Pull requests

• fix(arborist): preserve failed targets while loading peer sets

  #10150·drewmt opened Oct 21, 2026·

  ·
  1

• quansat775@gmail.com

  #10148·quansat775-ux opened Oct 21, 2026·

  ·

• fix: ignore implicit workspaces when running version

  #10147·Brytoxx021 opened Oct 20, 2026·

  ·

• fix: exempt explicit tarball targets from allow-file

  #10145·lazerg opened Oct 20, 2026Contributor·

  ·
  1

• fix(patch): exclude .git when copying tarballs into the rebase repo

  #10143·rootvector2 opened Oct 20, 2026Contributor·

  ·

• fix: preserve array items when deleting named properties

  #10142·drawliin opened Oct 19, 2026·

  ·
  1

• fix(arborist): keep an override written in two scopes on a shared node

  #10138·ump45nose opened Oct 16, 2026·

  ·
  1

• fix(publish): report publishConfig.tag in publish and stage notices

  #10136·ljharb opened Oct 15, 2026Contributor·

  ·

• fix(libnpmexec): install npx cache despite dryRun or packageLockOnly

  #10135·ljharb opened Oct 15, 2026Contributor·

  ·

• fix(arborist): reuse a link target spelled with a different drive-letter case

  #10133·vsolano9 opened Oct 15, 2026·

  ·

• fix(arborist): skip normalization for canonical ASCII map keys

  #10132·jeffwidman opened Oct 15, 2026Member·

  ·

• fix(arborist): skip named-edge refresh work for empty leaves

  #10131·jeffwidman opened Oct 15, 2026Member·

  ·

• fix(arborist): skip legacy dependency generation for v3 lockfiles

  #10130·jeffwidman opened Oct 15, 2026Member·

  ·
  1

• fix(arborist): block symlink escape in patch applier

  #10129·rootvector2 opened Oct 15, 2026Contributor·

  ·
  5

• fix(arborist): skip bundle checks without an applicable override

  #10128·jeffwidman opened Oct 15, 2026Member·

  ·

• fix(arborist): use a set for bundled-dependency traversal

  backport:v11
  #10127·jeffwidman opened Oct 15, 2026Member·

  ·
  1

• fix(arborist): bound concurrent package.json reads in loadActual

  #10126·SunnyScenery opened Oct 15, 2026·

  ·
  1

• fix(view): format publisher metadata containing actor information

  #10123·sergioperezcheco opened Oct 14, 2026·

  ·
  1

• fix(stage): validate staged manifest before writing the tarball

  #10121·rootvector2 opened Oct 14, 2026Contributor·

  ·

• fix(unpublish): refuse to unpublish a version when the registry returns no versions

  #10117·meganemura opened Oct 12, 2026·

  ·
  1

  5

  

• fix: accept omitted unresolved optional packages in npm ci

  #10115·mvanhorn opened Oct 12, 2026Contributor·

  ·
  1

• docs(arborist): describe yarn and pnpm lockfile support

  #10110·ump45nose opened Oct 10, 2026·

  ·
  1

• docs: note that npm install -g does not create a local node_modules

  #10109·ump45nose opened Oct 10, 2026·

  ·

• docs: propose Markdown conventions in CONTRIBUTING

  #10108·ump45nose opened Oct 10, 2026·

  ·

• docs(npmrc): describe how credentials are matched to the registry URL

  #10107·ump45nose opened Oct 10, 2026·

  ·
  1