Home » Oreps » npm » All Releases » arborist-v9.8.0 Release
npm/cli
the package manager for JavaScript
Watch
2
Commit Activity
Directory Browser
Velocity History
Releasesarborist-v9.8.0
Basic Details Issues Addressed Top Contributors Directory Browser Release Notes
npm arborist-v9.8.0

npm: arborist-v9.8.0 Release

Release date:
June 11, 2026
Previous version:
arborist-v9.7.0 (released May 27, 2026)
Magnitude:
1,623 Diff Delta
Contributors:
5 total committers
Data confidence:
Commits:
29 impacting commits

29 Features Released with arborist-v9.8.0

feat: allowScripts tooling and inBundle hardening
#9483
feat: add min-release-age-exclude config
#9534
feat: differentiate GitHub Actions environments in user-agent
#9517
fix: match dotted and versioned args in approve-scripts/deny-scripts
#9540
fix: recognize allowScripts for local link targets
#9497
fix: suggest --allow-scripts for global installs in unreviewed-scripts warnings
#9481
fix(arborist): clean up orphaned scoped store entries in linked strategy
#9484
fix: emit valid JSON from approve-scripts/deny-scripts --json
#9535
fix(arborist): show real install script names on lockfile installs
#9428
fix: keep nested file: deps and re-resolve changed git refs
#9530
fix: show full parent command path in subcommand usage errors
#9464
fix(arborist): link meta-only optional peers in linked strategy
#9485
fix: don't apply min-release-age in `npm audit signatures`
#9430
fix: list pending scripts in approve-scripts when ignore-scripts is set
#9482
fix(arborist): apply registry-tarball allow-remote exemption in linked strategy
#9500
fix: respect allowScripts policy in prune, dedupe, uninstall, audit, and link
#9462
docs: approve-scripts only throws EGLOBAL when run with -g
#9522
fix: pass script-shell to publish lifecycle hooks
#9499
docs: clarify package.json override value specs
#9508
docs: use the latest version for global update and outdated's `wanted`
#9501
fix: reject reserved object keys in queryable setter
#9425
fix: flatten path separators in pack output filename
#9468
fix: escape executable name in libnpmexec run-script
#9467
fix: invalid issue template YAML indentation
#9465
fix: sanitize package name in linked-strategy path construction
#9455
docs: update minimum npm required for npm trust
#9478
fix: validate registry path for allow-remote tarball exception
#9489
fix(arborist): honor allow-remote=root for root-direct remote tarballs
#9511
deps updates jun11
#9542

Browse Other Releases

Latest Pending Unreleased 😎
config-v6.1.1 Released January 12, 2023
11,116 Ξ”
config-v6.1.0 Released November 2, 2022
0 Ξ”
arborist-v10.0.0-pre.0.0 Released May 20, 2026
0 Ξ”
arborist-v10.0.0-pre.0 Released May 20, 2026
1,427 Ξ”
arborist-v9.8.0 Released June 11, 2026
1,623 Ξ”
arborist-v9.7.0 Released May 27, 2026
32 Ξ”
arborist-v9.6.0 Released May 20, 2026
752 Ξ”
arborist-v9.5.0 Released May 6, 2026
443 Ξ”
arborist-v9.4.3 Released April 22, 2026
165 Ξ”
arborist-v9.4.2 Released March 18, 2026
220 Ξ”

Top Contributors in arborist-v9.8.0

github-actions[bot]
JamieMagee
owlstronaut
manzoorwanijk
reggi

Directory Browser for arborist-v9.8.0

We haven't yet finished calculating and confirming the files and directories changed in this release. Please check back soon.

Release Notes Published

9.8.0 (2026-06-11)

Features

  • ae8ac4e #9534 add min-release-age-exclude config (@JamieMagee, @caseyjhol)
  • 8ff3e48 #9483 allowScripts tooling and inBundle hardening (#9483) (@github-actions[bot], @JamieMagee) ### Bug Fixes
  • fc5573a #9530 keep nested file: deps and re-resolve changed git refs (#9530) (@github-actions[bot], @owlstronaut)
  • b13ee4d #9511 arborist: honor allow-remote=root for root-direct remote tarballs (#9511) (@github-actions[bot], @manzoorwanijk)
  • 66408d7 #9500 arborist: apply registry-tarball allow-remote exemption in linked strategy (#9500) (@github-actions[bot], @manzoorwanijk)
  • 4fa81df #9497 recognize allowScripts for local link targets (#9497) (@github-actions[bot], @cyphercodes, @cyphercodes)
  • 95cf2e9 #9489 validate registry path for allow-remote tarballs (@Abhinav-143x)
  • 869cb9a #9485 arborist: link meta-only optional peers in linked strategy (@manzoorwanijk)
  • d41a9e3 #9484 arborist: clean up orphaned scoped store entries in linked strategy (@manzoorwanijk)
  • 39d034d #9455 sanitize package name in linked-strategy path construction (@owlstronaut)
  • d59c964 #9451 reject path traversal entries when inflating dependency shrinkwraps (@owlstronaut)
  • c9045d5 #9429 arborist: read install scripts from disk on lockfile installs instead of a sentinel (@JamieMagee)