v12.1.0

12.1.0 (2026-09-21)

Features

• 6400533 #9948 token: support read-write-stage-only granular access tokens (#9948) (@Tayvon, @Copilot)
• 8723f53 #9898 stage: display staged package status (#9898) (@joelverhagen)

Bug Fixes

• c9876d7 #9882 provenance-file takes precedence over OIDC auto-generated provenance (#9882) (@yunseo-kim)
• b016aa2 #9913 config: avoid exporting persistent allow-scripts (#9913) (@Fnine59)
• d6c6122 #9914 arborist: match allowScripts keys for local paths (#9914) (@martinrrm, @Copilot)
• a8c9b2f #9823 keep dry-run output valid json (#9823) (@martinrrm)
• da50c34 #9881 arborist: reject uninstall args that carry a version (#9881) (@lazerg)
• 71915e8 #9756 exempt explicit pack targets from allow-directory (#9756) (@ychampion, @ychampion)
• 51c2bf8 #9864 don't print the funding message for global installs (#9864) (@lazerg)

Documentation

• bea9066 #9838 document npm 12 install script blocking (#9838) (@reggi)

Dependencies

• 6e40f73 #9871 undici@6.28.0 (@martinrrm, @Copilot)
• 05bd2a4 #9871 ip-address@10.5.0 (@martinrrm, @Copilot)
• b7c490d #9871 brace-expansion@5.0.9 (@martinrrm, @Copilot)
• 75a943d #9843 tar@7.5.22 (#9843) (@martinrrm, @Copilot)

Chores

• 7b50811 #9961 pack: select workspace through config (#9961) (@reggi)
• 81a901c #9915 recognize prefixed Node.js PR titles (#9915) (@reggi)
• 4cdccea #9836 update node-integration workflow template to latest actions (#9836) (@MikeMcC399)
• 278df04 #9822 pass nodedir to node-gyp via npm_package_config env in node integration (#9822) (@reggi, @Copilot)
• workspace: @npmcli/arborist@10.0.3
• workspace: @npmcli/config@11.1.0
• workspace: libnpmdiff@9.0.3
• workspace: libnpmexec@11.0.3
• workspace: libnpmfund@8.0.3
• workspace: libnpmpack@10.0.3
• workspace: libnpmpublish@12.0.1