Skip to content

Commit 81e4cfa

Browse files
github-actions[bot]npm-cli-bot
github-actions[bot]
authored and
npm-cli-bot
committed
chore: release 11.17.0
1 parent 693bb3d commit 81e4cfa

17 files changed

Lines changed: 122 additions & 42 deletions

‎.release-please-manifest.json‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
".": "11.16.0",
3-
"workspaces/arborist": "9.7.0",
2+
".": "11.17.0",
3+
"workspaces/arborist": "9.8.0",
44
"workspaces/libnpmaccess": "10.0.3",
5-
"workspaces/libnpmdiff": "8.1.9",
6-
"workspaces/libnpmexec": "10.2.9",
7-
"workspaces/libnpmfund": "7.0.23",
5+
"workspaces/libnpmdiff": "8.1.10",
6+
"workspaces/libnpmexec": "10.3.0",
7+
"workspaces/libnpmfund": "7.0.24",
88
"workspaces/libnpmorg": "8.0.1",
9-
"workspaces/libnpmpack": "9.1.9",
9+
"workspaces/libnpmpack": "9.1.10",
1010
"workspaces/libnpmpublish": "11.2.0",
1111
"workspaces/libnpmsearch": "9.0.1",
1212
"workspaces/libnpmteam": "8.0.2",
1313
"workspaces/libnpmversion": "8.0.4",
14-
"workspaces/config": "10.10.0"
14+
"workspaces/config": "10.10.1"
1515
}

‎AUTHORS‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1007,3 +1007,8 @@ Caleb Everett <calebev@amazon.com>
10071007
Vishal Doshi <vishal.doshi@gmail.com>
10081008
raazkhnl <raazkhnl@gmail.com>
10091009
Tea Reggi <reggi@github.com>
1010+
12122J <javiergomezbu@gmail.com>
1011+
Jamie Magee <jamagee@microsoft.com>
1012+
Jamie Magee <jamie.magee@gmail.com>
1013+
meeech <4623+meeech@users.noreply.github.com>
1014+
Abhinav <mrabhinav2k03@gmail.com>

‎CHANGELOG.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,35 @@
11
# Changelog
22

3+
## [11.17.0](https://github.com/npm/cli/compare/v11.16.0...v11.17.0) (2026-06-08)
4+
### Features
5+
* [`8ff3e48`](https://github.com/npm/cli/commit/8ff3e48113a53576a8d450d7d5a1cb190a1986e1) [#9483](https://github.com/npm/cli/pull/9483) allowScripts tooling and inBundle hardening (#9483) (@github-actions[bot], @JamieMagee)
6+
### Bug Fixes
7+
* [`351a309`](https://github.com/npm/cli/commit/351a309e7c625b79cfb0c9fbaa2dc9a544509f70) [#9499](https://github.com/npm/cli/pull/9499) pass script-shell to publish lifecycle hooks (#9499) (@github-actions[bot])
8+
* [`4fa81df`](https://github.com/npm/cli/commit/4fa81dfedab4bf39e85d828f217a70210afd6dac) [#9497](https://github.com/npm/cli/pull/9497) recognize allowScripts for local link targets (#9497) (@github-actions[bot], @cyphercodes, @cyphercodes)
9+
* [`95cf2e9`](https://github.com/npm/cli/commit/95cf2e9efea892023387f3aec6062b8a7e8f1a60) [#9489](https://github.com/npm/cli/pull/9489) validate registry path for allow-remote tarballs (@Abhinav-143x)
10+
* [`9dd219b`](https://github.com/npm/cli/commit/9dd219b20ec3a1c7e46b23209b4619b872f1b604) [#9462](https://github.com/npm/cli/pull/9462) respect allowScripts policy in prune, dedupe, uninstall, audit, and link (#9462) (@github-actions[bot], @JamieMagee)
11+
* [`cd8d18a`](https://github.com/npm/cli/commit/cd8d18a66832856c5cc2ba90dc7c8b0f3dbe476b) [#9482](https://github.com/npm/cli/pull/9482) list pending scripts in approve-scripts when ignore-scripts is set (#9482) (@github-actions[bot], @JamieMagee)
12+
* [`c14e87c`](https://github.com/npm/cli/commit/c14e87c5d84a81ebe14ebe9c68e050ee6ec0fded) [#9481](https://github.com/npm/cli/pull/9481) suggest --allow-scripts for global installs in unreviewed-scripts warnings (#9481) (@github-actions[bot], @JamieMagee)
13+
* [`7ade52e`](https://github.com/npm/cli/commit/7ade52ea4059ca75e83f10e892b24581624acef9) [#9465](https://github.com/npm/cli/pull/9465) invalid issue template YAML indentation (#9465) (@github-actions[bot], @fallintoplace)
14+
* [`c069622`](https://github.com/npm/cli/commit/c0696225d8792e461989214ba7d8886dfd862b4a) [#9464](https://github.com/npm/cli/pull/9464) show full parent command path in subcommand usage errors (#9464) (@owlstronaut)
15+
* [`1bb62bb`](https://github.com/npm/cli/commit/1bb62bb639d1f791a0c51d236fba01c25c58992e) [#9454](https://github.com/npm/cli/pull/9454) config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@JamieMagee)
16+
* [`84eeb5f`](https://github.com/npm/cli/commit/84eeb5fe9db14e01ebc44999ebe126224a78eb83) [#9431](https://github.com/npm/cli/pull/9431) audit: don't apply min-release-age before filter when verifying installed signatures (@JamieMagee)
17+
* [`3bd3377`](https://github.com/npm/cli/commit/3bd3377f207732b47655ea3a896d53046df199c4) [#9426](https://github.com/npm/cli/pull/9426) block forbidden keys in Queryable setter to prevent prototype pollution (@12122J, @claude)
18+
### Documentation
19+
* [`693bb3d`](https://github.com/npm/cli/commit/693bb3de834f4611bf41785be357dc4598a2aaae) [#9508](https://github.com/npm/cli/pull/9508) clarify package.json override value specs (#9508) (@github-actions[bot], @ded-furby)
20+
* [`ccffe4a`](https://github.com/npm/cli/commit/ccffe4a917e1b9faf6e8fa9ab3a2856819e29e3a) [#9501](https://github.com/npm/cli/pull/9501) use the latest version for global update and outdated's `wanted` (#9501) (@github-actions[bot], @liangmiQwQ)
21+
* [`66e97c2`](https://github.com/npm/cli/commit/66e97c20003b43d80c464b89fb1e1c8c6b5c9433) [#9478](https://github.com/npm/cli/pull/9478) update minimum npm required for npm trust (@meeech)
22+
23+
24+
### Dependencies
25+
26+
* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.8.0): `@npmcli/arborist@9.8.0`
27+
* [workspace](https://github.com/npm/cli/releases/tag/config-v10.10.1): `@npmcli/config@10.10.1`
28+
* [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.10): `libnpmdiff@8.1.10`
29+
* [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.0): `libnpmexec@10.3.0`
30+
* [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.24): `libnpmfund@7.0.24`
31+
* [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.10): `libnpmpack@9.1.10`
32+
333
## [11.16.0](https://github.com/npm/cli/compare/v11.15.0...v11.16.0) (2026-05-27)
434
### Features
535
* [`4b67f6e`](https://github.com/npm/cli/commit/4b67f6ed21a8bf7e47ae78b7fc9cc9fbdfa95057) [#9416](https://github.com/npm/cli/pull/9416) publish --access=private alias for restricted (#9416) (@github-actions[bot], @reggi, @Copilot)

‎package-lock.json‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"name": "npm",
3-
"version": "11.16.0",
3+
"version": "11.17.0",
44
"lockfileVersion": 3,
55
"requires": true,
66
"packages": {
77
"": {
88
"name": "npm",
9-
"version": "11.16.0",
9+
"version": "11.17.0",
1010
"bundleDependencies": [
1111
"@isaacs/string-locale-compare",
1212
"@npmcli/arborist",
@@ -84,8 +84,8 @@
8484
],
8585
"dependencies": {
8686
"@isaacs/string-locale-compare": "^1.1.0",
87-
"@npmcli/arborist": "^9.7.0",
88-
"@npmcli/config": "^10.10.0",
87+
"@npmcli/arborist": "^9.8.0",
88+
"@npmcli/config": "^10.10.1",
8989
"@npmcli/fs": "^5.0.0",
9090
"@npmcli/map-workspaces": "^5.0.3",
9191
"@npmcli/metavuln-calculator": "^9.0.3",
@@ -109,11 +109,11 @@
109109
"is-cidr": "^6.0.4",
110110
"json-parse-even-better-errors": "^5.0.0",
111111
"libnpmaccess": "^10.0.3",
112-
"libnpmdiff": "^8.1.9",
113-
"libnpmexec": "^10.2.9",
114-
"libnpmfund": "^7.0.23",
112+
"libnpmdiff": "^8.1.10",
113+
"libnpmexec": "^10.3.0",
114+
"libnpmfund": "^7.0.24",
115115
"libnpmorg": "^8.0.1",
116-
"libnpmpack": "^9.1.9",
116+
"libnpmpack": "^9.1.10",
117117
"libnpmpublish": "^11.2.0",
118118
"libnpmsearch": "^9.0.1",
119119
"libnpmteam": "^8.0.2",
@@ -14605,7 +14605,7 @@
1460514605
},
1460614606
"workspaces/arborist": {
1460714607
"name": "@npmcli/arborist",
14608-
"version": "9.7.0",
14608+
"version": "9.8.0",
1460914609
"license": "ISC",
1461014610
"dependencies": {
1461114611
"@gar/promise-retry": "^1.0.0",
@@ -14663,7 +14663,7 @@
1466314663
},
1466414664
"workspaces/config": {
1466514665
"name": "@npmcli/config",
14666-
"version": "10.10.0",
14666+
"version": "10.10.1",
1466714667
"license": "ISC",
1466814668
"dependencies": {
1466914669
"@npmcli/map-workspaces": "^5.0.0",
@@ -14703,10 +14703,10 @@
1470314703
}
1470414704
},
1470514705
"workspaces/libnpmdiff": {
14706-
"version": "8.1.9",
14706+
"version": "8.1.10",
1470714707
"license": "ISC",
1470814708
"dependencies": {
14709-
"@npmcli/arborist": "^9.7.0",
14709+
"@npmcli/arborist": "^9.8.0",
1471014710
"@npmcli/installed-package-contents": "^4.0.0",
1471114711
"binary-extensions": "^3.0.0",
1471214712
"diff": "^8.0.2",
@@ -14725,11 +14725,11 @@
1472514725
}
1472614726
},
1472714727
"workspaces/libnpmexec": {
14728-
"version": "10.2.9",
14728+
"version": "10.3.0",
1472914729
"license": "ISC",
1473014730
"dependencies": {
1473114731
"@gar/promise-retry": "^1.0.0",
14732-
"@npmcli/arborist": "^9.7.0",
14732+
"@npmcli/arborist": "^9.8.0",
1473314733
"@npmcli/package-json": "^7.0.0",
1473414734
"@npmcli/run-script": "^10.0.0",
1473514735
"ci-info": "^4.0.0",
@@ -14756,10 +14756,10 @@
1475614756
}
1475714757
},
1475814758
"workspaces/libnpmfund": {
14759-
"version": "7.0.23",
14759+
"version": "7.0.24",
1476014760
"license": "ISC",
1476114761
"dependencies": {
14762-
"@npmcli/arborist": "^9.7.0"
14762+
"@npmcli/arborist": "^9.8.0"
1476314763
},
1476414764
"devDependencies": {
1476514765
"@npmcli/eslint-config": "^5.0.1",
@@ -14789,10 +14789,10 @@
1478914789
}
1479014790
},
1479114791
"workspaces/libnpmpack": {
14792-
"version": "9.1.9",
14792+
"version": "9.1.10",
1479314793
"license": "ISC",
1479414794
"dependencies": {
14795-
"@npmcli/arborist": "^9.7.0",
14795+
"@npmcli/arborist": "^9.8.0",
1479614796
"@npmcli/run-script": "^10.0.0",
1479714797
"npm-package-arg": "^13.0.0",
1479814798
"pacote": "^21.0.2"

‎package.json‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "11.16.0",
2+
"version": "11.17.0",
33
"name": "npm",
44
"description": "a package manager for JavaScript",
55
"workspaces": [
@@ -52,8 +52,8 @@
5252
},
5353
"dependencies": {
5454
"@isaacs/string-locale-compare": "^1.1.0",
55-
"@npmcli/arborist": "^9.7.0",
56-
"@npmcli/config": "^10.10.0",
55+
"@npmcli/arborist": "^9.8.0",
56+
"@npmcli/config": "^10.10.1",
5757
"@npmcli/fs": "^5.0.0",
5858
"@npmcli/map-workspaces": "^5.0.3",
5959
"@npmcli/metavuln-calculator": "^9.0.3",
@@ -77,11 +77,11 @@
7777
"is-cidr": "^6.0.4",
7878
"json-parse-even-better-errors": "^5.0.0",
7979
"libnpmaccess": "^10.0.3",
80-
"libnpmdiff": "^8.1.9",
81-
"libnpmexec": "^10.2.9",
82-
"libnpmfund": "^7.0.23",
80+
"libnpmdiff": "^8.1.10",
81+
"libnpmexec": "^10.3.0",
82+
"libnpmfund": "^7.0.24",
8383
"libnpmorg": "^8.0.1",
84-
"libnpmpack": "^9.1.9",
84+
"libnpmpack": "^9.1.10",
8585
"libnpmpublish": "^11.2.0",
8686
"libnpmsearch": "^9.0.1",
8787
"libnpmteam": "^8.0.2",

‎workspaces/arborist/CHANGELOG.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,18 @@
11
# Changelog
22

3+
## [9.8.0](https://github.com/npm/cli/compare/arborist-v9.7.0...arborist-v9.8.0) (2026-06-08)
4+
### Features
5+
* [`8ff3e48`](https://github.com/npm/cli/commit/8ff3e48113a53576a8d450d7d5a1cb190a1986e1) [#9483](https://github.com/npm/cli/pull/9483) allowScripts tooling and inBundle hardening (#9483) (@github-actions[bot], @JamieMagee)
6+
### Bug Fixes
7+
* [`66408d7`](https://github.com/npm/cli/commit/66408d7f423313dd0daa7fa9356c4d5fe25ee86c) [#9500](https://github.com/npm/cli/pull/9500) arborist: apply registry-tarball allow-remote exemption in linked strategy (#9500) (@github-actions[bot], @manzoorwanijk)
8+
* [`4fa81df`](https://github.com/npm/cli/commit/4fa81dfedab4bf39e85d828f217a70210afd6dac) [#9497](https://github.com/npm/cli/pull/9497) recognize allowScripts for local link targets (#9497) (@github-actions[bot], @cyphercodes, @cyphercodes)
9+
* [`95cf2e9`](https://github.com/npm/cli/commit/95cf2e9efea892023387f3aec6062b8a7e8f1a60) [#9489](https://github.com/npm/cli/pull/9489) validate registry path for allow-remote tarballs (@Abhinav-143x)
10+
* [`869cb9a`](https://github.com/npm/cli/commit/869cb9a1ef5627872830935024be94d60102b514) [#9485](https://github.com/npm/cli/pull/9485) arborist: link meta-only optional peers in linked strategy (@manzoorwanijk)
11+
* [`d41a9e3`](https://github.com/npm/cli/commit/d41a9e3494135593c2bbd0010e0b21b5adc6ee90) [#9484](https://github.com/npm/cli/pull/9484) arborist: clean up orphaned scoped store entries in linked strategy (@manzoorwanijk)
12+
* [`39d034d`](https://github.com/npm/cli/commit/39d034d7bee3f523ebfac8215e924d466722d101) [#9455](https://github.com/npm/cli/pull/9455) sanitize package name in linked-strategy path construction (@owlstronaut)
13+
* [`d59c964`](https://github.com/npm/cli/commit/d59c96413f6c731b3df87556efe4f0a9706d0a6d) [#9451](https://github.com/npm/cli/pull/9451) reject path traversal entries when inflating dependency shrinkwraps (@owlstronaut)
14+
* [`c9045d5`](https://github.com/npm/cli/commit/c9045d5885fa1338b7d32fa845aea0bfeab01657) [#9429](https://github.com/npm/cli/pull/9429) arborist: read install scripts from disk on lockfile installs instead of a sentinel (@JamieMagee)
15+
316
## [9.7.0](https://github.com/npm/cli/compare/arborist-v9.6.0...arborist-v9.7.0) (2026-05-27)
417
### Features
518
* [`a10c7ca`](https://github.com/npm/cli/commit/a10c7caf3ad9d2d5e17234c5c5e615dbce7717f9) [#9415](https://github.com/npm/cli/pull/9415) Phase 1 of `allowScripts` opt-in install-script policy (#9360) (#9415) (@owlstronaut, @JamieMagee)

‎workspaces/arborist/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@npmcli/arborist",
3-
"version": "9.7.0",
3+
"version": "9.8.0",
44
"description": "Manage node_modules trees",
55
"dependencies": {
66
"@gar/promise-retry": "^1.0.0",

‎workspaces/config/CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
# Changelog
22

3+
## [10.10.1](https://github.com/npm/cli/compare/config-v10.10.0...config-v10.10.1) (2026-06-08)
4+
### Bug Fixes
5+
* [`1bb62bb`](https://github.com/npm/cli/commit/1bb62bb639d1f791a0c51d236fba01c25c58992e) [#9454](https://github.com/npm/cli/pull/9454) config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@JamieMagee)
6+
37
## [10.10.0](https://github.com/npm/cli/compare/config-v10.9.1...config-v10.10.0) (2026-05-27)
48
### Features
59
* [`4b67f6e`](https://github.com/npm/cli/commit/4b67f6ed21a8bf7e47ae78b7fc9cc9fbdfa95057) [#9416](https://github.com/npm/cli/pull/9416) publish --access=private alias for restricted (#9416) (@github-actions[bot], @reggi, @Copilot)

‎workspaces/config/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@npmcli/config",
3-
"version": "10.10.0",
3+
"version": "10.10.1",
44
"files": [
55
"bin/",
66
"lib/"

‎workspaces/libnpmdiff/CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,10 @@
8080

8181
* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/arborist@9.7.0`
8282

83+
### Dependencies
84+
85+
* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.8.0): `@npmcli/arborist@9.8.0`
86+
8387
## [8.1.0](https://github.com/npm/cli/compare/libnpmdiff-v8.0.13...libnpmdiff-v8.1.0) (2026-02-04)
8488
### Features
8589
* [`f5f6cf7`](https://github.com/npm/cli/commit/f5f6cf7c9fc9315b96eb29c5c7d5ab63ad3a9122) [#8943](https://github.com/npm/cli/pull/8943) config: add --allow-git (@wraithgar)

0 commit comments

Comments
 (0)