npm: v11.17.0 Release

11.17.0 (2026-06-11)

Features

• ae8ac4e #9534 add min-release-age-exclude config (@JamieMagee, @caseyjhol)
• 8ff3e48 #9483 allowScripts tooling and inBundle hardening (#9483) (@github-actions[bot], @JamieMagee) ### Bug Fixes
• 847cdf8 #9541 match dotted and versioned args in approve-scripts/deny-scripts (@owlstronaut)
• d99f7cb #9535 emit valid JSON from approve-scripts/deny-scripts --json (@owlstronaut)
• 351a309 #9499 pass script-shell to publish lifecycle hooks (#9499) (@github-actions[bot])
• 4fa81df #9497 recognize allowScripts for local link targets (#9497) (@github-actions[bot], @cyphercodes, @cyphercodes)
• 95cf2e9 #9489 validate registry path for allow-remote tarballs (@Abhinav-143x)
• 9dd219b #9462 respect allowScripts policy in prune, dedupe, uninstall, audit, and link (#9462) (@github-actions[bot], @JamieMagee)
• cd8d18a #9482 list pending scripts in approve-scripts when ignore-scripts is set (#9482) (@github-actions[bot], @JamieMagee)
• c14e87c #9481 suggest --allow-scripts for global installs in unreviewed-scripts warnings (#9481) (@github-actions[bot], @JamieMagee)
• 7ade52e #9465 invalid issue template YAML indentation (#9465) (@github-actions[bot], @fallintoplace)
• c069622 #9464 show full parent command path in subcommand usage errors (#9464) (@owlstronaut)
• 1bb62bb #9454 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@JamieMagee)
• 84eeb5f #9431 audit: don't apply min-release-age before filter when verifying installed signatures (@JamieMagee)
• 3bd3377 #9426 block forbidden keys in Queryable setter to prevent prototype pollution (@12122J, @claude) ### Documentation
• a86a7a9 #9522 approve-scripts only throws EGLOBAL when run with -g (@JamieMagee)
• 693bb3d #9508 clarify package.json override value specs (#9508) (@github-actions[bot], @ded-furby)
• ccffe4a #9501 use the latest version for global update and outdated's wanted (#9501) (@github-actions[bot], @liangmiQwQ)
• 66e97c2 #9478 update minimum npm required for npm trust (@meeech) ### Dependencies
• bd09b87 #9542 postcss-selector-parser@7.1.4
• 95bfc4c #9542 tinyglobby@0.2.17
• 8c0d5fd #9542 tar@7.5.16
• 967d377 #9542 semver@7.8.4
• cdaac1b #9542 pacote@21.5.1
• 25c8a9e #9542 node-gyp@12.4.0 ### Chores
• 2922fa4 #9542 dev dependency updates (@owlstronaut)
• workspace: @npmcli/arborist@9.8.0
• workspace: @npmcli/config@10.11.0
• workspace: libnpmdiff@8.1.10
• workspace: libnpmexec@10.3.0
• workspace: libnpmfund@7.0.24
• workspace: libnpmpack@9.1.10