chore: release 11.15.0

.release-please-manifest.json

@@ -1,12 +1,12 @@
 {
-  ".": "11.14.1",
-  "workspaces/arborist": "9.5.0",
+  ".": "11.15.0",
+  "workspaces/arborist": "9.6.0",
   "workspaces/libnpmaccess": "10.0.3",
-  "workspaces/libnpmdiff": "8.1.7",
-  "workspaces/libnpmexec": "10.2.7",
-  "workspaces/libnpmfund": "7.0.21",
+  "workspaces/libnpmdiff": "8.1.8",
+  "workspaces/libnpmexec": "10.2.8",
+  "workspaces/libnpmfund": "7.0.22",
   "workspaces/libnpmorg": "8.0.1",
-  "workspaces/libnpmpack": "9.1.7",
+  "workspaces/libnpmpack": "9.1.8",
   "workspaces/libnpmpublish": "11.1.3",
   "workspaces/libnpmsearch": "9.0.1",
   "workspaces/libnpmteam": "8.0.2",

CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [11.15.0](https://github.com/npm/cli/compare/v11.14.1...v11.15.0) (2026-05-13)
+### Features
+* [`8df10f5`](https://github.com/npm/cli/commit/8df10f5a399048c9d2dd7eba1d65c0b4b6a5b1c8) [#9354](https://github.com/npm/cli/pull/9354) add allow-git/allow-file/allow-directory/allow-remote configs (@owlstronaut)
+### Bug Fixes
+* [`468550f`](https://github.com/npm/cli/commit/468550fb8f6ded97df03e6b8a82dbfbcb7b47d30) [#9354](https://github.com/npm/cli/pull/9354) refactor #failureNode, adjust tests and safety (@owlstronaut)
+* [`cabe249`](https://github.com/npm/cli/commit/cabe2499347c17d97eecc3bbca3d96fe2f556d0d) [#9354](https://github.com/npm/cli/pull/9354) allow-remote=none does not block registry tarballs (@owlstronaut)
+
+
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.8): `libnpmdiff@8.1.8`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.8): `libnpmexec@10.2.8`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.22): `libnpmfund@7.0.22`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.8): `libnpmpack@9.1.8`
+
 ## [11.14.1](https://github.com/npm/cli/compare/v11.14.0...v11.14.1) (2026-05-08)
 ### Bug Fixes
 * [`dca12cb`](https://github.com/npm/cli/commit/dca12cb24199aa7046eb53547097906b8731e51b) [#9328](https://github.com/npm/cli/pull/9328) remove settings (#9328) (@github-actions[bot], @owlstronaut)

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "npm",
-  "version": "11.14.1",
+  "version": "11.15.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "npm",
-      "version": "11.14.1",
+      "version": "11.15.0",
       "bundleDependencies": [
         "@isaacs/string-locale-compare",
         "@npmcli/arborist",
@@ -84,7 +84,7 @@
       ],
       "dependencies": {
         "@isaacs/string-locale-compare": "^1.1.0",
-        "@npmcli/arborist": "^9.5.0",
+        "@npmcli/arborist": "^9.6.0",
         "@npmcli/config": "^10.9.0",
         "@npmcli/fs": "^5.0.0",
         "@npmcli/map-workspaces": "^5.0.3",
@@ -109,11 +109,11 @@
         "is-cidr": "^6.0.4",
         "json-parse-even-better-errors": "^5.0.0",
         "libnpmaccess": "^10.0.3",
-        "libnpmdiff": "^8.1.7",
-        "libnpmexec": "^10.2.7",
-        "libnpmfund": "^7.0.21",
+        "libnpmdiff": "^8.1.8",
+        "libnpmexec": "^10.2.8",
+        "libnpmfund": "^7.0.22",
         "libnpmorg": "^8.0.1",
-        "libnpmpack": "^9.1.7",
+        "libnpmpack": "^9.1.8",
         "libnpmpublish": "^11.1.3",
         "libnpmsearch": "^9.0.1",
         "libnpmteam": "^8.0.2",
@@ -14608,7 +14608,7 @@
     },
     "workspaces/arborist": {
       "name": "@npmcli/arborist",
-      "version": "9.5.0",
+      "version": "9.6.0",
       "license": "ISC",
       "dependencies": {
         "@gar/promise-retry": "^1.0.0",
@@ -14706,10 +14706,10 @@
       }
     },
     "workspaces/libnpmdiff": {
-      "version": "8.1.7",
+      "version": "8.1.8",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.5.0",
+        "@npmcli/arborist": "^9.6.0",
         "@npmcli/installed-package-contents": "^4.0.0",
         "binary-extensions": "^3.0.0",
         "diff": "^8.0.2",
@@ -14728,11 +14728,11 @@
       }
     },
     "workspaces/libnpmexec": {
-      "version": "10.2.7",
+      "version": "10.2.8",
       "license": "ISC",
       "dependencies": {
         "@gar/promise-retry": "^1.0.0",
-        "@npmcli/arborist": "^9.5.0",
+        "@npmcli/arborist": "^9.6.0",
         "@npmcli/package-json": "^7.0.0",
         "@npmcli/run-script": "^10.0.0",
         "ci-info": "^4.0.0",
@@ -14759,10 +14759,10 @@
       }
     },
     "workspaces/libnpmfund": {
-      "version": "7.0.21",
+      "version": "7.0.22",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.5.0"
+        "@npmcli/arborist": "^9.6.0"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^5.0.1",
@@ -14792,10 +14792,10 @@
       }
     },
     "workspaces/libnpmpack": {
-      "version": "9.1.7",
+      "version": "9.1.8",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.5.0",
+        "@npmcli/arborist": "^9.6.0",
         "@npmcli/run-script": "^10.0.0",
         "npm-package-arg": "^13.0.0",
         "pacote": "^21.0.2"

package.json

@@ -1,5 +1,5 @@
 {
-  "version": "11.14.1",
+  "version": "11.15.0",
   "name": "npm",
   "description": "a package manager for JavaScript",
   "workspaces": [
@@ -52,7 +52,7 @@
   },
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",
-    "@npmcli/arborist": "^9.5.0",
+    "@npmcli/arborist": "^9.6.0",
     "@npmcli/config": "^10.9.0",
     "@npmcli/fs": "^5.0.0",
     "@npmcli/map-workspaces": "^5.0.3",
@@ -77,11 +77,11 @@
     "is-cidr": "^6.0.4",
     "json-parse-even-better-errors": "^5.0.0",
     "libnpmaccess": "^10.0.3",
-    "libnpmdiff": "^8.1.7",
-    "libnpmexec": "^10.2.7",
-    "libnpmfund": "^7.0.21",
+    "libnpmdiff": "^8.1.8",
+    "libnpmexec": "^10.2.8",
+    "libnpmfund": "^7.0.22",
     "libnpmorg": "^8.0.1",
-    "libnpmpack": "^9.1.7",
+    "libnpmpack": "^9.1.8",
     "libnpmpublish": "^11.1.3",
     "libnpmsearch": "^9.0.1",
     "libnpmteam": "^8.0.2",

workspaces/arborist/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [9.6.0](https://github.com/npm/cli/compare/arborist-v9.5.0...arborist-v9.6.0) (2026-05-13)
+### Features
+* [`8df10f5`](https://github.com/npm/cli/commit/8df10f5a399048c9d2dd7eba1d65c0b4b6a5b1c8) [#9354](https://github.com/npm/cli/pull/9354) add allow-git/allow-file/allow-directory/allow-remote configs (@owlstronaut)
+### Bug Fixes
+* [`468550f`](https://github.com/npm/cli/commit/468550fb8f6ded97df03e6b8a82dbfbcb7b47d30) [#9354](https://github.com/npm/cli/pull/9354) refactor #failureNode, adjust tests and safety (@owlstronaut)
+* [`cabe249`](https://github.com/npm/cli/commit/cabe2499347c17d97eecc3bbca3d96fe2f556d0d) [#9354](https://github.com/npm/cli/pull/9354) allow-remote=none does not block registry tarballs (@owlstronaut)
+* [`2169018`](https://github.com/npm/cli/commit/21690186fe054c8a2d1e54fbf8ed7aa9b7978d71) [#9340](https://github.com/npm/cli/pull/9340) arborist: skip extraneous fsChildren in linked-strategy reify (@manzoorwanijk)
+* [`1d0395e`](https://github.com/npm/cli/commit/1d0395ef02d1b68122f9f4964c2ad56e3303cfc4) [#9338](https://github.com/npm/cli/pull/9338) arborist: prune removed-workspace entries from package-lock.json (@manzoorwanijk)
+### Chores
+* [`6a2bdbc`](https://github.com/npm/cli/commit/6a2bdbc81b9653d98b54133cc6a3fcb61c1d1d21) [#9350](https://github.com/npm/cli/pull/9350) change test wording to not collide with tap (#9350) (@github-actions[bot], @owlstronaut)
+
 ## [9.5.0](https://github.com/npm/cli/compare/arborist-v9.4.3...arborist-v9.5.0) (2026-05-06)
 ### Features
 * [`20fb6a0`](https://github.com/npm/cli/commit/20fb6a0d0f2ffc65656d08504eb6ca14980d2c71) [#9312](https://github.com/npm/cli/pull/9312) arborist: add lockfileString() for in-memory lockfile generation (@ljharb)

workspaces/arborist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/arborist",
-  "version": "9.5.0",
+  "version": "9.6.0",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@gar/promise-retry": "^1.0.0",

workspaces/libnpmdiff/CHANGELOG.md

@@ -72,6 +72,10 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0`
 
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0`
+
 ## [8.1.0](https://github.com/npm/cli/compare/libnpmdiff-v8.0.13...libnpmdiff-v8.1.0) (2026-02-04)
 ### Features
 * [`f5f6cf7`](https://github.com/npm/cli/commit/f5f6cf7c9fc9315b96eb29c5c7d5ab63ad3a9122) [#8943](https://github.com/npm/cli/pull/8943) config: add --allow-git (@wraithgar)

workspaces/libnpmdiff/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmdiff",
-  "version": "8.1.7",
+  "version": "8.1.8",
   "description": "The registry diff",
   "repository": {
     "type": "git",
@@ -47,7 +47,7 @@
     "tap": "^16.3.8"
   },
   "dependencies": {
-    "@npmcli/arborist": "^9.5.0",
+    "@npmcli/arborist": "^9.6.0",
     "@npmcli/installed-package-contents": "^4.0.0",
     "binary-extensions": "^3.0.0",
     "diff": "^8.0.2",

workspaces/libnpmexec/CHANGELOG.md

@@ -44,6 +44,10 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0`
 
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0`
+
 ## [10.2.6](https://github.com/npm/cli/compare/libnpmexec-v10.2.5...libnpmexec-v10.2.6) (2026-04-22)
 ### Bug Fixes
 * [`e200696`](https://github.com/npm/cli/commit/e200696c3555fc9a9a0e388064da0b5238ae2b73) [#9256](https://github.com/npm/cli/pull/9256) libnpmexec: skip redundant reify for cached directory specs (#9256) (@github-actions[bot], @manzoorwanijk)

workspaces/libnpmexec/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmexec",
-  "version": "10.2.7",
+  "version": "10.2.8",
   "files": [
     "bin/",
     "lib/"
@@ -61,7 +61,7 @@
   },
   "dependencies": {
     "@gar/promise-retry": "^1.0.0",
-    "@npmcli/arborist": "^9.5.0",
+    "@npmcli/arborist": "^9.6.0",
     "@npmcli/package-json": "^7.0.0",
     "@npmcli/run-script": "^10.0.0",
     "ci-info": "^4.0.0",

workspaces/libnpmfund/CHANGELOG.md

@@ -96,6 +96,10 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0`
 
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0`
+
 ## [7.0.0](https://github.com/npm/cli/compare/libnpmfund-v7.0.0-pre.1...libnpmfund-v7.0.0) (2024-12-16)
 ### Features
 * [`a7bfc6d`](https://github.com/npm/cli/commit/a7bfc6df76882996ebb834dbca785fdf33b8c50d) [#7972](https://github.com/npm/cli/pull/7972) trigger release process (#7972) (@wraithgar)

workspaces/libnpmfund/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmfund",
-  "version": "7.0.21",
+  "version": "7.0.22",
   "main": "lib/index.js",
   "files": [
     "bin/",
@@ -46,7 +46,7 @@
     "tap": "^16.3.8"
   },
   "dependencies": {
-    "@npmcli/arborist": "^9.5.0"
+    "@npmcli/arborist": "^9.6.0"
   },
   "engines": {
     "node": "^20.17.0 || >=22.9.0"

workspaces/libnpmpack/CHANGELOG.md

@@ -80,6 +80,10 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0`
 
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0`
+
 ## [9.1.0](https://github.com/npm/cli/compare/libnpmpack-v9.0.13...libnpmpack-v9.1.0) (2026-02-04)
 ### Features
 * [`f5f6cf7`](https://github.com/npm/cli/commit/f5f6cf7c9fc9315b96eb29c5c7d5ab63ad3a9122) [#8943](https://github.com/npm/cli/pull/8943) config: add --allow-git (@wraithgar)

workspaces/libnpmpack/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmpack",
-  "version": "9.1.7",
+  "version": "9.1.8",
   "description": "Programmatic API for the bits behind npm pack",
   "author": "GitHub Inc.",
   "main": "lib/index.js",
@@ -37,7 +37,7 @@
   "bugs": "https://github.com/npm/libnpmpack/issues",
   "homepage": "https://npmjs.com/package/libnpmpack",
   "dependencies": {
-    "@npmcli/arborist": "^9.5.0",
+    "@npmcli/arborist": "^9.6.0",
     "@npmcli/run-script": "^10.0.0",
     "npm-package-arg": "^13.0.0",
     "pacote": "^21.0.2"