I'm skipping the release train and violating npm's release process a little, because the major new "feature" of npm@2.5.1 is that its tests have been updated to pass on io.js 1.1.x (see #663 for context). The test failures weren't always visible because the test-npm stanza in the Makefile needs to be updated to ensure that the PATH is set up to only run the binary built by the Makefile. For joyent/node, the patch looks like:

% g d Makefile
diff --git a/Makefile b/Makefile
index 6c148eb..9f388c4 100644
--- a/Makefile
+++ b/Makefile
@@ -154,12 +154,15 @@ test-npm: node
        cd deps/npm ; npm_config_cache="$(shell pwd)/npm-cache" \
             npm_config_prefix="$(shell pwd)/npm-prefix" \
             npm_config_tmp="$(shell pwd)/npm-tmp" \
-            ../../node cli.js install
+            PATH="../..:/bin:/usr/bin" \
+            node cli.js install
        cd deps/npm ; npm_config_cache="$(shell pwd)/npm-cache" \
             npm_config_prefix="$(shell pwd)/npm-prefix" \
             npm_config_tmp="$(shell pwd)/npm-tmp" \
-            ../../node cli.js run-script test-all && \
-            ../../node cli.js prune --prod && \
+            PATH="../..:/bin:/usr/bin" \
+            node cli.js run-script test-all && \
+            PATH="../..:/bin:/usr/bin" \
+            node cli.js prune --prod && \
             cd ../.. && \
             rm -rf npm-cache npm-tmp npm-prefix

But for io.js, it's more complicated, because npm's tests themselves rely upon the node binary being present, and that's not guaranteed in the cases where the node → iojs symlink might not have been made yet.

These test changes complement npm@2.5.0, which includes a small new feature (see below), but more important fixes a potentially serious regression in npm-registry-client that would cause npm@2.3.0 and npm@2.4.1 to have issues connecting to registries from within proxied networks (which would also prevent using the bundled npm to update itself if these environments).

The shorter changelog is:

• 0e8d473 #7281 npm-registry-mock@1.0.0: Clean up API, set connection: close, which makes tests pass on io.js 1.1.x.
  (@robertkowalski)
• f9313a0
  #7226 Ensure that all request
  settings are copied onto the agent.
  (@othiym23)
• fec4c96
  Allow --no-proxy to override HTTP_PROXY setting in environment.
  (@othiym23)
• 9d61e96
  npm outdated --long now includes a column showing the type of dependency.
  (@watilde)

NOTE: skipping ahead in the release train probably means there won't be a new PR for npm being updated next week.