12.0.0-pre.0 (2026-06-19)

⚠️ BREAKING CHANGES

• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• opts.access now defaults to null instead of 'public'. With null, libnpmpublish no longer sets an explicit access level in the publish payload, so new scoped packages are created as restricted (registry default) and republishes preserve the existing access level. Callers that want to force public access must now pass access: 'public' explicitly.

Features

• ce7681f #9496 packageExtensions for root-owned dependency manifest repairs (#9496) (@manzoorwanijk)
• 1db885c #9439 native dependency patching (npm patch add/commit/update/ls/rm) (#9439) (@manzoorwanijk)
• 18eb967 #9559 bump to new node engine range (@owlstronaut)

Bug Fixes

• 79b0c84 #9419 default opts.access to null to preserve registry behavior (@owlstronaut)
• c5292fa #9422 use prerelease strategy without a bug (@owlstronaut)

Dependencies

• 428afa6 #9559 sigstore@5.0.0
• 1502286 #9559 ssri@14.0.0
• 21df0ab #9559 proc-log@7.0.0
• 1f9c567 #9559 npm-registry-fetch@20.0.1
• d80859a #9559 npm-package-arg@14.0.0
• 0be6ae2 #9559 @npmcli/package-json@8.0.0

Chores

• 1453954 #9559 nock@14.0.0 (@owlstronaut)
• 0323f2d #9559 template-oss-apply (@owlstronaut)
• ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
• d25a179 #9559 template-oss-apply (@owlstronaut)