You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
npm sbom --sbom-format=cyclonedx now reports the name field from each package's package.json instead of the on-disk directory name. The name, bom-ref, and purl of the root component and of aliased dependencies may change.
npm no longer registers man pages with the system when installed globally. man npm-install will no longer work, but npm help install is unaffected.
The npm pkg output is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly to npm view.
npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
The Twitter and Freenode profile fields have been removed from the npm registry. This means that users will no longer be able to set or view these fields in their npm profiles.
npm will no longer attempt to resolve the path to node via whichnode. process.execPath is already set by Node to the resolved real path of the node binary, so the lookup was redundant. Scripts that expected npm to override process.execPath with a PATH-resolved (potentially symlinked) node path may be affected.
the --json output of npm pack and npm publish have changed. They are now always consistent, and in the same format.
the star, stars and unstar commands have been removed
The npm adduser command has been removed. Create and manage user accounts on the npm website, and use npm login to authenticate on the command line.
Preserve https protocol when working with git (#8703)
The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
root `preinstall` now runs before dependencies are installed.
unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning. (Unknown .npmrc configs still warn by default; opt into erroring with the new strict-npmrc config.)
Dependency lifecycle scripts are now blocked by default unless allowed by the root package's allowScripts policy. After installing, run npm install-scripts approve to record approvals and npm rebuild to execute newly approved scripts.
npm is a root dev dependency. It is on PATH through node_modules/.bin, so changeset publish in the release workflows runs this npm. Nothing else in the repo calls it; installs go through Bun.
Age: 12.2.0 was published on 2026-09-30, well past three days.
Breaking changes in 12.0.0 and why each is safe here:
npm view/npm info --json now always returns an array. This broke published-version detection in older @changesets/cli. The repo is on @changesets/cli 3.0.3, whose parseInfoResult unwraps the array.
npm pack/npm publish --json output changed.@changesets/cli 3.0.3 reads the tarball filename from either shape.
Node ^22.22.2 || ^24.15.0 || >=26. The ubuntu-24.04 runner image the release jobs use ships Node 22.23.3.
Unknown .npmrc keys now throw. The repo has no .npmrc. The manual publish workflow writes only the standard _authToken key.
Dependency lifecycle scripts blocked by default, allow-git/allow-remote default to none, root preinstall ordering. These apply to npm install, which this repo does not use.
Removed commands (shrinkwrap, adduser, star), npm pkg output, npm init licence default, sbom naming, man pages, whichnode. None is used.
12.0.1 to 12.2.0 add OIDC support to dist-tag, staged-package status and granular token types, and fix bugs. Trusted publishing through OIDC is unchanged.
CI is green. CI does not run a publish, so the first real check of the publish path is the next release. If it fails there, the remedy is to revert this bump.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
11.21.1→12.2.0Release Notes
npm/cli (npm)
v12.2.0Compare Source
Features
9741b64#10038 dist-tag: support OIDC authentication (#10038) (@reggi, @Copilot)Documentation
0c3b82a#10017 update npm stage docs to reflect that it can create new packages (#10017) (@shmam, @Copilot)Dependencies
@npmcli/config@11.2.0v12.1.0Compare Source
Features
6400533#9948 token: support read-write-stage-only granular access tokens (#9948) (@Tayvon, @Copilot)8723f53#9898 stage: display staged package status (#9898) (@joelverhagen)Bug Fixes
c9876d7#9882 provenance-file takes precedence over OIDC auto-generated provenance (#9882) (@yunseo-kim)b016aa2#9913 config: avoid exporting persistent allow-scripts (#9913) (@Fnine59)d6c6122#9914 arborist: match allowScripts keys for local paths (#9914) (@martinrrm, @Copilot)a8c9b2f#9823 keep dry-run output valid json (#9823) (@martinrrm)da50c34#9881 arborist: reject uninstall args that carry a version (#9881) (@lazerg)71915e8#9756 exempt explicit pack targets from allow-directory (#9756) (@ychampion, @ychampion)51c2bf8#9864 don't print the funding message for global installs (#9864) (@lazerg)Documentation
bea9066#9838 document npm 12 install script blocking (#9838) (@reggi)Dependencies
6e40f73#9871undici@6.28.0(@martinrrm, @Copilot)05bd2a4#9871ip-address@10.5.0(@martinrrm, @Copilot)b7c490d#9871brace-expansion@5.0.9(@martinrrm, @Copilot)75a943d#9843tar@7.5.22(#9843) (@martinrrm, @Copilot)Chores
7b50811#9961 pack: select workspace through config (#9961) (@reggi)81a901c#9915 recognize prefixed Node.js PR titles (#9915) (@reggi)4cdccea#9836 updatenode-integrationworkflow template to latest actions (#9836) (@MikeMcC399)278df04#9822 pass nodedir to node-gyp via npm_package_config env in node integration (#9822) (@reggi, @Copilot)@npmcli/arborist@10.0.3@npmcli/config@11.1.0libnpmdiff@9.0.3libnpmexec@11.0.3libnpmfund@8.0.3libnpmpack@10.0.3libnpmpublish@12.0.1v12.0.2Compare Source
Bug Fixes
834408e#9760 pack: honor min-release-age-exclude (#9760) (@martinrrm, @Copilot)ef6cfea#9786 owner: use scoped registry for user lookup (#9786) (@martinrrm, @Copilot)Documentation
9e17dc0#9805 clarify npm 12 unknown-config breaking change in changelogs (#9805) (@Hashim1999164)Chores
7b1f6c1#9747 parse pack --json object output in node integration (#9747) (@reggi, @Copilot)Dependencies
@npmcli/arborist@10.0.2@npmcli/config@11.0.1libnpmdiff@9.0.2libnpmexec@11.0.2libnpmfund@8.0.2libnpmpack@10.0.2v12.0.1Compare Source
Features
6400533#9948 token: support read-write-stage-only granular access tokens (#9948) (@Tayvon, @Copilot)8723f53#9898 stage: display staged package status (#9898) (@joelverhagen)Bug Fixes
c9876d7#9882 provenance-file takes precedence over OIDC auto-generated provenance (#9882) (@yunseo-kim)b016aa2#9913 config: avoid exporting persistent allow-scripts (#9913) (@Fnine59)d6c6122#9914 arborist: match allowScripts keys for local paths (#9914) (@martinrrm, @Copilot)a8c9b2f#9823 keep dry-run output valid json (#9823) (@martinrrm)da50c34#9881 arborist: reject uninstall args that carry a version (#9881) (@lazerg)71915e8#9756 exempt explicit pack targets from allow-directory (#9756) (@ychampion, @ychampion)51c2bf8#9864 don't print the funding message for global installs (#9864) (@lazerg)Documentation
bea9066#9838 document npm 12 install script blocking (#9838) (@reggi)Dependencies
6e40f73#9871undici@6.28.0(@martinrrm, @Copilot)05bd2a4#9871ip-address@10.5.0(@martinrrm, @Copilot)b7c490d#9871brace-expansion@5.0.9(@martinrrm, @Copilot)75a943d#9843tar@7.5.22(#9843) (@martinrrm, @Copilot)Chores
7b50811#9961 pack: select workspace through config (#9961) (@reggi)81a901c#9915 recognize prefixed Node.js PR titles (#9915) (@reggi)4cdccea#9836 updatenode-integrationworkflow template to latest actions (#9836) (@MikeMcC399)278df04#9822 pass nodedir to node-gyp via npm_package_config env in node integration (#9822) (@reggi, @Copilot)@npmcli/arborist@10.0.3@npmcli/config@11.1.0libnpmdiff@9.0.3libnpmexec@11.0.3libnpmfund@8.0.3libnpmpack@10.0.3libnpmpublish@12.0.1v12.0.0Compare Source
npm sbom --sbom-format=cyclonedxnow reports thenamefield from each package'spackage.jsoninstead of the on-disk directory name. Thename,bom-ref, andpurlof the root component and of aliased dependencies may change.man npm-installwill no longer work, butnpm help installis unaffected.npm pkgoutput is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly tonpm view.npm shrinkwrapis removed, theshrinkwrapconfig alias is removed, andnpm-shrinkwrap.jsonis no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-rootnpm-shrinkwrap.jsontopackage-lock.json; usebundleDependenciesif you need to ship a locked dependency tree.npm packandnpm publishhave changed. They are now always consistent, and in the same format.star,starsandunstarcommands have been removednpm addusercommand has been removed. Create and manage user accounts on the npm website, and usenpm loginto authenticate on the command line.npm inithas been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.npmnow supports node^22.22.2 || ^24.15.0 || >=26.0.0.npmrcconfigs still warn by default; opt into erroring with the newstrict-npmrcconfig.)allowScriptspolicy. After installing, runnpm install-scripts approveto record approvals andnpm rebuildto execute newly approved scripts.Chores
b77b532#9735 remove pre-release mode from npm 12 and workspaces (#9735) (@reggi, @Copilot)Dependencies
@npmcli/arborist@10.0.0@npmcli/config@11.0.0libnpmaccess@11.0.0libnpmdiff@9.0.0libnpmexec@11.0.0libnpmfund@8.0.0libnpmorg@9.0.0libnpmpack@10.0.0libnpmpublish@12.0.0libnpmsearch@10.0.0libnpmteam@9.0.0libnpmversion@9.0.0Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.