[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
npm (source)	10.9.9+sha512.d60fba8cb42f688b81e33c2f1cbef2ad7b977166700ec0ad057f1b6d60ea6ef2524abf673e20c35931cd8305d1dbb8887134d6eefdc0e7b8435bd458bf65b862 → 12.2.0

---

Release Notes

npm/cli (npm)

v12.2.0

Compare Source

Features

• 9741b64 #​10038 dist-tag: support OIDC authentication (#​10038) (@​reggi, @​Copilot)

Documentation

• 0c3b82a #​10017 update npm stage docs to reflect that it can create new packages (#​10017) (@​shmam, @​Copilot)

Dependencies

• workspace: @npmcli/config@11.2.0

v12.1.0

Compare Source

Features

• 6400533 #​9948 token: support read-write-stage-only granular access tokens (#​9948) (@​Tayvon, @​Copilot)
• 8723f53 #​9898 stage: display staged package status (#​9898) (@​joelverhagen)

Bug Fixes

• c9876d7 #​9882 provenance-file takes precedence over OIDC auto-generated provenance (#​9882) (@​yunseo-kim)
• b016aa2 #​9913 config: avoid exporting persistent allow-scripts (#​9913) (@​Fnine59)
• d6c6122 #​9914 arborist: match allowScripts keys for local paths (#​9914) (@​martinrrm, @​Copilot)
• a8c9b2f #​9823 keep dry-run output valid json (#​9823) (@​martinrrm)
• da50c34 #​9881 arborist: reject uninstall args that carry a version (#​9881) (@​lazerg)
• 71915e8 #​9756 exempt explicit pack targets from allow-directory (#​9756) (@​ychampion, @​ychampion)
• 51c2bf8 #​9864 don't print the funding message for global installs (#​9864) (@​lazerg)

Documentation

• bea9066 #​9838 document npm 12 install script blocking (#​9838) (@​reggi)

Dependencies

• 6e40f73 #​9871 undici@6.28.0 (@​martinrrm, @​Copilot)
• 05bd2a4 #​9871 ip-address@10.5.0 (@​martinrrm, @​Copilot)
• b7c490d #​9871 brace-expansion@5.0.9 (@​martinrrm, @​Copilot)
• 75a943d #​9843 tar@7.5.22 (#​9843) (@​martinrrm, @​Copilot)

Chores

• 7b50811 #​9961 pack: select workspace through config (#​9961) (@​reggi)
• 81a901c #​9915 recognize prefixed Node.js PR titles (#​9915) (@​reggi)
• 4cdccea #​9836 update node-integration workflow template to latest actions (#​9836) (@​MikeMcC399)
• 278df04 #​9822 pass nodedir to node-gyp via npm_package_config env in node integration (#​9822) (@​reggi, @​Copilot)
• workspace: @npmcli/arborist@10.0.3
• workspace: @npmcli/config@11.1.0
• workspace: libnpmdiff@9.0.3
• workspace: libnpmexec@11.0.3
• workspace: libnpmfund@8.0.3
• workspace: libnpmpack@10.0.3
• workspace: libnpmpublish@12.0.1

v12.0.2

Compare Source

Bug Fixes

• 834408e #​9760 pack: honor min-release-age-exclude (#​9760) (@​martinrrm, @​Copilot)
• ef6cfea #​9786 owner: use scoped registry for user lookup (#​9786) (@​martinrrm, @​Copilot)

Documentation

• 9e17dc0 #​9805 clarify npm 12 unknown-config breaking change in changelogs (#​9805) (@​Hashim1999164)

Chores

• 7b1f6c1 #​9747 parse pack --json object output in node integration (#​9747) (@​reggi, @​Copilot)

Dependencies

• workspace: @npmcli/arborist@10.0.2
• workspace: @npmcli/config@11.0.1
• workspace: libnpmdiff@9.0.2
• workspace: libnpmexec@11.0.2
• workspace: libnpmfund@8.0.2
• workspace: libnpmpack@10.0.2

v12.0.1

Compare Source

Features

• 6400533 #​9948 token: support read-write-stage-only granular access tokens (#​9948) (@​Tayvon, @​Copilot)
• 8723f53 #​9898 stage: display staged package status (#​9898) (@​joelverhagen)

Bug Fixes

• c9876d7 #​9882 provenance-file takes precedence over OIDC auto-generated provenance (#​9882) (@​yunseo-kim)
• b016aa2 #​9913 config: avoid exporting persistent allow-scripts (#​9913) (@​Fnine59)
• d6c6122 #​9914 arborist: match allowScripts keys for local paths (#​9914) (@​martinrrm, @​Copilot)
• a8c9b2f #​9823 keep dry-run output valid json (#​9823) (@​martinrrm)
• da50c34 #​9881 arborist: reject uninstall args that carry a version (#​9881) (@​lazerg)
• 71915e8 #​9756 exempt explicit pack targets from allow-directory (#​9756) (@​ychampion, @​ychampion)
• 51c2bf8 #​9864 don't print the funding message for global installs (#​9864) (@​lazerg)

Documentation

• bea9066 #​9838 document npm 12 install script blocking (#​9838) (@​reggi)

Dependencies

• 6e40f73 #​9871 undici@6.28.0 (@​martinrrm, @​Copilot)
• 05bd2a4 #​9871 ip-address@10.5.0 (@​martinrrm, @​Copilot)
• b7c490d #​9871 brace-expansion@5.0.9 (@​martinrrm, @​Copilot)
• 75a943d #​9843 tar@7.5.22 (#​9843) (@​martinrrm, @​Copilot)

Chores

• 7b50811 #​9961 pack: select workspace through config (#​9961) (@​reggi)
• 81a901c #​9915 recognize prefixed Node.js PR titles (#​9915) (@​reggi)
• 4cdccea #​9836 update node-integration workflow template to latest actions (#​9836) (@​MikeMcC399)
• 278df04 #​9822 pass nodedir to node-gyp via npm_package_config env in node integration (#​9822) (@​reggi, @​Copilot)
• workspace: @npmcli/arborist@10.0.3
• workspace: @npmcli/config@11.1.0
• workspace: libnpmdiff@9.0.3
• workspace: libnpmexec@11.0.3
• workspace: libnpmfund@8.0.3
• workspace: libnpmpack@10.0.3
• workspace: libnpmpublish@12.0.1

v12.0.0

Compare Source

⚠️ BREAKING CHANGES

• npm view --json now always returns an array.
• npm sbom --sbom-format=cyclonedx now reports the name field from each package's package.json instead of the on-disk directory name. The name, bom-ref, and purl of the root component and of aliased dependencies may change.
• npm no longer registers man pages with the system when installed globally. man npm-install will no longer work, but npm help install is unaffected.
• The npm pkg output is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly to npm view.
• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• The Twitter and Freenode profile fields have been removed from the npm registry. This means that users will no longer be able to set or view these fields in their npm profiles.
• npm will no longer attempt to resolve the path to node via whichnode. process.execPath is already set by Node to the resolved real path of the node binary, so the lookup was redundant. Scripts that expected npm to override process.execPath with a PATH-resolved (potentially symlinked) node path may be affected.
• the --json output of npm pack and npm publish have changed. They are now always consistent, and in the same format.
• the star, stars and unstar commands have been removed
• The npm adduser command has been removed. Create and manage user accounts on the npm website, and use npm login to authenticate on the command line.
• Preserve https protocol when working with git (#​8703)
• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• root `preinstall` now runs before dependencies are installed.
• unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning. (Unknown .npmrc configs still warn by default; opt into erroring with the new strict-npmrc config.)
• Dependency lifecycle scripts are now blocked by default unless allowed by the root package's allowScripts policy. After installing, run npm install-scripts approve to record approvals and npm rebuild to execute newly approved scripts.

Chores

• b77b532 #​9735 remove pre-release mode from npm 12 and workspaces (#​9735) (@​reggi, @​Copilot)

Dependencies

• workspace: @npmcli/arborist@10.0.0
• workspace: @npmcli/config@11.0.0
• workspace: libnpmaccess@11.0.0
• workspace: libnpmdiff@9.0.0
• workspace: libnpmexec@11.0.0
• workspace: libnpmfund@8.0.0
• workspace: libnpmorg@9.0.0
• workspace: libnpmpack@10.0.0
• workspace: libnpmpublish@12.0.0
• workspace: libnpmsearch@10.0.0
• workspace: libnpmteam@9.0.0
• workspace: libnpmversion@9.0.0

v11.21.0

Compare Source

v11.20.0

Compare Source

Features

• 0b3c699 #​9994 token: support read-write-stage-only granular access tokens (#​9994) (@​github-actions[bot], @​Tayvon, @​Copilot)
• b872816 #​9920 stage: display staged package status (#​9920) (@​github-actions[bot], @​joelverhagen)

Bug Fixes

• ddbadfc #​9947 provenance-file takes precedence over OIDC auto-generated provenance (#​9947) (@​github-actions[bot], @​yunseo-kim)
• 64d4b4b #​9937 config: avoid exporting persistent allow-scripts (#​9937) (@​github-actions[bot], @​Fnine59)
• 70317da #​9930 arborist: reject uninstall args that carry a version (#​9930) (@​github-actions[bot], @​lazerg)
• 55ae484 #​9929 arborist: match allowScripts keys for local paths (#​9929) (@​github-actions[bot], @​martinrrm, @​Copilot)
• 7f1f2b7 #​9928 keep dry-run output valid json (#​9928) (@​github-actions[bot], @​martinrrm)
• f28cca9 #​9927 don't print the funding message for global installs (#​9927) (@​github-actions[bot], @​lazerg)

Chores

• 6ff3000 #​10010 pack: select workspace through config (#​10010) (@​github-actions[bot], @​reggi)
• afdc5bd #​9932 pass nodedir to node-gyp via npm_package_config env in node integration (#​9932) (@​reggi)
• 83f95ff #​9931 update node-integration workflow template to latest actions (#​9931) (@​reggi)
• f020fba #​9925 recognize prefixed Node.js PR titles (#​9925) (@​github-actions[bot], @​reggi)

Dependencies

• workspace: @npmcli/arborist@9.9.2
• workspace: @npmcli/config@10.13.0
• workspace: libnpmdiff@8.1.13
• workspace: libnpmexec@10.3.3
• workspace: libnpmfund@7.0.27
• workspace: libnpmpack@9.1.14
• workspace: libnpmpublish@11.2.1

v11.19.1

Compare Source

Bug Fixes

• 83b750d #​9916 exempt explicit pack targets from allow-directory (#​9916) (@​github-actions[bot], @​ychampion, @​ychampion)

Dependencies

• 4791b27 #​9872 undici@6.28.0 (@​martinrrm, @​Copilot)
• 823d647 #​9872 ip-address@10.5.0 (@​martinrrm, @​Copilot)
• 04f8efe #​9872 brace-expansion@5.0.9 (@​martinrrm, @​Copilot)
• 1610280 #​9842 tar@7.5.22 (#​9842) (@​martinrrm, @​Copilot)
• workspace: libnpmpack@9.1.13

v11.19.0

Compare Source

Features

• 7d39aa6 #​9698 install-scripts: use install-scripts as the warning log title (@​manzoorwanijk)

Bug Fixes

• 3529ca2 #​9811 pack: honor min-release-age-exclude (#​9811) (@​github-actions[bot], @​martinrrm, @​Copilot)
• 67f12ae #​9810 owner: use scoped registry for user lookup (#​9810) (@​github-actions[bot], @​martinrrm, @​Copilot)

Dependencies

• workspace: @npmcli/arborist@9.9.1
• workspace: libnpmdiff@8.1.12
• workspace: libnpmexec@10.3.2
• workspace: libnpmfund@7.0.26
• workspace: libnpmpack@9.1.12

v11.18.0

Compare Source

Features

• 3021ad6 #​9694 arborist: extend replace-registry-host with URL prefix matching (#​6110) (#​9694) (@​github-actions[bot], @​u2mejc)
• abd8c6b #​9677 graduate the linked install strategy from experimental to stable (#​9677) (@​github-actions[bot], @​manzoorwanijk)
• 9420673 #​9662 install-scripts: prune unused allowScripts entries (#​9662) (@​github-actions[bot], @​JamieMagee)
• fc9d4c7 #​9635 namespace install-script approval commands under npm install-scripts (#​9635) (@​manzoorwanijk)
• 073253f #​9564 warn when min-release-age blocks an audit fix (#​9564) (@​github-actions[bot], @​JamieMagee)

Bug Fixes

• 598ffdb #​9693 sbom: percent-encode vcs_url qualifier in generated purls (#​9693) (@​github-actions[bot], @​ubeddulla)
• 05793d0 #​9691 output all the required parameters for npm token list (#​9691) (@​github-actions[bot], @​rijildaniel)
• cd57139 #​9669 arborist: surface undeclared workspaces under the linked strategy (backport release/v11) (#​9669) (@​manzoorwanijk)
• 5b6ff9c #​9667 reify: report added count for fresh linked installs (#​9667) (@​github-actions[bot], @​manzoorwanijk, @​owlstronaut)
• 8f13beb #​9664 query: report logical dep location under linked strategy (#​9664) (@​github-actions[bot], @​manzoorwanijk)
• 168ba30 #​9663 allowScripts: close enforcement gaps (#​9652) (backport release/v11) (#​9663) (@​JamieMagee)
• ae64f88 #​9648 exec: resolve workspace-local bin under the linked install strategy (#​9648) (@​github-actions[bot], @​manzoorwanijk)
• 784cbe9 #​9636 ls: restore 100% coverage on release/v11 after #​9633 (#​9636) (@​manzoorwanijk)
• 70f0ea5 #​9607 approve-scripts: approve deps with no resolved URL by name (#​9607) (@​github-actions[bot], @​JamieMagee)
• b2e6338 #​9602 arborist: don't flag inert optional deps in strict-allow-scripts (#​9602) (@​github-actions[bot], @​JamieMagee)
• 6ad5715 #​9595 link: scope npm link --workspace to the workspace, not the root (#​9595) (@​github-actions[bot], @​manzoorwanijk)

Documentation

• 3658bb5 #​9690 recommend install-strategy=linked to catch phantom dependencies (#​9690) (@​github-actions[bot], @​manzoorwanijk)

Dependencies

• 54656b6 #​9696 undici@6.27.0
• 31c4773 #​9696 brace-expansion@5.0.7
• e773c77 #​9696 tar@7.5.19
• f05f6af #​9696 semver@7.8.5
• 804f9ba #​9580 npm-profile@12.0.2

Chores

• f79b37f #​9696 dev dependency updates (@​owlstronaut)
• a04cd84 #​9584 add web-login proxy doneUrl regression for npm-profile fix (#​9584) (@​github-actions[bot], @​manzoorwanijk)
• workspace: @npmcli/arborist@9.9.0
• workspace: @npmcli/config@10.12.0
• workspace: libnpmdiff@8.1.11
• workspace: libnpmexec@10.3.1
• workspace: libnpmfund@7.0.25
• workspace: libnpmpack@9.1.11

arborist: 9.9.0

9.9.0 (2026-06-29)

Features

• 3021ad6 #​9694 arborist: extend replace-registry-host with URL prefix matching (#​6110) (#​9694) (@​github-actions[bot], @​u2mejc)
• abd8c6b #​9677 graduate the linked install strategy from experimental to stable (#​9677) (@​github-actions[bot], @​manzoorwanijk)
• 9420673 #​9662 install-scripts: prune unused allowScripts entries (#​9662) (@​github-actions[bot], @​JamieMagee)
• 073253f #​9564 warn when min-release-age blocks an audit fix (#​9564) (@​github-actions[bot], @​JamieMagee)

Bug Fixes

• 774875b #​9686 arborist: keep bin links for allowScripts-denied packages (#​9686) (@​JamieMagee)
• 719de1e #​9673 arborist: apply overrides across a file: link (backport release/v11) (#​9673) (@​manzoorwanijk)
• cd57139 #​9669 arborist: surface undeclared workspaces under the linked strategy (backport release/v11) (#​9669) (@​manzoorwanijk)
• ede32d3 #​9668 arborist: forward transitive overrides through linked store links (#​9658) (backport release/v11) (#​9668) (@​manzoorwanijk)
• f503b07 #​9666 correct dev/prod dep flags for workspaces under the linked strategy (#​9666) (@​github-actions[bot], @​manzoorwanijk)
• f580889 #​9665 arborist: load transitive optional deps into linked actual tree (#​9665) (@​github-actions[bot], @​manzoorwanijk)
• 8f13beb #​9664 query: report logical dep location under linked strategy (#​9664) (@​github-actions[bot], @​manzoorwanijk)
• 168ba30 #​9663 allowScripts: close enforcement gaps (#​9652) (backport release/v11) (#​9663) (@​JamieMagee)
• 4c9eacb #​9649 arborist: clean up stale .store and hoisted dirs on strategy switch (#​9649) (@​github-actions[bot], @​manzoorwanijk)
• d2c680e #​9645 arborist: invalid filterNode crash under the linked strategy (#​9645) (@​github-actions[bot], @​manzoorwanijk)
• 4e40b1c #​9644 arborist: repair wrong-but-existing symlink target in linked strategy (#​9644) (@​github-actions[bot], @​manzoorwanijk)
• 9d1774e #​9643 arborist: remove stale .bin shims after uninstall under linked (#​9643) (@​github-actions[bot], @​manzoorwanijk)
• ed37d24 #​9642 arborist: record the linked .store layout in the hidden lockfile (backport #​9630) (#​9642) (@​manzoorwanijk)
• e601d4a #​9641 arborist: validate peerOptional conflicts in no-save mutations (#​9641) (@​owlstronaut, @​dale-lakes, @​dale-lakes)
• 03cee43 #​9638 arborist: fix audit-report determinism due to dropped via links (#​9638) (@​github-actions[bot], @​arjun-vegeta)
• a30d855 #​9633 arborist: don't load store packages' devDependencies as required edges (#​9633) (@​manzoorwanijk)
• 887ca97 #​9631 arborist: audit the non-isolated tree under the linked strategy (#​9631) (@​github-actions[bot], @​manzoorwanijk)
• b2e6338 #​9602 arborist: don't flag inert optional deps in strict-allow-scripts (#​9602) (@​github-actions[bot], @​JamieMagee)
• 390ebfa #​9593 arborist: symlink workspace file: deps on non-workspace local packages (#​9593) (@​github-actions[bot], @​manzoorwanijk)
• aaeb2f1 #​9578 arborist: expose store node_modules via NODE_PATH for linked-strategy install scripts (#​9578) (@​github-actions[bot], @​manzoorwanijk)
• 05b6f0f #​9577 arborist: allow-remote exemption for proxy/mirror-fronted registry tarballs (#​9577) (@​github-actions[bot], @​manzoorwanijk)

config: 10.12.0

10.12.0 (2026-06-29)

Features

• 3021ad6 #​9694 arborist: extend replace-registry-host with URL prefix matching (#​6110) (#​9694) (@​github-actions[bot], @​u2mejc)
• abd8c6b #​9677 graduate the linked install strategy from experimental to stable (#​9677) (@​github-actions[bot], @​manzoorwanijk)
• 073253f #​9564 warn when min-release-age blocks an audit fix (#​9564) (@​github-actions[bot], @​JamieMagee)

Bug Fixes

• b2e6338 #​9602 arborist: don't flag inert optional deps in strict-allow-scripts (#​9602) (@​github-actions[bot], @​JamieMagee)

Documentation

• 3658bb5 #​9690 recommend install-strategy=linked to catch phantom dependencies (#​9690) (@​github-actions[bot], @​manzoorwanijk)

libnpmdiff: 8.1.11

Dependencies

• workspace: @npmcli/arborist@9.9.0

libnpmexec: 10.3.1

10.3.1 (2026-06-29)

Bug Fixes

• f3f2465 #​9692 exec: prevent shared binPaths pollution across workspace runs (#​9692) ([@​github-actions](https://redirect.github.com/g

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 and 15 of the month (* 0-3 1,15 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.