Skip to content

chore: release 11.13.0 - #9240

Merged
owlstronaut merged 1 commit into
release/v11from
release-please--branches--release/v11
Apr 22, 2026
Merged

chore: release 11.13.0#9240
owlstronaut merged 1 commit into
release/v11from
release-please--branches--release/v11

Conversation

@github-actions

@github-actions github-actions Bot commented Apr 15, 2026

Copy link
Copy Markdown
Contributor

🤖 I have created a release beep boop

11.13.0

11.13.0 (2026-04-22)

Features

Bug Fixes

Dependencies

Chores

arborist: 9.4.3

9.4.3 (2026-04-22)

Bug Fixes

libnpmdiff: 8.1.6

Dependencies

libnpmexec: 10.2.6

10.2.6 (2026-04-22)

Bug Fixes

Dependencies

libnpmfund: 7.0.20

Dependencies

libnpmpack: 9.1.6

Dependencies


This PR was generated with Release Please. See documentation.

@github-actions

github-actions Bot commented Apr 15, 2026

Copy link
Copy Markdown
Contributor Author

Release Manager

Release workflow run: https://github.com/npm/cli/actions/runs/24800315631

Release Checklist for v11.13.0

  • 1. Checkout the release branch

    Ensure git status is not dirty on this branch after resetting deps. If it is, then something is probably wrong with the automated release process.

    gh pr checkout 9240 --force
    npm run resetdeps
    node scripts/git-dirty.js
  • 2. Check CI status

    gh pr checks --watch
  • 3. Log in to npm

    npm login sessions are short lived, so you will want to have a fresh one before you publish.

    npm login
  • 4. Publish the CLI and workspaces

    Warning:
    This will publish all updated workspaces to latest, prerelease or backport depending on their version, and will publish the CLI with the dist-tag set to next-11.

    Note:
    The --test argument can optionally be omitted to run the publish process without running any tests locally.

    node scripts/publish.js --test
  • 5. Optionally install and test npm@11.13.0 locally

    npm i -g npm@11.13.0
    npm --version
    npm whoami
    npm help install
    # etc
  • 6. Set latest dist-tag to newly published version

    Warning:
    NOT FOR PRERELEASE: Do not run this step for prereleases or if 11 is not being set to latest.

    node . dist-tag add npm@11.13.0 latest
  • 7. Trigger docs.npmjs.com update

    gh workflow run update-cli.yml --repo npm/documentation
  • 8. Approve and Merge release PR

    gh pr review --approve
    gh pr merge --rebase
    git checkout release/v11
    git fetch
    git reset --hard origin/release/v11
    node . run resetdeps
  • 9. Wait For Release Tags

    Warning:
    The remaining steps all require the GitHub tags and releases to be created first. These are done once this PR has been labelled with autorelease: tagged.

    Release Please will run on the just merged release commit and create GitHub releases and tags for each package. The release bot will will comment on this PR when the releases and tags are created.

    Note:
    The release workflow also includes the Node integration tests which do not need to finish before continuing.

    You can watch the release workflow in your terminal with the following command:

    gh run watch `gh run list -R npm/cli -w release -b release/v11 -L 1 --json databaseId -q ".[0].databaseId"`
    
  • 10. Mark GitHub Release as latest

    Warning:
    You must wait for CI to create the release tags before running this step. These are done once this PR has been labelled with autorelease: tagged.

    Release Please will make GitHub Releases for the CLI and all workspaces, but GitHub has UI affordances for which release should appear as the "latest", which should always be the CLI. To mark the CLI release as latest run this command:

    gh release -R npm/cli edit v11.13.0 --latest
  • 11. Open nodejs/node PR to update npm

    Warning:
    You must wait for CI to create the release tags before running this step. These are done once this PR has been labelled with autorelease: tagged.

    Trigger the Create Node PR action. This will open a PR on nodejs/node to the main branch.

    First, sync our fork of node with the upstream source:

    gh repo sync npm/node --source nodejs/node --force

    Then, if we are opening a PR against the latest version of node:

    gh workflow run create-node-pr.yml -R npm/cli -f spec=next-11

    For backport releases, you must target the correct Node branch using -f branch=<NODE_MAJOR>. Make sure you are targeting the right Node major version for this npm version.

    For example, this will create a PR on nodejs/node to the v16.x-staging branch:

    gh workflow run create-node-pr.yml -R npm/cli -f spec=next-11 -f branch=16
  • 12. Label and fast-track nodejs/node PR

    Note:
    This requires being a nodejs collaborator. This could be you!

    • Thumbs-up reaction on the Fast-track comment
    • Add an LGTM / Approval
    • Add request-ci label to get it running CI
    • Add commit-queue label once everything is green
    • For backport releases, comment on the PR asking the Node.js team to add dont-land-on-v<NODE_MAJOR> labels for Node versions where this npm version should not be included

@github-actions
github-actions Bot force-pushed the release-please--branches--release/v11 branch 3 times, most recently from afe4ac7 to 317fe08 Compare April 15, 2026 18:44
@github-actions github-actions Bot changed the title chore: release 11.12.2 chore: release 11.13.0 Apr 16, 2026
@github-actions
github-actions Bot force-pushed the release-please--branches--release/v11 branch 4 times, most recently from c90b6d0 to 1cf0309 Compare April 17, 2026 15:21
pavel-kalmykov added a commit to pavel-kalmykov/bitbucket-server-mcp that referenced this pull request Apr 17, 2026
PR #34 moved semantic-release out of devDependencies to an ephemeral
`npm install --no-save --no-package-lock` in the release workflow.
That fixed Vulnerabilities 7->10 on OpenSSF Scorecard but dropped
Pinned-Dependencies 9->9 (still flagged) because Scorecard counts
`npm install` as unpinned; only `npm ci` against a lockfile is
accepted as pinned.

Move the tooling into a .release/ subpackage with its own
package-lock.json. The release workflow now runs `npm ci --prefix
.release` and executes the binary from .release/node_modules/.bin/.

Why this is the same audit outcome as PR #34 but without the scorecard
penalty: `npm audit` only walks the tree rooted at the current
directory. With tooling in .release/node_modules/, the root
`npm audit` never sees the bundled `npm` CLI or its vendored
brace-expansion/picomatch advisories; they are reachable only from
`.release/` which we never audit on main.

Upstream context: npm/cli#9194 tracks the same advisories
(brace-expansion GHSA-f886-m6hf-6m8v, picomatch GHSA-3v7f-55p6-f55p
and GHSA-c2c7-rcm5-vvqj). The fix lands in npm 11.13.0 (PR
npm/cli#9240). Once @semantic-release/npm picks it up via its
`^11.6.2` range, `npm update` inside `.release/` refreshes the
lockfile without any other churn.
pavel-kalmykov added a commit to pavel-kalmykov/bitbucket-server-mcp that referenced this pull request Apr 17, 2026
PR #34 (ephemeral install) traded Vulnerabilities 7→10 at the cost of
Pinned-Dependencies staying at 9 because `npm install --no-save` is
flagged as unpinned. PR #35 (.release/ subpackage with its own
lockfile) fixed Pinned-Dependencies 9→10 but osv-scanner then found
the bundled brace-expansion/picomatch advisories in the committed
`.release/package-lock.json` and Vulnerabilities fell back to 7.

Net: both approaches land at ~7.5-7.7 score, and both add
architectural noise (ephemeral install vs split tooling tree) that
exists solely to dodge `npm audit`.

Simpler path: restore semantic-release, @semantic-release/changelog,
@semantic-release/git in devDependencies; drop the .release/
subpackage and the Dependabot carve-out for it; revert the release
workflow to `npx semantic-release`. We accept Vulnerabilities 7 while
npm/cli#9194 lands (npm 11.13.0 bumps the bundled brace-expansion to
5.0.5 and picomatch to 4.0.4; release PR npm/cli#9240 open since
2026-04-15, historical merge-to-publish window 2-9 days).

Kept from the earlier scorecard sweep:
- Dockerfile multistage build using `npm ci` (Pinned-Dependencies 10)
- Branch protection: ruleset requires PR, no admin bypass
- fast-check pin at 4.6.0 (TS strict-build incompat in 4.7.0)

When npm 11.13.x lands, Dependabot will open the bump PR automatically
and Vulnerabilities goes back to 10 with zero manual changes here.
bitbucket-mcp-bot Bot pushed a commit to pavel-kalmykov/bitbucket-server-mcp that referenced this pull request Apr 17, 2026
## [0.6.7](v0.6.6...v0.6.7) (2026-04-17)

### Reverts

* restore semantic-release in devDependencies ([8c6e172](8c6e172)), closes [#34](#34) [#35](#35) [npm/cli#9194](npm/cli#9194) [npm/cli#9240](npm/cli#9240)
@github-actions
github-actions Bot force-pushed the release-please--branches--release/v11 branch 5 times, most recently from 21d2c50 to 20f358f Compare April 22, 2026 20:15
@github-actions
github-actions Bot force-pushed the release-please--branches--release/v11 branch from 20f358f to 77171f0 Compare April 22, 2026 20:16
@owlstronaut
owlstronaut merged commit 524590f into release/v11 Apr 22, 2026
107 checks passed
@owlstronaut
owlstronaut deleted the release-please--branches--release/v11 branch April 22, 2026 20:45
@github-actions

Copy link
Copy Markdown
Contributor Author

@github-actions

github-actions Bot commented Apr 22, 2026

Copy link
Copy Markdown
Contributor Author

Release Workflow

🚨🚨🚨

@npm/cli-team: The post-release workflow failed for this release. Manual steps may need to be taken after examining the workflow output.

🚨🚨🚨

renovate Bot added a commit to gwennlbh/swarpc that referenced this pull request Jul 30, 2026
##### [v11.18.0](npm/cli@v11.17.0...fef2b13)

##### [v11.17.0](https://github.com/npm/cli/releases/tag/v11.17.0)

##### Features

- [`ae8ac4e`](npm/cli@ae8ac4e) [#9534](npm/cli#9534) add min-release-age-exclude config ([@JamieMagee](https://github.com/JamieMagee), [@caseyjhol](https://github.com/caseyjhol))
- [`8ff3e48`](npm/cli@8ff3e48) [#9483](npm/cli#9483) allowScripts tooling and inBundle hardening ([#9483](npm/cli#9483)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))

##### Bug Fixes

- [`847cdf8`](npm/cli@847cdf8) [#9541](npm/cli#9541) match dotted and versioned args in approve-scripts/deny-scripts ([@owlstronaut](https://github.com/owlstronaut))
- [`d99f7cb`](npm/cli@d99f7cb) [#9535](npm/cli#9535) emit valid JSON from approve-scripts/deny-scripts --json ([@owlstronaut](https://github.com/owlstronaut))
- [`351a309`](npm/cli@351a309) [#9499](npm/cli#9499) pass script-shell to publish lifecycle hooks ([#9499](npm/cli#9499)) ([@github-actions](https://github.com/github-actions)\[bot])
- [`4fa81df`](npm/cli@4fa81df) [#9497](npm/cli#9497) recognize allowScripts for local link targets ([#9497](npm/cli#9497)) ([@github-actions](https://github.com/github-actions)\[bot], [@cyphercodes](https://github.com/cyphercodes), [@cyphercodes](https://github.com/cyphercodes))
- [`95cf2e9`](npm/cli@95cf2e9) [#9489](npm/cli#9489) validate registry path for allow-remote tarballs ([@Abhinav-143x](https://github.com/Abhinav-143x))
- [`9dd219b`](npm/cli@9dd219b) [#9462](npm/cli#9462) respect allowScripts policy in prune, dedupe, uninstall, audit, and link ([#9462](npm/cli#9462)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`cd8d18a`](npm/cli@cd8d18a) [#9482](npm/cli#9482) list pending scripts in approve-scripts when ignore-scripts is set ([#9482](npm/cli#9482)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`c14e87c`](npm/cli@c14e87c) [#9481](npm/cli#9481) suggest --allow-scripts for global installs in unreviewed-scripts warnings ([#9481](npm/cli#9481)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`7ade52e`](npm/cli@7ade52e) [#9465](npm/cli#9465) invalid issue template YAML indentation ([#9465](npm/cli#9465)) ([@github-actions](https://github.com/github-actions)\[bot], [@fallintoplace](https://github.com/fallintoplace))
- [`c069622`](npm/cli@c069622) [#9464](npm/cli#9464) show full parent command path in subcommand usage errors ([#9464](npm/cli#9464)) ([@owlstronaut](https://github.com/owlstronaut))
- [`1bb62bb`](npm/cli@1bb62bb) [#9454](npm/cli#9454) config: clarify --all help so it's accurate for approve-scripts and deny-scripts ([@JamieMagee](https://github.com/JamieMagee))
- [`84eeb5f`](npm/cli@84eeb5f) [#9431](npm/cli#9431) audit: don't apply min-release-age before filter when verifying installed signatures ([@JamieMagee](https://github.com/JamieMagee))
- [`3bd3377`](npm/cli@3bd3377) [#9426](npm/cli#9426) block forbidden keys in Queryable setter to prevent prototype pollution ([@12122J](https://github.com/12122J), [@claude](https://github.com/claude))

##### Documentation

- [`a86a7a9`](npm/cli@a86a7a9) [#9522](npm/cli#9522) approve-scripts only throws EGLOBAL when run with -g ([@JamieMagee](https://github.com/JamieMagee))
- [`693bb3d`](npm/cli@693bb3d) [#9508](npm/cli#9508) clarify package.json override value specs ([#9508](npm/cli#9508)) ([@github-actions](https://github.com/github-actions)\[bot], [@ded-furby](https://github.com/ded-furby))
- [`ccffe4a`](npm/cli@ccffe4a) [#9501](npm/cli#9501) use the latest version for global update and outdated's `wanted` ([#9501](npm/cli#9501)) ([@github-actions](https://github.com/github-actions)\[bot], [@liangmiQwQ](https://github.com/liangmiQwQ))
- [`66e97c2`](npm/cli@66e97c2) [#9478](npm/cli#9478) update minimum npm required for npm trust ([@meeech](https://github.com/meeech))

##### Dependencies

- [`bd09b87`](npm/cli@bd09b87) [#9542](npm/cli#9542) `postcss-selector-parser@7.1.4`
- [`95bfc4c`](npm/cli@95bfc4c) [#9542](npm/cli#9542) `tinyglobby@0.2.17`
- [`8c0d5fd`](npm/cli@8c0d5fd) [#9542](npm/cli#9542) `tar@7.5.16`
- [`967d377`](npm/cli@967d377) [#9542](npm/cli#9542) `semver@7.8.4`
- [`cdaac1b`](npm/cli@cdaac1b) [#9542](npm/cli#9542) `pacote@21.5.1`
- [`25c8a9e`](npm/cli@25c8a9e) [#9542](npm/cli#9542) `node-gyp@12.4.0`

##### Chores

- [`2922fa4`](npm/cli@2922fa4) [#9542](npm/cli#9542) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.8.0): `@npmcli/arborist@9.8.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.11.0): `@npmcli/config@10.11.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.10): `libnpmdiff@8.1.10`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.0): `libnpmexec@10.3.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.24): `libnpmfund@7.0.24`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.10): `libnpmpack@9.1.10`
##### [v11.16.0](https://github.com/npm/cli/releases/tag/v11.16.0)

##### Features

- [`4b67f6e`](npm/cli@4b67f6e) [#9416](npm/cli#9416) publish --access=private alias for restricted ([#9416](npm/cli#9416)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`a10c7ca`](npm/cli@a10c7ca) [#9415](npm/cli#9415) Phase 1 of `allowScripts` opt-in install-script policy ([#9360](npm/cli#9360)) ([#9415](npm/cli#9415)) ([@owlstronaut](https://github.com/owlstronaut), [@JamieMagee](https://github.com/JamieMagee))

##### Bug Fixes

- [`1f7869b`](npm/cli@1f7869b) [#9411](npm/cli#9411) fix typo of fullMetadata ([@owlstronaut](https://github.com/owlstronaut))
- [`cde03ba`](npm/cli@cde03ba) [#9390](npm/cli#9390) config: pause progress spinner during interactive editor spawn ([#9388](npm/cli#9388)) ([@github-actions](https://github.com/github-actions)\[bot], [@Zelys-DFKH](https://github.com/Zelys-DFKH), [@claude](https://github.com/claude))

##### Documentation

- [`c5e9d73`](npm/cli@c5e9d73) [#9390](npm/cli#9390) Document `npm_old_version` and `npm_new_version` environment variables ([#9389](npm/cli#9389)) ([@github-actions](https://github.com/github-actions)\[bot], [@36degrees](https://github.com/36degrees))

##### Dependencies

- [`cdd7bbc`](npm/cli@cdd7bbc) [#9421](npm/cli#9421) `undici@6.26.0`
- [`fde87c9`](npm/cli@fde87c9) [#9421](npm/cli#9421) `sigstore@4.1.1`
- [`2779793`](npm/cli@2779793) [#9421](npm/cli#9421) `lru-cache@11.5.1`
- [`dea702d`](npm/cli@dea702d) [#9421](npm/cli#9421) `@sigstore/verify@3.1.1`
- [`4eab03f`](npm/cli@4eab03f) [#9421](npm/cli#9421) `@sigstore/core@3.2.1`
- [`74c7323`](npm/cli@74c7323) [#9421](npm/cli#9421) `@npmcli/agent@4.0.2`
- [`edc4ab3`](npm/cli@edc4ab3) [#9421](npm/cli#9421) `semver@7.8.1`
- [`5f6ce33`](npm/cli@5f6ce33) [#9421](npm/cli#9421) `make-fetch-happen@15.0.6`

##### Chores

- [`bd04976`](npm/cli@bd04976) [#9421](npm/cli#9421) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`aeceb23`](npm/cli@aeceb23) [#9407](npm/cli#9407) sanitize newlines in flags table default and type values ([#9407](npm/cli#9407)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/arborist@9.7.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.10.0): `@npmcli/config@10.10.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.9): `libnpmdiff@8.1.9`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.9): `libnpmexec@10.2.9`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.23): `libnpmfund@7.0.23`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.9): `libnpmpack@9.1.9`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmversion-v8.0.4): `libnpmversion@8.0.4`
##### [v11.15.0](https://github.com/npm/cli/releases/tag/v11.15.0)

##### Features

- [`0d5d899`](npm/cli@0d5d899) [#9379](npm/cli#9379) npm stage ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`1433740`](npm/cli@1433740) [#9376](npm/cli#9376) add permissions support to trust commands ([#9376](npm/cli#9376)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`8df10f5`](npm/cli@8df10f5) [#9339](npm/cli#9339) add allow-git/allow-file/allow-directory/allow-remote configs ([@owlstronaut](https://github.com/owlstronaut))

##### Bug Fixes

- [`39b625e`](npm/cli@39b625e) [#9381](npm/cli#9381) key stage download --json output by package name ([#9381](npm/cli#9381)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`6aa332d`](npm/cli@6aa332d) [#9339](npm/cli#9339) allow min-release-age in npmrc to coexist with --before ([@raazkhnl](https://github.com/raazkhnl))
- [`468550f`](npm/cli@468550f) [#9339](npm/cli#9339) refactor #failureNode, adjust tests and safety ([@owlstronaut](https://github.com/owlstronaut))
- [`cabe249`](npm/cli@cabe249) [#9339](npm/cli#9339) allow-remote=none does not block registry tarballs ([@owlstronaut](https://github.com/owlstronaut))

##### Dependencies

- [`8416a60`](npm/cli@8416a60) [#9383](npm/cli#9383) `socks@2.8.9`
- [`5e5a25b`](npm/cli@5e5a25b) [#9383](npm/cli#9383) `lru-cache@11.5.0`
- [`a6f9ad2`](npm/cli@a6f9ad2) [#9383](npm/cli#9383) `ip-address@10.2.0`
- [`63f8114`](npm/cli@63f8114) [#9383](npm/cli#9383) `brace-expansion@5.0.6`
- [`6918b4c`](npm/cli@6918b4c) [#9383](npm/cli#9383) `bin-links@6.0.2`
- [`bf84079`](npm/cli@bf84079) [#9383](npm/cli#9383) `tar@7.5.15`
- [`bdef82c`](npm/cli@bdef82c) [#9383](npm/cli#9383) `semver@7.8.0`
- [`3f38a67`](npm/cli@3f38a67) [#9383](npm/cli#9383) `hosted-git-info@9.0.3`

##### Chores

- [`816f3bf`](npm/cli@816f3bf) [#9383](npm/cli#9383) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.1): `@npmcli/config@10.9.1`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.8): `libnpmdiff@8.1.8`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.8): `libnpmexec@10.2.8`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.22): `libnpmfund@7.0.22`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.8): `libnpmpack@9.1.8`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v11.2.0): `libnpmpublish@11.2.0`
##### [v11.14.1](https://github.com/npm/cli/releases/tag/v11.14.1)

##### Bug Fixes

- [`dca12cb`](npm/cli@dca12cb) [#9328](npm/cli#9328) remove settings ([#9328](npm/cli#9328)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut))
##### [v11.14.0](https://github.com/npm/cli/releases/tag/v11.14.0)

##### Features

- [`45fc5e0`](npm/cli@45fc5e0) [#9288](npm/cli#9288) add allow-directory, allow-file, and allow-remote ([#9288](npm/cli#9288)) ([@github-actions](https://github.com/github-actions)\[bot], [@wraithgar](https://github.com/wraithgar))

##### Bug Fixes

- [`6c17544`](npm/cli@6c17544) [#9318](npm/cli#9318) sbom: dedupe per-node dependsOn / relationships ([#9318](npm/cli#9318)) ([@github-actions](https://github.com/github-actions)\[bot], [@mikaelkristiansson](https://github.com/mikaelkristiansson))

##### Dependencies

- [`840fe18`](npm/cli@840fe18) [#9322](npm/cli#9322) `socks@10.1.1`
- [`b771289`](npm/cli@b771289) [#9322](npm/cli#9322) `ip-address@10.1.1`
- [`addffcb`](npm/cli@addffcb) [#9322](npm/cli#9322) `cidr-regex@5.0.5`

##### Chores

- [`041fd58`](npm/cli@041fd58) [#9322](npm/cli#9322) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`89c505a`](npm/cli@89c505a) [#9320](npm/cli#9320) add cli-triage team as codeowner ([#9320](npm/cli#9320)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.0): `@npmcli/config@10.9.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.7): `libnpmdiff@8.1.7`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.7): `libnpmexec@10.2.7`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.21): `libnpmfund@7.0.21`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.7): `libnpmpack@9.1.7`
##### [v11.13.0](https://github.com/npm/cli/releases/tag/v11.13.0)

##### Features

- [`8e8dadb`](npm/cli@8e8dadb) [#9246](npm/cli#9246) add `u` as alias for `update` command ([#9246](npm/cli#9246)) ([@github-actions](https://github.com/github-actions)\[bot], [@Ausoj](https://github.com/Ausoj))

##### Bug Fixes

- [`ecd161b`](npm/cli@ecd161b) [#9258](npm/cli#9258) ignore intended error code ([@owlstronaut](https://github.com/owlstronaut))

##### Dependencies

- [`8d2fdcd`](npm/cli@8d2fdcd) [#9272](npm/cli#9272) `lru-cache@11.3.5`
- [`e603d36`](npm/cli@e603d36) [#9272](npm/cli#9272) `node-gyp@12.3.0`
- [`d48b7da`](npm/cli@d48b7da) [#9272](npm/cli#9272) `is-cidr@6.0.4`
- [`032a5ca`](npm/cli@032a5ca) [#9240](npm/cli#9240) `@sigstore/protobuf-specs@0.5.1`
- [`33a81e7`](npm/cli@33a81e7) [#9240](npm/cli#9240) `tinyglobby@0.2.16`
- [`68dc4a0`](npm/cli@68dc4a0) [#9240](npm/cli#9240) `picomatch@4.0.4`
- [`1bb6703`](npm/cli@1bb6703) [#9240](npm/cli#9240) `lru-cache@11.3.3`
- [`37059e4`](npm/cli@37059e4) [#9240](npm/cli#9240) `diff@8.0.4`
- [`fb450ab`](npm/cli@fb450ab) [#9240](npm/cli#9240) `minimatch@10.2.5`
- [`7c4bbbf`](npm/cli@7c4bbbf) [#9240](npm/cli#9240) `tar@7.5.13`
- [`703a3bc`](npm/cli@703a3bc) [#9240](npm/cli#9240) `minipass-flush@1.0.6`

##### Chores

- [`e0724ac`](npm/cli@e0724ac) [#9272](npm/cli#9272) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`d249341`](npm/cli@d249341) [#9230](npm/cli#9230) don't run npm update in CI ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.4.3): `@npmcli/arborist@9.4.3`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.6): `libnpmdiff@8.1.6`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.6): `libnpmexec@10.2.6`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.20): `libnpmfund@7.0.20`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.6): `libnpmpack@9.1.6`
renovate Bot added a commit to gwennlbh/swarpc that referenced this pull request Aug 5, 2026
##### [v11.19.0](npm/cli@v11.18.0...6a8a1b9)

##### [v11.18.0](npm/cli@v11.17.0...fef2b13)

##### [v11.17.0](https://github.com/npm/cli/releases/tag/v11.17.0)

##### Features

- [`ae8ac4e`](npm/cli@ae8ac4e) [#9534](npm/cli#9534) add min-release-age-exclude config ([@JamieMagee](https://github.com/JamieMagee), [@caseyjhol](https://github.com/caseyjhol))
- [`8ff3e48`](npm/cli@8ff3e48) [#9483](npm/cli#9483) allowScripts tooling and inBundle hardening ([#9483](npm/cli#9483)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))

##### Bug Fixes

- [`847cdf8`](npm/cli@847cdf8) [#9541](npm/cli#9541) match dotted and versioned args in approve-scripts/deny-scripts ([@owlstronaut](https://github.com/owlstronaut))
- [`d99f7cb`](npm/cli@d99f7cb) [#9535](npm/cli#9535) emit valid JSON from approve-scripts/deny-scripts --json ([@owlstronaut](https://github.com/owlstronaut))
- [`351a309`](npm/cli@351a309) [#9499](npm/cli#9499) pass script-shell to publish lifecycle hooks ([#9499](npm/cli#9499)) ([@github-actions](https://github.com/github-actions)\[bot])
- [`4fa81df`](npm/cli@4fa81df) [#9497](npm/cli#9497) recognize allowScripts for local link targets ([#9497](npm/cli#9497)) ([@github-actions](https://github.com/github-actions)\[bot], [@cyphercodes](https://github.com/cyphercodes), [@cyphercodes](https://github.com/cyphercodes))
- [`95cf2e9`](npm/cli@95cf2e9) [#9489](npm/cli#9489) validate registry path for allow-remote tarballs ([@Abhinav-143x](https://github.com/Abhinav-143x))
- [`9dd219b`](npm/cli@9dd219b) [#9462](npm/cli#9462) respect allowScripts policy in prune, dedupe, uninstall, audit, and link ([#9462](npm/cli#9462)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`cd8d18a`](npm/cli@cd8d18a) [#9482](npm/cli#9482) list pending scripts in approve-scripts when ignore-scripts is set ([#9482](npm/cli#9482)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`c14e87c`](npm/cli@c14e87c) [#9481](npm/cli#9481) suggest --allow-scripts for global installs in unreviewed-scripts warnings ([#9481](npm/cli#9481)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`7ade52e`](npm/cli@7ade52e) [#9465](npm/cli#9465) invalid issue template YAML indentation ([#9465](npm/cli#9465)) ([@github-actions](https://github.com/github-actions)\[bot], [@fallintoplace](https://github.com/fallintoplace))
- [`c069622`](npm/cli@c069622) [#9464](npm/cli#9464) show full parent command path in subcommand usage errors ([#9464](npm/cli#9464)) ([@owlstronaut](https://github.com/owlstronaut))
- [`1bb62bb`](npm/cli@1bb62bb) [#9454](npm/cli#9454) config: clarify --all help so it's accurate for approve-scripts and deny-scripts ([@JamieMagee](https://github.com/JamieMagee))
- [`84eeb5f`](npm/cli@84eeb5f) [#9431](npm/cli#9431) audit: don't apply min-release-age before filter when verifying installed signatures ([@JamieMagee](https://github.com/JamieMagee))
- [`3bd3377`](npm/cli@3bd3377) [#9426](npm/cli#9426) block forbidden keys in Queryable setter to prevent prototype pollution ([@12122J](https://github.com/12122J), [@claude](https://github.com/claude))

##### Documentation

- [`a86a7a9`](npm/cli@a86a7a9) [#9522](npm/cli#9522) approve-scripts only throws EGLOBAL when run with -g ([@JamieMagee](https://github.com/JamieMagee))
- [`693bb3d`](npm/cli@693bb3d) [#9508](npm/cli#9508) clarify package.json override value specs ([#9508](npm/cli#9508)) ([@github-actions](https://github.com/github-actions)\[bot], [@ded-furby](https://github.com/ded-furby))
- [`ccffe4a`](npm/cli@ccffe4a) [#9501](npm/cli#9501) use the latest version for global update and outdated's `wanted` ([#9501](npm/cli#9501)) ([@github-actions](https://github.com/github-actions)\[bot], [@liangmiQwQ](https://github.com/liangmiQwQ))
- [`66e97c2`](npm/cli@66e97c2) [#9478](npm/cli#9478) update minimum npm required for npm trust ([@meeech](https://github.com/meeech))

##### Dependencies

- [`bd09b87`](npm/cli@bd09b87) [#9542](npm/cli#9542) `postcss-selector-parser@7.1.4`
- [`95bfc4c`](npm/cli@95bfc4c) [#9542](npm/cli#9542) `tinyglobby@0.2.17`
- [`8c0d5fd`](npm/cli@8c0d5fd) [#9542](npm/cli#9542) `tar@7.5.16`
- [`967d377`](npm/cli@967d377) [#9542](npm/cli#9542) `semver@7.8.4`
- [`cdaac1b`](npm/cli@cdaac1b) [#9542](npm/cli#9542) `pacote@21.5.1`
- [`25c8a9e`](npm/cli@25c8a9e) [#9542](npm/cli#9542) `node-gyp@12.4.0`

##### Chores

- [`2922fa4`](npm/cli@2922fa4) [#9542](npm/cli#9542) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.8.0): `@npmcli/arborist@9.8.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.11.0): `@npmcli/config@10.11.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.10): `libnpmdiff@8.1.10`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.0): `libnpmexec@10.3.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.24): `libnpmfund@7.0.24`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.10): `libnpmpack@9.1.10`
##### [v11.16.0](https://github.com/npm/cli/releases/tag/v11.16.0)

##### Features

- [`4b67f6e`](npm/cli@4b67f6e) [#9416](npm/cli#9416) publish --access=private alias for restricted ([#9416](npm/cli#9416)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`a10c7ca`](npm/cli@a10c7ca) [#9415](npm/cli#9415) Phase 1 of `allowScripts` opt-in install-script policy ([#9360](npm/cli#9360)) ([#9415](npm/cli#9415)) ([@owlstronaut](https://github.com/owlstronaut), [@JamieMagee](https://github.com/JamieMagee))

##### Bug Fixes

- [`1f7869b`](npm/cli@1f7869b) [#9411](npm/cli#9411) fix typo of fullMetadata ([@owlstronaut](https://github.com/owlstronaut))
- [`cde03ba`](npm/cli@cde03ba) [#9390](npm/cli#9390) config: pause progress spinner during interactive editor spawn ([#9388](npm/cli#9388)) ([@github-actions](https://github.com/github-actions)\[bot], [@Zelys-DFKH](https://github.com/Zelys-DFKH), [@claude](https://github.com/claude))

##### Documentation

- [`c5e9d73`](npm/cli@c5e9d73) [#9390](npm/cli#9390) Document `npm_old_version` and `npm_new_version` environment variables ([#9389](npm/cli#9389)) ([@github-actions](https://github.com/github-actions)\[bot], [@36degrees](https://github.com/36degrees))

##### Dependencies

- [`cdd7bbc`](npm/cli@cdd7bbc) [#9421](npm/cli#9421) `undici@6.26.0`
- [`fde87c9`](npm/cli@fde87c9) [#9421](npm/cli#9421) `sigstore@4.1.1`
- [`2779793`](npm/cli@2779793) [#9421](npm/cli#9421) `lru-cache@11.5.1`
- [`dea702d`](npm/cli@dea702d) [#9421](npm/cli#9421) `@sigstore/verify@3.1.1`
- [`4eab03f`](npm/cli@4eab03f) [#9421](npm/cli#9421) `@sigstore/core@3.2.1`
- [`74c7323`](npm/cli@74c7323) [#9421](npm/cli#9421) `@npmcli/agent@4.0.2`
- [`edc4ab3`](npm/cli@edc4ab3) [#9421](npm/cli#9421) `semver@7.8.1`
- [`5f6ce33`](npm/cli@5f6ce33) [#9421](npm/cli#9421) `make-fetch-happen@15.0.6`

##### Chores

- [`bd04976`](npm/cli@bd04976) [#9421](npm/cli#9421) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`aeceb23`](npm/cli@aeceb23) [#9407](npm/cli#9407) sanitize newlines in flags table default and type values ([#9407](npm/cli#9407)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/arborist@9.7.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.10.0): `@npmcli/config@10.10.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.9): `libnpmdiff@8.1.9`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.9): `libnpmexec@10.2.9`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.23): `libnpmfund@7.0.23`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.9): `libnpmpack@9.1.9`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmversion-v8.0.4): `libnpmversion@8.0.4`
##### [v11.15.0](https://github.com/npm/cli/releases/tag/v11.15.0)

##### Features

- [`0d5d899`](npm/cli@0d5d899) [#9379](npm/cli#9379) npm stage ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`1433740`](npm/cli@1433740) [#9376](npm/cli#9376) add permissions support to trust commands ([#9376](npm/cli#9376)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`8df10f5`](npm/cli@8df10f5) [#9339](npm/cli#9339) add allow-git/allow-file/allow-directory/allow-remote configs ([@owlstronaut](https://github.com/owlstronaut))

##### Bug Fixes

- [`39b625e`](npm/cli@39b625e) [#9381](npm/cli#9381) key stage download --json output by package name ([#9381](npm/cli#9381)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`6aa332d`](npm/cli@6aa332d) [#9339](npm/cli#9339) allow min-release-age in npmrc to coexist with --before ([@raazkhnl](https://github.com/raazkhnl))
- [`468550f`](npm/cli@468550f) [#9339](npm/cli#9339) refactor #failureNode, adjust tests and safety ([@owlstronaut](https://github.com/owlstronaut))
- [`cabe249`](npm/cli@cabe249) [#9339](npm/cli#9339) allow-remote=none does not block registry tarballs ([@owlstronaut](https://github.com/owlstronaut))

##### Dependencies

- [`8416a60`](npm/cli@8416a60) [#9383](npm/cli#9383) `socks@2.8.9`
- [`5e5a25b`](npm/cli@5e5a25b) [#9383](npm/cli#9383) `lru-cache@11.5.0`
- [`a6f9ad2`](npm/cli@a6f9ad2) [#9383](npm/cli#9383) `ip-address@10.2.0`
- [`63f8114`](npm/cli@63f8114) [#9383](npm/cli#9383) `brace-expansion@5.0.6`
- [`6918b4c`](npm/cli@6918b4c) [#9383](npm/cli#9383) `bin-links@6.0.2`
- [`bf84079`](npm/cli@bf84079) [#9383](npm/cli#9383) `tar@7.5.15`
- [`bdef82c`](npm/cli@bdef82c) [#9383](npm/cli#9383) `semver@7.8.0`
- [`3f38a67`](npm/cli@3f38a67) [#9383](npm/cli#9383) `hosted-git-info@9.0.3`

##### Chores

- [`816f3bf`](npm/cli@816f3bf) [#9383](npm/cli#9383) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.1): `@npmcli/config@10.9.1`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.8): `libnpmdiff@8.1.8`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.8): `libnpmexec@10.2.8`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.22): `libnpmfund@7.0.22`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.8): `libnpmpack@9.1.8`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v11.2.0): `libnpmpublish@11.2.0`
##### [v11.14.1](https://github.com/npm/cli/releases/tag/v11.14.1)

##### Bug Fixes

- [`dca12cb`](npm/cli@dca12cb) [#9328](npm/cli#9328) remove settings ([#9328](npm/cli#9328)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut))
##### [v11.14.0](https://github.com/npm/cli/releases/tag/v11.14.0)

##### Features

- [`45fc5e0`](npm/cli@45fc5e0) [#9288](npm/cli#9288) add allow-directory, allow-file, and allow-remote ([#9288](npm/cli#9288)) ([@github-actions](https://github.com/github-actions)\[bot], [@wraithgar](https://github.com/wraithgar))

##### Bug Fixes

- [`6c17544`](npm/cli@6c17544) [#9318](npm/cli#9318) sbom: dedupe per-node dependsOn / relationships ([#9318](npm/cli#9318)) ([@github-actions](https://github.com/github-actions)\[bot], [@mikaelkristiansson](https://github.com/mikaelkristiansson))

##### Dependencies

- [`840fe18`](npm/cli@840fe18) [#9322](npm/cli#9322) `socks@10.1.1`
- [`b771289`](npm/cli@b771289) [#9322](npm/cli#9322) `ip-address@10.1.1`
- [`addffcb`](npm/cli@addffcb) [#9322](npm/cli#9322) `cidr-regex@5.0.5`

##### Chores

- [`041fd58`](npm/cli@041fd58) [#9322](npm/cli#9322) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`89c505a`](npm/cli@89c505a) [#9320](npm/cli#9320) add cli-triage team as codeowner ([#9320](npm/cli#9320)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.0): `@npmcli/config@10.9.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.7): `libnpmdiff@8.1.7`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.7): `libnpmexec@10.2.7`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.21): `libnpmfund@7.0.21`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.7): `libnpmpack@9.1.7`
##### [v11.13.0](https://github.com/npm/cli/releases/tag/v11.13.0)

##### Features

- [`8e8dadb`](npm/cli@8e8dadb) [#9246](npm/cli#9246) add `u` as alias for `update` command ([#9246](npm/cli#9246)) ([@github-actions](https://github.com/github-actions)\[bot], [@Ausoj](https://github.com/Ausoj))

##### Bug Fixes

- [`ecd161b`](npm/cli@ecd161b) [#9258](npm/cli#9258) ignore intended error code ([@owlstronaut](https://github.com/owlstronaut))

##### Dependencies

- [`8d2fdcd`](npm/cli@8d2fdcd) [#9272](npm/cli#9272) `lru-cache@11.3.5`
- [`e603d36`](npm/cli@e603d36) [#9272](npm/cli#9272) `node-gyp@12.3.0`
- [`d48b7da`](npm/cli@d48b7da) [#9272](npm/cli#9272) `is-cidr@6.0.4`
- [`032a5ca`](npm/cli@032a5ca) [#9240](npm/cli#9240) `@sigstore/protobuf-specs@0.5.1`
- [`33a81e7`](npm/cli@33a81e7) [#9240](npm/cli#9240) `tinyglobby@0.2.16`
- [`68dc4a0`](npm/cli@68dc4a0) [#9240](npm/cli#9240) `picomatch@4.0.4`
- [`1bb6703`](npm/cli@1bb6703) [#9240](npm/cli#9240) `lru-cache@11.3.3`
- [`37059e4`](npm/cli@37059e4) [#9240](npm/cli#9240) `diff@8.0.4`
- [`fb450ab`](npm/cli@fb450ab) [#9240](npm/cli#9240) `minimatch@10.2.5`
- [`7c4bbbf`](npm/cli@7c4bbbf) [#9240](npm/cli#9240) `tar@7.5.13`
- [`703a3bc`](npm/cli@703a3bc) [#9240](npm/cli#9240) `minipass-flush@1.0.6`

##### Chores

- [`e0724ac`](npm/cli@e0724ac) [#9272](npm/cli#9272) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`d249341`](npm/cli@d249341) [#9230](npm/cli#9230) don't run npm update in CI ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.4.3): `@npmcli/arborist@9.4.3`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.6): `libnpmdiff@8.1.6`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.6): `libnpmexec@10.2.6`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.20): `libnpmfund@7.0.20`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.6): `libnpmpack@9.1.6`
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant