FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: upgrade npm to 11.12.1 · nodejs/node@bc265aa · GitHub

deps: upgrade npm to 11.12.1 · nodejs/node@bc265aa · GitHub
Skip to content

Navigation Menu

Sign in
Sign in
Sign up

Commit bc265aa

Browse files
npm-cli-bot
authored and
aduh95
committed
deps: upgrade npm to 11.12.1
PR-URL: #62448 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
1 parent 312476c commit bc265aa

269 files changed

Lines changed: 976 additions & 2720 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/npm/docs/content/commands/npm-audit.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,16 @@ The `audit signatures` command will also verify the provenance attestations of d
4444
Because provenance attestations are such a new feature, security features may be added to (or changed in) the attestation format over time.
4545
To ensure that you're always able to verify attestation signatures check that you're running the latest version of the npm CLI. Please note this often means updating npm beyond the version that ships with Node.js.
4646

47+
To include the full sigstore attestation bundles in JSON output, use:
48+
49+
```bash
50+
$ npm audit signatures --json --include-attestations
51+
```
52+
53+
This adds a `verified` array to the JSON output containing the attestation
54+
bundles (DSSE envelopes, verification material, and transparency log entries)
55+
for each verified package.
56+
4757
The npm CLI supports registry signatures and signing keys provided by any registry if the following conventions are followed:
4858

4959
1. Signatures are provided in the package's `packument` in each published version within the `dist` object:
@@ -357,6 +367,18 @@ run any pre- or post-scripts.
357367

358368

359369

370+
#### `include-attestations`
371+
372+
* Default: false
373+
* Type: Boolean
374+
375+
When used with `npm audit signatures --json`, includes the full sigstore
376+
attestation bundles in the JSON output for each verified package. The
377+
bundles contain DSSE envelopes, verification material, and transparency log
378+
entries.
379+
380+
381+
360382
#### `workspace`
361383

362384
* Default:

‎deps/npm/docs/content/commands/npm-install-test.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -281,6 +281,8 @@ of a relative number of days.
281281

282282
This config cannot be used with: `before`
283283

284+
This value is not exported to the environment for child processes.
285+
284286
#### `bin-links`
285287

286288
* Default: true

‎deps/npm/docs/content/commands/npm-install.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -623,6 +623,8 @@ of a relative number of days.
623623
624624
This config cannot be used with: `before`
625625
626+
This value is not exported to the environment for child processes.
627+
626628
#### `bin-links`
627629
628630
* Default: true

‎deps/npm/docs/content/commands/npm-ls.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Note that nested packages will *also* show the paths to the specified packages.
2323
For example, running `npm ls promzard` in npm's source tree will show:
2424

2525
```bash
26-
npm@11.11.1 /path/to/npm
26+
npm@11.12.1 /path/to/npm
2727
└─┬ init-package-json@0.0.4
2828
└── promzard@0.1.5
2929
```

‎deps/npm/docs/content/commands/npm-outdated.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,8 @@ of a relative number of days.
182182

183183
This config cannot be used with: `before`
184184

185+
This value is not exported to the environment for child processes.
186+
185187
### See Also
186188

187189
* [package spec](/using-npm/package-spec)

‎deps/npm/docs/content/commands/npm-publish.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ A `package` is interpreted the same way as other commands (like `npm install`) a
5454
* f) a `<name>` that has a "latest" tag satisfying (e)
5555
* g) a `<git remote url>` that resolves to (a)
5656

57+
If either (a) or (b) is specified as a relative path, it should begin with an explicit `./` prefix.
58+
5759
The publish will fail if the package name and version combination already exists in the specified registry.
5860

5961
Once a package is published with a given name and version, that specific name and version combination can never be used again, even if it is removed with [`npm unpublish`](/commands/npm-unpublish).

‎deps/npm/docs/content/commands/npm-trust.md‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,6 @@ description: Manage trusted publishing relationships between packages and CI/CD
66

77
### Synopsis
88

9-
```bash
10-
11-
```
12-
139
Note: This command is unaware of workspaces.
1410

1511
### Prerequisites

‎deps/npm/docs/content/commands/npm-update.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -347,6 +347,8 @@ of a relative number of days.
347347

348348
This config cannot be used with: `before`
349349

350+
This value is not exported to the environment for child processes.
351+
350352
#### `bin-links`
351353

352354
* Default: true

‎deps/npm/docs/content/commands/npm.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ Note: This command is unaware of workspaces.
1414

1515
### Version
1616

17-
11.11.1
17+
11.12.1
1818

1919
### Description
2020

‎deps/npm/docs/content/using-npm/config.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -770,6 +770,18 @@ the order in which omit/include are specified on the command-line.
770770

771771

772772

773+
#### `include-attestations`
774+
775+
* Default: false
776+
* Type: Boolean
777+
778+
When used with `npm audit signatures --json`, includes the full sigstore
779+
attestation bundles in the JSON output for each verified package. The
780+
bundles contain DSSE envelopes, verification material, and transparency log
781+
entries.
782+
783+
784+
773785
#### `include-staged`
774786

775787
* Default: false
@@ -1086,6 +1098,8 @@ of a relative number of days.
10861098

10871099
This config cannot be used with: `before`
10881100

1101+
This value is not exported to the environment for child processes.
1102+
10891103
#### `name`
10901104

10911105
* Default: null

0 commit comments

Comments
 (0)

Footer

© 2026 GitHub, Inc.
Back | FazBrowse Home | New Git URL