c17d97eecc3bbca3d96fe2f556d0d) [#9339](https://github.com/npm/cli/pull/9339) allow-remote=none does not block registry tarballs ([@owlstronaut](https://github.com/owlstronaut)) ##### Dependencies - [`8416a60`](https://github.com/npm/cli/commit/8416a6034d5998bdc3980fe0c682b26579ed207e) [#9383](https://github.com/npm/cli/pull/9383) `socks@2.8.9` - [`5e5a25b`](https://github.com/npm/cli/commit/5e5a25b5a1f2c2cb6911be22fbf4456d3ed17d88) [#9383](https://github.com/npm/cli/pull/9383) `lru-cache@11.5.0` - [`a6f9ad2`](https://github.com/npm/cli/commit/a6f9ad298531c6619f0b2df16e4ed3c27b616765) [#9383](https://github.com/npm/cli/pull/9383) `ip-address@10.2.0` - [`63f8114`](https://github.com/npm/cli/commit/63f8114f275830f55c3b0427a2ca9fff4e4cf333) [#9383](https://github.com/npm/cli/pull/9383) `brace-expansion@5.0.6` - [`6918b4c`](https://github.com/npm/cli/commit/6918b4cd149a3917e7d84beddb1b20138cc0ebac) [#9383](https://github.com/npm/cli/pull/9383) `bin-links@6.0.2` - [`bf84079`](https://github.com/npm/cli/commit/bf84079a507c20d8215bc0154bac65e6d14b27f8) [#9383](https://github.com/npm/cli/pull/9383) `tar@7.5.15` - [`bdef82c`](https://github.com/npm/cli/commit/bdef82c2e003b682f4be324a1a45a5a6b09d0ec1) [#9383](https://github.com/npm/cli/pull/9383) `semver@7.8.0` - [`3f38a67`](https://github.com/npm/cli/commit/3f38a6777ae746e136756521e0134f92a4425c90) [#9383](https://github.com/npm/cli/pull/9383) `hosted-git-info@9.0.3` ##### Chores - [`816f3bf`](https://github.com/npm/cli/commit/816f3bfeed3b8f19bd480ba305eb48c71e779f59) [#9383](https://github.com/npm/cli/pull/9383) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.1): `@npmcli/config@10.9.1` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.8): `libnpmdiff@8.1.8` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.8): `libnpmexec@10.2.8` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.22): `libnpmfund@7.0.22` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.8): `libnpmpack@9.1.8` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v11.2.0): `libnpmpublish@11.2.0` ##### [v11.14.1](https://github.com/npm/cli/releases/tag/v11.14.1) ##### Bug Fixes - [`dca12cb`](https://github.com/npm/cli/commit/dca12cb24199aa7046eb53547097906b8731e51b) [#9328](https://github.com/npm/cli/pull/9328) remove settings ([#9328](https://github.com/npm/cli/issues/9328)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut)) ##### [v11.14.0](https://github.com/npm/cli/releases/tag/v11.14.0) ##### Features - [`45fc5e0`](https://github.com/npm/cli/commit/45fc5e0dd144bb21148d7aa35439695ab44cdfda) [#9288](https://github.com/npm/cli/pull/9288) add allow-directory, allow-file, and allow-remote ([#9288](https://github.com/npm/cli/issues/9288)) ([@github-actions](https://github.com/github-actions)\[bot], [@wraithgar](https://github.com/wraithgar)) ##### Bug Fixes - [`6c17544`](https://github.com/npm/cli/commit/6c17544d757a4ee167edd03b47ad5e5da92d8ce6) [#9318](https://github.com/npm/cli/pull/9318) sbom: dedupe per-node dependsOn / relationships ([#9318](https://github.com/npm/cli/issues/9318)) ([@github-actions](https://github.com/github-actions)\[bot], [@mikaelkristiansson](https://github.com/mikaelkristiansson)) ##### Dependencies - [`840fe18`](https://github.com/npm/cli/commit/840fe18eb466d0253ad5891fdf211e0bcb174936) [#9322](https://github.com/npm/cli/pull/9322) `socks@10.1.1` - [`b771289`](https://github.com/npm/cli/commit/b77128922b59cc3b4a7578131a1d75b53b84065e) [#9322](https://github.com/npm/cli/pull/9322) `ip-address@10.1.1` - [`addffcb`](https://github.com/npm/cli/commit/addffcb389388d753fe8f394077ffeb2a6590efb) [#9322](https://github.com/npm/cli/pull/9322) `cidr-regex@5.0.5` ##### Chores - [`041fd58`](https://github.com/npm/cli/commit/041fd5879704c39a0cde6eaba299285877c728c7) [#9322](https://github.com/npm/cli/pull/9322) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [`89c505a`](https://github.com/npm/cli/commit/89c505aec8f9263acb43cd892b9582e4860dde8a) [#9320](https://github.com/npm/cli/pull/9320) add cli-triage team as codeowner ([#9320](https://github.com/npm/cli/issues/9320)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.0): `@npmcli/config@10.9.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.7): `libnpmdiff@8.1.7` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.7): `libnpmexec@10.2.7` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.21): `libnpmfund@7.0.21` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.7): `libnpmpack@9.1.7` ##### [v11.13.0](https://github.com/npm/cli/releases/tag/v11.13.0) ##### Features - [`8e8dadb`](https://github.com/npm/cli/commit/8e8dadb8ae378c1dde0b98c15167d739abaa9b37) [#9246](https://github.com/npm/cli/pull/9246) add `u` as alias for `update` command ([#9246](https://github.com/npm/cli/issues/9246)) ([@github-actions](https://github.com/github-actions)\[bot], [@Ausoj](https://github.com/Ausoj)) ##### Bug Fixes - [`ecd161b`](https://github.com/npm/cli/commit/ecd161b206ca49f22f455585ff7ced0b6d0e0511) [#9258](https://github.com/npm/cli/pull/9258) ignore intended error code ([@owlstronaut](https://github.com/owlstronaut)) ##### Dependencies - [`8d2fdcd`](https://github.com/npm/cli/commit/8d2fdcdeb09e78b6b6dd0a7e9eaa5b222ec91071) [#9272](https://github.com/npm/cli/pull/9272) `lru-cache@11.3.5` - [`e603d36`](https://github.com/npm/cli/commit/e603d36910c6ad91bf7ff890a29149758201a98b) [#9272](https://github.com/npm/cli/pull/9272) `node-gyp@12.3.0` - [`d48b7da`](https://github.com/npm/cli/commit/d48b7da10bc0cbc8821d3bdbba9b571d84d5509d) [#9272](https://github.com/npm/cli/pull/9272) `is-cidr@6.0.4` - [`032a5ca`](https://github.com/npm/cli/commit/032a5ca94a5b6095883256a1538a59f840adce80) [#9240](https://github.com/npm/cli/pull/9240) `@sigstore/protobuf-specs@0.5.1` - [`33a81e7`](https://github.com/npm/cli/commit/33a81e7f1c63b522d025142ecd6acc1a368dc603) [#9240](https://github.com/npm/cli/pull/9240) `tinyglobby@0.2.16` - [`68dc4a0`](https://github.com/npm/cli/commit/68dc4a02480563be34daf205ad08b6d3ca3cc550) [#9240](https://github.com/npm/cli/pull/9240) `picomatch@4.0.4` - [`1bb6703`](https://github.com/npm/cli/commit/1bb670362d3fe6724e9837a1dedf3bac9ff343dd) [#9240](https://github.com/npm/cli/pull/9240) `lru-cache@11.3.3` - [`37059e4`](https://github.com/npm/cli/commit/37059e41129c444839fcadcfb01f2aade63054d2) [#9240](https://github.com/npm/cli/pull/9240) `diff@8.0.4` - [`fb450ab`](https://github.com/npm/cli/commit/fb450ab4f85cde6aa9936f1f76b6a6b0ecbe9b56) [#9240](https://github.com/npm/cli/pull/9240) `minimatch@10.2.5` - [`7c4bbbf`](https://github.com/npm/cli/commit/7c4bbbfae55dcce038e1e9482ac946d99ad02442) [#9240](https://github.com/npm/cli/pull/9240) `tar@7.5.13` - [`703a3bc`](https://github.com/npm/cli/commit/703a3bc9e7f0f035729ab49e5122c2f4bf7fbf32) [#9240](https://github.com/npm/cli/pull/9240) `minipass-flush@1.0.6` ##### Chores - [`e0724ac`](https://github.com/npm/cli/commit/e0724ac79e1b2acbb40694869a0fc67f050e4918) [#9272](https://github.com/npm/cli/pull/9272) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [`d249341`](https://github.com/npm/cli/commit/d2493410f7559837ad65a7b4117111a3590c4e8f) [#9230](https://github.com/npm/cli/pull/9230) don't run npm update in CI ([@owlstronaut](https://github.com/owlstronaut)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.4.3): `@npmcli/arborist@9.4.3` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.6): `libnpmdiff@8.1.6` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.6): `libnpmexec@10.2.6` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.20): `libnpmfund@7.0.20` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.6): `libnpmpack@9.1.6`
9 tasks done
Karthik-beta
added a commit
to Karthik-beta/fiscalclock
that referenced
this pull request
Nov 4, 2026
… handling (#75) ## Why The maintainer is using a CodeRabbit Advanced trial to review the whole codebase, fix what it finds, merge and repeat; this pull request fixes the six round 1 findings for `website/` (the review is in #66). No linked issue: these are review findings from the trial, each checked against the code and its source before the change. ## What changed Fixed: - `website/README.md` (Reserved Font Name): links "SIL Open Font License" to its [official text](https://openfontlicense.org/open-font-license-official-text/). The text's condition 3 bars a Modified Version from using the Reserved Font Name, and its definition of a Modified Version includes "changing formats", which backs "do not subset or convert". - `website/README.md` (install scripts): the claim "npm 11.7.0 honours `allowScripts`" was wrong. As of 4 Nov 2026 the npm 11 release notes put `allowScripts` in [11.16.0](https://github.com/npm/cli/releases/tag/v11.16.0) and the `npm install-scripts` command, with `ls`, in [11.18.0](https://github.com/npm/cli/releases/tag/v11.18.0) (its [pull request](npm/cli#9635) adds `approve`, `deny` and `ls`). The paragraph now says so, with those sources. It also said `npm install-scripts ls` lists only `@ibm/plex-mono`, which stopped being true once `allowScripts` denies it (the command now prints "No packages with unreviewed install scripts."). It now says that with `allowScripts` removed the command lists only that package, checked on 4 Nov 2026 with npm 11.19.1. The `postinstall` explanation, `--ignore-scripts` on Vercel and the local `npm ci` command are unchanged. - `website/src/content/docs/index.mdx` (build provenance): the "release workflow" link pointed at the attestations page. It now links `release.yml` as the creator of the provenance and the attestations page as the list of it. The "stores no registry tokens" claim is scoped to the repository and dated as of 3 Nov 2026, as in the README's [Supply chain](https://github.com/Karthik-beta/fiscalclock#supply-chain) section, and the sentence says the workflow publishes with short-lived credentials from trusted publishing, since it requests a temporary crates.io token. - `website/src/content/docs/index.mdx` (packages paragraph): the release and format-draft claims are dated as of 2 Nov 2026 and link to the Install page's [Supported versions](https://fiscalclock.karthik.nz/start-here/install/#supported-versions) section, which has the sources and the same date. The package table is unchanged. - `website/src/scripts/playground.ts` (`replaceState` rate limit): MDN's [`History.replaceState()`](https://developer.mozilla.org/en-US/docs/Web/API/History/replaceState#exceptions) lists `SecurityError` as thrown "if the method is called too frequently", so the claim holds. Before the fix, a throwing `replaceState` stopped the first render, so the playground never left "Loading" (reproduced in the built site). A `writeUrl` helper now encodes the state, calls `replaceState` in a `try`, and ignores only a `SecurityError`; `schedule` and `render` use it. - `website/src/scripts/playground.ts` (hash without state): reproduced in the built site that `hashchange` to a fragment such as `#main` replaced the typed definition with the first example. The handler now loads state only when the fragment starts with `#s=` (new `hasState` in `playground-state.ts`, which `decodeState` also uses). The initial load is unchanged, so a bookmarked link still restores its state. - `CHANGELOG.md`: one "Website" line under Unreleased/Fixed for the two playground fixes. Tests: three Playwright tests in `website/tests/playground.spec.ts` (a link to another part of the page keeps the typed definition and date; a `#s=` fragment still loads that state; the playground renders and updates results when `replaceState` always throws a `SecurityError`) and a unit test for `hasState`. Against the unfixed code the first and third fail and the second passes; against the fix all pass. ## Dismissed None. All six findings were valid. ## Needs maintainer None for these findings. One thing for the maintainer, outside the findings: `website/tests/unit/json-path.test.ts` fails on Node.js 24.21.0 and 24.22.1 (two tests, "a path to a field finds its value" and "a missing field marks the deepest field that exists") and passes on 26.12.0. The file is not touched here. Because `npm test` is `node --test ... && playwright test`, a Node 24 run stops before Playwright. I ran the Playwright part on Node 26.12.0 (see below). ## Checklist - [x] The pull request links an issue, or explains why none is needed. - [x] An ADR is linked if the change alters the definition format, an operation's result, the public API, error codes, core dependencies, supported versions or scope (see CONTRIBUTING.md). No such change. - [x] Behaviour changes come with conformance vectors whose expected results come from a cited source or an independent generator, not from fiscalclock's own output. No library behaviour changed; the website behaviour fixes have Playwright tests. - [x] No expected result in an existing vector changed, or the linked issue explains why. None changed. - [x] Every new factual claim in code, docs or tests has a source link or a reproducible check, and time-sensitive facts carry "as of <date>". - [x] Documentation (README, spec, wiki) is updated where behaviour changed. - [x] `CHANGELOG.md` has an entry under "Unreleased" for any user-visible change. - [x] The checks in AGENTS.md that cover the change were run (for example `python -I scripts/check.py rust python`), and the description lists the commands and their results. - [x] Commits follow Conventional Commits and carry no AI or model attribution lines. ## Checks `python -I scripts/check.py website docs` on Node.js 24.22.1: - PASS: `node_version`, `site_install`, `site_build`, `site_check`, `site_examples`, `site_links`, `markdownlint`, `cspell`, `yamllint`, `local_links`. - FAIL: `site_tests`, in the two `json-path` unit tests described above, which this change does not touch. `npm test` in `website/` on Node.js 26.12.0, so the Playwright suite runs: PASS. The 26 unit tests pass and all 161 Playwright checks pass (accessibility, CSP, links, playground, the new tests). Playwright ran against `astro preview` started by hand, because `npx astro preview` did not become ready within Playwright's 60 s webServer timeout on this machine.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #9629 to
release/v11.Adds the namespaced
npm install-scriptscommand (approve,deny,ls), keepingnpm approve-scripts/npm deny-scriptsworking as aliases, and points the install-time, rebuild, and strict-allow-scripts guidance at the new namespace.References
Backports #9629