iframe-proxy

github-actions · 2026-05-21T15:52:18Z

🤖 I have created a release beep boop

12.0.0-pre.1

12.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

Preserve https protocol when working with git (fix!: Preserve https protocol when working with git #8703)
The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
root `preinstall` now runs before dependencies are installed.
unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning.

Features

ce7681f #9496 packageExtensions for root-owned dependency manifest repairs (feat: packageExtensions for root-owned dependency manifest repairs #9496) (@manzoorwanijk)
1db885c #9439 native dependency patching (npm patch add/commit/update/ls/rm) (feat: native dependency patching (npm patch add/commit/update/ls/rm) #9439) (@manzoorwanijk)
fc80bb3 #9234 remove default license for npm init (@owlstronaut)
be8053c #9544 warn when min-release-age blocks an audit fix (feat: warn when min-release-age blocks an audit fix #9544) (@JamieMagee)
18eb967 #9559 bump to new node engine range (@owlstronaut)
c3e1a71 #9532 add min-release-age-exclude config (@JamieMagee, @caseyjhol)
5cd5150 #9424 default-deny install scripts (allowScripts opt-in) [v12] (@JamieMagee)
64e3f79 #9480 allowScripts tooling and inBundle hardening (feat: allowScripts tooling and inBundle hardening #9480) (@JamieMagee)
caa3295 #9466 default allow-git and allow-remote to none (@owlstronaut)
f2e4a28 #9351 add a global npmignore file (feat: add a global npmignore file #9351) (@ljharb)
c9be2d1 #9153 publish --access=private alias for restricted (feat: publish --access=private alias for restricted #9153) (@reggi, @Copilot)
7068d42 #9360 Phase 1 of allowScripts opt-in install-script policy (feat: Phase 1 of allowScripts opt-in install-script policy #9360) (@JamieMagee)
979518d #9276 error on unknown configs, flags, and abbreviations (feat!: error on unknown configs, flags, and abbreviations #9276) (@owlstronaut)

Bug Fixes

e96a7de #8703 Preserve https protocol when working with git (fix!: Preserve https protocol when working with git #8703) (@oldium)
a847d28 #9575 patch: warn when patch update --to targets an uninstalled version (fix(patch): warn when patch update --to targets an uninstalled version #9575) (@manzoorwanijk)
62b0694 #9576 patch: explain out-of-sync lockfile after --ignore-patch-failures (fix(patch): explain out-of-sync lockfile after --ignore-patch-failures #9576) (@manzoorwanijk)
5ddf6cc #9567 patch: keep the update marker on a no-op commit so a retry finalizes (fix(patch): keep the update marker on a no-op commit so a retry finalizes #9567) (@manzoorwanijk)
fc3ef5a #9559 adapt to @npmcli/run-script@11 breaking changes (@owlstronaut)
abf78b3 #9540 match dotted and versioned args in approve-scripts/deny-scripts (@owlstronaut)
f6270d1 #9531 emit valid JSON from approve-scripts/deny-scripts --json (@owlstronaut)
0e55f97 #9492 pass script-shell to publish lifecycle hooks (@Zelys-DFKH)
2cbb13b #9490 recognize allowScripts for local link targets (fix: recognize allowScripts for local link targets #9490) (@cyphercodes, @cyphercodes)
bf623e0 #9473 validate registry path for allow-remote tarballs (@Abhinav-143x)
6be874b #9479 list pending scripts in approve-scripts when ignore-scripts is set (fix: list pending scripts in approve-scripts when ignore-scripts is set #9479) (@JamieMagee)
6603b2c #9469 suggest --allow-scripts for global installs in unreviewed-scripts warnings (fix: suggest --allow-scripts for global installs in unreviewed-scripts warnings #9469) (@JamieMagee)
fe820b6 #9442 invalid issue template YAML indentation (fix: invalid issue template YAML indentation #9442) (@fallintoplace)
fe41ae7 #9404 show full parent command path in subcommand usage errors (fix: show full parent command path in subcommand usage errors #9404) (@shaanmajid)
75bf7de #9456 respect allowScripts policy in prune, dedupe, uninstall, audit fix, and link (@JamieMagee)
6efac6e #9453 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@JamieMagee)
b97edc0 #9430 audit: don't apply min-release-age before filter when verifying installed signatures (@JamieMagee)
080e3b2 #9425 block forbidden keys in Queryable setter to prevent prototype pollution (@12122J, @claude)
c5292fa #9422 use prerelease strategy without a bug (@owlstronaut)
33aebaa #9410 fix typo of fullMetadata (@owlstronaut)
2a03860 #9267 run root preinstall before reify (@owlstronaut)
c0fc549 #9372 config: pause progress spinner during interactive editor spawn (fix(config): pause progress spinner during interactive editor spawn #9372) (@Zelys-DFKH, @claude)

Documentation

357e8cd #9520 approve-scripts only throws EGLOBAL when run with -g (@JamieMagee)
bcf01c6 #9505 clarify package.json override value specs (docs: clarify package.json override value specs #9505) (@ded-furby)
455aa4a #9401 use the latest version for global update and outdated's wanted (docs: use the latest version for global update and outdated's wanted #9401) (@liangmiQwQ)
aac80dc #9470 update minimum npm required for npm trust (@meeech)
d124c08 #9385 Document npm_old_version and npm_new_version environment variables (docs: Document npm_old_version and npm_new_version environment variables #9385) (@36degrees)

Dependencies

9cbba72 #9579 npm-profile@13.0.1
d4e0a70 #9559 @tufjs/repo-mock@5.0.0
3ef66bb #9559 bundle arborist runtime deps for bootstrap
5dce6fb #9559 npm-packlist@11.2.0
ad05528 #9559 @npmcli/git@8.0.0
cc45055 #9559 @npmcli/node-gyp@6.0.0
a12e2c8 #9559 @npmcli/name-from-folder@5.0.0
cc96d57 #9559 @npmcli/installed-package-contents@5.0.0
3dc18e5 #9559 @npmcli/git@8.0.0
428afa6 #9559 sigstore@5.0.0
95ed19c #9559 regenerate bundled dependencies
b62db95 #9559 bin-links@7.0.0
2f5da83 #9559 @npmcli/fs@6.0.0
370f9c6 #9559 node-gyp@13.0.0
e459d7a #9559 which@7.0.0
5032af3 #9559 validate-npm-package-name@8.0.0
13d97ac #9559 tar@7.5.16
1502286 #9559 ssri@14.0.0
68eb39c #9559 semver@7.8.4
3484d7f #9559 read@6.0.0
21df0ab #9559 proc-log@7.0.0
8f85646 #9559 parse-conflict-json@6.0.0
a44c1cf #9559 pacote@22.0.0
171bba3 #9559 npm-user-validate@5.0.0
1f9c567 #9559 npm-registry-fetch@20.0.1
1fd247a #9559 npm-profile@13.0.0
998ff1d #9559 npm-pick-manifest@12.0.0
d80859a #9559 npm-package-arg@14.0.0
5e1d513 #9559 npm-install-checks@9.0.0
faf97e5 #9559 npm-audit-report@8.0.0
471309f #9559 nopt@10.0.1
40395b8 #9559 make-fetch-happen@16.0.1
30e89d9 #9559 json-parse-even-better-errors@6.0.0
d44db96 #9559 is-cidr@7.0.0
350fb18 #9559 init-package-json@9.0.0
406820a #9559 ini@7.0.0
d867351 #9559 hosted-git-info@10.1.1
66d46bc #9559 cacache@21.0.1
0d15aec #9559 abbrev@5.0.0
9bbdefb #9559 @sigstore/tuf@5.0.0
9d13ebf #9559 @npmcli/run-script@11.0.0
27c4dcc #9559 @npmcli/redact@5.0.0
f0eaef3 #9559 @npmcli/promise-spawn@10.0.0
0be6ae2 #9559 @npmcli/package-json@8.0.0
f86a019 #9559 @npmcli/metavuln-calculator@10.0.0
4d234b2 #9559 @npmcli/map-workspaces@6.0.0
d28783e #9420 undici@6.26.0
7f6c6ef #9420 sigstore@4.1.1
ee61b6e #9420 lru-cache@11.5.1
d5ddef2 #9420 @sigstore/verify@3.1.1
11e7ac7 #9420 @sigstore/core@3.2.1
11cd66e #9420 @npmcli/agent@4.0.2
8be4c04 #9420 semver@7.8.1
577d61d #9420 make-fetch-happen@15.0.6

Chores

059c06e #9560 add web-login proxy doneUrl regression for npm-profile fix (chore: add web-login proxy doneUrl regression for npm-profile fix #9560) (@manzoorwanijk)
1453954 #9559 nock@14.0.0 (@owlstronaut)
0323f2d #9559 template-oss-apply (@owlstronaut)
ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
d25a179 #9559 template-oss-apply (@owlstronaut)
acdd6d5 #9559 bumping @npmcli/template-oss from 4.29.0 to 5.1.0 (@owlstronaut)
4e2496a #9513 update issue templates - better language (@owlstronaut)
7a997ac #9512 update issue templates (chore: update issue templates #9512) (@owlstronaut)
da63c79 #9420 dev dependency updates (@owlstronaut)
5fc9bc0 #9393 sanitize newlines in flags table default and type values (chore: sanitize newlines in flags table default and type values #9393) (@reggi, @Copilot)
workspace: @npmcli/arborist@10.0.0-pre.1
workspace: @npmcli/config@11.0.0-pre.1
workspace: libnpmaccess@11.0.0-pre.0
workspace: libnpmdiff@9.0.0-pre.0
workspace: libnpmexec@11.0.0-pre.0
workspace: libnpmfund@8.0.0-pre.0
workspace: libnpmorg@9.0.0-pre.0
workspace: libnpmpack@10.0.0-pre.1
workspace: libnpmpublish@12.0.0-pre.0
workspace: libnpmsearch@10.0.0-pre.0
workspace: libnpmteam@9.0.0-pre.0
workspace: libnpmversion@9.0.0-pre.1

arborist: 10.0.0-pre.1

10.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

Preserve https protocol when working with git (fix!: Preserve https protocol when working with git #8703)
npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

ce7681f #9496 packageExtensions for root-owned dependency manifest repairs (feat: packageExtensions for root-owned dependency manifest repairs #9496) (@manzoorwanijk)
1db885c #9439 native dependency patching (npm patch add/commit/update/ls/rm) (feat: native dependency patching (npm patch add/commit/update/ls/rm) #9439) (@manzoorwanijk)
be8053c #9544 warn when min-release-age blocks an audit fix (feat: warn when min-release-age blocks an audit fix #9544) (@JamieMagee)
18eb967 #9559 bump to new node engine range (@owlstronaut)
c3e1a71 #9532 add min-release-age-exclude config (@JamieMagee, @caseyjhol)
5cd5150 #9424 default-deny install scripts (allowScripts opt-in) [v12] (@JamieMagee)
64e3f79 #9480 allowScripts tooling and inBundle hardening (feat: allowScripts tooling and inBundle hardening #9480) (@JamieMagee)
7068d42 #9360 Phase 1 of allowScripts opt-in install-script policy (feat: Phase 1 of allowScripts opt-in install-script policy #9360) (@JamieMagee)

Bug Fixes

e96a7de #8703 Preserve https protocol when working with git (fix!: Preserve https protocol when working with git #8703) (@oldium)
afce424 #9551 arborist: expose store node_modules via NODE_PATH for linked-strategy install scripts (fix(arborist): expose store node_modules via NODE_PATH for linked-strategy install scripts #9551) (@manzoorwanijk)
8bbd70d #9550 arborist: allow-remote exemption for proxy/mirror-fronted registry tarballs (fix(arborist): allow-remote exemption for proxy/mirror-fronted registry tarballs #9550) (@manzoorwanijk)
315e3bd #9574 arborist: drop orphaned patch entry on uninstall instead of EPATCHUNUSED (fix(arborist): drop orphaned patch entry on uninstall instead of EPATCHUNUSED #9574) (@manzoorwanijk)
62b0694 #9576 patch: explain out-of-sync lockfile after --ignore-patch-failures (fix(patch): explain out-of-sync lockfile after --ignore-patch-failures #9576) (@manzoorwanijk)
cfda867 #9570 arborist: warn once for workspace packageExtensions selector match (fix(arborist): warn once for workspace packageExtensions selector match #9570) (@manzoorwanijk)
f9c977c #9569 arborist: re-apply packageExtensions to the linked actual tree (fix(arborist): re-apply packageExtensions to the linked actual tree #9569) (@manzoorwanijk)
fc3ef5a #9559 adapt to @npmcli/run-script@11 breaking changes (@owlstronaut)
fc6268a #9523 keep nested file: deps and re-resolve changed git refs (fix: keep nested file: deps and re-resolve changed git refs #9523) (@owlstronaut)
34dbdf5 #9525 arborist: enforce allowScripts for file:/link: dep scripts (@JamieMagee)
d70e116 #9510 arborist: honor allow-remote=root for root-direct remote tarballs (fix(arborist): honor allow-remote=root for root-direct remote tarballs #9510) (@manzoorwanijk)
4bcba54 #9495 arborist: apply registry-tarball allow-remote exemption in linked strategy (fix(arborist): apply registry-tarball allow-remote exemption in linked strategy #9495) (@manzoorwanijk)
2cbb13b #9490 recognize allowScripts for local link targets (fix: recognize allowScripts for local link targets #9490) (@cyphercodes, @cyphercodes)
bf623e0 #9473 validate registry path for allow-remote tarballs (@Abhinav-143x)
a105799 #9461 arborist: link meta-only optional peers in linked strategy (@manzoorwanijk)
275bc69 #9441 arborist: clean up orphaned scoped store entries in linked strategy (@manzoorwanijk)
9f3c97f #9452 sanitize package name in linked-strategy path construction (@owlstronaut)
a81f2f8 #9428 arborist: read install scripts from disk on lockfile installs instead of a sentinel (@JamieMagee)
c5292fa #9422 use prerelease strategy without a bug (@owlstronaut)
dac7ff6 #9399 arborist: drop self-link materialization for undeclared workspaces (fix(arborist): drop self-link materialization for undeclared workspaces #9399) (@manzoorwanijk)
b77850e #9395 skip hidden lockfile save on dry run (fix: skip hidden lockfile save on dry run #9395) (@puneetdixit200, @puneetdixit200)

Dependencies

cc45055 #9559 @npmcli/node-gyp@6.0.0
a12e2c8 #9559 @npmcli/name-from-folder@5.0.0
cc96d57 #9559 @npmcli/installed-package-contents@5.0.0
b62db95 #9559 bin-links@7.0.0
2f5da83 #9559 @npmcli/fs@6.0.0
1502286 #9559 ssri@14.0.0
21df0ab #9559 proc-log@7.0.0
8f85646 #9559 parse-conflict-json@6.0.0
a44c1cf #9559 pacote@22.0.0
1f9c567 #9559 npm-registry-fetch@20.0.1
998ff1d #9559 npm-pick-manifest@12.0.0
d80859a #9559 npm-package-arg@14.0.0
5e1d513 #9559 npm-install-checks@9.0.0
471309f #9559 nopt@10.0.1
d867351 #9559 hosted-git-info@10.1.1
66d46bc #9559 cacache@21.0.1
9d13ebf #9559 @npmcli/run-script@11.0.0
27c4dcc #9559 @npmcli/redact@5.0.0
0be6ae2 #9559 @npmcli/package-json@8.0.0
f86a019 #9559 @npmcli/metavuln-calculator@10.0.0
4d234b2 #9559 @npmcli/map-workspaces@6.0.0

Chores

1453954 #9559 nock@14.0.0 (@owlstronaut)
0323f2d #9559 template-oss-apply (@owlstronaut)
ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
d25a179 #9559 template-oss-apply (@owlstronaut)

config: 11.0.0-pre.1

11.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning.

Features

1db885c #9439 native dependency patching (npm patch add/commit/update/ls/rm) (feat: native dependency patching (npm patch add/commit/update/ls/rm) #9439) (@manzoorwanijk)
fc80bb3 #9234 remove default license for npm init (@owlstronaut)
be8053c #9544 warn when min-release-age blocks an audit fix (feat: warn when min-release-age blocks an audit fix #9544) (@JamieMagee)
18eb967 #9559 bump to new node engine range (@owlstronaut)
c3e1a71 #9532 add min-release-age-exclude config (@JamieMagee, @caseyjhol)
f6a9aad #9517 differentiate GitHub Actions environments in user-agent (feat: differentiate GitHub Actions environments in user-agent #9517) (@reggi, @Copilot)
5cd5150 #9424 default-deny install scripts (allowScripts opt-in) [v12] (@JamieMagee)
caa3295 #9466 default allow-git and allow-remote to none (@owlstronaut)
f2e4a28 #9351 add a global npmignore file (feat: add a global npmignore file #9351) (@ljharb)
c9be2d1 #9153 publish --access=private alias for restricted (feat: publish --access=private alias for restricted #9153) (@reggi, @Copilot)
7068d42 #9360 Phase 1 of allowScripts opt-in install-script policy (feat: Phase 1 of allowScripts opt-in install-script policy #9360) (@JamieMagee)
979518d #9276 error on unknown configs, flags, and abbreviations (feat!: error on unknown configs, flags, and abbreviations #9276) (@owlstronaut)

Bug Fixes

9b5c7b0 #9521 config: strict-allow-scripts default blocks with a warning, not silently (@JamieMagee)
6efac6e #9453 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@JamieMagee)
c5292fa #9422 use prerelease strategy without a bug (@owlstronaut)

Dependencies

21df0ab #9559 proc-log@7.0.0
471309f #9559 nopt@10.0.1
406820a #9559 ini@7.0.0
0be6ae2 #9559 @npmcli/package-json@8.0.0
4d234b2 #9559 @npmcli/map-workspaces@6.0.0

Chores

0323f2d #9559 template-oss-apply (@owlstronaut)
ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
d25a179 #9559 template-oss-apply (@owlstronaut)

libnpmaccess: 11.0.0-pre.0

11.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

18eb967 #9559 bump to new node engine range (@owlstronaut)

Dependencies

1f9c567 #9559 npm-registry-fetch@20.0.1
d80859a #9559 npm-package-arg@14.0.0

Chores

1453954 #9559 nock@14.0.0 (@owlstronaut)
0323f2d #9559 template-oss-apply (@owlstronaut)
ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
d25a179 #9559 template-oss-apply (@owlstronaut)
40fcab4 #8991 @npmcli/template-oss@4.29.0 (@wraithgar)

libnpmdiff: 9.0.0-pre.0

9.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.

Features

18eb967 #9559 bump to new node engine range (@owlstronaut)
caa3295 #9466 default allow-git and allow-remote to none (@owlstronaut)

Bug Fixes

c5292fa #9422 use prerelease strategy without a bug (@owlstronaut)

Dependencies

cc96d57 #9559 @npmcli/installed-package-contents@5.0.0
a44c1cf #9559 pacote@22.0.0
d80859a #9559 npm-package-arg@14.0.0

Chores

0323f2d #9559 template-oss-apply (@owlstronaut)
ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
d25a179 #9559 template-oss-apply (@owlstronaut)
workspace: @npmcli/arborist@10.0.0-pre.1

libnpmexec: 11.0.0-pre.0

11.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

18eb967 #9559 bump to new node engine range (@owlstronaut)
64e3f79 #9480 allowScripts tooling and inBundle hardening (feat: allowScripts tooling and inBundle hardening #9480) (@JamieMagee)

Bug Fixes

6901bb1 #9436 escape executable name in libnpmexec run-script (fix: escape executable name in libnpmexec run-script #9436) (@rootvector2)
c5292fa #9422 use prerelease strategy without a bug (@owlstronaut)
6237783 #9408 exempt local project introspection from allow-directory (@owlstronaut)

Dependencies

b62db95 #9559 bin-links@7.0.0
3484d7f #9559 read@6.0.0
21df0ab #9559 proc-log@7.0.0
a44c1cf #9559 pacote@22.0.0
d80859a #9559 npm-package-arg@14.0.0
9d13ebf #9559 @npmcli/run-script@11.0.0
0be6ae2 #9559 @npmcli/package-json@8.0.0

Chores

1453954 #9559 nock@14.0.0 (@owlstronaut)
0323f2d #9559 template-oss-apply (@owlstronaut)
ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
d25a179 #9559 template-oss-apply (@owlstronaut)
workspace: @npmcli/arborist@10.0.0-pre.1

libnpmfund: 8.0.0-pre.0

8.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

18eb967 #9559 bump to new node engine range (@owlstronaut)

Bug Fixes

c5292fa #9422 use prerelease strategy without a bug (@owlstronaut)

Chores

0323f2d #9559 template-oss-apply (@owlstronaut)
ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
d25a179 #9559 template-oss-apply (@owlstronaut)

Dependencies

workspace: @npmcli/arborist@10.0.0-pre.1

libnpmorg: 9.0.0-pre.0

9.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

18eb967 #9559 bump to new node engine range (@owlstronaut)

Dependencies

1f9c567 #9559 npm-registry-fetch@20.0.1

Chores

1453954 #9559 nock@14.0.0 (@owlstronaut)
0323f2d #9559 template-oss-apply (@owlstronaut)
ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
d25a179 #9559 template-oss-apply (@owlstronaut)
40fcab4 #8991 @npmcli/template-oss@4.29.0 (@wraithgar)
5e0909b #8620 fix spelling in workspaces (chore: fix spelling in workspaces #8620) (@jsoref)

libnpmpack: 10.0.0-pre.1

10.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.

Features

18eb967 #9559 bump to new node engine range (@owlstronaut)
caa3295 #9466 default allow-git and allow-remote to none (@owlstronaut)

Bug Fixes

76f8059 #9446 flatten path separators in pack output filename (fix: flatten path separators in pack output filename #9446) (@rootvector2)
c5292fa #9422 use prerelease strategy without a bug (@owlstronaut)

Dependencies

a44c1cf #9559 pacote@22.0.0
d80859a #9559 npm-package-arg@14.0.0
9d13ebf #9559 @npmcli/run-script@11.0.0

Chores

1453954 #9559 nock@14.0.0 (@owlstronaut)
0323f2d #9559 template-oss-apply (@owlstronaut)
ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
d25a179 #9559 template-oss-apply (@owlstronaut)
workspace: @npmcli/arborist@10.0.0-pre.1

libnpmpublish: 12.0.0-pre.0

12.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
opts.access now defaults to null instead of 'public'. With null, libnpmpublish no longer sets an explicit access level in the publish payload, so new scoped packages are created as restricted (registry default) and republishes preserve the existing access level. Callers that want to force public access must now pass access: 'public' explicitly.

Features

ce7681f #9496 packageExtensions for root-owned dependency manifest repairs (feat: packageExtensions for root-owned dependency manifest repairs #9496) (@manzoorwanijk)
1db885c #9439 native dependency patching (npm patch add/commit/update/ls/rm) (feat: native dependency patching (npm patch add/commit/update/ls/rm) #9439) (@manzoorwanijk)
18eb967 #9559 bump to new node engine range (@owlstronaut)

Bug Fixes

79b0c84 #9419 default opts.access to null to preserve registry behavior (@owlstronaut)
c5292fa #9422 use prerelease strategy without a bug (@owlstronaut)

Dependencies

428afa6 #9559 sigstore@5.0.0
1502286 #9559 ssri@14.0.0
21df0ab #9559 proc-log@7.0.0
1f9c567 #9559 npm-registry-fetch@20.0.1
d80859a #9559 npm-package-arg@14.0.0
0be6ae2 #9559 @npmcli/package-json@8.0.0

Chores

1453954 #9559 nock@14.0.0 (@owlstronaut)
0323f2d #9559 template-oss-apply (@owlstronaut)
ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
d25a179 #9559 template-oss-apply (@owlstronaut)

libnpmsearch: 10.0.0-pre.0

10.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

18eb967 #9559 bump to new node engine range (@owlstronaut)

Dependencies

1f9c567 #9559 npm-registry-fetch@20.0.1

Chores

1453954 #9559 nock@14.0.0 (@owlstronaut)
0323f2d #9559 template-oss-apply (@owlstronaut)
ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
d25a179 #9559 template-oss-apply (@owlstronaut)
40fcab4 #8991 @npmcli/template-oss@4.29.0 (@wraithgar)
5e0909b #8620 fix spelling in workspaces (chore: fix spelling in workspaces #8620) (@jsoref)

libnpmteam: 9.0.0-pre.0

9.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

18eb967 #9559 bump to new node engine range (@owlstronaut)

Dependencies

1f9c567 #9559 npm-registry-fetch@20.0.1

Chores

1453954 #9559 nock@14.0.0 (@owlstronaut)
0323f2d #9559 template-oss-apply (@owlstronaut)
ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
d25a179 #9559 template-oss-apply (@owlstronaut)
40fcab4 #8991 @npmcli/template-oss@4.29.0 (@wraithgar)
5e0909b #8620 fix spelling in workspaces (chore: fix spelling in workspaces #8620) (@jsoref)

libnpmversion: 9.0.0-pre.1

9.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

18eb967 #9559 bump to new node engine range (@owlstronaut)

Bug Fixes

c5292fa #9422 use prerelease strategy without a bug (@owlstronaut)

Documentation

d124c08 #9385 Document npm_old_version and npm_new_version environment variables (docs: Document npm_old_version and npm_new_version environment variables #9385) (@36degrees)

Dependencies

3dc18e5 #9559 @npmcli/git@8.0.0
21df0ab #9559 proc-log@7.0.0
30e89d9 #9559 json-parse-even-better-errors@6.0.0
9d13ebf #9559 @npmcli/run-script@11.0.0

Chores

0323f2d #9559 template-oss-apply (@owlstronaut)
ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
d25a179 #9559 template-oss-apply (@owlstronaut)

This PR was generated with Release Please. See documentation.

github-actions · 2026-05-21T15:52:30Z

Release Manager

Release workflow run: https://github.com/npm/cli/actions/runs/27832287591

Release Checklist for v12.0.0-pre.1

1. Checkout the release branch

Ensure git status is not dirty on this branch after resetting deps. If it is, then something is probably wrong with the automated release process.
```
gh pr checkout 9387 --force
```
```
npm run resetdeps
```
```
node scripts/git-dirty.js
```
2. Check CI status
```
gh pr checks --watch
```
3. Log in to npm

npm login sessions are short lived, so you will want to have a fresh one before you publish.
```
npm login
```
4. Publish the CLI and workspaces

Warning:
This will publish all updated workspaces to latest, prerelease or backport depending on their version, and will publish the CLI with the dist-tag set to next-12.

Note:
The --test argument can optionally be omitted to run the publish process without running any tests locally.
```
node scripts/publish.js --test
```

5. Optionally install and test npm@12.0.0-pre.1 locally

npm i -g npm@12.0.0-pre.1

npm --version
npm whoami
npm help install
# etc

6. Trigger docs.npmjs.com update

gh workflow run update-cli.yml --repo npm/documentation

7. Approve and Merge release PR

gh pr review --approve

gh pr merge --rebase

git checkout latest

git fetch

git reset --hard origin/latest

node . run resetdeps

8. Wait For Release Tags

Warning:
The remaining steps all require the GitHub tags and releases to be created first. These are done once this PR has been labelled with autorelease: tagged.

Release Please will run on the just merged release commit and create GitHub releases and tags for each package. The release bot will will comment on this PR when the releases and tags are created.

Note:
The release workflow also includes the Node integration tests which do not need to finish before continuing.

You can watch the release workflow in your terminal with the following command:
```
gh run watch `gh run list -R npm/cli -w release -b latest -L 1 --json databaseId -q ".[0].databaseId"`
```
9. Mark GitHub Release as latest

Warning:
You must wait for CI to create the release tags before running this step. These are done once this PR has been labelled with autorelease: tagged.

Release Please will make GitHub Releases for the CLI and all workspaces, but GitHub has UI affordances for which release should appear as the "latest", which should always be the CLI. To mark the CLI release as latest run this command:
```
gh release -R npm/cli edit v12.0.0-pre.1 --latest
```
10. Open nodejs/node PR to update npm

Warning:
You must wait for CI to create the release tags before running this step. These are done once this PR has been labelled with autorelease: tagged.

Trigger the Create Node PR action. This will open a PR on nodejs/node to the main branch.

First, sync our fork of node with the upstream source:
```
gh repo sync npm/node --source nodejs/node --force
```
Then, if we are opening a PR against the latest version of node:
```
gh workflow run create-node-pr.yml -R npm/cli -f spec=next-12
```
For backport releases, you must target the correct Node branch using -f branch=<NODE_MAJOR>. Make sure you are targeting the right Node major version for this npm version.

For example, this will create a PR on nodejs/node to the v16.x-staging branch:
```
gh workflow run create-node-pr.yml -R npm/cli -f spec=next-12 -f branch=16
```
11. Label and fast-track nodejs/node PR

Note:
This requires being a nodejs collaborator. This could be you!
- Thumbs-up reaction on the Fast-track comment
- Add an LGTM / Approval
- Add request-ci label to get it running CI
- Add commit-queue label once everything is green
- For backport releases, comment on the PR asking the Node.js team to add dont-land-on-v<NODE_MAJOR> labels for Node versions where this npm version should not be included

github-actions · 2026-06-19T15:26:02Z

🤖 Created releases:

🌻

github-actions · 2026-06-19T15:26:19Z

github-actions Bot requested review from a team as code owners May 21, 2026 15:52

github-actions Bot added the autorelease: pending label May 21, 2026

github-actions Bot force-pushed the release-please--branches--latest branch 24 times, most recently from aae5900 to 56bee35 Compare May 27, 2026 19:44

This was referenced May 27, 2026

Default prerelease-type: "pre.0" does not bump on already-prerelease versions npm/template-oss#564

Open

fix: use prerelease strategy without a bug #9422

Merged

github-actions Bot force-pushed the release-please--branches--latest branch 23 times, most recently from 677dacd to a5df59c Compare June 3, 2026 21:42

JamieMagee mentioned this pull request Jun 11, 2026

Plans for npm 12 nodejs/Release#1161

Closed

manzoorwanijk mentioned this pull request Jun 19, 2026

Better support for monorepos ds300/patch-package#277

Open

chore: release 12.0.0-pre.1

06d9cc7

owlstronaut approved these changes Jun 19, 2026

View reviewed changes

shirakaba mentioned this pull request Oct 26, 2026

Vended patches (e.g. in SDK 55 template) are overlooked in monorepo context shirakaba/expo-desktop#39

Open

Sunbelt Computer Software

PL/B Language Development and Support

Navigation Menu

Repository navigation

chore: release 12.0.0-pre.1 - #9387

chore: release 12.0.0-pre.1#9387
owlstronaut merged 1 commit into
latestfrom
release-please--branches--latest

github-actions Bot commented May 21, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 21, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 19, 2026

Uh oh!

github-actions Bot commented Jun 19, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Sunbelt Computer Software

PL/B Language Development and Support

Conversation

github-actions Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 I have created a release beep boop

12.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

Features

Bug Fixes

Documentation

Dependencies

Chores

10.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

Features

Bug Fixes

Dependencies

Chores

11.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

Features

Bug Fixes

Dependencies

Chores

11.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

Features

Dependencies

Chores

9.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

Features

Bug Fixes

Dependencies

Chores

11.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

Features

Bug Fixes

Dependencies

Chores

8.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

Features

Bug Fixes

Chores

Dependencies

9.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

Features

Dependencies

Chores

10.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

Features

Bug Fixes

Dependencies

Chores

12.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

Features

Bug Fixes

Dependencies

Chores

10.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

Features

Dependencies

Chores

9.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

Features

Dependencies

Chores

9.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

Features

Bug Fixes

Documentation

github-actions Bot commented May 21, 2026 •

edited

Loading

github-actions Bot commented May 21, 2026 •

edited

Loading

github-actions Bot commented Jun 19, 2026 •

edited

Loading