chore(deps): update npm to v12 - #56
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/npm-12.x
branch
from
July 30, 2026 00:16
0111072 to
494bd56
Compare
renovate
Bot
force-pushed
the
renovate/npm-12.x
branch
from
September 16, 2026 00:48
494bd56 to
4d0b2a9
Compare
renovate
Bot
force-pushed
the
renovate/npm-12.x
branch
from
September 23, 2026 00:11
4d0b2a9 to
842399f
Compare
Contributor
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^8.19.4→^12.1.0Release Notes
npm/cli (npm)
v12.1.0Compare Source
Features
6400533#9948 token: support read-write-stage-only granular access tokens (#9948) (@Tayvon, @Copilot)8723f53#9898 stage: display staged package status (#9898) (@joelverhagen)Bug Fixes
c9876d7#9882 provenance-file takes precedence over OIDC auto-generated provenance (#9882) (@yunseo-kim)b016aa2#9913 config: avoid exporting persistent allow-scripts (#9913) (@Fnine59)d6c6122#9914 arborist: match allowScripts keys for local paths (#9914) (@martinrrm, @Copilot)a8c9b2f#9823 keep dry-run output valid json (#9823) (@martinrrm)da50c34#9881 arborist: reject uninstall args that carry a version (#9881) (@lazerg)71915e8#9756 exempt explicit pack targets from allow-directory (#9756) (@ychampion, @ychampion)51c2bf8#9864 don't print the funding message for global installs (#9864) (@lazerg)Documentation
bea9066#9838 document npm 12 install script blocking (#9838) (@reggi)Dependencies
6e40f73#9871undici@6.28.0(@martinrrm, @Copilot)05bd2a4#9871ip-address@10.5.0(@martinrrm, @Copilot)b7c490d#9871brace-expansion@5.0.9(@martinrrm, @Copilot)75a943d#9843tar@7.5.22(#9843) (@martinrrm, @Copilot)Chores
7b50811#9961 pack: select workspace through config (#9961) (@reggi)81a901c#9915 recognize prefixed Node.js PR titles (#9915) (@reggi)4cdccea#9836 updatenode-integrationworkflow template to latest actions (#9836) (@MikeMcC399)278df04#9822 pass nodedir to node-gyp via npm_package_config env in node integration (#9822) (@reggi, @Copilot)@npmcli/arborist@10.0.3@npmcli/config@11.1.0libnpmdiff@9.0.3libnpmexec@11.0.3libnpmfund@8.0.3libnpmpack@10.0.3libnpmpublish@12.0.1v12.0.2Compare Source
Bug Fixes
834408e#9760 pack: honor min-release-age-exclude (#9760) (@martinrrm, @Copilot)ef6cfea#9786 owner: use scoped registry for user lookup (#9786) (@martinrrm, @Copilot)Documentation
9e17dc0#9805 clarify npm 12 unknown-config breaking change in changelogs (#9805) (@Hashim1999164)Chores
7b1f6c1#9747 parse pack --json object output in node integration (#9747) (@reggi, @Copilot)Dependencies
@npmcli/arborist@10.0.2@npmcli/config@11.0.1libnpmdiff@9.0.2libnpmexec@11.0.2libnpmfund@8.0.2libnpmpack@10.0.2v12.0.1Compare Source
Bug Fixes
ecb02a8#9745 view: avoid wrapping array results (#9745) (@reggi, @martinrrm, @Copilot)47fc8b1#9740 correct bundled sigstore from dev dependency conflict (#9740) (@james-pre)Dependencies
@npmcli/arborist@10.0.1libnpmdiff@9.0.1libnpmexec@11.0.1libnpmfund@8.0.1libnpmpack@10.0.1v12.0.0Compare Source
npm sbom --sbom-format=cyclonedxnow reports thenamefield from each package'spackage.jsoninstead of the on-disk directory name. Thename,bom-ref, andpurlof the root component and of aliased dependencies may change.man npm-installwill no longer work, butnpm help installis unaffected.npm pkgoutput is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly tonpm view.npm shrinkwrapis removed, theshrinkwrapconfig alias is removed, andnpm-shrinkwrap.jsonis no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-rootnpm-shrinkwrap.jsontopackage-lock.json; usebundleDependenciesif you need to ship a locked dependency tree.npm packandnpm publishhave changed. They are now always consistent, and in the same format.star,starsandunstarcommands have been removednpm addusercommand has been removed. Create and manage user accounts on the npm website, and usenpm loginto authenticate on the command line.npm inithas been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.npmnow supports node^22.22.2 || ^24.15.0 || >=26.0.0Chores
b77b532#9735 remove pre-release mode from npm 12 and workspaces (#9735) (@reggi, @Copilot)Dependencies
@npmcli/arborist@10.0.0@npmcli/config@11.0.0libnpmaccess@11.0.0libnpmdiff@9.0.0libnpmexec@11.0.0libnpmfund@8.0.0libnpmorg@9.0.0libnpmpack@10.0.0libnpmpublish@12.0.0libnpmsearch@10.0.0libnpmteam@9.0.0libnpmversion@9.0.0v11.20.0Compare Source
v11.19.1Compare Source
v11.19.0Compare Source
v11.18.0Compare Source
v11.17.0Compare Source
Features
ae8ac4e#9534 add min-release-age-exclude config (@JamieMagee, @caseyjhol)8ff3e48#9483 allowScripts tooling and inBundle hardening (#9483) (@github-actions[bot], @JamieMagee)Bug Fixes
847cdf8#9541 match dotted and versioned args in approve-scripts/deny-scripts (@owlstronaut)d99f7cb#9535 emit valid JSON from approve-scripts/deny-scripts --json (@owlstronaut)351a309#9499 pass script-shell to publish lifecycle hooks (#9499) (@github-actions[bot])4fa81df#9497 recognize allowScripts for local link targets (#9497) (@github-actions[bot], @cyphercodes, @cyphercodes)95cf2e9#9489 validate registry path for allow-remote tarballs (@Abhinav-143x)9dd219b#9462 respect allowScripts policy in prune, dedupe, uninstall, audit, and link (#9462) (@github-actions[bot], @JamieMagee)cd8d18a#9482 list pending scripts in approve-scripts when ignore-scripts is set (#9482) (@github-actions[bot], @JamieMagee)c14e87c#9481 suggest --allow-scripts for global installs in unreviewed-scripts warnings (#9481) (@github-actions[bot], @JamieMagee)7ade52e#9465 invalid issue template YAML indentation (#9465) (@github-actions[bot], @fallintoplace)c069622#9464 show full parent command path in subcommand usage errors (#9464) (@owlstronaut)1bb62bb#9454 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@JamieMagee)84eeb5f#9431 audit: don't apply min-release-age before filter when verifying installed signatures (@JamieMagee)3bd3377#9426 block forbidden keys in Queryable setter to prevent prototype pollution (@12122J, @claude)Documentation
a86a7a9#9522 approve-scripts only throws EGLOBAL when run with -g (@JamieMagee)693bb3d#9508 clarify package.json override value specs (#9508) (@github-actions[bot], @ded-furby)ccffe4a#9501 use the latest version for global update and outdated'swanted(#9501) (@github-actions[bot], @liangmiQwQ)66e97c2#9478 update minimum npm required for npm trust (@meeech)Dependencies
bd09b87#9542postcss-selector-parser@7.1.495bfc4c#9542tinyglobby@0.2.178c0d5fd#9542tar@7.5.16967d377#9542semver@7.8.4cdaac1b#9542pacote@21.5.125c8a9e#9542node-gyp@12.4.0Chores
2922fa4#9542 dev dependency updates (@owlstronaut)@npmcli/arborist@9.8.0@npmcli/config@10.11.0libnpmdiff@8.1.10libnpmexec@10.3.0libnpmfund@7.0.24libnpmpack@9.1.10v11.16.0Compare Source
Features
4b67f6e#9416 publish --access=private alias for restricted (#9416) (@github-actions[bot], @reggi, @Copilot)a10c7ca#9415 Phase 1 ofallowScriptsopt-in install-script policy (#9360) (#9415) (@owlstronaut, @JamieMagee)Bug Fixes
1f7869b#9411 fix typo of fullMetadata (@owlstronaut)cde03ba#9390 config: pause progress spinner during interactive editor spawn (#9388) (@github-actions[bot], @Zelys-DFKH, @claude)Documentation
c5e9d73#9390 Documentnpm_old_versionandnpm_new_versionenvironment variables (#9389) (@github-actions[bot], @36degrees)Dependencies
cdd7bbc#9421undici@6.26.0fde87c9#9421sigstore@4.1.12779793#9421lru-cache@11.5.1dea702d#9421@sigstore/verify@3.1.14eab03f#9421@sigstore/core@3.2.174c7323#9421@npmcli/agent@4.0.2edc4ab3#9421semver@7.8.15f6ce33#9421make-fetch-happen@15.0.6Chores
bd04976#9421 dev dependency updates (@owlstronaut)aeceb23#9407 sanitize newlines in flags table default and type values (#9407) (@reggi, @Copilot)@npmcli/arborist@9.7.0@npmcli/config@10.10.0libnpmdiff@8.1.9libnpmexec@10.2.9libnpmfund@7.0.23libnpmpack@9.1.9libnpmversion@8.0.4v11.15.0Compare Source
Features
0d5d899#9379 npm stage (@reggi, @Copilot)1433740#9376 add permissions support to trust commands (#9376) (@github-actions[bot], @reggi, @Copilot)8df10f5#9339 add allow-git/allow-file/allow-directory/allow-remote configs (@owlstronaut)Bug Fixes
39b625e#9381 key stage download --json output by package name (#9381) (@reggi, @Copilot)6aa332d#9339 allow min-release-age in npmrc to coexist with --before (@raazkhnl)468550f#9339 refactor #failureNode, adjust tests and safety (@owlstronaut)cabe249#9339 allow-remote=none does not block registry tarballs (@owlstronaut)Dependencies
8416a60#9383socks@2.8.95e5a25b#9383lru-cache@11.5.0a6f9ad2#9383ip-address@10.2.063f8114#9383brace-expansion@5.0.66918b4c#9383bin-links@6.0.2bf84079#9383tar@7.5.15bdef82c#9383semver@7.8.03f38a67#9383hosted-git-info@9.0.3Chores
816f3bf#9383 dev dependency updates (@owlstronaut)@npmcli/arborist@9.6.0@npmcli/config@10.9.1libnpmdiff@8.1.8libnpmexec@10.2.8libnpmfund@7.0.22libnpmpack@9.1.8libnpmpublish@11.2.0v11.14.1Compare Source
Bug Fixes
dca12cb#9328 remove settings (#9328) (@github-actions[bot], @owlstronaut)v11.14.0Compare Source
Features
45fc5e0#9288 add allow-directory, allow-file, and allow-remote (#9288) (@github-actions[bot], @wraithgar)Bug Fixes
6c17544#9318 sbom: dedupe per-node dependsOn / relationships (#9318) (@github-actions[bot], @mikaelkristiansson)Dependencies
840fe18#9322socks@10.1.1b771289#9322ip-address@10.1.1addffcb#9322cidr-regex@5.0.5Chores
041fd58#9322 dev dependency updates (@owlstronaut)89c505a#9320 add cli-triage team as codeowner (#9320) (@github-actions[bot], @owlstronaut)@npmcli/arborist@9.5.0@npmcli/config@10.9.0libnpmdiff@8.1.7libnpmexec@10.2.7libnpmfund@7.0.21libnpmpack@9.1.7v11.13.0Compare Source
Features
8e8dadb#9246 adduas alias forupdatecommand (#9246) (@github-actions[bot], @Ausoj)Bug Fixes
ecd161b#9258 ignore intended error code (@owlstronaut)Dependencies
8d2fdcd#9272lru-cache@11.3.5e603d36#9272node-gyp@12.3.0d48b7da#9272is-cidr@6.0.4032a5ca#9240@sigstore/protobuf-specs@0.5.133a81e7#9240tinyglobby@0.2.1668dc4a0#9240picomatch@4.0.41bb6703#9240lru-cache@11.3.337059e4#9240diff@8.0.4fb450ab#9240minimatch@10.2.57c4bbbf#9240tar@7.5.13703a3bc#9240minipass-flush@1.0.6Chores
e0724ac#9272 dev dependency updates (@owlstronaut)d249341#9230 don't run npm update in CI (@owlstronaut)@npmcli/arborist@9.4.3libnpmdiff@8.1.6libnpmexec@10.2.6libnpmfund@7.0.20libnpmpack@9.1.6v11.12.1Compare Source
Bug Fixes
596706a#9148 revert prefer-offline/prefer-online exclusivity (#9129) (@owlstronaut)Documentation
d1ee8a5#9140 Add note on relative path prefix for npm publish (#9140) (@pydsigner)Dependencies
@npmcli/config@10.8.1v11.12.0Compare Source
Features
8eff5fb#9049 audit: add --include-attestations flag to output sigstore bundles (#9049) (@mitchdenny)Bug Fixes
03af94d#9123 skip synopsis code block when command has no usage (@owlstronaut)21ea382#9110 arborist: resolve sibling override sets via common ancestor (#9110) (@manzoorwanijk)Dependencies
03f4c3a#9131@sigstore/tuf@4.0.24d5f7d9#9131@gar/promise-retry@1.0.38dcfe69#9131@sigstore/sign@4.1.1e5a7e22#9127lru-cache@11.2.782deab6#9127make-fetch-happen@15.0.5ce195dc#9127cacache@20.0.4Chores
95fa7f4#9132 fix docs test snapshot (#9132) (@wraithgar)7e9d538#9127 dev dependency updates (@wraithgar)920e5ed#9127 test snapshots (@wraithgar)98ccf92#9125 fix snap tests (@owlstronaut)@npmcli/arborist@9.4.2@npmcli/config@10.8.0libnpmdiff@8.1.5libnpmexec@10.2.5libnpmfund@7.0.19libnpmpack@9.1.5v11.11.1Compare Source
Bug Fixes
a9d242b#9099 include all subcommands on main command help (#9099) (@wraithgar)29b8407#9087 unwrap comments and lines meant for output (#9087) (@wraithgar)b56986a#9095 ls: suppress false UNMET DEPENDENCYs in linked strategy (#9095) (@manzoorwanijk)76c76e5#9083 ci: don't error on optional deps in the lockfile (#9083) (@wraithgar)a29aeee#9028 arborist: retry bin-links on Windows EPERM (#9028) (@manzoorwanijk)6565eeb#9045 bypass packument cache to prevent ETARGET errors after publish (#9045) (@Jadu07)Documentation
3b96929#9074 scripts: remove mention of obsolete root user behavior (#9074) (@mohd-akram)16ac4e0#9054 fix workspace cross-dependency documentation (@owlstronaut)Dependencies
075ae23#9086tar@7.5.1113fa40d#9086pacote@21.5.0bf7ea2b#9060brace-expansion@5.0.42000d2c#9060minimatch@10.2.4d86b260#9060tar@7.5.10dff1853#9060@npmcli/run-script@10.0.493c3365#9060write-file-atomic@7.0.1Chores
d1996a7#9060 dev dependency updates (@wraithgar)@npmcli/arborist@9.4.1libnpmdiff@8.1.4libnpmexec@10.2.4libnpmfund@7.0.18libnpmpack@9.1.4v11.11.0Compare Source
Features
4fcd352#9017 add :type(registry) to query selector syntax (#9017) (@wraithgar)e1b21f0#8909 adds circleci to trust command (#8909) (@owlstronaut)9a33ad0#8925 adds circleci to oidc (#8925) (@owlstronaut)Bug Fixes
4426411#9026 npm audit signatures for keyless attestation registries (#9026) (@ajayk)658b323#9010 handle legacy licenses array in sbom output (#9010) (@JNC4)Documentation
143f8cd#9007 docs shouldn't wrap yaml description (#9007) (@owlstronaut)Dependencies
7798b6e#9027@gar/promise-retry@1.0.24838864#9027balanced-match@4.0.40c200dd#9027brace-expansion@5.0.3f0606bb#9027spdx-license-ids@3.0.23d43f350#9027make-fetch-happen@15.0.44d0918a#9027@npmcli/git@7.0.28912ca7#9027minipass-fetch@5.0.2450ff35#9027npm-packlist@10.0.420ef5a5#9027pacote@21.4.0Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.