v11.18.0

11.18.0 (2026-06-29)

Features

• 3021ad6 #9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)
• abd8c6b #9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)
• 9420673 #9662 install-scripts: prune unused allowScripts entries (#9662) (@github-actions[bot], @JamieMagee)
• fc9d4c7 #9635 namespace install-script approval commands under npm install-scripts (#9635) (@manzoorwanijk)
• 073253f #9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)

Bug Fixes

• 598ffdb #9693 sbom: percent-encode vcs_url qualifier in generated purls (#9693) (@github-actions[bot], @ubeddulla)
• 05793d0 #9691 output all the required parameters for npm token list (#9691) (@github-actions[bot], @rijildaniel)
• cd57139 #9669 arborist: surface undeclared workspaces under the linked strategy (backport release/v11) (#9669) (@manzoorwanijk)
• 5b6ff9c #9667 reify: report added count for fresh linked installs (#9667) (@github-actions[bot], @manzoorwanijk, @owlstronaut)
• 8f13beb #9664 query: report logical dep location under linked strategy (#9664) (@github-actions[bot], @manzoorwanijk)
• 168ba30 #9663 allowScripts: close enforcement gaps (#9652) (backport release/v11) (#9663) (@JamieMagee)
• ae64f88 #9648 exec: resolve workspace-local bin under the linked install strategy (#9648) (@github-actions[bot], @manzoorwanijk)
• 784cbe9 #9636 ls: restore 100% coverage on release/v11 after #9633 (#9636) (@manzoorwanijk)
• 70f0ea5 #9607 approve-scripts: approve deps with no resolved URL by name (#9607) (@github-actions[bot], @JamieMagee)
• b2e6338 #9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)
• 6ad5715 #9595 link: scope npm link --workspace to the workspace, not the root (#9595) (@github-actions[bot], @manzoorwanijk)

Documentation

• 3658bb5 #9690 recommend install-strategy=linked to catch phantom dependencies (#9690) (@github-actions[bot], @manzoorwanijk)

Dependencies

• 54656b6 #9696 undici@6.27.0
• 31c4773 #9696 brace-expansion@5.0.7
• e773c77 #9696 tar@7.5.19
• f05f6af #9696 semver@7.8.5
• 804f9ba #9580 npm-profile@12.0.2

Chores

• f79b37f #9696 dev dependency updates (@owlstronaut)
• a04cd84 #9584 add web-login proxy doneUrl regression for npm-profile fix (#9584) (@github-actions[bot], @manzoorwanijk)
• workspace: @npmcli/arborist@9.9.0
• workspace: @npmcli/config@10.12.0
• workspace: libnpmdiff@8.1.11
• workspace: libnpmexec@10.3.1
• workspace: libnpmfund@7.0.25
• workspace: libnpmpack@9.1.11

arborist: 9.9.0

9.9.0 (2026-06-29)

Features

• 3021ad6 #9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)
• abd8c6b #9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)
• 9420673 #9662 install-scripts: prune unused allowScripts entries (#9662) (@github-actions[bot], @JamieMagee)
• 073253f #9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)

Bug Fixes

• 774875b #9686 arborist: keep bin links for allowScripts-denied packages (#9686) (@JamieMagee)
• 719de1e #9673 arborist: apply overrides across a file: link (backport release/v11) (#9673) (@manzoorwanijk)
• cd57139 #9669 arborist: surface undeclared workspaces under the linked strategy (backport release/v11) (#9669) (@manzoorwanijk)
• ede32d3 #9668 arborist: forward transitive overrides through linked store links (#9658) (backport release/v11) (#9668) (@manzoorwanijk)
• f503b07 #9666 correct dev/prod dep flags for workspaces under the linked strategy (#9666) (@github-actions[bot], @manzoorwanijk)
• f580889 #9665 arborist: load transitive optional deps into linked actual tree (#9665) (@github-actions[bot], @manzoorwanijk)
• 8f13beb #9664 query: report logical dep location under linked strategy (#9664) (@github-actions[bot], @manzoorwanijk)
• 168ba30 #9663 allowScripts: close enforcement gaps (#9652) (backport release/v11) (#9663) (@JamieMagee)
• 4c9eacb #9649 arborist: clean up stale .store and hoisted dirs on strategy switch (#9649) (@github-actions[bot], @manzoorwanijk)
• d2c680e #9645 arborist: invalid filterNode crash under the linked strategy (#9645) (@github-actions[bot], @manzoorwanijk)
• 4e40b1c #9644 arborist: repair wrong-but-existing symlink target in linked strategy (#9644) (@github-actions[bot], @manzoorwanijk)
• 9d1774e #9643 arborist: remove stale .bin shims after uninstall under linked (#9643) (@github-actions[bot], @manzoorwanijk)
• ed37d24 #9642 arborist: record the linked .store layout in the hidden lockfile (backport #9630) (#9642) (@manzoorwanijk)
• e601d4a #9641 arborist: validate peerOptional conflicts in no-save mutations (#9641) (@owlstronaut, @dale-lakes, @dale-lakes)
• 03cee43 #9638 arborist: fix audit-report determinism due to dropped via links (#9638) (@github-actions[bot], @arjun-vegeta)
• a30d855 #9633 arborist: don't load store packages' devDependencies as required edges (#9633) (@manzoorwanijk)
• 887ca97 #9631 arborist: audit the non-isolated tree under the linked strategy (#9631) (@github-actions[bot], @manzoorwanijk)
• b2e6338 #9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)
• 390ebfa #9593 arborist: symlink workspace file: deps on non-workspace local packages (#9593) (@github-actions[bot], @manzoorwanijk)
• aaeb2f1 #9578 arborist: expose store node_modules via NODE_PATH for linked-strategy install scripts (#9578) (@github-actions[bot], @manzoorwanijk)
• 05b6f0f #9577 arborist: allow-remote exemption for proxy/mirror-fronted registry tarballs (#9577) (@github-actions[bot], @manzoorwanijk)

config: 10.12.0

10.12.0 (2026-06-29)

Features

• 3021ad6 #9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)
• abd8c6b #9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)
• 073253f #9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)

Bug Fixes

• b2e6338 #9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)

Documentation

• 3658bb5 #9690 recommend install-strategy=linked to catch phantom dependencies (#9690) (@github-actions[bot], @manzoorwanijk)

libnpmdiff: 8.1.11

Dependencies

• workspace: @npmcli/arborist@9.9.0

libnpmexec: 10.3.1

10.3.1 (2026-06-29)

Bug Fixes

• f3f2465 #9692 exec: prevent shared binPaths pollution across workspace runs (#9692) (@github-actions[bot], @arjun-vegeta)
• b2e6338 #9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)

Dependencies

• workspace: @npmcli/arborist@9.9.0

libnpmfund: 7.0.25

Dependencies

• workspace: @npmcli/arborist@9.9.0

libnpmpack: 9.1.11

Dependencies

• workspace: @npmcli/arborist@9.9.0