Repository navigation
chore(deps): update npm to v11.21.2 - #233
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/npm-11.x
branch
from
October 13, 2026 11:34
05a841b to
f80d619
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-11.x
branch
3 times, most recently
from
October 22, 2026 14:30
a4dfc9d to
0414c1f
Compare
renovate
Bot
force-pushed
the
renovate/npm-11.x
branch
18 times, most recently
from
October 29, 2026 15:21
b383eb4 to
34352e3
Compare
renovate
Bot
force-pushed
the
renovate/npm-11.x
branch
7 times, most recently
from
November 5, 2026 01:32
1e85672 to
2a9ef1b
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-11.x
branch
24 times, most recently
from
November 7, 2026 14:10
5d1e95c to
c5f5279
Compare
renovate
Bot
force-pushed
the
renovate/npm-11.x
branch
from
November 9, 2026 23:11
c5f5279 to
1906d11
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
11.6.2→11.21.2Release Notes
npm/cli (npm)
v11.21.2Compare Source
Bug Fixes
9433b48#10195 accept supported Node.js prereleases at startup (#10195) (@github-actions[bot], @reggi, @Copilot)Dependencies
8cbc35a#10206semver@7.8.6(@reggi, @Copilot)9c0af6b#10172ip-address@10.7.5f3707dc#10172undici@6.29.1484a19d#10176pacote@21.5.2(@martinrrm, @Copilot)bfae5d0#10176promise-spawn@9.0.2(@martinrrm)2ef644b#10176bin-links@6.0.3(@martinrrm)libnpmexec@10.3.5v11.21.1Compare Source
Bug Fixes
1c7b661#10059 write registry allowScripts keys under install-strategy=linked (#10059) (@github-actions[bot], @manzoorwanijk)Dependencies
8cec7c9#10089http-cache-semantics@4.3.0(@reggi)fd105c7#10089undici@6.29.0(@reggi)fc2a0dd#10089postcss-selector-parser@7.1.6(@reggi)bae8cd7#10089ip-address@10.7.2(@reggi)4a9d14d#10089brace-expansion@5.0.12(@reggi)@npmcli/arborist@9.9.3libnpmdiff@8.1.14libnpmexec@10.3.4libnpmfund@7.0.28libnpmpack@9.1.15v11.21.0Compare Source
Features
1f38f64#10056 dist-tag: support OIDC authentication (#10056) (@github-actions[bot], @reggi, @Copilot)Documentation
0a8b905#10050 update npm stage docs to reflect that it can create new packages (#10050) (@github-actions[bot], @shmam, @Copilot)Dependencies
@npmcli/config@10.14.0v11.20.0Compare Source
Features
0b3c699#9994 token: support read-write-stage-only granular access tokens (#9994) (@github-actions[bot], @Tayvon, @Copilot)b872816#9920 stage: display staged package status (#9920) (@github-actions[bot], @joelverhagen)Bug Fixes
ddbadfc#9947 provenance-file takes precedence over OIDC auto-generated provenance (#9947) (@github-actions[bot], @yunseo-kim)64d4b4b#9937 config: avoid exporting persistent allow-scripts (#9937) (@github-actions[bot], @Fnine59)70317da#9930 arborist: reject uninstall args that carry a version (#9930) (@github-actions[bot], @lazerg)55ae484#9929 arborist: match allowScripts keys for local paths (#9929) (@github-actions[bot], @martinrrm, @Copilot)7f1f2b7#9928 keep dry-run output valid json (#9928) (@github-actions[bot], @martinrrm)f28cca9#9927 don't print the funding message for global installs (#9927) (@github-actions[bot], @lazerg)Chores
6ff3000#10010 pack: select workspace through config (#10010) (@github-actions[bot], @reggi)afdc5bd#9932 pass nodedir to node-gyp via npm_package_config env in node integration (#9932) (@reggi)83f95ff#9931 updatenode-integrationworkflow template to latest actions (#9931) (@reggi)f020fba#9925 recognize prefixed Node.js PR titles (#9925) (@github-actions[bot], @reggi)Dependencies
@npmcli/arborist@9.9.2@npmcli/config@10.13.0libnpmdiff@8.1.13libnpmexec@10.3.3libnpmfund@7.0.27libnpmpack@9.1.14libnpmpublish@11.2.1v11.19.1Compare Source
Bug Fixes
83b750d#9916 exempt explicit pack targets from allow-directory (#9916) (@github-actions[bot], @ychampion, @ychampion)Dependencies
4791b27#9872undici@6.28.0(@martinrrm, @Copilot)823d647#9872ip-address@10.5.0(@martinrrm, @Copilot)04f8efe#9872brace-expansion@5.0.9(@martinrrm, @Copilot)1610280#9842tar@7.5.22(#9842) (@martinrrm, @Copilot)libnpmpack@9.1.13v11.19.0Compare Source
Features
7d39aa6#9698 install-scripts: use install-scripts as the warning log title (@manzoorwanijk)Bug Fixes
3529ca2#9811 pack: honor min-release-age-exclude (#9811) (@github-actions[bot], @martinrrm, @Copilot)67f12ae#9810 owner: use scoped registry for user lookup (#9810) (@github-actions[bot], @martinrrm, @Copilot)Dependencies
@npmcli/arborist@9.9.1libnpmdiff@8.1.12libnpmexec@10.3.2libnpmfund@7.0.26libnpmpack@9.1.12v11.18.0Compare Source
Features
3021ad6#9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)abd8c6b#9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)9420673#9662 install-scripts: prune unused allowScripts entries (#9662) (@github-actions[bot], @JamieMagee)fc9d4c7#9635 namespace install-script approval commands under npm install-scripts (#9635) (@manzoorwanijk)073253f#9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)Bug Fixes
598ffdb#9693 sbom: percent-encode vcs_url qualifier in generated purls (#9693) (@github-actions[bot], @ubeddulla)05793d0#9691 output all the required parameters for npm token list (#9691) (@github-actions[bot], @rijildaniel)cd57139#9669 arborist: surface undeclared workspaces under the linked strategy (backport release/v11) (#9669) (@manzoorwanijk)5b6ff9c#9667 reify: report added count for fresh linked installs (#9667) (@github-actions[bot], @manzoorwanijk, @owlstronaut)8f13beb#9664 query: report logical dep location under linked strategy (#9664) (@github-actions[bot], @manzoorwanijk)168ba30#9663 allowScripts: close enforcement gaps (#9652) (backport release/v11) (#9663) (@JamieMagee)ae64f88#9648 exec: resolve workspace-local bin under the linked install strategy (#9648) (@github-actions[bot], @manzoorwanijk)784cbe9#9636 ls: restore 100% coverage on release/v11 after #9633 (#9636) (@manzoorwanijk)70f0ea5#9607 approve-scripts: approve deps with no resolved URL by name (#9607) (@github-actions[bot], @JamieMagee)b2e6338#9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)6ad5715#9595 link: scopenpm link --workspaceto the workspace, not the root (#9595) (@github-actions[bot], @manzoorwanijk)Documentation
3658bb5#9690 recommend install-strategy=linked to catch phantom dependencies (#9690) (@github-actions[bot], @manzoorwanijk)Dependencies
54656b6#9696undici@6.27.031c4773#9696brace-expansion@5.0.7e773c77#9696tar@7.5.19f05f6af#9696semver@7.8.5804f9ba#9580npm-profile@12.0.2Chores
f79b37f#9696 dev dependency updates (@owlstronaut)a04cd84#9584 add web-login proxy doneUrl regression for npm-profile fix (#9584) (@github-actions[bot], @manzoorwanijk)@npmcli/arborist@9.9.0@npmcli/config@10.12.0libnpmdiff@8.1.11libnpmexec@10.3.1libnpmfund@7.0.25libnpmpack@9.1.11arborist: 9.9.0
9.9.0 (2026-06-29)
Features
3021ad6#9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)abd8c6b#9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)9420673#9662 install-scripts: prune unused allowScripts entries (#9662) (@github-actions[bot], @JamieMagee)073253f#9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)Bug Fixes
774875b#9686 arborist: keep bin links for allowScripts-denied packages (#9686) (@JamieMagee)719de1e#9673 arborist: apply overrides across a file: link (backport release/v11) (#9673) (@manzoorwanijk)cd57139#9669 arborist: surface undeclared workspaces under the linked strategy (backport release/v11) (#9669) (@manzoorwanijk)ede32d3#9668 arborist: forward transitive overrides through linked store links (#9658) (backport release/v11) (#9668) (@manzoorwanijk)f503b07#9666 correct dev/prod dep flags for workspaces under the linked strategy (#9666) (@github-actions[bot], @manzoorwanijk)f580889#9665 arborist: load transitive optional deps into linked actual tree (#9665) (@github-actions[bot], @manzoorwanijk)8f13beb#9664 query: report logical dep location under linked strategy (#9664) (@github-actions[bot], @manzoorwanijk)168ba30#9663 allowScripts: close enforcement gaps (#9652) (backport release/v11) (#9663) (@JamieMagee)4c9eacb#9649 arborist: clean up stale .store and hoisted dirs on strategy switch (#9649) (@github-actions[bot], @manzoorwanijk)d2c680e#9645 arborist: invalid filterNode crash under the linked strategy (#9645) (@github-actions[bot], @manzoorwanijk)4e40b1c#9644 arborist: repair wrong-but-existing symlink target in linked strategy (#9644) (@github-actions[bot], @manzoorwanijk)9d1774e#9643 arborist: remove stale .bin shims after uninstall under linked (#9643) (@github-actions[bot], @manzoorwanijk)ed37d24#9642 arborist: record the linked .store layout in the hidden lockfile (backport #9630) (#9642) (@manzoorwanijk)e601d4a#9641 arborist: validate peerOptional conflicts in no-save mutations (#9641) (@owlstronaut, @dale-lakes, @dale-lakes)03cee43#9638 arborist: fix audit-report determinism due to dropped via links (#9638) (@github-actions[bot], @arjun-vegeta)a30d855#9633 arborist: don't load store packages' devDependencies as required edges (#9633) (@manzoorwanijk)887ca97#9631 arborist: audit the non-isolated tree under the linked strategy (#9631) (@github-actions[bot], @manzoorwanijk)b2e6338#9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)390ebfa#9593 arborist: symlink workspace file: deps on non-workspace local packages (#9593) (@github-actions[bot], @manzoorwanijk)aaeb2f1#9578 arborist: expose store node_modules via NODE_PATH for linked-strategy install scripts (#9578) (@github-actions[bot], @manzoorwanijk)05b6f0f#9577 arborist: allow-remote exemption for proxy/mirror-fronted registry tarballs (#9577) (@github-actions[bot], @manzoorwanijk)config: 10.12.0
10.12.0 (2026-06-29)
Features
3021ad6#9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)abd8c6b#9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)073253f#9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)Bug Fixes
b2e6338#9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)Documentation
3658bb5#9690 recommend install-strategy=linked to catch phantom dependencies (#9690) (@github-actions[bot], @manzoorwanijk)libnpmdiff: 8.1.11
Dependencies
@npmcli/arborist@9.9.0libnpmexec: 10.3.1
10.3.1 (2026-06-29)
Bug Fixes
f3f2465#9692 exec: prevent shared binPaths pollution across workspace runs (#9692) (@github-actions[bot], @arjun-vegeta)b2e6338#9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)Dependencies
@npmcli/arborist@9.9.0libnpmfund: 7.0.25
Dependencies
@npmcli/arborist@9.9.0libnpmpack: 9.1.11
Dependencies
@npmcli/arborist@9.9.0v11.17.0Compare Source
Features
ae8ac4e#9534 add min-release-age-exclude config (@JamieMagee, @caseyjhol)8ff3e48#9483 allowScripts tooling and inBundle hardening (#9483) (@github-actions[bot], @JamieMagee)Bug Fixes
847cdf8#9541 match dotted and versioned args in approve-scripts/deny-scripts (@owlstronaut)d99f7cb#9535 emit valid JSON from approve-scripts/deny-scripts --json (@owlstronaut)351a309#9499 pass script-shell to publish lifecycle hooks (#9499) (@github-actions[bot])4fa81df#9497 recognize allowScripts for local link targets (#9497) (@github-actions[bot], @cyphercodes, @cyphercodes)95cf2e9#9489 validate registry path for allow-remote tarballs (@Abhinav-143x)9dd219b#9462 respect allowScripts policy in prune, dedupe, uninstall, audit, and link (#9462) (@github-actions[bot], @JamieMagee)cd8d18a#9482 list pending scripts in approve-scripts when ignore-scripts is set (#9482) (@github-actions[bot], @JamieMagee)c14e87c#9481 suggest --allow-scripts for global installs in unreviewed-scripts warnings (#9481) (@github-actions[bot], @JamieMagee)7ade52e#9465 invalid issue template YAML indentation (#9465) (@github-actions[bot], @fallintoplace)c069622#9464 show full parent command path in subcommand usage errors (#9464) (@owlstronaut)1bb62bb#9454 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@JamieMagee)84eeb5f#9431 audit: don't apply min-release-age before filter when verifying installed signatures (@JamieMagee)3bd3377#9426 block forbidden keys in Queryable setter to prevent prototype pollution (@12122J, @claude)Documentation
a86a7a9#9522 approve-scripts only throws EGLOBAL when run with -g (@JamieMagee)693bb3d#9508 clarify package.json override value specs (#9508) (@github-actions[bot], @ded-furby)ccffe4a#9501 use the latest version for global update and outdated'swanted(#9501) (@github-actions[bot], @liangmiQwQ)66e97c2#9478 update minimum npm required for npm trust (@meeech)Dependencies
bd09b87#9542postcss-selector-parser@7.1.495bfc4c#9542tinyglobby@0.2.178c0d5fd#9542tar@7.5.16967d377#9542semver@7.8.4cdaac1b#9542pacote@21.5.125c8a9e#9542node-gyp@12.4.0Chores
2922fa4](https://redirect.github.com/npm/cli/commit/2922fa45f1145c14d7eb0e5796a685Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.