deps: upgrade npm to 11.6.1 by npm-cli-bot · Pull Request #60012 · nodejs/node · GitHub
Skip to content

deps: upgrade npm to 11.6.1#60012

Merged
nodejs-github-bot merged 1 commit intonodejs:mainfrom
npm:npm-v11.6.1-main
Oct 2, 2025
Merged

deps: upgrade npm to 11.6.1#60012
nodejs-github-bot merged 1 commit intonodejs:mainfrom
npm:npm-v11.6.1-main

Conversation

@npm-cli-bot
Copy link
Copy Markdown
Contributor

@npm-cli-bot npm-cli-bot commented Sep 25, 2025

11.6.1 (2025-09-23)

Bug Fixes

Documentation

Dependencies

Chores

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

nodejs-github-bot commented Sep 25, 2025

@nodejs-github-bot nodejs-github-bot added fast-track PRs that do not need to wait for 72 hours to land. needs-ci PRs that need a full CI run. npm Issues and PRs related to the npm client dependency or the npm registry. labels Sep 25, 2025
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Sep 25, 2025

Fast-track has been requested by @nodejs-github-bot. Please 👍 to approve.

@wraithgar
Copy link
Copy Markdown
Contributor

wraithgar commented Sep 25, 2025

The main update here is getting our subdependencies updated. Most of the npmcli ones needed semver major changes to get up to the same engines declaration as npm itself. This is a follow up task to any new major npm release, but this one just took awhile.

@richardlau richardlau added dont-land-on-v20.x PRs that should not land on the v20.x-staging branch and should not be released in v20.x. dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. labels Sep 25, 2025
@lpinca lpinca added the request-ci Add this label to start a Jenkins CI on a PR. label Sep 27, 2025
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Sep 27, 2025
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

nodejs-github-bot commented Sep 27, 2025

CI: https://ci.nodejs.org/job/node-test-pull-request/69394/

@aduh95 aduh95 removed the fast-track PRs that do not need to wait for 72 hours to land. label Sep 30, 2025
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

nodejs-github-bot commented Sep 30, 2025

CI: https://ci.nodejs.org/job/node-test-pull-request/69478/

@aduh95 aduh95 added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Sep 30, 2025
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

nodejs-github-bot commented Oct 2, 2025

CI: https://ci.nodejs.org/job/node-test-pull-request/69513/

@addaleax addaleax added the commit-queue Add this label to land a pull request using GitHub Actions. label Oct 2, 2025
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Oct 2, 2025
@nodejs-github-bot nodejs-github-bot merged commit 5d843c9 into nodejs:main Oct 2, 2025
82 checks passed
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

nodejs-github-bot commented Oct 2, 2025

Landed in 5d843c9

targos pushed a commit that referenced this pull request Oct 6, 2025
@npm-cli-bot @targos
deps: upgrade npm to 11.6.1
dc44c9f 
PR-URL: #60012
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
@github-actions github-actions Bot mentioned this pull request Oct 7, 2025
Merged
@ChALkeR
Copy link
Copy Markdown
Member

ChALkeR commented Oct 27, 2025 •
edited
Loading

This introduced a tar version which could expose uninitialized memory if zero-fill is disabled in #60423

See isaacs/node-tar#445

  1. Is affected code ever called from npm?
  2. If yes, is returning uninitialized process memory a concern?

This was referenced Oct 27, 2025
Closed
Merged
@wraithgar
Copy link
Copy Markdown
Contributor

wraithgar commented Oct 27, 2025 •
edited
Loading

I don't believe npm does any synchronous operations with tar.

$ npm query \#tar|npx json -a _id location from
tar@7.5.1 node_modules/tar [
  "node_modules/node-gyp",
  "node_modules/pacote",
  "workspaces/libnpmdiff",
  "node_modules/node-gyp/node_modules/cacache",
  ""
]

node-gyp does an async extract

$ grep -r tar\\. node_modules/node-gyp/lib/
node_modules/node-gyp/lib/install.js:          await tar.extract({
node_modules/node-gyp/lib/install.js:              tar.extract({

pacote does an async extract and list

node_modules/pacote/lib/dir.js:      .then(files => tar.c(tarCreateOptions(this.package), files)
node_modules/pacote/lib/fetcher.js:    const extractor = tar.x(this.#tarxOptions({ cwd: dest }))

libnpmdiff does an async create and list

workspaces/libnpmdiff/lib/index.js:const untar = require('./untar.js')
workspaces/libnpmdiff/lib/tarball.js:      tar.c(tarCreateOptions(manifest), files).concat()
workspaces/libnpmdiff/lib/untar.js:  tar.list({

npm itself does an async list

lib/utils/tar.js:  const stream = tar.t({

cacache never actually used it npm/cacache#312

@ChALkeR
Copy link
Copy Markdown
Member

ChALkeR commented Oct 28, 2025

@wraithgar Thanks! I also rechecked the usage here and it appears that the problematic codepath is indeed not used from npm

@ChALkeR ChALkeR mentioned this pull request Oct 28, 2025
Closed
@ChALkeR
Copy link
Copy Markdown
Member

ChALkeR commented Oct 28, 2025 •
edited
Loading

@Ankush-Pathak Ankush-Pathak mentioned this pull request Nov 4, 2025
Merged
@github-actions github-actions Bot mentioned this pull request Jan 3, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lpinca lpinca lpinca approved these changes

@targos targos targos approved these changes

@RafaelGSS RafaelGSS RafaelGSS approved these changes

Assignees

No one assigned

Labels

author ready PRs that have at least one approval, no pending requests for changes, and a CI started. dont-land-on-v20.x PRs that should not land on the v20.x-staging branch and should not be released in v20.x. dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. needs-ci PRs that need a full CI run. npm Issues and PRs related to the npm client dependency or the npm registry.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

10 participants

@npm-cli-bot @nodejs-github-bot @wraithgar @ChALkeR @lpinca @targos @RafaelGSS @addaleax @richardlau @aduh95