deps: upgrade npm to 11.19.0 by npm-cli-bot · Pull Request #64885 · nodejs/node · GitHub

This PR contains changes from: npm@11.18.0 npm@11.19.0

11.18.0

11.18.0 (2026-06-29)

Features

3021ad6 #9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)
abd8c6b #9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)
9420673 #9662 install-scripts: prune unused allowScripts entries (#9662) (@github-actions[bot], @JamieMagee)
fc9d4c7 #9635 namespace install-script approval commands under npm install-scripts (#9635) (@manzoorwanijk)
073253f #9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)

Bug Fixes

598ffdb #9693 sbom: percent-encode vcs_url qualifier in generated purls (#9693) (@github-actions[bot], @ubeddulla)
05793d0 #9691 output all the required parameters for npm token list (#9691) (@github-actions[bot], @rijildaniel)
cd57139 #9669 arborist: surface undeclared workspaces under the linked strategy (backport release/v11) (#9669) (@manzoorwanijk)
5b6ff9c #9667 reify: report added count for fresh linked installs (#9667) (@github-actions[bot], @manzoorwanijk, @owlstronaut)
8f13beb #9664 query: report logical dep location under linked strategy (#9664) (@github-actions[bot], @manzoorwanijk)
168ba30 #9663 allowScripts: close enforcement gaps (#9652) (backport release/v11) (#9663) (@JamieMagee)
ae64f88 #9648 exec: resolve workspace-local bin under the linked install strategy (#9648) (@github-actions[bot], @manzoorwanijk)
784cbe9 #9636 ls: restore 100% coverage on release/v11 after #9633 (#9636) (@manzoorwanijk)
70f0ea5 #9607 approve-scripts: approve deps with no resolved URL by name (#9607) (@github-actions[bot], @JamieMagee)
b2e6338 #9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)
6ad5715 #9595 link: scope npm link --workspace to the workspace, not the root (#9595) (@github-actions[bot], @manzoorwanijk)

Documentation

3658bb5 #9690 recommend install-strategy=linked to catch phantom dependencies (#9690) (@github-actions[bot], @manzoorwanijk)

Dependencies

54656b6 #9696 undici@6.27.0
31c4773 #9696 brace-expansion@5.0.7
e773c77 #9696 tar@7.5.19
f05f6af #9696 semver@7.8.5
804f9ba #9580 npm-profile@12.0.2

Chores

f79b37f #9696 dev dependency updates (@owlstronaut)
a04cd84 #9584 add web-login proxy doneUrl regression for npm-profile fix (#9584) (@github-actions[bot], @manzoorwanijk)
workspace: @npmcli/arborist@9.9.0
workspace: @npmcli/config@10.12.0
workspace: libnpmdiff@8.1.11
workspace: libnpmexec@10.3.1
workspace: libnpmfund@7.0.25
workspace: libnpmpack@9.1.11

arborist: 9.9.0

9.9.0 (2026-06-29)

Features

3021ad6 #9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)
abd8c6b #9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)
9420673 #9662 install-scripts: prune unused allowScripts entries (#9662) (@github-actions[bot], @JamieMagee)
073253f #9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)

Bug Fixes

774875b #9686 arborist: keep bin links for allowScripts-denied packages (#9686) (@JamieMagee)
719de1e #9673 arborist: apply overrides across a file: link (backport release/v11) (#9673) (@manzoorwanijk)
cd57139 #9669 arborist: surface undeclared workspaces under the linked strategy (backport release/v11) (#9669) (@manzoorwanijk)
ede32d3 #9668 arborist: forward transitive overrides through linked store links (#9658) (backport release/v11) (#9668) (@manzoorwanijk)
f503b07 #9666 correct dev/prod dep flags for workspaces under the linked strategy (#9666) (@github-actions[bot], @manzoorwanijk)
f580889 #9665 arborist: load transitive optional deps into linked actual tree (#9665) (@github-actions[bot], @manzoorwanijk)
8f13beb #9664 query: report logical dep location under linked strategy (#9664) (@github-actions[bot], @manzoorwanijk)
168ba30 #9663 allowScripts: close enforcement gaps (#9652) (backport release/v11) (#9663) (@JamieMagee)
4c9eacb #9649 arborist: clean up stale .store and hoisted dirs on strategy switch (#9649) (@github-actions[bot], @manzoorwanijk)
d2c680e #9645 arborist: invalid filterNode crash under the linked strategy (#9645) (@github-actions[bot], @manzoorwanijk)
4e40b1c #9644 arborist: repair wrong-but-existing symlink target in linked strategy (#9644) (@github-actions[bot], @manzoorwanijk)
9d1774e #9643 arborist: remove stale .bin shims after uninstall under linked (#9643) (@github-actions[bot], @manzoorwanijk)
ed37d24 #9642 arborist: record the linked .store layout in the hidden lockfile (backport #9630) (#9642) (@manzoorwanijk)
e601d4a #9641 arborist: validate peerOptional conflicts in no-save mutations (#9641) (@owlstronaut, @dale-lakes, @dale-lakes)
03cee43 #9638 arborist: fix audit-report determinism due to dropped via links (#9638) (@github-actions[bot], @arjun-vegeta)
a30d855 #9633 arborist: don't load store packages' devDependencies as required edges (#9633) (@manzoorwanijk)
887ca97 #9631 arborist: audit the non-isolated tree under the linked strategy (#9631) (@github-actions[bot], @manzoorwanijk)
b2e6338 #9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)
390ebfa #9593 arborist: symlink workspace file: deps on non-workspace local packages (#9593) (@github-actions[bot], @manzoorwanijk)
aaeb2f1 #9578 arborist: expose store node_modules via NODE_PATH for linked-strategy install scripts (#9578) (@github-actions[bot], @manzoorwanijk)
05b6f0f #9577 arborist: allow-remote exemption for proxy/mirror-fronted registry tarballs (#9577) (@github-actions[bot], @manzoorwanijk)

config: 10.12.0

10.12.0 (2026-06-29)

Features

3021ad6 #9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)
abd8c6b #9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)
073253f #9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)

Bug Fixes

b2e6338 #9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)

Documentation

3658bb5 #9690 recommend install-strategy=linked to catch phantom dependencies (#9690) (@github-actions[bot], @manzoorwanijk)

libnpmdiff: 8.1.11

Dependencies

workspace: @npmcli/arborist@9.9.0

libnpmexec: 10.3.1

10.3.1 (2026-06-29)

Bug Fixes

f3f2465 #9692 exec: prevent shared binPaths pollution across workspace runs (#9692) (@github-actions[bot], @arjun-vegeta)
b2e6338 #9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)

Dependencies

workspace: @npmcli/arborist@9.9.0

libnpmfund: 7.0.25

Dependencies

workspace: @npmcli/arborist@9.9.0

libnpmpack: 9.1.11

Dependencies

workspace: @npmcli/arborist@9.9.0

11.19.0

11.19.0 (2026-07-28)

Features

7d39aa6 #9698 install-scripts: use install-scripts as the warning log title (@manzoorwanijk)

Bug Fixes

3529ca2 #9811 pack: honor min-release-age-exclude (#9811) (@github-actions[bot], @martinrrm, @Copilot)
67f12ae #9810 owner: use scoped registry for user lookup (#9810) (@github-actions[bot], @martinrrm, @Copilot)

Dependencies

workspace: @npmcli/arborist@9.9.1
workspace: libnpmdiff@8.1.12
workspace: libnpmexec@10.3.2
workspace: libnpmfund@7.0.26
workspace: libnpmpack@9.1.12

Review requested:

@nodejs/security-wg

CI: https://ci.nodejs.org/job/node-test-pull-request/75358/

CI: https://ci.nodejs.org/job/node-test-pull-request/75371/

Why does this target v24.x-staging instead of main?

Why does this target v24.x-staging instead of main?

How would that work if #64882 proposes to land npm@12.0.2 into main?

Ideally 11.19.0 should land on main before 12.0.2 – if #64882 lands first, we would still want the PR against v26.x-staging, not v24.x-staging

@reggi who triggered these releases also opened a Slack thread https://openjs-foundation.slack.com/archives/C019Y2T6STH/p1785531468429629 so it may be easier to sort out the strategy with her in Slack.

Ideally 11.19.0 should land on main before 12.0.2 – if #64882 lands first, we would still want the PR against v26.x-staging, not v24.x-staging

The PR for v26.x-staging is #64883. That should be land cleanly on v24.x-staging if npm 11.18.0 is cherry-picked first.

This PR goes against https://github.com/nodejs/node/blob/main/doc/contributing/backporting-to-release-lines.md#criteria-for-backporting

The "Current" release line is more flexible than LTS lines. LTS branches, detailed in the Release Plan, require commits to mature in the Current release for at least two weeks before backporting.

Superseded by #64883.

deps: upgrade npm to 11.19.0

51d5bdd

nodejs-github-bot added needs-ci PRs that need a full CI run. npm Issues and PRs related to the npm client dependency or the npm registry. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch. labels Jul 31, 2026

reggi mentioned this pull request Jul 31, 2026

Keeping npm up to date in Node.js npm/cli#9827

Open

ljharb approved these changes Jul 31, 2026

View reviewed changes

avivkeller approved these changes Jul 31, 2026

View reviewed changes

MikeMcC399 added the request-ci Add this label to start a Jenkins CI on a PR. label Aug 1, 2026

MikeMcC399 mentioned this pull request Aug 1, 2026

deps: upgrade npm to 11.18.0 #64199

Merged

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Aug 1, 2026

lpinca approved these changes Aug 1, 2026

View reviewed changes

avivkeller added the author ready PRs that have at least one approval, no outstanding review comments, and a CI started. label Aug 1, 2026

MikeMcC399 approved these changes Aug 1, 2026

View reviewed changes

trivikr approved these changes Aug 2, 2026

View reviewed changes

MikeMcC399 reviewed Aug 4, 2026

View reviewed changes

MikeMcC399 removed the author ready PRs that have at least one approval, no outstanding review comments, and a CI started. label Aug 4, 2026

Renegade334 closed this Aug 4, 2026

deps: upgrade npm to 11.19.0 by npm-cli-bot · Pull Request #64885 · nodejs/node · GitHub

Uh oh!

Uh oh!

deps: upgrade npm to 11.19.0 - #64885

deps: upgrade npm to 11.19.0#64885
npm-cli-bot wants to merge 1 commit into
nodejs:v24.x-stagingfrom
npm:npm-v11.19.0-24

npm-cli-bot commented Jul 31, 2026

Uh oh!

nodejs-github-bot commented Jul 31, 2026

Uh oh!

nodejs-github-bot commented Aug 1, 2026

Uh oh!

nodejs-github-bot commented Aug 1, 2026

Uh oh!

aduh95 commented Aug 3, 2026

Uh oh!

MikeMcC399 commented Aug 3, 2026

Uh oh!

aduh95 commented Aug 3, 2026

Uh oh!

MikeMcC399 commented Aug 3, 2026

Uh oh!

richardlau commented Aug 3, 2026

Uh oh!

MikeMcC399 left a comment

Uh oh!

Renegade334 commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

deps: upgrade npm to 11.19.0 by npm-cli-bot · Pull Request #64885 · nodejs/node · GitHub

Uh oh!

Uh oh!

deps: upgrade npm to 11.19.0 - #64885

deps: upgrade npm to 11.19.0#64885npm-cli-bot wants to merge 1 commit intonodejs:v24.x-stagingnodejs/node:v24.x-stagingfrom npm:npm-v11.19.0-24npm/node:npm-v11.19.0-24Copy head branch name to clipboard

Conversation

npm-cli-bot commented Jul 31, 2026

11.18.0 (2026-06-29)

Features

Bug Fixes

Documentation

Dependencies

Chores

9.9.0 (2026-06-29)

Features

Bug Fixes

10.12.0 (2026-06-29)

Features

Bug Fixes

Documentation

Dependencies

10.3.1 (2026-06-29)

Bug Fixes

Dependencies

Dependencies

Dependencies

11.19.0 (2026-07-28)

Features

Bug Fixes

Dependencies

Uh oh!

nodejs-github-bot commented Jul 31, 2026

Uh oh!

nodejs-github-bot commented Aug 1, 2026

Uh oh!

nodejs-github-bot commented Aug 1, 2026

Uh oh!

aduh95 commented Aug 3, 2026

Uh oh!

MikeMcC399 commented Aug 3, 2026

Uh oh!

aduh95 commented Aug 3, 2026

Uh oh!

MikeMcC399 commented Aug 3, 2026

Uh oh!

richardlau commented Aug 3, 2026

Uh oh!

MikeMcC399 left a comment

Choose a reason for hiding this comment

Uh oh!

Renegade334 commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

deps: upgrade npm to 11.19.0#64885
npm-cli-bot wants to merge 1 commit into
nodejs:v24.x-stagingfrom
npm:npm-v11.19.0-24