FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: upgrade npm to 11.17.0 · nodejs/node@e40cee5 · GitHub

deps: upgrade npm to 11.17.0 · nodejs/node@e40cee5 · GitHub
Skip to content

Navigation Menu

Sign in
Sign in
Sign up

Commit e40cee5

Browse files
npm-cli-bot
authored and
aduh95
committed
deps: upgrade npm to 11.17.0
PR-URL: #63857 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Jordan Harband <ljharb@gmail.com>
1 parent 823efe8 commit e40cee5

320 files changed

Lines changed: 6507 additions & 3776 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/npm/docs/content/commands/npm-approve-scripts.md‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,14 @@ In the current release, this field is advisory: install scripts still run
2525
by default, but installs print a list of packages whose scripts have not
2626
been reviewed. A future release will block unreviewed install scripts.
2727

28+
This command only works inside a project that has a `package.json`. Running
29+
it with `--global` (`-g`) fails with an `EGLOBAL` error, since global
30+
installs (`npm install -g`) and one-off executions (`npm exec` / `npx`) have
31+
no project `package.json` to write to. To allow install scripts in those
32+
contexts, use the `--allow-scripts` flag at install time (for example
33+
`npm install -g --allow-scripts=canvas,sharp`) or persist the setting with
34+
`npm config set allow-scripts=canvas,sharp --location=user`.
35+
2836
There are three modes:
2937

3038
```bash
@@ -74,9 +82,10 @@ npm approve-scripts --allow-scripts-pending
7482
* Default: false
7583
* Type: Boolean
7684

77-
When running `npm outdated` and `npm ls`, setting `--all` will show all
78-
outdated or installed packages, rather than only those directly depended
79-
upon by the current project.
85+
Show or act on all packages, not just the ones your project directly depends
86+
on. For `npm outdated` and `npm ls` this lists every outdated or installed
87+
package. For `npm approve-scripts` and `npm deny-scripts` it selects every
88+
package with pending install scripts.
8089

8190

8291

‎deps/npm/docs/content/commands/npm-deny-scripts.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -59,9 +59,10 @@ npm deny-scripts --all
5959
* Default: false
6060
* Type: Boolean
6161

62-
When running `npm outdated` and `npm ls`, setting `--all` will show all
63-
outdated or installed packages, rather than only those directly depended
64-
upon by the current project.
62+
Show or act on all packages, not just the ones your project directly depends
63+
on. For `npm outdated` and `npm ls` this lists every outdated or installed
64+
package. For `npm approve-scripts` and `npm deny-scripts` it selects every
65+
package with pending install scripts.
6566

6667

6768

‎deps/npm/docs/content/commands/npm-install-test.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -375,6 +375,9 @@ sources, the standard precedence applies (cli > env > project > user >
375375
global), so a higher-priority source can always relax or override a
376376
lower-priority one.
377377

378+
Packages whose names match `min-release-age-exclude` are exempt from this
379+
filter.
380+
378381

379382

380383
#### `min-release-age`
@@ -394,6 +397,37 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
394397
apply, `before` wins within a single source and across sources the standard
395398
precedence rules apply.
396399

400+
Packages whose names match `min-release-age-exclude` are exempt from this
401+
filter.
402+
403+
This value is not exported to the environment for child processes.
404+
405+
#### `min-release-age-exclude`
406+
407+
* Default:
408+
* Type: String (can be set multiple times)
409+
410+
A list of package names or `minimatch` glob patterns that are exempt from
411+
the `min-release-age` (and `before`) filter. A matching package can always
412+
resolve to its newest version, even when a release-age window is set.
413+
414+
For example, to apply a release-age window to third-party dependencies while
415+
letting internally maintained packages update immediately:
416+
417+
```
418+
min-release-age=7
419+
min-release-age-exclude[]=@myorg/*
420+
min-release-age-exclude[]=my-internal-pkg
421+
```
422+
423+
Only the named package is exempt; its own dependencies still follow the
424+
release-age policy unless they also match a pattern. Patterns match against
425+
the package name, so `@myorg/*` matches `@myorg/shared-utils`.
426+
427+
Excluding a package does not change which registry it is fetched from. You
428+
should own your private scope on the public registry so that nobody else can
429+
publish a package with the same name.
430+
397431
This value is not exported to the environment for child processes.
398432

399433
#### `bin-links`

‎deps/npm/docs/content/commands/npm-install.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -717,6 +717,9 @@ sources, the standard precedence applies (cli > env > project > user >
717717
global), so a higher-priority source can always relax or override a
718718
lower-priority one.
719719

720+
Packages whose names match `min-release-age-exclude` are exempt from this
721+
filter.
722+
720723

721724

722725
#### `min-release-age`
@@ -736,6 +739,37 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
736739
apply, `before` wins within a single source and across sources the standard
737740
precedence rules apply.
738741

742+
Packages whose names match `min-release-age-exclude` are exempt from this
743+
filter.
744+
745+
This value is not exported to the environment for child processes.
746+
747+
#### `min-release-age-exclude`
748+
749+
* Default:
750+
* Type: String (can be set multiple times)
751+
752+
A list of package names or `minimatch` glob patterns that are exempt from
753+
the `min-release-age` (and `before`) filter. A matching package can always
754+
resolve to its newest version, even when a release-age window is set.
755+
756+
For example, to apply a release-age window to third-party dependencies while
757+
letting internally maintained packages update immediately:
758+
759+
```
760+
min-release-age=7
761+
min-release-age-exclude[]=@myorg/*
762+
min-release-age-exclude[]=my-internal-pkg
763+
```
764+
765+
Only the named package is exempt; its own dependencies still follow the
766+
release-age policy unless they also match a pattern. Patterns match against
767+
the package name, so `@myorg/*` matches `@myorg/shared-utils`.
768+
769+
Excluding a package does not change which registry it is fetched from. You
770+
should own your private scope on the public registry so that nobody else can
771+
publish a package with the same name.
772+
739773
This value is not exported to the environment for child processes.
740774

741775
#### `bin-links`

‎deps/npm/docs/content/commands/npm-ll.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,10 @@ List installed packages
2323
* Default: false
2424
* Type: Boolean
2525

26-
When running `npm outdated` and `npm ls`, setting `--all` will show all
27-
outdated or installed packages, rather than only those directly depended
28-
upon by the current project.
26+
Show or act on all packages, not just the ones your project directly depends
27+
on. For `npm outdated` and `npm ls` this lists every outdated or installed
28+
package. For `npm approve-scripts` and `npm deny-scripts` it selects every
29+
package with pending install scripts.
2930

3031

3132

‎deps/npm/docs/content/commands/npm-ls.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Note that nested packages will *also* show the paths to the specified packages.
2323
For example, running `npm ls promzard` in npm's source tree will show:
2424

2525
```bash
26-
npm@11.16.0 /path/to/npm
26+
npm@11.17.0 /path/to/npm
2727
└─┬ init-package-json@0.0.4
2828
└── promzard@0.1.5
2929
```
@@ -43,9 +43,10 @@ When run as `ll` or `la`, it shows extended information by default.
4343
* Default: false
4444
* Type: Boolean
4545

46-
When running `npm outdated` and `npm ls`, setting `--all` will show all
47-
outdated or installed packages, rather than only those directly depended
48-
upon by the current project.
46+
Show or act on all packages, not just the ones your project directly depends
47+
on. For `npm outdated` and `npm ls` this lists every outdated or installed
48+
package. For `npm approve-scripts` and `npm deny-scripts` it selects every
49+
package with pending install scripts.
4950

5051

5152

‎deps/npm/docs/content/commands/npm-outdated.md‎

Lines changed: 39 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Use `--all` to find all outdated meta-dependencies as well.
2020
In the output:
2121

2222
* `wanted` is the maximum version of the package that satisfies the semver range specified in `package.json`.
23-
If there's no available semver range (i.e. you're running `npm outdated --global`, or the package isn't included in `package.json`), then `wanted` shows the currently-installed version.
23+
If there's no available semver range (i.e. you're running `npm outdated --global`, or the package isn't included in `package.json`), then `wanted` shows the latest version.
2424
* `latest` is the version of the package tagged as latest in the registry.
2525
Running `npm publish` with no special configuration will publish the package with a dist-tag of `latest`.
2626
This may or may not be the maximum version of the package, or the most-recently published version of the package, depending on how the package's developer manages the latest [dist-tag](/commands/npm-dist-tag).
@@ -73,9 +73,10 @@ A few things to note:
7373
* Default: false
7474
* Type: Boolean
7575

76-
When running `npm outdated` and `npm ls`, setting `--all` will show all
77-
outdated or installed packages, rather than only those directly depended
78-
upon by the current project.
76+
Show or act on all packages, not just the ones your project directly depends
77+
on. For `npm outdated` and `npm ls` this lists every outdated or installed
78+
package. For `npm approve-scripts` and `npm deny-scripts` it selects every
79+
package with pending install scripts.
7980

8081

8182

@@ -171,6 +172,9 @@ sources, the standard precedence applies (cli > env > project > user >
171172
global), so a higher-priority source can always relax or override a
172173
lower-priority one.
173174

175+
Packages whose names match `min-release-age-exclude` are exempt from this
176+
filter.
177+
174178

175179

176180
#### `min-release-age`
@@ -190,6 +194,37 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
190194
apply, `before` wins within a single source and across sources the standard
191195
precedence rules apply.
192196

197+
Packages whose names match `min-release-age-exclude` are exempt from this
198+
filter.
199+
200+
This value is not exported to the environment for child processes.
201+
202+
#### `min-release-age-exclude`
203+
204+
* Default:
205+
* Type: String (can be set multiple times)
206+
207+
A list of package names or `minimatch` glob patterns that are exempt from
208+
the `min-release-age` (and `before`) filter. A matching package can always
209+
resolve to its newest version, even when a release-age window is set.
210+
211+
For example, to apply a release-age window to third-party dependencies while
212+
letting internally maintained packages update immediately:
213+
214+
```
215+
min-release-age=7
216+
min-release-age-exclude[]=@myorg/*
217+
min-release-age-exclude[]=my-internal-pkg
218+
```
219+
220+
Only the named package is exempt; its own dependencies still follow the
221+
release-age policy unless they also match a pattern. Patterns match against
222+
the package name, so `@myorg/*` matches `@myorg/shared-utils`.
223+
224+
Excluding a package does not change which registry it is fetched from. You
225+
should own your private scope on the public registry so that nobody else can
226+
publish a package with the same name.
227+
193228
This value is not exported to the environment for child processes.
194229

195230
### See Also

‎deps/npm/docs/content/commands/npm-query.md‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -262,6 +262,82 @@ This config cannot be used with: `expect-result-count`
262262
Tells to expect a specific number of results from the command.
263263

264264
This config cannot be used with: `expect-results`
265+
266+
#### `before`
267+
268+
* Default: null
269+
* Type: null or Date
270+
271+
If passed to `npm install`, will rebuild the npm tree such that only
272+
versions that were available **on or before** the given date are installed.
273+
If there are no versions available for the current set of dependencies, the
274+
command will error.
275+
276+
If the requested version is a `dist-tag` and the given tag does not pass the
277+
`--before` filter, the most recent version less than or equal to that tag
278+
will be used. For example, `foo@latest` might install `foo@1.2` even though
279+
`latest` is `2.0`.
280+
281+
If `before` and `min-release-age` are both set in the same source, `before`
282+
wins (an explicit absolute date overrides a relative window). Across
283+
sources, the standard precedence applies (cli > env > project > user >
284+
global), so a higher-priority source can always relax or override a
285+
lower-priority one.
286+
287+
Packages whose names match `min-release-age-exclude` are exempt from this
288+
filter.
289+
290+
291+
292+
#### `min-release-age`
293+
294+
* Default: null
295+
* Type: null or Number
296+
297+
If set, npm will build the npm tree such that only versions that were
298+
available more than the given number of days ago will be installed. If there
299+
are no versions available for the current set of dependencies, the command
300+
will error.
301+
302+
This flag is a complement to `before`, which accepts an exact date instead
303+
of a relative number of days. The two may coexist (e.g. `min-release-age` in
304+
your `.npmrc` is preserved when npm internally spawns a sub-process with
305+
`--before` while preparing a `git:` or `github:` dependency); when both
306+
apply, `before` wins within a single source and across sources the standard
307+
precedence rules apply.
308+
309+
Packages whose names match `min-release-age-exclude` are exempt from this
310+
filter.
311+
312+
This value is not exported to the environment for child processes.
313+
314+
#### `min-release-age-exclude`
315+
316+
* Default:
317+
* Type: String (can be set multiple times)
318+
319+
A list of package names or `minimatch` glob patterns that are exempt from
320+
the `min-release-age` (and `before`) filter. A matching package can always
321+
resolve to its newest version, even when a release-age window is set.
322+
323+
For example, to apply a release-age window to third-party dependencies while
324+
letting internally maintained packages update immediately:
325+
326+
```
327+
min-release-age=7
328+
min-release-age-exclude[]=@myorg/*
329+
min-release-age-exclude[]=my-internal-pkg
330+
```
331+
332+
Only the named package is exempt; its own dependencies still follow the
333+
release-age policy unless they also match a pattern. Patterns match against
334+
the package name, so `@myorg/*` matches `@myorg/shared-utils`.
335+
336+
Excluding a package does not change which registry it is fetched from. You
337+
should own your private scope on the public registry so that nobody else can
338+
publish a package with the same name.
339+
340+
This value is not exported to the environment for child processes.
265341
## See Also
266342

267343
* [dependency selectors](/using-npm/dependency-selectors)

‎deps/npm/docs/content/commands/npm-stage.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,7 @@ npm stage publish <package-spec>
151151

152152
| Flag | Default | Type | Description |
153153
| --- | --- | --- | --- |
154-
| `--tag` | "latest" | String | If you ask npm to install a package and don't tell it a specific version, then it will install the specified tag. It is the tag added to the package@version specified in the `npm dist-tag add` command, if no explicit tag is given. When used by the `npm diff` command, this is the tag used to fetch the tarball that will be compared with the local files by default. If used in the `npm publish` command, this is the tag that will be added to the package submitted to the registry. |
154+
| `--tag` | "latest" | String | If you ask npm to install a package and don't tell it a specific version, then it will install the specified tag. It is the tag added to the package@version specified in the `npm dist-tag add` command, if no explicit tag is given. When used by the `npm diff` command, this is the tag used to fetch the tarball that will be compared with the local files by default. If used in the `npm publish` command, this is the tag that will be added to the package submitted to the registry. |
155155
| `--access` | 'public' for new packages, existing packages it will not change the current level | null, "restricted", "public", or "private" | If you do not want your scoped package to be publicly viewable (and installable) set `--access=restricted`. Unscoped packages cannot be set to `restricted`. Note: This defaults to not changing the current access level for existing packages. Specifying a value of `restricted` or `public` during publish will change the access for an existing package the same way that `npm access set status` would. The value `private` is an alias for `restricted`. |
156156
| `--dry-run` | false | Boolean | Indicates that you don't want npm to make any changes and that it should only report what it would have done. This can be passed into any of the commands that modify your local installation, eg, `install`, `update`, `dedupe`, `uninstall`, as well as `pack` and `publish`. Note: This is NOT honored by other network related commands, eg `dist-tags`, `owner`, etc. |
157157
| `--otp` | null | null or String | This is a one-time password from a two-factor authenticator. It's needed when publishing or changing package permissions with `npm access`. If not set, and a registry response fails with a challenge for a one-time password, npm will prompt on the command line for one. |

‎deps/npm/docs/content/commands/npm-trust.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ Note: This command is unaware of workspaces.
1212

1313
Before using npm trust commands, ensure the following requirements are met:
1414

15-
* **npm version**: `npm@11.10.0` or above is required. Use `npm install -g npm@^11.10.0` to update if needed.
15+
* **npm version**: `npm@11.15.0` or above is required. Use `npm install -g npm@^11.15.0` to update if needed.
1616
* **Write permissions on the package**: You must have write access to the package you're configuring.
1717
* **2FA enabled on account**: Two-factor authentication must be enabled at the account level. Even if it's not currently enabled, you must enable it to use trust commands.
1818
* **Supported authentication methods**: Granular Access Tokens (GAT) with the bypass 2FA option are not supported. Legacy basic auth (username and password) credentials will not work for trust commands or endpoints.

0 commit comments

Comments
 (0)

Footer

© 2026 GitHub, Inc.
Back | FazBrowse Home | New Git URL