Repository navigation
chore(deps): update npm to v11.21.0 - #128
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
✅ Deploy Preview for yechs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
renovate
Bot
force-pushed
the
renovate/npm-11.x
branch
from
October 1, 2026 04:39
2b11eac to
c736934
Compare
renovate
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
11.8.0→11.21.0Release Notes
npm/cli (npm)
v11.21.0Compare Source
v11.20.0Compare Source
Features
0b3c699#9994 token: support read-write-stage-only granular access tokens (#9994) (@github-actions[bot], @Tayvon, @Copilot)b872816#9920 stage: display staged package status (#9920) (@github-actions[bot], @joelverhagen)Bug Fixes
ddbadfc#9947 provenance-file takes precedence over OIDC auto-generated provenance (#9947) (@github-actions[bot], @yunseo-kim)64d4b4b#9937 config: avoid exporting persistent allow-scripts (#9937) (@github-actions[bot], @Fnine59)70317da#9930 arborist: reject uninstall args that carry a version (#9930) (@github-actions[bot], @lazerg)55ae484#9929 arborist: match allowScripts keys for local paths (#9929) (@github-actions[bot], @martinrrm, @Copilot)7f1f2b7#9928 keep dry-run output valid json (#9928) (@github-actions[bot], @martinrrm)f28cca9#9927 don't print the funding message for global installs (#9927) (@github-actions[bot], @lazerg)Chores
6ff3000#10010 pack: select workspace through config (#10010) (@github-actions[bot], @reggi)afdc5bd#9932 pass nodedir to node-gyp via npm_package_config env in node integration (#9932) (@reggi)83f95ff#9931 updatenode-integrationworkflow template to latest actions (#9931) (@reggi)f020fba#9925 recognize prefixed Node.js PR titles (#9925) (@github-actions[bot], @reggi)Dependencies
@npmcli/arborist@9.9.2@npmcli/config@10.13.0libnpmdiff@8.1.13libnpmexec@10.3.3libnpmfund@7.0.27libnpmpack@9.1.14libnpmpublish@11.2.1v11.19.1Compare Source
v11.19.0Compare Source
v11.18.0Compare Source
v11.17.0Compare Source
Features
ae8ac4e#9534 add min-release-age-exclude config (@JamieMagee, @caseyjhol)8ff3e48#9483 allowScripts tooling and inBundle hardening (#9483) (@github-actions[bot], @JamieMagee)Bug Fixes
847cdf8#9541 match dotted and versioned args in approve-scripts/deny-scripts (@owlstronaut)d99f7cb#9535 emit valid JSON from approve-scripts/deny-scripts --json (@owlstronaut)351a309#9499 pass script-shell to publish lifecycle hooks (#9499) (@github-actions[bot])4fa81df#9497 recognize allowScripts for local link targets (#9497) (@github-actions[bot], @cyphercodes, @cyphercodes)95cf2e9#9489 validate registry path for allow-remote tarballs (@Abhinav-143x)9dd219b#9462 respect allowScripts policy in prune, dedupe, uninstall, audit, and link (#9462) (@github-actions[bot], @JamieMagee)cd8d18a#9482 list pending scripts in approve-scripts when ignore-scripts is set (#9482) (@github-actions[bot], @JamieMagee)c14e87c#9481 suggest --allow-scripts for global installs in unreviewed-scripts warnings (#9481) (@github-actions[bot], @JamieMagee)7ade52e#9465 invalid issue template YAML indentation (#9465) (@github-actions[bot], @fallintoplace)c069622#9464 show full parent command path in subcommand usage errors (#9464) (@owlstronaut)1bb62bb#9454 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@JamieMagee)84eeb5f#9431 audit: don't apply min-release-age before filter when verifying installed signatures (@JamieMagee)3bd3377#9426 block forbidden keys in Queryable setter to prevent prototype pollution (@12122J, @claude)Documentation
a86a7a9#9522 approve-scripts only throws EGLOBAL when run with -g (@JamieMagee)693bb3d#9508 clarify package.json override value specs (#9508) (@github-actions[bot], @ded-furby)ccffe4a#9501 use the latest version for global update and outdated'swanted(#9501) (@github-actions[bot], @liangmiQwQ)66e97c2#9478 update minimum npm required for npm trust (@meeech)Dependencies
bd09b87#9542postcss-selector-parser@7.1.495bfc4c#9542tinyglobby@0.2.178c0d5fd#9542tar@7.5.16967d377#9542semver@7.8.4cdaac1b#9542pacote@21.5.125c8a9e#9542node-gyp@12.4.0Chores
2922fa4#9542 dev dependency updates (@owlstronaut)@npmcli/arborist@9.8.0@npmcli/config@10.11.0libnpmdiff@8.1.10libnpmexec@10.3.0libnpmfund@7.0.24libnpmpack@9.1.10v11.16.0Compare Source
Features
4b67f6e#9416 publish --access=private alias for restricted (#9416) (@github-actions[bot], @reggi, @Copilot)a10c7ca#9415 Phase 1 ofallowScriptsopt-in install-script policy (#9360) (#9415) (@owlstronaut, @JamieMagee)Bug Fixes
1f7869b#9411 fix typo of fullMetadata (@owlstronaut)cde03ba#9390 config: pause progress spinner during interactive editor spawn (#9388) (@github-actions[bot], @Zelys-DFKH, @claude)Documentation
c5e9d73#9390 Documentnpm_old_versionandnpm_new_versionenvironment variables (#9389) (@github-actions[bot], @36degrees)Dependencies
cdd7bbc#9421undici@6.26.0fde87c9#9421sigstore@4.1.12779793#9421lru-cache@11.5.1dea702d#9421@sigstore/verify@3.1.14eab03f#9421@sigstore/core@3.2.174c7323#9421@npmcli/agent@4.0.2edc4ab3#9421semver@7.8.15f6ce33#9421make-fetch-happen@15.0.6Chores
bd04976#9421 dev dependency updates (@owlstronaut)aeceb23#9407 sanitize newlines in flags table default and type values (#9407) (@reggi, @Copilot)@npmcli/arborist@9.7.0@npmcli/config@10.10.0libnpmdiff@8.1.9libnpmexec@10.2.9libnpmfund@7.0.23libnpmpack@9.1.9libnpmversion@8.0.4v11.15.0Compare Source
Features
0d5d899#9379 npm stage (@reggi, @Copilot)1433740#9376 add permissions support to trust commands (#9376) (@github-actions[bot], @reggi, @Copilot)8df10f5#9339 add allow-git/allow-file/allow-directory/allow-remote configs (@owlstronaut)Bug Fixes
39b625e#9381 key stage download --json output by package name (#9381) (@reggi, @Copilot)6aa332d#9339 allow min-release-age in npmrc to coexist with --before (@raazkhnl)468550f#9339 refactor #failureNode, adjust tests and safety (@owlstronaut)cabe249#9339 allow-remote=none does not block registry tarballs (@owlstronaut)Dependencies
8416a60#9383socks@2.8.95e5a25b#9383lru-cache@11.5.0a6f9ad2#9383ip-address@10.2.063f8114#9383brace-expansion@5.0.66918b4c#9383bin-links@6.0.2bf84079#9383tar@7.5.15bdef82c#9383semver@7.8.03f38a67#9383hosted-git-info@9.0.3Chores
816f3bf#9383 dev dependency updates (@owlstronaut)@npmcli/arborist@9.6.0@npmcli/config@10.9.1libnpmdiff@8.1.8libnpmexec@10.2.8libnpmfund@7.0.22libnpmpack@9.1.8libnpmpublish@11.2.0v11.14.1Compare Source
Bug Fixes
dca12cb#9328 remove settings (#9328) (@github-actions[bot], @owlstronaut)v11.14.0Compare Source
Features
45fc5e0#9288 add allow-directory, allow-file, and allow-remote (#9288) (@github-actions[bot], @wraithgar)Bug Fixes
6c17544#9318 sbom: dedupe per-node dependsOn / relationships (#9318) (@github-actions[bot], @mikaelkristiansson)Dependencies
840fe18#9322socks@10.1.1b771289#9322ip-address@10.1.1addffcb#9322cidr-regex@5.0.5Chores
041fd58#9322 dev dependency updates (@owlstronaut)89c505a#9320 add cli-triage team as codeowner (#9320) (@github-actions[bot], @owlstronaut)@npmcli/arborist@9.5.0@npmcli/config@10.9.0libnpmdiff@8.1.7libnpmexec@10.2.7libnpmfund@7.0.21libnpmpack@9.1.7v11.13.0Compare Source
Features
8e8dadb#9246 adduas alias forupdatecommand (#9246) (@github-actions[bot], @Ausoj)Bug Fixes
ecd161b#9258 ignore intended error code (@owlstronaut)Dependencies
8d2fdcd#9272lru-cache@11.3.5e603d36#9272node-gyp@12.3.0d48b7da#9272is-cidr@6.0.4032a5ca#9240@sigstore/protobuf-specs@0.5.133a81e7#9240tinyglobby@0.2.1668dc4a0#9240picomatch@4.0.41bb6703#9240lru-cache@11.3.337059e4#9240diff@8.0.4fb450ab#9240minimatch@10.2.57c4bbbf#9240tar@7.5.13703a3bc#9240minipass-flush@1.0.6Chores
e0724ac#9272 dev dependency updates (@owlstronaut)d249341#9230 don't run npm update in CI (@owlstronaut)@npmcli/arborist@9.4.3libnpmdiff@8.1.6libnpmexec@10.2.6libnpmfund@7.0.20libnpmpack@9.1.6v11.12.1Compare Source
Bug Fixes
596706a#9148 revert prefer-offline/prefer-online exclusivity (#9129) (@owlstronaut)Documentation
d1ee8a5#9140 Add note on relative path prefix for npm publish (#9140) (@pydsigner)Dependencies
@npmcli/config@10.8.1v11.12.0Compare Source
Features
8eff5fb#9049 audit: add --include-attestations flag to output sigstore bundles (#9049) (@mitchdenny)Bug Fixes
03af94d#9123 skip synopsis code block when command has no usage (@owlstronaut)21ea382#9110 arborist: resolve sibling override sets via common ancestor (#9110) (@manzoorwanijk)Dependencies
03f4c3a#9131@sigstore/tuf@4.0.24d5f7d9#9131@gar/promise-retry@1.0.38dcfe69#9131@sigstore/sign@4.1.1e5a7e22#9127lru-cache@11.2.782deab6#9127make-fetch-happen@15.0.5ce195dc#9127cacache@20.0.4Chores
95fa7f4#9132 fix docs test snapshot (#9132) (@wraithgar)7e9d538#9127 dev dependency updates (@wraithgar)920e5ed#9127 test snapshots (@wraithgar)98ccf92#9125 fix snap tests (@owlstronaut)@npmcli/arborist@9.4.2@npmcli/config@10.8.0libnpmdiff@8.1.5libnpmexec@10.2.5libnpmfund@7.0.19libnpmpack@9.1.5v11.11.1Compare Source
Bug Fixes
a9d242b#9099 include all subcommands on main command help (#9099) (@wraithgar)29b8407#9087 unwrap comments and lines meant for output (#9087) (@wraithgar)b56986a#9095 ls: suppress false UNMET DEPENDENCYs in linked strategy (#9095) (@manzoorwanijk)76c76e5#9083 ci: don't error on optional deps in the lockfile (#9083) (@wraithgar)a29aeee#9028 arborist: retry bin-links on Windows EPERM (#9028) (@manzoorwanijk)6565eeb#9045 bypass packument cache to prevent ETARGET errors after publish (#9045) (@Jadu07)Documentation
3b96929#9074 scripts: remove mention of obsolete root user behavior (#9074) (@mohd-akram)16ac4e0#9054 fix workspace cross-dependency documentation (@owlstronaut)Dependencies
075ae23#9086tar@7.5.1113fa40d#9086pacote@21.5.0bf7ea2b#9060brace-expansion@5.0.42000d2c#9060minimatch@10.2.4d86b260#9060tar@7.5.10dff1853#9060@npmcli/run-script@10.0.493c3365#9060write-file-atomic@7.0.1Chores
d1996a7#9060 dev dependency updates (@wraithgar)@npmcli/arborist@9.4.1libnpmdiff@8.1.4libnpmexec@10.2.4libnpmfund@7.0.18libnpmpack@9.1.4v11.11.0Compare Source
Features
4fcd352#9017 add :type(registry) to query selector syntax (#9017) (@wraithgar)e1b21f0#8909 adds circleci to trust command (#8909) (@owlstronaut)9a33ad0#8925 adds circleci to oidc (#8925) (@owlstronaut)Bug Fixes
4426411#9026 npm audit signatures for keyless attestation registries (#9026) (@ajayk)658b323#9010 handle legacy licenses array in sbom output (#9010) (@JNC4)Documentation
143f8cd#9007 docs shouldn't wrap yaml description (#9007) (@owlstronaut)Dependencies
7798b6e#9027@gar/promise-retry@1.0.24838864#9027balanced-match@4.0.40c200dd#9027brace-expansion@5.0.3f0606bb#9027spdx-license-ids@3.0.23d43f350#9027make-fetch-happen@15.0.44d0918a#9027@npmcli/git@7.0.28912ca7#9027minipass-fetch@5.0.2450ff35#9027npm-packlist@10.0.420ef5a5#9027pacote@21.4.060f332c#9008 remove promise-retrycb8b9c7#9008 add@gar/promise-retry@1.0.0@npmcli/arborist@9.4.0libnpmdiff@8.1.3libnpmexec@10.2.3libnpmfund@7.0.17libnpmpack@9.1.3v11.10.1Compare Source
Bug Fixes
9fac412#8995 improve unknown config warning with .npmrc section hint (#8995) (@umeshmore45)bb135cc#8981 arborist: fixpeerOptionaldependency resolution inbuildIdealTree(#8981) (@Saibamen, @cursoragent)5c03826#8993 remove tabular output from "npm view" (@wraithgar)4648f26#8993 remove tabular output from "npm team" (@wraithgar)Documentation
0a5756d#8998 clarify unsupported custom .npmrc keys and recommend alternatives (#8998) (@maitrawebtech)22c9153#8985 fix typo and grammar in README (#8985) (@csmit195, Chris)Dependencies
aa8ffbf#9002init-package-json@8.2.5(#9002)67a0f09#9001glob@13.0.656b8fd4#9001minimatch@10.2.2aa7fef5#9001minipass@7.1.3d3a4161#9000@npmcli/package-json@7.0.5(#9000)7aa9338#8993 remove cli-columnsf7f7c53#8991 hoist balanced-match10cb575#8991 hoist latest yallist1b3dc9a#8991cidr-regex@5.0.34307af6#8991glob@13.0.513b4d6a#8991minimatch@10.2.145d4000#8991tar@7.5.9Chores
40fcab4#8991@npmcli/template-oss@4.29.0(@wraithgar)1598adb#8991 dev dependency updates (@wraithgar)@npmcli/arborist@9.3.1@npmcli/config@10.7.1libnpmdiff@8.1.2libnpmexec@10.2.2libnpmfund@7.0.16libnpmpack@9.1.2v11.10.0Compare Source
Features
cf56a1e#8899 npm trust, per-command config (@reggi)cf56a1e#8899 npm trust (@reggi)66d6e11#8965 add min-release-age (#8965) (@wraithgar)Dependencies
aae84bf#8973pacote@21.3.18bcb675#8973cidr-regex@5.0.2f87aaab#8973lru-cache@11.2.6acec871#8973ssri@13.0.11e42a86#8973glob@13.0.2e1c08a4#8973is-cidr@6.0.3dfb0e34#8973semver@7.7.40ee7776#8973which@6.0.1Chores
eb81df8#8973 dev dependency updates (@wraithgar)995e757#8966 Clean up some todos, add tests for previously skipped blocks (@owlstronaut)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.