Update CLI documentation for npm v12 and related changes - #1
Merged
Conversation
## Situation [npm@12.0.0](https://github.com/npm/cli/releases/tag/v12.0.0) was released, but no CLI documentation was generated for v12 (see npm/cli#9742). https://docs.npmjs.com/cli still redirects to v11. ## Root cause The nightly **Update CLI** workflow only runs `npm run build -w cli`, which reads the manually-maintained `cli/releases.json`. That file had no `v12` entry, so `build.js` never matched `npm@12.x` to a release and generated nothing. Additionally `v11` still pointed at the `latest` branch, which now tracks v12 in npm/cli. ## Change Repoint `v11` to its new `release/v11` branch and add a `v12` entry on `latest`, mirroring the previous major preparations ("Update CLI releases for npm 10" and #1402 "preparation for v11"). Adding the new `v12` key triggers the build's cache-voiding (`voidOnNewKey`), which resets v11 to `legacy` and regenerates the nav. After merge, the nightly `update-cli` job (or a manual `workflow_dispatch`) will build and publish the v12 docs. Fixes npm/cli#9742 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
## Summary Adds the npm **v12** section to `content/nav.yml` and cleans up the v11 command list. ### v12 - Adds a full `Version 12.0.1` nav entry (marked `default: true`, `type: latest`) with Commands, Configuring npm, and Using npm sections. ### v11 updates - Adds missing commands: `npm adduser`, `npm shrinkwrap`, `npm star`, `npm stars`, `npm unstar`. - Adds `npm-shrinkwrap.json` under Configuring npm. - Removes entries that no longer belong in v11: `npm patch`, `.npm-extension`. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Bumps: - shell-quote from 4.7.8 to 4.7.9 via the lockfile. - handlebars from 1.8.2 to 1.10.0 via the lockfile. - tar, yaml, sigstore, socket.io-parser, picomatch, flatted, engine.io, axios, brace-expansion, @xmldom/xmldom, @babel/plugin-transform-modules-systemjs, @babel/core, joi, multer, svgo via the lockfile. - engine.io-client, socket.io-adapter via the lockfile to resolve ws vulnerabilities. - @actions/http-client via the lockfile to resolve high undici vulnerabilities. - socks via the lockfile to resolve ip-address vulnerabilities
<!-- What / Why --> <!-- Describe the request in detail. What it does and why it's being changed. --> ## References <!-- Examples: Related to #0 Depends on #0 Blocked by #0 Fixes #0 Closes #0 -->
…g august 2026 (#2006) ## Summary Starting early August 2026, Granular Access Tokens with **Bypass 2FA** enabled will no longer be permitted to perform account-identity or account-governance actions. Bypass-2FA tokens remain valid for publishing (for now) Account-identity actions clarified across the docs: - Change email or password - Modify or disable 2FA configuration - Create, escalate, or manage access tokens - Add or remove maintainers / other package-governance changes ## Files updated - `content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx` — added an "Account-identity actions require an interactive 2FA challenge" section and refined the Bypass 2FA description. - `content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx` — clarified the Bypass 2FA checkbox scope during token creation and linked to the new section. - `content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx` — narrowed the "bypass 2FA is enabled" bullet to package write actions and added a bullet for account-identity actions. - `content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx` — noted in the callout that account-identity actions cannot be performed with a bypass-2FA token. ## Notes - Wording aligns with the epic's "raise the floor, ease the path" framing and points users toward [trusted publishing](https://docs.npmjs.com/trusted-publishers) for CI/CD as a migration path. - No changes to nav or redirects were needed. --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Copilot-Session: 17ac1732-86bf-4b6f-a698-70850d2b7b27
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.