v22.0.0

22.0.0 (2026-06-15)

⚠️ BREAKING CHANGES

• pacote now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• git specs using the https or git+https protocol now resolve to git+https URLs instead of being switched to git+ssh. Shortcut specs (e.g. github:user/repo, user/repo) and git+ssh/git:// specs are unchanged.

Features

• 09316f5 #504 bump to new node engine range (@owlstronaut)
• 2ab74b0 #497 strip patchedDependencies from the packed package.json (#497) (@manzoorwanijk)
• 66e7ea7 #487 forward globalIgnoreFile option to npm-packlist (@ljharb)

Bug Fixes

• ce804fb #498 avoid ReDoS in addGitSha committish stripping (#498) (@owlstronaut)
• 1f5f131 #494 pass --global=false when preparing git dependencies (@owlstronaut)
• e0af7f6 #486 respect ignoreScripts option for git dependencies (@owlstronaut)
• 12c8c8f #481 fall back to git clone when tarball response is not a valid archive (@babyhuey)
• 61f065a #481 use statusCode instead of constructor name for tarball fallback in git fetcher (@j1mb0-1)
• 6d160c1 #434 do not switch to git+ssh for https repository links (#434) (@oldium)

Dependencies

• 371e8b0 #504 ssri@14.0.0
• b68c6c2 #504 sigstore@5.0.0
• 57793ab #504 proc-log@7.0.0
• 33eacc9 #504 npm-registry-fetch@20.0.1
• a131916 #504 npm-pick-manifest@12.0.0
• 2b03527 #504 npm-packlist@11.2.0
• 5f8ad42 #504 npm-package-arg@14.0.0
• ee3b96d #504 cacache@21.0.1
• 033f655 #504 @npmcli/run-script@11.0.0
• ddcc738 #504 @npmcli/promise-spawn@10.0.0
• 6a28eb2 #504 @npmcli/package-json@8.0.0
• 5879416 #504 @npmcli/installed-package-contents@5.0.0
• 41ea727 #504 @npmcli/git@8.0.0

Chores

• 3fc5fd4 #504 @npmcli/eslint-config@7.0.0 (@owlstronaut)
• 7350ab8 #504 hosted-git-info@10.1.1 (@owlstronaut)
• c7c7d7f #504 template-oss-apply (@owlstronaut)
• e9ac85e #501 template-oss-apply (@owlstronaut)
• e184356 #501 template-oss@5.1.0 (@owlstronaut)
• 644ebb6 #479 template-oss-apply (@owlstronaut)
• ee64bea #479 @npmcli/template-oss@4.30.0 (@owlstronaut)