[pull] latest from npm:latest - #14

Open

pull[bot] wants to merge 1023 commits into

Graybar-codespace:latestfrom

This pull request is big! We're only showing the most recent 250 commits

Commits on Apr 22, 2026

chore: dev dependency updates
Michael Smith
committed
b9332e6

Commits on Apr 23, 2026

fix!: don't install man pages in system locations
Michael Smith
committed
e20424b

Commits on Apr 28, 2026

fix!: align CycloneDX SBOM component names with SPDX (#9284)
cyphercodes
authored
faf7348
feat: add allow-directory, allow-file, and allow-remote (#9287)
wraithgar
authored
916cb4b
fix!: refuse to pack when overrides apply to bundled packages
Michael Smith
committed
b1965d6

Commits on May 1, 2026

fix(config): preserve min-release-age after flattening

lawrence3699
authored and
Michael Smith
committed
6628d05

Commits on May 4, 2026

Commits on May 5, 2026

feat(arborist): add lockfileString() for in-memory lockfile generation

ljharb
authored and
Michael Smith
committed
b8655c7

Commits on May 6, 2026

fix(arborist): clean up orphan top-level symlinks in linked strategy (#9309)
manzoorwanijk
authored
076551b
fix(sbom): dedupe per-node dependsOn / relationships (#9311)
mikaelkristiansson
authored
d623988
chore: add cli-triage team as codeowner (#9317)
Michael Smith
authored
d68bd36
deps: cidr-regex@5.0.5
Michael Smith
committed
37bd0c6
deps: ip-address@10.1.1
Michael Smith
committed
af65766
deps: socks@10.1.1
Michael Smith
committed
fbe1dd0
chore: dev dependency updates
Michael Smith
committed
4259e57

Commits on May 8, 2026

fix: remove settings (#9327)
Michael Smith
authored
70af7b3

Commits on May 11, 2026

fix(arborist): prune removed-workspace entries from package-lock.json

manzoorwanijk
authored and
Michael Smith
committed
4c7f6ba
fix(arborist): skip extraneous fsChildren in linked-strategy reify

manzoorwanijk
authored and
Michael Smith
committed
81793ae

Commits on May 12, 2026

docs: npm view with json outputs array docs update (#9335)
yetanotheraryan
authored
6704ab2
chore: change test wording to not collide with tap (#9349)
Michael Smith
authored
b61281d

Commits on May 13, 2026

feat: add allow-git/allow-file/allow-directory/allow-remote configs
Michael Smith
committed
e0f12f7
fix: allow-remote=none does not block registry tarballs
Michael Smith
committed
1f17566
fix: refactor #failureNode, adjust tests and safety
Michael Smith
committed
f550eb4

Commits on May 15, 2026

fix(arborist): only forward Link overrides when a rule names a target dep

manzoorwanijk
authored and
Michael Smith
committed
2c9587e
fix(arborist): skip lockfile entries for optional deps with incomplete manifests (#9343)

ecanturk
and
Michael Smith
authored
822ce86
docs: add example to optionalDependencies section (#9363)
verifizieren
authored
c97b39b

Commits on May 20, 2026

feat: add permissions support to trust commands (#9248)

reggi
and
Copilot
authored
cf94dbe
fix: allow min-release-age in npmrc to coexist with --before

raazkhnl
authored and
Michael Smith
committed
ca585c8
fix: min-release-age=0 doesn't filter, honor cross-source precedence
Michael Smith
committed
18ebb0f
feat: npm stage (#9201)

reggi
and
Copilot
authored
254809e
fix: key stage download --json output by package name (#9380)

reggi
and
Copilot
authored
2a13550
deps: hosted-git-info@9.0.3
Michael Smith
committed
514c71b
deps: semver@7.8.0
Michael Smith
committed
66c7ff1
deps: tar@7.5.15
Michael Smith
committed
91bd674
deps: bin-links@6.0.2
Michael Smith
committed
e36a4e3
deps: brace-expansion@5.0.6
Michael Smith
committed
1c4a796
deps: ip-address@10.2.0
Michael Smith
committed
b2717e4
deps: lru-cache@11.5.0
Michael Smith
committed
a77416e
deps: socks@2.8.9
Michael Smith
committed
d151521
chore: dev dependency updates
Michael Smith
committed
f502c4f
chore: release 12.0.0-pre.0.0

github-actions[bot]
authored and
Michael Smith
committed
4296f64

Commits on May 21, 2026

docs: Document `npm_old_version` and `npm_new_version` environment variables (#9385)
36degrees
authored
d124c08
fix(config): pause progress spinner during interactive editor spawn (#9372)

Zelys-DFKH
and
claude
authored
c0fc549
feat!: error on unknown configs, flags, and abbreviations (#9276)
Michael Smith
authored
979518d
fix!: run root preinstall before reify
Michael Smith
committed
2a03860

Commits on May 26, 2026

chore: sanitize newlines in flags table default and type values (#9393)

reggi
and
Copilot
authored
5fc9bc0
fix: exempt local project introspection from allow-directory
Michael Smith
committed
6237783
fix: fix typo of fullMetadata
Michael Smith
committed
33aebaa

Commits on May 27, 2026

feat: Phase 1 of `allowScripts` opt-in install-script policy (#9360)
JamieMagee
authored
7068d42
feat: publish --access=private alias for restricted (#9153)

reggi
and
Copilot
authored
c9be2d1
fix: skip hidden lockfile save on dry run (#9395)
puneetdixit200
authored
b77850e
fix(arborist): drop self-link materialization for undeclared workspaces (#9399)
manzoorwanijk
authored
dac7ff6
feat: add a global npmignore file (#9351)
ljharb
authored
f2e4a28
deps: make-fetch-happen@15.0.6
Michael Smith
committed
577d61d
deps: semver@7.8.1
Michael Smith
committed
8be4c04
deps: @npmcli/agent@4.0.2
Michael Smith
committed
11cd66e
deps: @sigstore/core@3.2.1
Michael Smith
committed
11e7ac7
deps: @sigstore/verify@3.1.1
Michael Smith
committed
d5ddef2
deps: lru-cache@11.5.1
Michael Smith
committed
ee61b6e
deps: sigstore@4.1.1
Michael Smith
committed
7f6c6ef
deps: undici@6.26.0
Michael Smith
committed
d28783e
chore: dev dependency updates
Michael Smith
committed
da63c79
fix: use prerelease strategy without a bug
Michael Smith
committed
c5292fa

Commits on May 28, 2026

fix: block forbidden keys in Queryable setter to prevent prototype pollution

authored and
Michael Smith
committed
080e3b2
fix!: default opts.access to null to preserve registry behavior
Michael Smith
committed
79b0c84
fix(arborist): read install scripts from disk on lockfile installs instead of a sentinel

JamieMagee
authored and
Michael Smith
committed
a81f2f8
fix(audit): don't apply min-release-age before filter when verifying installed signatures

JamieMagee
authored and
Michael Smith
committed
b97edc0

Commits on Jun 1, 2026

fix(config): clarify --all help so it's accurate for approve-scripts and deny-scripts

JamieMagee
authored and
Michael Smith
committed
6efac6e
fix: sanitize package name in linked-strategy path construction
Michael Smith
committed
9f3c97f

Commits on Jun 2, 2026

fix: respect allowScripts policy in prune, dedupe, uninstall, audit fix, and link

JamieMagee
authored and
Michael Smith
committed
75bf7de
fix: show full parent command path in subcommand usage errors (#9404)
shaanmajid
authored
fe41ae7
fix: invalid issue template YAML indentation (#9442)
fallintoplace
authored
fe820b6
fix: escape executable name in libnpmexec run-script (#9436)
rootvector2
authored
6901bb1
fix: flatten path separators in pack output filename (#9446)
rootvector2
authored
76f8059
feat!: default allow-git and allow-remote to none
Michael Smith
committed
caa3295

Commits on Jun 3, 2026

docs: update minimum npm required for npm trust

meeech
authored and
Michael Smith
committed
aac80dc
fix: suggest --allow-scripts for global installs in unreviewed-scripts warnings (#9469)
JamieMagee
authored
6603b2c
fix: list pending scripts in approve-scripts when ignore-scripts is set (#9479)
JamieMagee
authored
6be874b
feat: allowScripts tooling and inBundle hardening (#9480)
JamieMagee
authored
64e3f79
feat: default-deny install scripts (allowScripts opt-in) [v12]

JamieMagee
authored and
Michael Smith
committed
5cd5150
fix(arborist): clean up orphaned scoped store entries in linked strategy

manzoorwanijk
authored and
Michael Smith
committed
275bc69
fix(arborist): link meta-only optional peers in linked strategy

manzoorwanijk
authored and
Michael Smith
committed
a105799

Commits on Jun 4, 2026

fix: validate registry path for allow-remote tarballs

Abhinav-143x
authored and
Michael Smith
committed
bf623e0

Commits on Jun 5, 2026

fix: recognize allowScripts for local link targets (#9490)
cyphercodes
authored
2cbb13b
fix: pass script-shell to publish lifecycle hooks

Zelys-DFKH
authored and
Michael Smith
committed
0e55f97
fix(arborist): apply registry-tarball allow-remote exemption in linked strategy (#9495)
manzoorwanijk
authored
4bcba54
docs: use the latest version for global update and outdated's `wanted` (#9401)
liangmiQwQ
authored
455aa4a

Commits on Jun 8, 2026

docs: clarify package.json override value specs (#9505)
ded-furby
authored
bcf01c6
fix(arborist): honor allow-remote=root for root-direct remote tarballs (#9510)
manzoorwanijk
authored
d70e116
chore: update issue templates (#9512)
Michael Smith
authored
7a997ac
chore: update issue templates - better language
Michael Smith
committed
4e2496a

Commits on Jun 9, 2026

docs: approve-scripts only throws EGLOBAL when run with -g

JamieMagee
authored and
Michael Smith
committed
357e8cd
fix(config): strict-allow-scripts default blocks with a warning, not silently

JamieMagee
authored and
Michael Smith
committed
9b5c7b0
fix(arborist): enforce allowScripts for file:/link: dep scripts

JamieMagee
authored and
Michael Smith
committed
34dbdf5

Commits on Jun 10, 2026

fix: keep nested file: deps and re-resolve changed git refs (#9523)
Michael Smith
authored
fc6268a
feat: differentiate GitHub Actions environments in user-agent (#9517)

reggi
and
Copilot
authored
f6a9aad
feat: add min-release-age-exclude config

authored and
Michael Smith
committed
c3e1a71
test: regenerate smoke snapshot for strict-allow-scripts description

JamieMagee
authored and
Michael Smith
committed
b3b7197
fix: emit valid JSON from approve-scripts/deny-scripts --json
Michael Smith
committed
f6270d1

Commits on Jun 11, 2026

fix: match dotted and versioned args in approve-scripts/deny-scripts
Michael Smith
committed
abf78b3

Commits on Jun 18, 2026

chore: bumping @npmcli/template-oss from 4.29.0 to 5.1.0
Michael Smith
committed
acdd6d5
feat!: bump to new node engine range
Michael Smith
committed
18eb967
chore: template-oss-apply
Michael Smith
committed
d25a179
deps: @npmcli/map-workspaces@6.0.0
Michael Smith
committed
4d234b2
deps: @npmcli/metavuln-calculator@10.0.0
Michael Smith
committed
f86a019
deps: @npmcli/package-json@8.0.0
Michael Smith
committed
0be6ae2
deps: @npmcli/promise-spawn@10.0.0
Michael Smith
committed
f0eaef3
deps: @npmcli/redact@5.0.0
Michael Smith
committed
27c4dcc
deps: @npmcli/run-script@11.0.0
Michael Smith
committed
9d13ebf
deps: @sigstore/tuf@5.0.0
Michael Smith
committed
9bbdefb
deps: abbrev@5.0.0
Michael Smith
committed
0d15aec
deps: cacache@21.0.1
Michael Smith
committed
66d46bc
deps: hosted-git-info@10.1.1
Michael Smith
committed
d867351
deps: ini@7.0.0
Michael Smith
committed
406820a
deps: init-package-json@9.0.0
Michael Smith
committed
350fb18
deps: is-cidr@7.0.0
Michael Smith
committed
d44db96
deps: json-parse-even-better-errors@6.0.0
Michael Smith
committed
30e89d9
deps: make-fetch-happen@16.0.1
Michael Smith
committed
40395b8
deps: nopt@10.0.1
Michael Smith
committed
471309f
deps: npm-audit-report@8.0.0
Michael Smith
committed
faf97e5
deps: npm-install-checks@9.0.0
Michael Smith
committed
5e1d513
deps: npm-package-arg@14.0.0
Michael Smith
committed
d80859a
deps: npm-pick-manifest@12.0.0
Michael Smith
committed
998ff1d
deps: npm-profile@13.0.0
Michael Smith
committed
1fd247a
deps: npm-registry-fetch@20.0.1
Michael Smith
committed
1f9c567
deps: npm-user-validate@5.0.0
Michael Smith
committed
171bba3
deps: pacote@22.0.0
Michael Smith
committed
a44c1cf
deps: parse-conflict-json@6.0.0
Michael Smith
committed
8f85646
deps: proc-log@7.0.0
Michael Smith
committed
21df0ab
deps: read@6.0.0
Michael Smith
committed
3484d7f
deps: semver@7.8.4
Michael Smith
committed
68eb39c
deps: ssri@14.0.0
Michael Smith
committed
1502286
deps: tar@7.5.16
Michael Smith
committed
13d97ac
deps: validate-npm-package-name@8.0.0
Michael Smith
committed
5032af3
deps: which@7.0.0
Michael Smith
committed
e459d7a
deps: node-gyp@13.0.0
Michael Smith
committed
370f9c6
deps: @npmcli/fs@6.0.0
Michael Smith
committed
2f5da83
deps: bin-links@7.0.0
Michael Smith
committed
b62db95
deps: regenerate bundled dependencies
Michael Smith
committed
95ed19c
deps: sigstore@5.0.0
Michael Smith
committed
428afa6
deps: @npmcli/git@8.0.0
Michael Smith
committed
3dc18e5
deps: @npmcli/installed-package-contents@5.0.0
Michael Smith
committed
cc96d57
deps: @npmcli/name-from-folder@5.0.0
Michael Smith
committed
a12e2c8
deps: @npmcli/node-gyp@6.0.0
Michael Smith
committed
cc45055
deps: @npmcli/git@8.0.0
Michael Smith
committed
ad05528
deps: npm-packlist@11.2.0
Michael Smith
committed
5dce6fb
chore: @npmcli/template-oss@5.1.1
Michael Smith
committed
ee3d87f
chore: template-oss-apply
Michael Smith
committed
0323f2d
deps: bundle arborist runtime deps for bootstrap
Michael Smith
committed
3ef66bb
deps: @tufjs/repo-mock@5.0.0
Michael Smith
committed
d4e0a70
chore: nock@14.0.0
Michael Smith
committed
1453954
fix: adapt to @npmcli/run-script@11 breaking changes
Michael Smith
committed
fc3ef5a
feat: warn when min-release-age blocks an audit fix (#9544)
JamieMagee
authored
be8053c
feat!: remove default license for npm init
Michael Smith
committed
fc80bb3
feat: native dependency patching (npm patch add/commit/update/ls/rm) (#9439)
manzoorwanijk
authored
1db885c
fix(patch): keep the update marker on a no-op commit so a retry finalizes (#9567)
manzoorwanijk
authored
5ddf6cc
feat: packageExtensions for root-owned dependency manifest repairs (#9496)
manzoorwanijk
authored
ce7681f
fix(arborist): re-apply packageExtensions to the linked actual tree (#9569)
manzoorwanijk
authored
f9c977c
fix(arborist): warn once for workspace packageExtensions selector match (#9570)
manzoorwanijk
authored
cfda867
fix(patch): explain out-of-sync lockfile after --ignore-patch-failures (#9576)
manzoorwanijk
authored
62b0694
fix(patch): warn when `patch update --to` targets an uninstalled version (#9575)
manzoorwanijk
authored
a847d28
fix(arborist): drop orphaned patch entry on uninstall instead of EPATCHUNUSED (#9574)
manzoorwanijk
authored
315e3bd
fix(arborist): allow-remote exemption for proxy/mirror-fronted registry tarballs (#9550)
manzoorwanijk
authored
8bbd70d
fix(arborist): expose store node_modules via NODE_PATH for linked-strategy install scripts (#9551)
manzoorwanijk
authored
afce424

Commits on Jun 19, 2026

deps: npm-profile@13.0.1
Michael Smith
committed
9cbba72
fix!: Preserve https protocol when working with git (#8703)
oldium
authored
e96a7de
chore: add web-login proxy doneUrl regression for npm-profile fix (#9560)
manzoorwanijk
authored
059c06e
chore: release 12.0.0-pre.1

github-actions[bot]
authored and
Michael Smith
committed
ed72962

Commits on Jun 22, 2026

fix(arborist): symlink workspace file: deps on non-workspace local packages (#9591)
manzoorwanijk
authored
00b9f9f
fix(link): scope `npm link <path> --workspace` to the workspace, not the root (#9592)
manzoorwanijk
authored
1a9ce8e
deps: npm-packlist@11.3.0
Michael Smith
committed
ce11dcf
feat: `.npm-extension` transformManifest for imperative manifest repairs (#9586)
manzoorwanijk
authored
58cd8f5

Commits on Jun 23, 2026

Commits on Jun 24, 2026

Commits on Jun 25, 2026

Commits on Jun 26, 2026

Commits on Jun 29, 2026

docs: recommend install-strategy=linked to catch phantom dependencies (#9678)
manzoorwanijk
authored
fdcfcee
fix: output all the required parameters for npm token list (#9588)
rijildaniel
authored
6da6555
fix(exec): prevent shared binPaths pollution across workspace runs (#9650)
arjun-vegeta
authored
18b930f
fix(sbom): percent-encode vcs_url qualifier in generated purls (#9670)
ubeddulla
authored
024e6d9
feat(arborist): extend replace-registry-host with URL prefix matching (#6110) (#9672)
u2mejc
authored
b51d156
deps: semver@7.8.5
Michael Smith
committed
0f77bb1
deps: tar@7.5.19
Michael Smith
committed
52349de
deps: @npmcli/agent@5.0.2
Michael Smith
committed
a18679a
deps: @sigstore/core@4.0.1
Michael Smith
committed
09ce72f
deps: @sigstore/verify@4.1.0
Michael Smith
committed
8e6ba7a
deps: brace-expansion@5.0.7
Michael Smith
committed
c1d0a10
deps: cmd-shim@9.0.2
Michael Smith
committed
2b7c6a4
deps: postcss-selector-parser@7.1.4
Michael Smith
committed
c1edadd
deps: tinyglobby@0.2.17
Michael Smith
committed
2d74bfb
deps: undici@6.27.0
Michael Smith
committed
f055ce6
chore: dev dependency updates
Michael Smith
committed
bbd640d
chore: release 12.0.0-pre.2

github-actions[bot]
authored and
Michael Smith
committed
fb304e7
feat(install-scripts): use install-scripts as the warning log title

manzoorwanijk
authored and
Michael Smith
committed
42b12c2

Commits on Jul 8, 2026

feat: warn instead of error on unknown .npmrc configs (#9729)
reggi
authored
fd75880
chore: clarify unknown-config breaking change note in changelog (#9733)

reggi
and
Copilot
authored
6fefd0e
chore: release 12.0.0-pre.3

github-actions[bot]
authored and
reggi
committed
230e221
chore: remove pre-release mode from npm 12 and workspaces (#9735)

reggi
and
Copilot
authored
b77b532
feat: trigger release process (#9737)
reggi
authored
5b83698
chore: release 12.0.0

github-actions[bot]
authored and
reggi
committed
4403f05

Commits on Jul 10, 2026

fix: correct bundled sigstore from dev dependency conflict (#9740)
james-pre
authored
47fc8b1
fix(view): avoid wrapping array results (#9745)

authored
ecb02a8
chore: release 12.0.1

github-actions[bot]
authored and
reggi
committed
72a6088
chore(arborist): add missing registry mock in bin links reify test (#9746)

reggi
and
Copilot
authored
ddd50e9
chore: parse pack --json object output in node integration (#9747)

reggi
and
Copilot
authored
7b1f6c1

Commits on Jul 22, 2026

fix(arborist): allow audit fix to install safe downgrades (#9761)

martinrrm
and
Copilot
authored
882d0b2

Commits on Jul 27, 2026

Commits on Jul 29, 2026

chore: release 12.0.2

github-actions[bot]
authored and
reggi
committed
b888cc9

Commits on Jul 30, 2026

chore: pass nodedir to node-gyp via npm_package_config env in node integration (#9822)

reggi
and
Copilot
authored
278df04

Commits on Aug 3, 2026

Commits on Aug 12, 2026

fix: don't print the funding message for global installs (#9864)
lazerg
authored
51c2bf8

Commits on Aug 20, 2026

fix(arborist): don't fetch packuments for uninstallable optional peer dependencies (#9877)
danielroe
authored
dc43591

Commits on Aug 24, 2026

Commits on Aug 25, 2026

fix(arborist): reject uninstall args that carry a version (#9881)
lazerg
authored
da50c34
fix: keep dry-run output valid json (#9823)
martinrrm
authored
a8c9b2f
deps: tar@7.5.22 (#9843)

martinrrm
and
Copilot
authored
75a943d
deps: brace-expansion@5.0.9

martinrrm
and
Copilot
committed
b7c490d
deps: ip-address@10.5.0

martinrrm
and
Copilot
committed
05bd2a4
deps: undici@6.28.0

martinrrm
and
Copilot
committed
6e40f73
fix(arborist): match allowScripts keys for local paths (#9914)

martinrrm
and
Copilot
authored
d6c6122

Commits on Aug 26, 2026

chore: recognize prefixed Node.js PR titles (#9915)
reggi
authored
81a901c

Commits on Aug 31, 2026

fix(config): avoid exporting persistent allow-scripts (#9913)
Fnine59
authored
b016aa2

Commits on Sep 3, 2026

fix: provenance-file takes precedence over OIDC auto-generated provenance (#9882)
yunseo-kim
authored
c9876d7