11.8.0 (2026-01-21)

Features

• 545e861 #8828 show proxy environment variables in npm config list (Max Black)

Bug Fixes

• c2f784d #8859 preserve serialNumber UUID in CycloneDX SBOM output #8837 (#8859) (@saksham-malhotra-27)
• f2c3af7 #8840 more intuitive byte formatting boundaries for rounding (#8840) (@watilde)

Documentation

• 3474ec3 #8866 fix typo/logic error in npm-dedupe docs (#8866) (@Schweinepriester)
• 5552e46 #8797 npm-install: explain package-lock.json behavior (#8797) (@MaxBlack-dev, Max Black)

Dependencies

• f478ca0 #8919 postcss-selector-parser@7.1.1
• 2b6a71f #8919 path-scurry@2.0.1
• 19096f2 #8919 sigstore@4.1.0
• e7f5d1e #8919 lru-cache@11.2.4
• 9e756ae #8919 ip-address@10.1.0
• f951820 #8919 common-ancestor-path@2.0.0
• 7a949ad #8919 @sigstore/verify@3.1.0
• 6979ce1 #8919 @sigstore/sign@4.1.0
• b4a6a41 #8919 @sigstore/core@3.1.0
• dc8a8e8 #8919 @sigstore/tuf@4.0.1
• be221ea #8919 validate-npm-package-name@7.0.2
• 149823d #8919 diff@8.0.3
• 32b2001 #8919 tar@7.5.4

Chores

• 8f599df #8919 pin jsdom to 27.0.0 (@wraithgar)
• f4f1161 #8919 dev dependency updates (@wraithgar)
• workspace: @npmcli/arborist@9.1.10
• workspace: @npmcli/config@10.5.0
• workspace: libnpmdiff@8.0.13
• workspace: libnpmexec@10.1.12
• workspace: libnpmfund@7.0.13
• workspace: libnpmpack@9.0.13

Dependencies

• workspace: @npmcli/arborist@9.1.10

Dependencies

• workspace: @npmcli/arborist@9.1.10

Dependencies

• workspace: @npmcli/arborist@9.1.10

Dependencies

• workspace: @npmcli/arborist@9.1.10

10.5.0 (2026-01-21)

Features

• 5a444d5 #8828 export environment config variable names (Max Black)

9.1.10 (2026-01-21)

Dependencies

• f951820 #8919 common-ancestor-path@2.0.0

11.7.0 (2025-12-09)

Features

• b380d15 #8697 add deduping to notices unless in verbose+ mode (@owlstronaut)

Bug Fixes

• 4ebb831 #8839 updates hints to use cli paradigm (@owlstronaut)
• 7896e51 #8838 update the token list text (@owlstronaut)
• 8ab8668 #8836 query: support package-lock-only in workspaces (@watilde)
• 35e8d38 #8322 properly handle newlines with input when using the spinner (#8322) (@mbtools)
• 0c0faae #8780 adduser: improve email prompt (#8780) (@mbtools)

Documentation

• 7f2ab9d #8810 scripts: replace deprecated prepublish and install examples with prepare (Max Black)
• 91ebab7 #8847 remove note about token create being disabled (@owlstronaut)
• 2030250 #8822 scripts: clarify prepare script runs with --production (Max Black)
• 33a50d7 #8821 scripts: update npm_package_* environment variables documentation (Max Black)
• 50508f9 #8793 package-json: add documentation for type field (#8793) (@MaxBlack-dev, Max Black)
• aa1dd7e #8823 scripts: document that prepare scripts run concurrently in workspaces (Max Black)
• 3f48487 #8820 package-spec: fix alias syntax in examples (Max Black)
• dd104da #8812 version: add note about git version requirements (Max Black)
• 58afdcc #8792 install: clarify prerelease version range behavior (Max Black)
• 9f818e8 #8795 npm-view: clarify object property access syntax and provide examples (Max Black)
• 39c2f2e #8791 add examples for command line flags including --prefix (Max Black)
• 1298530 #8790 clarify version field can be omitted in package-lock (Max Black)
• 090b6ca #8794 npx: clarify that arguments are passed to executed command (Max Black)
• a864f80 #8787 document gypfile field in package.json (Max Black)
• 2fc689d #8788 add field access patterns to npm view (Max Black)
• 4850639 #8796 package-json: add examples for replacing dependencies with forks in overrides (Max Black)
• 4864dd4 #8798 npm-install: document engines field priority when installing packages (Max Black)
• 95d25cd #8799 package-json: clarify repository field normalization during publish (Max Black)
• a367f9b #8800 package-lock-json: clarify that version field may be omitted for certain dependencies (Max Black)
• ffc9b71 #8801 npm-install: clarify --tag does not override package.json (#8801) (@MaxBlack-dev, Max Black)
• 73688ca #8735 clarify npm version behavior with prerelease versions (#8735) (@yashwantbezawada)
• 4a32606 #8785 updates the token create documentation (#8785) (@owlstronaut, @wraithgar)

Chores

• 54929ce #8836 update baseline-browser-mapping (@watilde)

Dependencies

• workspace: @npmcli/arborist@9.1.9
• workspace: @npmcli/config@10.4.5
• workspace: libnpmdiff@8.0.12
• workspace: libnpmexec@10.1.11
• workspace: libnpmfund@7.0.12
• workspace: libnpmpack@9.0.12

Dependencies

• workspace: @npmcli/arborist@9.1.9

Dependencies

• workspace: @npmcli/arborist@9.1.9