JamieMagee · GitHub

@JamieMagee

Merged

@JamieMagee

nishantms

nishantms

nishantms

nishantms

nishantms

nishantms

nishantms

nishantms

nishantms

nishantms

nishantms

nishantms

nishantms

…low-all-scripts configs
Three new configs to support the install-script opt-in policy. None
of them affect install behaviour yet; they're read by approve-scripts,
deny-scripts, and the install-time walker in later commits.
  - allow-scripts: comma-separated package list. Used as a fallback
    when the root package.json has no allowScripts field. Flattens
    to flatOptions.allowScripts.
  - strict-script-builds: boolean. Reserved for a future release that
    will turn blocked-script warnings into errors. No-op for now.
  - dangerously-allow-all-scripts: boolean escape hatch for that same
    future release. No-op for now.
Refs: npm/rfcs#868
…I configs
A precedence resolver reads the install-time allowScripts policy from
the layered sources and threads it through install/ci into arborist.
  - lib/utils/resolve-allow-scripts.js: pure resolver. Reads from
    npm.prefix so workspace sub-installs still pick up the project
    root. Returns { policy, source }. Strict fallback: package.json
    wins over flat config; lower layers are silently ignored, with
    one warn when a lower setting is being suppressed.
  - install.js / ci.js: await the resolver before constructing
    arborist opts, then pass policy through opts.allowScripts. Add
    the three new params to each command's static params list.
  - workspaces/arborist/lib/arborist/index.js: accept
    options.allowScripts and store it on this.options. No enforcement
    yet; read in later commits.
Also tightened the flatten function for the new allow-scripts config:
nopt wraps single comma-separated strings in arrays for [String, Array]
types, so each array entry needs splitting on commas before use.
Refs: npm/rfcs#868

This was referenced

Jun 4, 2026

Open

Closed

Closed

Open

Closed

This was referenced

Jul 2, 2026

Closed

Merged

Merged

This was referenced

Jul 23, 2026

Merged

Closed

Merged

renovate Bot added a commit to gwennlbh/swarpc that referenced this pull request

Jul 30, 2026 
##### [v11.18.0](npm/cli@ v11.17.0...fef2b13 )
##### [v11.17.0](https://github.com/npm/cli/releases/tag/v11.17.0)
##### Features
- [`ae8ac4e`](npm/cli@ ae8ac4e ) [#9534](npm/cli#9534) add min-release-age-exclude config ([@JamieMagee](https://github.com/JamieMagee), [@caseyjhol](https://github.com/caseyjhol))
- [`8ff3e48`](npm/cli@ 8ff3e48 ) [#9483](npm/cli#9483) allowScripts tooling and inBundle hardening ([#9483](npm/cli#9483)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
##### Bug Fixes
- [`847cdf8`](npm/cli@ 847cdf8 ) [#9541](npm/cli#9541) match dotted and versioned args in approve-scripts/deny-scripts ([@owlstronaut](https://github.com/owlstronaut))
- [`d99f7cb`](npm/cli@ d99f7cb ) [#9535](npm/cli#9535) emit valid JSON from approve-scripts/deny-scripts --json ([@owlstronaut](https://github.com/owlstronaut))
- [`351a309`](npm/cli@ 351a309 ) [#9499](npm/cli#9499) pass script-shell to publish lifecycle hooks ([#9499](npm/cli#9499)) ([@github-actions](https://github.com/github-actions)\[bot])
- [`4fa81df`](npm/cli@ 4fa81df ) [#9497](npm/cli#9497) recognize allowScripts for local link targets ([#9497](npm/cli#9497)) ([@github-actions](https://github.com/github-actions)\[bot], [@cyphercodes](https://github.com/cyphercodes), [@cyphercodes](https://github.com/cyphercodes))
- [`95cf2e9`](npm/cli@ 95cf2e9 ) [#9489](npm/cli#9489) validate registry path for allow-remote tarballs ([@Abhinav-143x](https://github.com/Abhinav-143x))
- [`9dd219b`](npm/cli@ 9dd219b ) [#9462](npm/cli#9462) respect allowScripts policy in prune, dedupe, uninstall, audit, and link ([#9462](npm/cli#9462)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`cd8d18a`](npm/cli@ cd8d18a ) [#9482](npm/cli#9482) list pending scripts in approve-scripts when ignore-scripts is set ([#9482](npm/cli#9482)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`c14e87c`](npm/cli@ c14e87c ) [#9481](npm/cli#9481) suggest --allow-scripts for global installs in unreviewed-scripts warnings ([#9481](npm/cli#9481)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`7ade52e`](npm/cli@ 7ade52e ) [#9465](npm/cli#9465) invalid issue template YAML indentation ([#9465](npm/cli#9465)) ([@github-actions](https://github.com/github-actions)\[bot], [@fallintoplace](https://github.com/fallintoplace))
- [`c069622`](npm/cli@ c069622 ) [#9464](npm/cli#9464) show full parent command path in subcommand usage errors ([#9464](npm/cli#9464)) ([@owlstronaut](https://github.com/owlstronaut))
- [`1bb62bb`](npm/cli@ 1bb62bb ) [#9454](npm/cli#9454) config: clarify --all help so it's accurate for approve-scripts and deny-scripts ([@JamieMagee](https://github.com/JamieMagee))
- [`84eeb5f`](npm/cli@ 84eeb5f ) [#9431](npm/cli#9431) audit: don't apply min-release-age before filter when verifying installed signatures ([@JamieMagee](https://github.com/JamieMagee))
- [`3bd3377`](npm/cli@ 3bd3377 ) [#9426](npm/cli#9426) block forbidden keys in Queryable setter to prevent prototype pollution ([@12122J](https://github.com/12122J), [@claude](https://github.com/claude))
##### Documentation
- [`a86a7a9`](npm/cli@ a86a7a9 ) [#9522](npm/cli#9522) approve-scripts only throws EGLOBAL when run with -g ([@JamieMagee](https://github.com/JamieMagee))
- [`693bb3d`](npm/cli@ 693bb3d ) [#9508](npm/cli#9508) clarify package.json override value specs ([#9508](npm/cli#9508)) ([@github-actions](https://github.com/github-actions)\[bot], [@ded-furby](https://github.com/ded-furby))
- [`ccffe4a`](npm/cli@ ccffe4a ) [#9501](npm/cli#9501) use the latest version for global update and outdated's `wanted` ([#9501](npm/cli#9501)) ([@github-actions](https://github.com/github-actions)\[bot], [@liangmiQwQ](https://github.com/liangmiQwQ))
- [`66e97c2`](npm/cli@ 66e97c2 ) [#9478](npm/cli#9478) update minimum npm required for npm trust ([@meeech](https://github.com/meeech))
##### Dependencies
- [`bd09b87`](npm/cli@ bd09b87 ) [#9542](npm/cli#9542) `postcss-selector-parser@7.1.4`
- [`95bfc4c`](npm/cli@ 95bfc4c ) [#9542](npm/cli#9542) `tinyglobby@0.2.17`
- [`8c0d5fd`](npm/cli@ 8c0d5fd ) [#9542](npm/cli#9542) `tar@7.5.16`
- [`967d377`](npm/cli@ 967d377 ) [#9542](npm/cli#9542) `semver@7.8.4`
- [`cdaac1b`](npm/cli@ cdaac1b ) [#9542](npm/cli#9542) `pacote@21.5.1`
- [`25c8a9e`](npm/cli@ 25c8a9e ) [#9542](npm/cli#9542) `node-gyp@12.4.0`
##### Chores
- [`2922fa4`](npm/cli@ 2922fa4 ) [#9542](npm/cli#9542) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.8.0): `@npmcli/arborist@9.8.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.11.0): `@npmcli/config@10.11.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.10): `libnpmdiff@8.1.10`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.0): `libnpmexec@10.3.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.24): `libnpmfund@7.0.24`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.10): `libnpmpack@9.1.10`
##### [v11.16.0](https://github.com/npm/cli/releases/tag/v11.16.0)
##### Features
- [`4b67f6e`](npm/cli@ 4b67f6e ) [#9416](npm/cli#9416) publish --access=private alias for restricted ([#9416](npm/cli#9416)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`a10c7ca`](npm/cli@ a10c7ca ) [#9415](npm/cli#9415) Phase 1 of `allowScripts` opt-in install-script policy ([#9360](npm/cli#9360)) ([#9415](npm/cli#9415)) ([@owlstronaut](https://github.com/owlstronaut), [@JamieMagee](https://github.com/JamieMagee))
##### Bug Fixes
- [`1f7869b`](npm/cli@ 1f7869b ) [#9411](npm/cli#9411) fix typo of fullMetadata ([@owlstronaut](https://github.com/owlstronaut))
- [`cde03ba`](npm/cli@ cde03ba ) [#9390](npm/cli#9390) config: pause progress spinner during interactive editor spawn ([#9388](npm/cli#9388)) ([@github-actions](https://github.com/github-actions)\[bot], [@Zelys-DFKH](https://github.com/Zelys-DFKH), [@claude](https://github.com/claude))
##### Documentation
- [`c5e9d73`](npm/cli@ c5e9d73 ) [#9390](npm/cli#9390) Document `npm_old_version` and `npm_new_version` environment variables ([#9389](npm/cli#9389)) ([@github-actions](https://github.com/github-actions)\[bot], [@36degrees](https://github.com/36degrees))
##### Dependencies
- [`cdd7bbc`](npm/cli@ cdd7bbc ) [#9421](npm/cli#9421) `undici@6.26.0`
- [`fde87c9`](npm/cli@ fde87c9 ) [#9421](npm/cli#9421) `sigstore@4.1.1`
- [`2779793`](npm/cli@ 2779793 ) [#9421](npm/cli#9421) `lru-cache@11.5.1`
- [`dea702d`](npm/cli@ dea702d ) [#9421](npm/cli#9421) `@sigstore/verify@3.1.1`
- [`4eab03f`](npm/cli@ 4eab03f ) [#9421](npm/cli#9421) `@sigstore/core@3.2.1`
- [`74c7323`](npm/cli@ 74c7323 ) [#9421](npm/cli#9421) `@npmcli/agent@4.0.2`
- [`edc4ab3`](npm/cli@ edc4ab3 ) [#9421](npm/cli#9421) `semver@7.8.1`
- [`5f6ce33`](npm/cli@ 5f6ce33 ) [#9421](npm/cli#9421) `make-fetch-happen@15.0.6`
##### Chores
- [`bd04976`](npm/cli@ bd04976 ) [#9421](npm/cli#9421) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`aeceb23`](npm/cli@ aeceb23 ) [#9407](npm/cli#9407) sanitize newlines in flags table default and type values ([#9407](npm/cli#9407)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/arborist@9.7.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.10.0): `@npmcli/config@10.10.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.9): `libnpmdiff@8.1.9`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.9): `libnpmexec@10.2.9`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.23): `libnpmfund@7.0.23`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.9): `libnpmpack@9.1.9`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmversion-v8.0.4): `libnpmversion@8.0.4`
##### [v11.15.0](https://github.com/npm/cli/releases/tag/v11.15.0)
##### Features
- [`0d5d899`](npm/cli@ 0d5d899 ) [#9379](npm/cli#9379) npm stage ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`1433740`](npm/cli@ 1433740 ) [#9376](npm/cli#9376) add permissions support to trust commands ([#9376](npm/cli#9376)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`8df10f5`](npm/cli@ 8df10f5 ) [#9339](npm/cli#9339) add allow-git/allow-file/allow-directory/allow-remote configs ([@owlstronaut](https://github.com/owlstronaut))
##### Bug Fixes
- [`39b625e`](npm/cli@ 39b625e ) [#9381](npm/cli#9381) key stage download --json output by package name ([#9381](npm/cli#9381)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`6aa332d`](npm/cli@ 6aa332d ) [#9339](npm/cli#9339) allow min-release-age in npmrc to coexist with --before ([@raazkhnl](https://github.com/raazkhnl))
- [`468550f`](npm/cli@ 468550f ) [#9339](npm/cli#9339) refactor #failureNode, adjust tests and safety ([@owlstronaut](https://github.com/owlstronaut))
- [`cabe249`](npm/cli@ cabe249 ) [#9339](npm/cli#9339) allow-remote=none does not block registry tarballs ([@owlstronaut](https://github.com/owlstronaut))
##### Dependencies
- [`8416a60`](npm/cli@ 8416a60 ) [#9383](npm/cli#9383) `socks@2.8.9`
- [`5e5a25b`](npm/cli@ 5e5a25b ) [#9383](npm/cli#9383) `lru-cache@11.5.0`
- [`a6f9ad2`](npm/cli@ a6f9ad2 ) [#9383](npm/cli#9383) `ip-address@10.2.0`
- [`63f8114`](npm/cli@ 63f8114 ) [#9383](npm/cli#9383) `brace-expansion@5.0.6`
- [`6918b4c`](npm/cli@ 6918b4c ) [#9383](npm/cli#9383) `bin-links@6.0.2`
- [`bf84079`](npm/cli@ bf84079 ) [#9383](npm/cli#9383) `tar@7.5.15`
- [`bdef82c`](npm/cli@ bdef82c ) [#9383](npm/cli#9383) `semver@7.8.0`
- [`3f38a67`](npm/cli@ 3f38a67 ) [#9383](npm/cli#9383) `hosted-git-info@9.0.3`
##### Chores
- [`816f3bf`](npm/cli@ 816f3bf ) [#9383](npm/cli#9383) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.1): `@npmcli/config@10.9.1`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.8): `libnpmdiff@8.1.8`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.8): `libnpmexec@10.2.8`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.22): `libnpmfund@7.0.22`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.8): `libnpmpack@9.1.8`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v11.2.0): `libnpmpublish@11.2.0`
##### [v11.14.1](https://github.com/npm/cli/releases/tag/v11.14.1)
##### Bug Fixes
- [`dca12cb`](npm/cli@ dca12cb ) [#9328](npm/cli#9328) remove settings ([#9328](npm/cli#9328)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut))
##### [v11.14.0](https://github.com/npm/cli/releases/tag/v11.14.0)
##### Features
- [`45fc5e0`](npm/cli@ 45fc5e0 ) [#9288](npm/cli#9288) add allow-directory, allow-file, and allow-remote ([#9288](npm/cli#9288)) ([@github-actions](https://github.com/github-actions)\[bot], [@wraithgar](https://github.com/wraithgar))
##### Bug Fixes
- [`6c17544`](npm/cli@ 6c17544 ) [#9318](npm/cli#9318) sbom: dedupe per-node dependsOn / relationships ([#9318](npm/cli#9318)) ([@github-actions](https://github.com/github-actions)\[bot], [@mikaelkristiansson](https://github.com/mikaelkristiansson))
##### Dependencies
- [`840fe18`](npm/cli@ 840fe18 ) [#9322](npm/cli#9322) `socks@10.1.1`
- [`b771289`](npm/cli@ b771289 ) [#9322](npm/cli#9322) `ip-address@10.1.1`
- [`addffcb`](npm/cli@ addffcb ) [#9322](npm/cli#9322) `cidr-regex@5.0.5`
##### Chores
- [`041fd58`](npm/cli@ 041fd58 ) [#9322](npm/cli#9322) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`89c505a`](npm/cli@ 89c505a ) [#9320](npm/cli#9320) add cli-triage team as codeowner ([#9320](npm/cli#9320)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.0): `@npmcli/config@10.9.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.7): `libnpmdiff@8.1.7`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.7): `libnpmexec@10.2.7`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.21): `libnpmfund@7.0.21`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.7): `libnpmpack@9.1.7`
##### [v11.13.0](https://github.com/npm/cli/releases/tag/v11.13.0)
##### Features
- [`8e8dadb`](npm/cli@ 8e8dadb ) [#9246](npm/cli#9246) add `u` as alias for `update` command ([#9246](npm/cli#9246)) ([@github-actions](https://github.com/github-actions)\[bot], [@Ausoj](https://github.com/Ausoj))
##### Bug Fixes
- [`ecd161b`](npm/cli@ ecd161b ) [#9258](npm/cli#9258) ignore intended error code ([@owlstronaut](https://github.com/owlstronaut))
##### Dependencies
- [`8d2fdcd`](npm/cli@ 8d2fdcd ) [#9272](npm/cli#9272) `lru-cache@11.3.5`
- [`e603d36`](npm/cli@ e603d36 ) [#9272](npm/cli#9272) `node-gyp@12.3.0`
- [`d48b7da`](npm/cli@ d48b7da ) [#9272](npm/cli#9272) `is-cidr@6.0.4`
- [`032a5ca`](npm/cli@ 032a5ca ) [#9240](npm/cli#9240) `@sigstore/protobuf-specs@0.5.1`
- [`33a81e7`](npm/cli@ 33a81e7 ) [#9240](npm/cli#9240) `tinyglobby@0.2.16`
- [`68dc4a0`](npm/cli@ 68dc4a0 ) [#9240](npm/cli#9240) `picomatch@4.0.4`
- [`1bb6703`](npm/cli@ 1bb6703 ) [#9240](npm/cli#9240) `lru-cache@11.3.3`
- [`37059e4`](npm/cli@ 37059e4 ) [#9240](npm/cli#9240) `diff@8.0.4`
- [`fb450ab`](npm/cli@ fb450ab ) [#9240](npm/cli#9240) `minimatch@10.2.5`
- [`7c4bbbf`](npm/cli@ 7c4bbbf ) [#9240](npm/cli#9240) `tar@7.5.13`
- [`703a3bc`](npm/cli@ 703a3bc ) [#9240](npm/cli#9240) `minipass-flush@1.0.6`
##### Chores
- [`e0724ac`](npm/cli@ e0724ac ) [#9272](npm/cli#9272) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`d249341`](npm/cli@ d249341 ) [#9230](npm/cli#9230) don't run npm update in CI ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.4.3): `@npmcli/arborist@9.4.3`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.6): `libnpmdiff@8.1.6`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.6): `libnpmexec@10.2.6`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.20): `libnpmfund@7.0.20`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.6): `libnpmpack@9.1.6`

This was referenced

Jul 31, 2026

Merged

Merged

Merged

Merged

Merged

Merged

Closed

Merged

Merged

renovate Bot added a commit to gwennlbh/swarpc that referenced this pull request

Aug 5, 2026 
##### [v11.19.0](npm/cli@ v11.18.0...6a8a1b9 )
##### [v11.18.0](npm/cli@ v11.17.0...fef2b13 )
##### [v11.17.0](https://github.com/npm/cli/releases/tag/v11.17.0)
##### Features
- [`ae8ac4e`](npm/cli@ ae8ac4e ) [#9534](npm/cli#9534) add min-release-age-exclude config ([@JamieMagee](https://github.com/JamieMagee), [@caseyjhol](https://github.com/caseyjhol))
- [`8ff3e48`](npm/cli@ 8ff3e48 ) [#9483](npm/cli#9483) allowScripts tooling and inBundle hardening ([#9483](npm/cli#9483)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
##### Bug Fixes
- [`847cdf8`](npm/cli@ 847cdf8 ) [#9541](npm/cli#9541) match dotted and versioned args in approve-scripts/deny-scripts ([@owlstronaut](https://github.com/owlstronaut))
- [`d99f7cb`](npm/cli@ d99f7cb ) [#9535](npm/cli#9535) emit valid JSON from approve-scripts/deny-scripts --json ([@owlstronaut](https://github.com/owlstronaut))
- [`351a309`](npm/cli@ 351a309 ) [#9499](npm/cli#9499) pass script-shell to publish lifecycle hooks ([#9499](npm/cli#9499)) ([@github-actions](https://github.com/github-actions)\[bot])
- [`4fa81df`](npm/cli@ 4fa81df ) [#9497](npm/cli#9497) recognize allowScripts for local link targets ([#9497](npm/cli#9497)) ([@github-actions](https://github.com/github-actions)\[bot], [@cyphercodes](https://github.com/cyphercodes), [@cyphercodes](https://github.com/cyphercodes))
- [`95cf2e9`](npm/cli@ 95cf2e9 ) [#9489](npm/cli#9489) validate registry path for allow-remote tarballs ([@Abhinav-143x](https://github.com/Abhinav-143x))
- [`9dd219b`](npm/cli@ 9dd219b ) [#9462](npm/cli#9462) respect allowScripts policy in prune, dedupe, uninstall, audit, and link ([#9462](npm/cli#9462)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`cd8d18a`](npm/cli@ cd8d18a ) [#9482](npm/cli#9482) list pending scripts in approve-scripts when ignore-scripts is set ([#9482](npm/cli#9482)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`c14e87c`](npm/cli@ c14e87c ) [#9481](npm/cli#9481) suggest --allow-scripts for global installs in unreviewed-scripts warnings ([#9481](npm/cli#9481)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`7ade52e`](npm/cli@ 7ade52e ) [#9465](npm/cli#9465) invalid issue template YAML indentation ([#9465](npm/cli#9465)) ([@github-actions](https://github.com/github-actions)\[bot], [@fallintoplace](https://github.com/fallintoplace))
- [`c069622`](npm/cli@ c069622 ) [#9464](npm/cli#9464) show full parent command path in subcommand usage errors ([#9464](npm/cli#9464)) ([@owlstronaut](https://github.com/owlstronaut))
- [`1bb62bb`](npm/cli@ 1bb62bb ) [#9454](npm/cli#9454) config: clarify --all help so it's accurate for approve-scripts and deny-scripts ([@JamieMagee](https://github.com/JamieMagee))
- [`84eeb5f`](npm/cli@ 84eeb5f ) [#9431](npm/cli#9431) audit: don't apply min-release-age before filter when verifying installed signatures ([@JamieMagee](https://github.com/JamieMagee))
- [`3bd3377`](npm/cli@ 3bd3377 ) [#9426](npm/cli#9426) block forbidden keys in Queryable setter to prevent prototype pollution ([@12122J](https://github.com/12122J), [@claude](https://github.com/claude))
##### Documentation
- [`a86a7a9`](npm/cli@ a86a7a9 ) [#9522](npm/cli#9522) approve-scripts only throws EGLOBAL when run with -g ([@JamieMagee](https://github.com/JamieMagee))
- [`693bb3d`](npm/cli@ 693bb3d ) [#9508](npm/cli#9508) clarify package.json override value specs ([#9508](npm/cli#9508)) ([@github-actions](https://github.com/github-actions)\[bot], [@ded-furby](https://github.com/ded-furby))
- [`ccffe4a`](npm/cli@ ccffe4a ) [#9501](npm/cli#9501) use the latest version for global update and outdated's `wanted` ([#9501](npm/cli#9501)) ([@github-actions](https://github.com/github-actions)\[bot], [@liangmiQwQ](https://github.com/liangmiQwQ))
- [`66e97c2`](npm/cli@ 66e97c2 ) [#9478](npm/cli#9478) update minimum npm required for npm trust ([@meeech](https://github.com/meeech))
##### Dependencies
- [`bd09b87`](npm/cli@ bd09b87 ) [#9542](npm/cli#9542) `postcss-selector-parser@7.1.4`
- [`95bfc4c`](npm/cli@ 95bfc4c ) [#9542](npm/cli#9542) `tinyglobby@0.2.17`
- [`8c0d5fd`](npm/cli@ 8c0d5fd ) [#9542](npm/cli#9542) `tar@7.5.16`
- [`967d377`](npm/cli@ 967d377 ) [#9542](npm/cli#9542) `semver@7.8.4`
- [`cdaac1b`](npm/cli@ cdaac1b ) [#9542](npm/cli#9542) `pacote@21.5.1`
- [`25c8a9e`](npm/cli@ 25c8a9e ) [#9542](npm/cli#9542) `node-gyp@12.4.0`
##### Chores
- [`2922fa4`](npm/cli@ 2922fa4 ) [#9542](npm/cli#9542) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.8.0): `@npmcli/arborist@9.8.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.11.0): `@npmcli/config@10.11.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.10): `libnpmdiff@8.1.10`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.0): `libnpmexec@10.3.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.24): `libnpmfund@7.0.24`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.10): `libnpmpack@9.1.10`
##### [v11.16.0](https://github.com/npm/cli/releases/tag/v11.16.0)
##### Features
- [`4b67f6e`](npm/cli@ 4b67f6e ) [#9416](npm/cli#9416) publish --access=private alias for restricted ([#9416](npm/cli#9416)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`a10c7ca`](npm/cli@ a10c7ca ) [#9415](npm/cli#9415) Phase 1 of `allowScripts` opt-in install-script policy ([#9360](npm/cli#9360)) ([#9415](npm/cli#9415)) ([@owlstronaut](https://github.com/owlstronaut), [@JamieMagee](https://github.com/JamieMagee))
##### Bug Fixes
- [`1f7869b`](npm/cli@ 1f7869b ) [#9411](npm/cli#9411) fix typo of fullMetadata ([@owlstronaut](https://github.com/owlstronaut))
- [`cde03ba`](npm/cli@ cde03ba ) [#9390](npm/cli#9390) config: pause progress spinner during interactive editor spawn ([#9388](npm/cli#9388)) ([@github-actions](https://github.com/github-actions)\[bot], [@Zelys-DFKH](https://github.com/Zelys-DFKH), [@claude](https://github.com/claude))
##### Documentation
- [`c5e9d73`](npm/cli@ c5e9d73 ) [#9390](npm/cli#9390) Document `npm_old_version` and `npm_new_version` environment variables ([#9389](npm/cli#9389)) ([@github-actions](https://github.com/github-actions)\[bot], [@36degrees](https://github.com/36degrees))
##### Dependencies
- [`cdd7bbc`](npm/cli@ cdd7bbc ) [#9421](npm/cli#9421) `undici@6.26.0`
- [`fde87c9`](npm/cli@ fde87c9 ) [#9421](npm/cli#9421) `sigstore@4.1.1`
- [`2779793`](npm/cli@ 2779793 ) [#9421](npm/cli#9421) `lru-cache@11.5.1`
- [`dea702d`](npm/cli@ dea702d ) [#9421](npm/cli#9421) `@sigstore/verify@3.1.1`
- [`4eab03f`](npm/cli@ 4eab03f ) [#9421](npm/cli#9421) `@sigstore/core@3.2.1`
- [`74c7323`](npm/cli@ 74c7323 ) [#9421](npm/cli#9421) `@npmcli/agent@4.0.2`
- [`edc4ab3`](npm/cli@ edc4ab3 ) [#9421](npm/cli#9421) `semver@7.8.1`
- [`5f6ce33`](npm/cli@ 5f6ce33 ) [#9421](npm/cli#9421) `make-fetch-happen@15.0.6`
##### Chores
- [`bd04976`](npm/cli@ bd04976 ) [#9421](npm/cli#9421) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`aeceb23`](npm/cli@ aeceb23 ) [#9407](npm/cli#9407) sanitize newlines in flags table default and type values ([#9407](npm/cli#9407)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/arborist@9.7.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.10.0): `@npmcli/config@10.10.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.9): `libnpmdiff@8.1.9`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.9): `libnpmexec@10.2.9`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.23): `libnpmfund@7.0.23`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.9): `libnpmpack@9.1.9`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmversion-v8.0.4): `libnpmversion@8.0.4`
##### [v11.15.0](https://github.com/npm/cli/releases/tag/v11.15.0)
##### Features
- [`0d5d899`](npm/cli@ 0d5d899 ) [#9379](npm/cli#9379) npm stage ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`1433740`](npm/cli@ 1433740 ) [#9376](npm/cli#9376) add permissions support to trust commands ([#9376](npm/cli#9376)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`8df10f5`](npm/cli@ 8df10f5 ) [#9339](npm/cli#9339) add allow-git/allow-file/allow-directory/allow-remote configs ([@owlstronaut](https://github.com/owlstronaut))
##### Bug Fixes
- [`39b625e`](npm/cli@ 39b625e ) [#9381](npm/cli#9381) key stage download --json output by package name ([#9381](npm/cli#9381)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`6aa332d`](npm/cli@ 6aa332d ) [#9339](npm/cli#9339) allow min-release-age in npmrc to coexist with --before ([@raazkhnl](https://github.com/raazkhnl))
- [`468550f`](npm/cli@ 468550f ) [#9339](npm/cli#9339) refactor #failureNode, adjust tests and safety ([@owlstronaut](https://github.com/owlstronaut))
- [`cabe249`](npm/cli@ cabe249 ) [#9339](npm/cli#9339) allow-remote=none does not block registry tarballs ([@owlstronaut](https://github.com/owlstronaut))
##### Dependencies
- [`8416a60`](npm/cli@ 8416a60 ) [#9383](npm/cli#9383) `socks@2.8.9`
- [`5e5a25b`](npm/cli@ 5e5a25b ) [#9383](npm/cli#9383) `lru-cache@11.5.0`
- [`a6f9ad2`](npm/cli@ a6f9ad2 ) [#9383](npm/cli#9383) `ip-address@10.2.0`
- [`63f8114`](npm/cli@ 63f8114 ) [#9383](npm/cli#9383) `brace-expansion@5.0.6`
- [`6918b4c`](npm/cli@ 6918b4c ) [#9383](npm/cli#9383) `bin-links@6.0.2`
- [`bf84079`](npm/cli@ bf84079 ) [#9383](npm/cli#9383) `tar@7.5.15`
- [`bdef82c`](npm/cli@ bdef82c ) [#9383](npm/cli#9383) `semver@7.8.0`
- [`3f38a67`](npm/cli@ 3f38a67 ) [#9383](npm/cli#9383) `hosted-git-info@9.0.3`
##### Chores
- [`816f3bf`](npm/cli@ 816f3bf ) [#9383](npm/cli#9383) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.1): `@npmcli/config@10.9.1`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.8): `libnpmdiff@8.1.8`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.8): `libnpmexec@10.2.8`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.22): `libnpmfund@7.0.22`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.8): `libnpmpack@9.1.8`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v11.2.0): `libnpmpublish@11.2.0`
##### [v11.14.1](https://github.com/npm/cli/releases/tag/v11.14.1)
##### Bug Fixes
- [`dca12cb`](npm/cli@ dca12cb ) [#9328](npm/cli#9328) remove settings ([#9328](npm/cli#9328)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut))
##### [v11.14.0](https://github.com/npm/cli/releases/tag/v11.14.0)
##### Features
- [`45fc5e0`](npm/cli@ 45fc5e0 ) [#9288](npm/cli#9288) add allow-directory, allow-file, and allow-remote ([#9288](npm/cli#9288)) ([@github-actions](https://github.com/github-actions)\[bot], [@wraithgar](https://github.com/wraithgar))
##### Bug Fixes
- [`6c17544`](npm/cli@ 6c17544 ) [#9318](npm/cli#9318) sbom: dedupe per-node dependsOn / relationships ([#9318](npm/cli#9318)) ([@github-actions](https://github.com/github-actions)\[bot], [@mikaelkristiansson](https://github.com/mikaelkristiansson))
##### Dependencies
- [`840fe18`](npm/cli@ 840fe18 ) [#9322](npm/cli#9322) `socks@10.1.1`
- [`b771289`](npm/cli@ b771289 ) [#9322](npm/cli#9322) `ip-address@10.1.1`
- [`addffcb`](npm/cli@ addffcb ) [#9322](npm/cli#9322) `cidr-regex@5.0.5`
##### Chores
- [`041fd58`](npm/cli@ 041fd58 ) [#9322](npm/cli#9322) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`89c505a`](npm/cli@ 89c505a ) [#9320](npm/cli#9320) add cli-triage team as codeowner ([#9320](npm/cli#9320)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.0): `@npmcli/config@10.9.0`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.7): `libnpmdiff@8.1.7`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.7): `libnpmexec@10.2.7`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.21): `libnpmfund@7.0.21`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.7): `libnpmpack@9.1.7`
##### [v11.13.0](https://github.com/npm/cli/releases/tag/v11.13.0)
##### Features
- [`8e8dadb`](npm/cli@ 8e8dadb ) [#9246](npm/cli#9246) add `u` as alias for `update` command ([#9246](npm/cli#9246)) ([@github-actions](https://github.com/github-actions)\[bot], [@Ausoj](https://github.com/Ausoj))
##### Bug Fixes
- [`ecd161b`](npm/cli@ ecd161b ) [#9258](npm/cli#9258) ignore intended error code ([@owlstronaut](https://github.com/owlstronaut))
##### Dependencies
- [`8d2fdcd`](npm/cli@ 8d2fdcd ) [#9272](npm/cli#9272) `lru-cache@11.3.5`
- [`e603d36`](npm/cli@ e603d36 ) [#9272](npm/cli#9272) `node-gyp@12.3.0`
- [`d48b7da`](npm/cli@ d48b7da ) [#9272](npm/cli#9272) `is-cidr@6.0.4`
- [`032a5ca`](npm/cli@ 032a5ca ) [#9240](npm/cli#9240) `@sigstore/protobuf-specs@0.5.1`
- [`33a81e7`](npm/cli@ 33a81e7 ) [#9240](npm/cli#9240) `tinyglobby@0.2.16`
- [`68dc4a0`](npm/cli@ 68dc4a0 ) [#9240](npm/cli#9240) `picomatch@4.0.4`
- [`1bb6703`](npm/cli@ 1bb6703 ) [#9240](npm/cli#9240) `lru-cache@11.3.3`
- [`37059e4`](npm/cli@ 37059e4 ) [#9240](npm/cli#9240) `diff@8.0.4`
- [`fb450ab`](npm/cli@ fb450ab ) [#9240](npm/cli#9240) `minimatch@10.2.5`
- [`7c4bbbf`](npm/cli@ 7c4bbbf ) [#9240](npm/cli#9240) `tar@7.5.13`
- [`703a3bc`](npm/cli@ 703a3bc ) [#9240](npm/cli#9240) `minipass-flush@1.0.6`
##### Chores
- [`e0724ac`](npm/cli@ e0724ac ) [#9272](npm/cli#9272) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`d249341`](npm/cli@ d249341 ) [#9230](npm/cli#9230) don't run npm update in CI ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.4.3): `@npmcli/arborist@9.4.3`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.6): `libnpmdiff@8.1.6`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.6): `libnpmexec@10.2.6`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.20): `libnpmfund@7.0.20`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.6): `libnpmpack@9.1.6`

This was referenced

Aug 6, 2026

Merged

Merged

Merged

Closed

Merged

Merged

Merged

Merged

Read the original on github.com ↗