Release v11.17.0 · npm/cli

11.17.0 (2026-06-11)

ae8ac4e #9534 add min-release-age-exclude config (@JamieMagee, @caseyjhol)
8ff3e48 #9483 allowScripts tooling and inBundle hardening (#9483) (@github-actions[bot], @JamieMagee)

847cdf8 #9541 match dotted and versioned args in approve-scripts/deny-scripts (@owlstronaut)
d99f7cb #9535 emit valid JSON from approve-scripts/deny-scripts --json (@owlstronaut)
351a309 #9499 pass script-shell to publish lifecycle hooks (#9499) (@github-actions[bot])
4fa81df #9497 recognize allowScripts for local link targets (#9497) (@github-actions[bot], @cyphercodes, @cyphercodes)
95cf2e9 #9489 validate registry path for allow-remote tarballs (@Abhinav-143x)
9dd219b #9462 respect allowScripts policy in prune, dedupe, uninstall, audit, and link (#9462) (@github-actions[bot], @JamieMagee)
cd8d18a #9482 list pending scripts in approve-scripts when ignore-scripts is set (#9482) (@github-actions[bot], @JamieMagee)
c14e87c #9481 suggest --allow-scripts for global installs in unreviewed-scripts warnings (#9481) (@github-actions[bot], @JamieMagee)
7ade52e #9465 invalid issue template YAML indentation (#9465) (@github-actions[bot], @fallintoplace)
c069622 #9464 show full parent command path in subcommand usage errors (#9464) (@owlstronaut)
1bb62bb #9454 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@JamieMagee)
84eeb5f #9431 audit: don't apply min-release-age before filter when verifying installed signatures (@JamieMagee)
3bd3377 #9426 block forbidden keys in Queryable setter to prevent prototype pollution (@12122J, @claude)

a86a7a9 #9522 approve-scripts only throws EGLOBAL when run with -g (@JamieMagee)
693bb3d #9508 clarify package.json override value specs (#9508) (@github-actions[bot], @ded-furby)
ccffe4a #9501 use the latest version for global update and outdated's wanted (#9501) (@github-actions[bot], @liangmiQwQ)
66e97c2 #9478 update minimum npm required for npm trust (@meeech)