chore(deps): update dependency npm to v11

[dev-mend-for-github-com]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
npm (source)	dependencies	major	8.19.2 → 11.6.3

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability	Reachability
Critical	9.8	CVE-2023-42282
High	7.5	CVE-2026-26996
High	7.5	CVE-2026-27904
Medium	5.3	CVE-2022-25883

---

Release Notes

npm/cli (npm)

v11.6.3

Compare Source

Bug Fixes

• c6242d9#​8706 change npm profile to create tokens with GAT support (#​8706) (@​owlstronaut, @​wraithgar)
• cbc6fa9#​8731 order of version information in error message (#​8731) (@​piotrd, @​pd-be)
• 11dbd7e#​8709 display full token when creating authentication tokens (#​8709) (@​MaxBlack-dev, Max Black)
• 49a4eef#​8676 use look behind regex for trailing slash stripping (#​8676) (@​wraithgar)
• b1aee62#​8645 dep flag calculation (#​8645) (@​liamcmitchell)

Documentation

• ca53c21#​8745 add workspace usage examples (#​8745) (@​MaxBlack-dev, Max Black)
• e71ca0e#​8746 add --save flag to documentation (#​8746) (@​MaxBlack-dev, Max Black)
• 06510a8#​8683 add ignore-scripts option to npm version help and docs (#​8683) (@​Tejas242)

Dependencies

• 7f72238#​8723cacache@20.0.2
• 7ac9db8#​8723init-package-json@8.2.3
• 41e97c6#​8723validate-npm-package-name@7.0.0
• 6b1fbe1#​8723npm-package-arg@13.0.2
• aa1d486#​8723@npmcli/promise-spawn@9.0.1
• 599c819#​8723which@6.0.0
• e49286e#​8723ini@5.0.0
• b7c9f96#​8723@npmcli/promise-spawn@9.0.0
• 8cc9f70#​8723ssri@13.0.0
• 0b7274f#​8723pacote@21.0.4
• 59b3c6a#​8723@npmcli/redact@4.0.0
• 578abad#​8723node-gyp@12.1.0
• 89c4151#​8723@npmcli/git@7.0.1
• c6d109d#​8723make-fetch-happen@15.0.3
• 34d8599#​8723npm-registry-fetch@19.1.1
• 4811a86#​8723@npmcli/run-script@10.0.3
• 6cb77df#​8723@npmcli/installed-package-contents@4.0.0
• 05ac7a7#​8723proc-log@6.0.0
• 0a74f6d#​8723bin-links@6.0.0
• c02ce5c#​8723@npmcli/package-json@7.0.2
• 9c0cefa#​8723json-parse-even-better-errors@5.0.0
• 041b9b2#​8723parse-conflict-json@5.0.1
• a1b0fea#​8723@npmcli/name-from-folder@4.0.0
• a085745#​8723abbrev@4.0.0
• 00d9c7d#​8723nopt@9.0.0
• 3404dca#​8723npm-install-checks@8.0.0
• 542fcf3#​8723@npmcli/node-gyp@5.0.0
• 89e14d3#​8723tar@7.5.2
• 5383f3a#​8723npm-registry-fetch@19.1.0
• 1bb9a7d#​8723npm-profile@12.0.1
• de619a4#​8723npm-pick-manifest@11.0.3
• 0e042ec#​8723npm-packlist@10.0.3
• 2a3c338#​8723node-gyp@11.5.0
• b96e86c#​8723minimatch@10.1.1
• d347329#​8723exponential-backoff@3.1.3
• d6830f4#​8723@npmcli/run-script@10.0.2
• bcc7ec8#​8723@npmcli/metavuln-calculator@9.0.3
• 7a419df#​8723@npmcli/map-workspaces@5.0.1

Chores

• 32bdd83#​8723 fix package-lock (@​wraithgar)
• 4bff14b#​8670 write tarball to testDir (#​8670) (@​wraithgar)
• 679486b#​8672 fix lockfile (#​8672) (@​wraithgar)
• workspace: @npmcli/arborist@9.1.7
• workspace: @npmcli/config@10.4.3
• workspace: libnpmdiff@8.0.10
• workspace: libnpmexec@10.1.9
• workspace: libnpmfund@7.0.10
• workspace: libnpmpack@9.0.10
• workspace: libnpmpublish@11.1.3
• workspace: libnpmversion@8.0.3

v11.6.2

Compare Source

Bug Fixes

• c54d1e9#​8633 progress bar code cleanup (#​8633) (@​wraithgar)
• d352e27#​8629 do not redact notice logs going to stdout (#​8629) (@​wraithgar)
• 5ac3678#​8617 spelling in ./lib and ./test/lib (#​8617) (@​jsoref)
• 9197995#​8619 spelling (#​8619) (@​jsoref)
• dd884e3#​8618 spelling (#​8618) (@​jsoref)
• f6028e6#​8614 skip redacting urls meant for opening by the user (#​8614) (@​wraithgar, @​jolyndenning)
• 54fd27f#​8602 refactor node.ideallyInert to node.inert (#​8602) (@​liamcmitchell)
• 79e3c1e#​8593 use @​npmcli/package-json to normalize package data (@​wraithgar)

Documentation

• 0469c5e#​8639 rewrap markdown (#​8639) (@​jsoref)
• 9ceb9c1#​8636 rewrap markdown (#​8636) (@​jsoref)
• 6324370#​8616 fix spelling (#​8616) (@​jsoref)
• 1b0429a#​8607 Fix spelling (#​8607) (@​jsoref)
• 7fbe07a#​8603 clean up deprecated npm access commands (#​8603) (@​jsoref)

Dependencies

• fa7cc6f#​8662ci-info@4.3.1 (#​8662)
• b05461b#​8663@sigstore/sign@4.0.1 (#​8663)
• c31de22#​8661 downgrade ci-info to 4.3.0 (#​8661) (@​wraithgar)
• c5191b5#​8659ci-info@4.3.1
• f255c92#​8659hosted-git-info@9.0.2
• bdaf323#​8659is-cidr@6.0.1
• a33f106#​8659lru-cache@11.2.2
• 8044e07#​8659npm-package-arg@13.0.1
• f577504#​8659npm-packlist@10.0.2
• 9aa4fa6#​8659semver@7.7.3
• fe9484a#​8593 remove normalize-package-data

Chores

• b3409f4#​8659 dev dependency updates (@​wraithgar)
• e8de81b#​8643 Add automatically generated annotation to dependencies.md (#​8643) (@​jsoref)
• 67cfaf3#​8627 fix spelling: different (#​8627) (@​jsoref)
• 17ddc0d#​8622 fix spelling (#​8622) (@​jsoref)
• c3e1790#​8605 Remove reference to nonexistent calendar (#​8605) (@​jsoref)
• ac9143e#​8604 Improve link accessibility for screen reader users (#​8604) (@​jsoref)
• 62d73e7#​8601 remove references to benchmarks workflow (#​8601) (@​jsoref)
• bb4b739#​8598 remove stale comment (#​8598) (@​jsoref)
• f73e65d#​8592 fix build url code for remark-github@​12 (#​8592) (@​wraithgar)
• workspace: @npmcli/arborist@9.1.6
• workspace: @npmcli/config@10.4.2
• workspace: libnpmaccess@10.0.3
• workspace: libnpmdiff@8.0.9
• workspace: libnpmexec@10.1.8
• workspace: libnpmfund@7.0.9
• workspace: libnpmpack@9.0.9
• workspace: libnpmpublish@11.1.2

v11.6.1

Compare Source

Bug Fixes

• d389614#​8579 corrects peer dependency flag propagation (@​owlstronaut)
• 5db81c3#​8512 allow concurrent non-local npx calls (#​8512) (@​jenseng, @​wraithgar)

Documentation

• 7a09902#​8582 bring back certfile (#​8582) (@​jenseng)

Dependencies

• 849dcb6#​8589tar@7.5.1 (#​8589)
• ea15731#​8576binary-extensions@3.1.0
• 0f41bac#​8576tiny-relative-date@2.0.2
• 07bf540#​8576is-cidr@6.0.0
• ef87ec6#​8576diff@8.0.2
• 48285e0#​8576 add fdir, isexe, and picomatch to node_modules
• 099238a#​8576fdir@6.5.0
• 6e4d673#​8576isexe@3.1.1
• 09a7494#​8576supports-color@10.2.2
• c5157c9#​8576chalk@5.6.2
• 46035db#​8576debug@4.4.3
• 5f6664b#​8576spdx-license-ids@3.0.22
• 5516583#​8576socks@2.8.7
• 6a392f3#​8576tinyglobby@0.2.15
• 9519f18#​8576npm-install-checks@7.1.2
• 34bafd1#​8576node-gyp@11.4.2
• dfd034e#​8576@npmcli/promise-spawn@8.0.3
• d4eef14#​8576rimraf@6.0.1
• 566f1b7#​8576minimatch@10.0.3
• ac33497#​8576mkdirp@3.0.1
• 1676626#​8576glob@11.0.3
• 817f0b1#​8576ignore-walk@8.0.0
• 79a4e67#​8576minizlib@3.0.2
• 38fa2c2#​8576negotiator@1.0.0
• 24252a1#​8576@npmcli/agent@4.0.0
• ea7ca5f#​8576lru-cache@11.2.1
• 521823b#​8576@npmcli/git@7.0.0
• bf6b686#​8576npm-package-arg@13.0.0
• 9392488#​8576npm-package-manifest@11.0.1
• 0082083#​8576normalize-package-data@8.0.0
• 633c4ed#​8576hosted-git-info@9.0.0
• 66f64eb#​8576make-fetch-happen@15.0.2
• 1f85f94#​8576@sigstore/tuf@4.0.0
• a2bdecc#​8576sigstore@4.0.0
• 1149971#​8576npm-registry-fetch@19.0.0
• b5bd5e3#​8576npm-profile@12.0.0
• 6221e27#​8576@npmcli/metavuln-calculator@9.0.2
• da81a37#​8576cacache@20.0.1
• 6b4c5f9#​8576@npmcli/run-script@10.0.0
• cb36a8a#​8576init-package-json@8.2.2
• b6bb9ae#​8576pacote@21.0.3
• 1b4433f#​8576@npmcli/map-workspaces@5.0.0
• ceae674#​8576@npmcli/package-json@7.0.1
• 4f37534#​8576 remove read-package-json-fast

Chores

• 7eb5c09#​8576 update package-lock with peer flag fixes (@​wraithgar)
• 0d00fd8#​8576jsdom@27.0.0 (@​wraithgar)
• 420a569#​8576unified@11.0.5 (@​wraithgar)
• 064deb3#​8576remark-rehype@11.1.2 (@​wraithgar)
• 30fe3ba#​8576remark-man@9.0.0 (@​wraithgar)
• 1c6bb4c#​8576rehype-stringify@10.0.1 (@​wraithgar)
• 208cb93#​8576remark-gfm@4.0.1 (@​wraithgar)
• 4a46b5a#​8576remark-github@12.0.0 (@​wraithgar)
• 93d190b#​8576remark-parse@11.0.0 (@​wraithgar)
• 05301a4#​8576remark@15.0.1 (@​wraithgar)
• 6afdda9#​8576ajv-formats@3.0.1 (@​wraithgar)
• 402a0ab#​8576@npmcli/template-oss@4.25.1 (@​wraithgar)
• 3b43bf7#​8576 dev dependency updates (@​wraithgar)
• 9f9146f#​8576@tufjs/repo-mock@4.0.0 (@​wraithgar)
• eed8a10#​8576 use latest/local arborist in mock-registry (@​wraithgar)
• workspace: @npmcli/arborist@9.1.5
• workspace: @npmcli/config@10.4.1
• workspace: libnpmaccess@10.0.2
• workspace: libnpmdiff@8.0.8
• workspace: libnpmexec@10.1.7
• workspace: libnpmfund@7.0.8
• workspace: libnpmorg@8.0.1
• workspace: libnpmpack@9.0.8
• workspace: libnpmpublish@11.1.1
• workspace: libnpmsearch@9.0.1
• workspace: libnpmteam@8.0.2
• workspace: libnpmversion@8.0.2

v11.6.0

Compare Source

Features

• bdcc10d#​8359 add support for optional env var replacements in .npmrc (#​8359) (@​aczekajski, @​owlstronaut)

Bug Fixes

• dd4cee9#​8539 powershell: improve argument parsing (#​8539) (@​alexsch01)
• 5f18557#​8532 powershell: fix issue with modified InvocationName (#​8532) (@​alexsch01)
• 9e5abf1#​8529 add redaction to log format egress (#​8529) (@​wraithgar)
• 75ce64a#​8524 revert handle signal exits gracefully (#​8524) (@​owlstronaut)
• 5d82d0b#​8469 ps1 scripts in powershell 5.1 (#​8469) (@​splatteredbits)

Dependencies

• workspace: @npmcli/arborist@9.1.4
• workspace: @npmcli/config@10.4.0
• workspace: libnpmdiff@8.0.7
• workspace: libnpmexec@10.1.6
• workspace: libnpmfund@7.0.7
• workspace: libnpmpack@9.0.7

v11.5.2

Compare Source

Bug Fixes

• 7d900c4#​8467 oidc visibility check for provenance (#​8467) (@​reggi, @​wraithgar)

Documentation

• d4e56b2#​8459 update snapshot generation command (#​8459) (@​MikeMcC399)

v11.5.1

Compare Source

⚠️ BREAKING CHANGES

• Preserve https protocol when working with git (#​8703)
• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• root `preinstall` now runs before dependencies are installed.
• unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning. (Unknown .npmrc configs still warn by default; opt into erroring with the new strict-npmrc config.)

Features

• ce7681f#​9496 packageExtensions for root-owned dependency manifest repairs (#​9496) (@​manzoorwanijk)
• 1db885c#​9439 native dependency patching (npm patch add/commit/update/ls/rm) (#​9439) (@​manzoorwanijk)
• fc80bb3#​9234 remove default license for npm init (@​owlstronaut)
• be8053c#​9544 warn when min-release-age blocks an audit fix (#​9544) (@​JamieMagee)
• 18eb967#​9559 bump to new node engine range (@​owlstronaut)
• c3e1a71#​9532 add min-release-age-exclude config (@​JamieMagee, @​caseyjhol)
• 5cd5150#​9424 default-deny install scripts (allowScripts opt-in) [v12] (@​JamieMagee)
• 64e3f79#​9480 allowScripts tooling and inBundle hardening (#​9480) (@​JamieMagee)
• caa3295#​9466 default allow-git and allow-remote to none (@​owlstronaut)
• f2e4a28#​9351 add a global npmignore file (#​9351) (@​ljharb)
• c9be2d1#​9153 publish --access=private alias for restricted (#​9153) (@​reggi, @​Copilot)
• 7068d42#​9360 Phase 1 of allowScripts opt-in install-script policy (#​9360) (@​JamieMagee)
• 979518d#​9276 error on unknown configs, flags, and abbreviations (#​9276) (@​owlstronaut)

Bug Fixes

• e96a7de#​8703 Preserve https protocol when working with git (#​8703) (@​oldium)
• a847d28#​9575 patch: warn when patch update --to targets an uninstalled version (#​9575) (@​manzoorwanijk)
• 62b0694#​9576 patch: explain out-of-sync lockfile after --ignore-patch-failures (#​9576) (@​manzoorwanijk)
• 5ddf6cc#​9567 patch: keep the update marker on a no-op commit so a retry finalizes (#​9567) (@​manzoorwanijk)
• fc3ef5a#​9559 adapt to @​npmcli/run-script@​11 breaking changes (@​owlstronaut)
• abf78b3#​9540 match dotted and versioned args in approve-scripts/deny-scripts (@​owlstronaut)
• f6270d1#​9531 emit valid JSON from approve-scripts/deny-scripts --json (@​owlstronaut)
• 0e55f97#​9492 pass script-shell to publish lifecycle hooks (@​Zelys-DFKH)
• 2cbb13b#​9490 recognize allowScripts for local link targets (#​9490) (@​cyphercodes, @​cyphercodes)
• bf623e0#​9473 validate registry path for allow-remote tarballs (@​Abhinav-143x)
• 6be874b#​9479 list pending scripts in approve-scripts when ignore-scripts is set (#​9479) (@​JamieMagee)
• 6603b2c#​9469 suggest --allow-scripts for global installs in unreviewed-scripts warnings (#​9469) (@​JamieMagee)
• fe820b6#​9442 invalid issue template YAML indentation (#​9442) (@​fallintoplace)
• fe41ae7#​9404 show full parent command path in subcommand usage errors (#​9404) (@​shaanmajid)
• 75bf7de#​9456 respect allowScripts policy in prune, dedupe, uninstall, audit fix, and link (@​JamieMagee)
• 6efac6e#​9453 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@​JamieMagee)
• b97edc0#​9430 audit: don't apply min-release-age before filter when verifying installed signatures (@​JamieMagee)
• 080e3b2#​9425 block forbidden keys in Queryable setter to prevent prototype pollution (@​12122J, @​claude)
• c5292fa#​9422 use prerelease strategy without a bug (@​owlstronaut)
• 33aebaa#​9410 fix typo of fullMetadata (@​owlstronaut)
• 2a03860#​9267 run root preinstall before reify (@​owlstronaut)
• c0fc549#​9372 config: pause progress spinner during interactive editor spawn (#​9372) (@​Zelys-DFKH, @​claude)

Documentation

• 357e8cd#​9520 approve-scripts only throws EGLOBAL when run with -g (@​JamieMagee)
• bcf01c6#​9505 clarify package.json override value specs (#​9505) (@​ded-furby)
• 455aa4a#​9401 use the latest version for global update and outdated's wanted (#​9401) (@​liangmiQwQ)
• aac80dc#​9470 update minimum npm required for npm trust (@​meeech)
• d124c08#​9385 Document npm_old_version and npm_new_version environment variables (#​9385) (@​36degrees)

Dependencies

• 9cbba72#​9579npm-profile@13.0.1
• d4e0a70#​9559@tufjs/repo-mock@5.0.0
• 3ef66bb#​9559 bundle arborist runtime deps for bootstrap
• 5dce6fb#​9559npm-packlist@11.2.0
• ad05528#​9559@npmcli/git@8.0.0
• cc45055#​9559@npmcli/node-gyp@6.0.0
• a12e2c8#​9559@npmcli/name-from-folder@5.0.0
• cc96d57#​9559@npmcli/installed-package-contents@5.0.0
• 3dc18e5#​9559@npmcli/git@8.0.0
• 428afa6#​9559sigstore@5.0.0
• [95ed19c](https://redirect.github.com/npm/cli/commit/95ed19cd940f6cfef17279be2399f

✂ Note

PR body was truncated to here.