npm: arborist-v10.0.0-pre.1 Release

10.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

• Preserve https protocol when working with git (#8703)
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0 ### Features
• ce7681f #9496 packageExtensions for root-owned dependency manifest repairs (#9496) (@manzoorwanijk)
• 1db885c #9439 native dependency patching (npm patch add/commit/update/ls/rm) (#9439) (@manzoorwanijk)
• be8053c #9544 warn when min-release-age blocks an audit fix (#9544) (@JamieMagee)
• 18eb967 #9559 bump to new node engine range (@owlstronaut)
• c3e1a71 #9532 add min-release-age-exclude config (@JamieMagee, @caseyjhol)
• 5cd5150 #9424 default-deny install scripts (allowScripts opt-in) [v12] (@JamieMagee)
• 64e3f79 #9480 allowScripts tooling and inBundle hardening (#9480) (@JamieMagee)
• 7068d42 #9360 Phase 1 of allowScripts opt-in install-script policy (#9360) (@JamieMagee) ### Bug Fixes
• e96a7de #8703 Preserve https protocol when working with git (#8703) (@oldium)
• afce424 #9551 arborist: expose store node_modules via NODE_PATH for linked-strategy install scripts (#9551) (@manzoorwanijk)
• 8bbd70d #9550 arborist: allow-remote exemption for proxy/mirror-fronted registry tarballs (#9550) (@manzoorwanijk)
• 315e3bd #9574 arborist: drop orphaned patch entry on uninstall instead of EPATCHUNUSED (#9574) (@manzoorwanijk)
• 62b0694 #9576 patch: explain out-of-sync lockfile after --ignore-patch-failures (#9576) (@manzoorwanijk)
• cfda867 #9570 arborist: warn once for workspace packageExtensions selector match (#9570) (@manzoorwanijk)
• f9c977c #9569 arborist: re-apply packageExtensions to the linked actual tree (#9569) (@manzoorwanijk)
• fc3ef5a #9559 adapt to @npmcli/run-script@11 breaking changes (@owlstronaut)
• fc6268a #9523 keep nested file: deps and re-resolve changed git refs (#9523) (@owlstronaut)
• 34dbdf5 #9525 arborist: enforce allowScripts for file:/link: dep scripts (@JamieMagee)
• d70e116 #9510 arborist: honor allow-remote=root for root-direct remote tarballs (#9510) (@manzoorwanijk)
• 4bcba54 #9495 arborist: apply registry-tarball allow-remote exemption in linked strategy (#9495) (@manzoorwanijk)
• 2cbb13b #9490 recognize allowScripts for local link targets (#9490) (@cyphercodes, @cyphercodes)
• bf623e0 #9473 validate registry path for allow-remote tarballs (@Abhinav-143x)
• a105799 #9461 arborist: link meta-only optional peers in linked strategy (@manzoorwanijk)
• 275bc69 #9441 arborist: clean up orphaned scoped store entries in linked strategy (@manzoorwanijk)
• 9f3c97f #9452 sanitize package name in linked-strategy path construction (@owlstronaut)
• a81f2f8 #9428 arborist: read install scripts from disk on lockfile installs instead of a sentinel (@JamieMagee)
• c5292fa #9422 use prerelease strategy without a bug (@owlstronaut)
• dac7ff6 #9399 arborist: drop self-link materialization for undeclared workspaces (#9399) (@manzoorwanijk)
• b77850e #9395 skip hidden lockfile save on dry run (#9395) (@puneetdixit200, @puneetdixit200) ### Dependencies
• cc45055 #9559 @npmcli/node-gyp@6.0.0
• a12e2c8 #9559 @npmcli/name-from-folder@5.0.0
• cc96d57 #9559 @npmcli/installed-package-contents@5.0.0
• b62db95 #9559 bin-links@7.0.0
• 2f5da83 #9559 @npmcli/fs@6.0.0
• 1502286 #9559 ssri@14.0.0
• 21df0ab #9559 proc-log@7.0.0
• 8f85646 #9559 parse-conflict-json@6.0.0
• a44c1cf #9559 pacote@22.0.0
• 1f9c567 #9559 npm-registry-fetch@20.0.1
• 998ff1d #9559 npm-pick-manifest@12.0.0
• d80859a #9559 npm-package-arg@14.0.0
• 5e1d513 #9559 npm-install-checks@9.0.0
• 471309f #9559 nopt@10.0.1
• d867351 #9559 hosted-git-info@10.1.1
• 66d46bc #9559 cacache@21.0.1
• 9d13ebf #9559 @npmcli/run-script@11.0.0
• 27c4dcc #9559 @npmcli/redact@5.0.0
• 0be6ae2 #9559 @npmcli/package-json@8.0.0
• f86a019 #9559 @npmcli/metavuln-calculator@10.0.0
• 4d234b2 #9559 @npmcli/map-workspaces@6.0.0 ### Chores
• 1453954 #9559 nock@14.0.0 (@owlstronaut)
• 0323f2d #9559 template-oss-apply (@owlstronaut)
• ee3d87f #9559 @npmcli/template-oss@5.1.1 (@owlstronaut)
• d25a179 #9559 template-oss-apply (@owlstronaut)