FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: upgrade npm to 11.18.0 by npm-cli-bot · Pull Request #64199 · nodejs/node · GitHub

/ node Public

deps: upgrade npm to 11.18.0 - #64199

Merged
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
npm:npm-v11.18.0-main
Jul 8, 2026
ConversationCommits (1)ChecksFiles changed
Merged

deps: upgrade npm to 11.18.0#64199
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
npm:npm-v11.18.0-main

Conversation

npm-cli-bot commented Jun 29, 2026

Copy link
Copy Markdown
Contributor

11.18.0 (2026-06-29)

Features

Bug Fixes

Documentation

Dependencies

Chores

arborist: 9.9.0

9.9.0 (2026-06-29)

Features

Bug Fixes

config: 10.12.0

10.12.0 (2026-06-29)

Features

Bug Fixes

Documentation

libnpmdiff: 8.1.11

Dependencies

libnpmexec: 10.3.1

10.3.1 (2026-06-29)

Bug Fixes

Dependencies

libnpmfund: 7.0.25

Dependencies

libnpmpack: 9.1.11

Dependencies

nodejs-github-bot commented Jun 29, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/security-wg

nodejs-github-bot added needs-ci PRs that need a full CI run. npm Issues and PRs related to the npm client dependency or the npm registry. labels Jun 29, 2026
richardlau added the request-ci Add this label to start a Jenkins CI on a PR. label Jun 30, 2026
github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jun 30, 2026

nodejs-github-bot commented Jun 30, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74451/

nodejs-github-bot commented Jul 2, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74507/

richardlau commented Jul 2, 2026

Copy link
Copy Markdown
Member

This will need a rebase to fix the CI failures.

This comment was marked as outdated.

Sign in to view

manzoorwanijk commented Jul 7, 2026

Copy link
Copy Markdown

The last lone maintainer of npm CLI is no longer at GitHub, and I don’t see anyone else being assigned yet. So, this may take longer to get rebased.

reggi commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

The last lone maintainer of npm CLI is no longer at GitHub, and I don’t see anyone else being assigned yet. So, this may take longer to get rebased.

✌️ I'm Tea I work on npm

richardlau added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 7, 2026

richardlau commented Jul 7, 2026

Copy link
Copy Markdown
Member

Is it too late to get the rebase done and landed before the Node.js 26.5.0 release?

I've restarted the CI for this PR, but am making no promises about getting this into the 26.5.0 release.

My intention for 26.5.0 was to start release builds tonight before I go to sleep so I can do the release tomorrow during my working hours (the worst case build time (which I don't know if we'll hit) is ~7 hours). We're past my work hours today so if I did try to get the npm release into 26.5.0 I'd have to give up a chunk of my evening to:

  • Check the CI for this PR has passed (restarting for any flakes)
  • Merge this PR
  • Update the release proposal
  • Rerun CI for the release proposal

The good news for Node.js 26 is that we do current releases fairly often, so it should not be too long before the next release.

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 7, 2026

nodejs-github-bot commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74641/

nodejs-github-bot commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74657/

nodejs-github-bot commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74660/

nodejs-github-bot commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74670/

nodejs-github-bot commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74671/

richardlau added the commit-queue Add this label to land a pull request using GitHub Actions. label Jul 8, 2026
nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Jul 8, 2026
nodejs-github-bot merged commit fd35018 into nodejs:main Jul 8, 2026
70 checks passed

nodejs-github-bot commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

Landed in fd35018

aduh95 pushed a commit that referenced this pull request Jul 21, 2026
deps: upgrade npm to 11.18.0
52e427d 
PR-URL: #64199
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
github-actions Bot mentioned this pull request Jul 21, 2026
Merged
santigimeno pushed a commit to nodesource/nsolid that referenced this pull request Jul 22, 2026
deps: upgrade npm to 11.18.0
ea52ab6 
PR-URL: nodejs/node#64199
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Signed-off-by: Santiago Gimeno <santiago.gimeno@gmail.com>

danez commented Jul 24, 2026

Copy link
Copy Markdown

Can this please be backported to 24.x and included in 24.19.0?
Because of npm/cli#9681. So basically allowScripts in npm < 11.18.0 is pretty broken and does not install bins.

richardlau added the dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. label Jul 24, 2026
MikeMcC399 mentioned this pull request Jul 25, 2026
Closed

MikeMcC399 commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

A critical severity vulnerability CVE-2026-59873 for tar <7.5.19 is being reported in the node Docker images currently bundling npm@11

Node.js npm tar resolved in
24.18.1 11.16.0 7.5.15 npm@11.18.0
26.5.1 11.17.0 7.5.16 npm@11.18.0

This would be resolved when this PR lands in Node.js 24.x and 26.x.

For npm 10.x used in Node.js 22.x see separate issue npm/cli#9801 npm/cli#9824

Updated - now only affects Node.js 24.x:

Node.js npm tar resolved in
24.19.0 11.17.0 7.5.16 npm@11.18.0
26.6.0 11.18.0 7.5.19 already resolved

Waldenesque commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown

@danez

EDIT:

npm 11.18 has now been released in Node 26, so it should be released in Node 24 within about a month.

RafaelGSS pushed a commit that referenced this pull request Jul 29, 2026
deps: upgrade npm to 11.18.0
ad2f3bc 
PR-URL: #64199
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
MikeMcC399 mentioned this pull request Jul 31, 2026
Closed

MikeMcC399 commented Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

A set of PRs for npm have been submitted, as listed on npm/cli#9827

The following two PRs are updates to npm 11.19.0:
#64883 - landed in main, backported to Node.js 26.7.0
#64885 - closed. Superseded by #64883

richardlau mentioned this pull request Aug 3, 2026
Closed
aduh95 pushed a commit that referenced this pull request Aug 6, 2026
deps: upgrade npm to 11.18.0
7ac97fc 
PR-URL: #64199
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
github-actions Bot mentioned this pull request Aug 21, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

lpinca lpinca approved these changes
richardlau richardlau approved these changes
gurgunday gurgunday approved these changes

Assignees

No one assigned

Labels

dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. needs-ci PRs that need a full CI run. npm Issues and PRs related to the npm client dependency or the npm registry.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

10 participants

Back | FazBrowse Home | New Git URL