Release v11.20.0 · npm/cli

11.20.0 (2026-09-21)

0b3c699 #9994 token: support read-write-stage-only granular access tokens (#9994) (@github-actions[bot], @Tayvon, @Copilot)
b872816 #9920 stage: display staged package status (#9920) (@github-actions[bot], @joelverhagen)

ddbadfc #9947 provenance-file takes precedence over OIDC auto-generated provenance (#9947) (@github-actions[bot], @yunseo-kim)
64d4b4b #9937 config: avoid exporting persistent allow-scripts (#9937) (@github-actions[bot], @Fnine59)
70317da #9930 arborist: reject uninstall args that carry a version (#9930) (@github-actions[bot], @lazerg)
55ae484 #9929 arborist: match allowScripts keys for local paths (#9929) (@github-actions[bot], @martinrrm, @Copilot)
7f1f2b7 #9928 keep dry-run output valid json (#9928) (@github-actions[bot], @martinrrm)
f28cca9 #9927 don't print the funding message for global installs (#9927) (@github-actions[bot], @lazerg)

6ff3000 #10010 pack: select workspace through config (#10010) (@github-actions[bot], @reggi)
afdc5bd #9932 pass nodedir to node-gyp via npm_package_config env in node integration (#9932) (@reggi)
83f95ff #9931 update node-integration workflow template to latest actions (#9931) (@reggi)
f020fba #9925 recognize prefixed Node.js PR titles (#9925) (@github-actions[bot], @reggi)