npm: v12.0.0-pre.2 Release

12.0.0-pre.2 (2026-06-29)

Features

• b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@u2mejc)
• 86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@manzoorwanijk)
• c4e5356 #9651 install-scripts: prune unused allowScripts entries (#9651) (@JamieMagee)
• 0c4dd41 #9629 namespace install-script approval commands under npm install-scripts (#9629) (@manzoorwanijk)
• 58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@manzoorwanijk) ### Bug Fixes
• 024e6d9 #9670 sbom: percent-encode vcs_url qualifier in generated purls (#9670) (@ubeddulla)
• 6da6555 #9588 output all the required parameters for npm token list (#9588) (@rijildaniel)
• ae6dbeb #9657 arborist: surface undeclared workspaces under the linked strategy (#9657) (@manzoorwanijk)
• 0c33947 #9661 reify: report added count for fresh linked installs (#9661) (@manzoorwanijk)
• 803ba70 #9656 query: report logical dep location under linked strategy (#9656) (@manzoorwanijk)
• 60d0d3d #9652 allowScripts: close three enforcement gaps (#9652) (@JamieMagee)
• d6fbb55 #9639 exec: resolve workspace-local bin under the linked install strategy (#9639) (@manzoorwanijk)
• 7e29a19 #9646 ls: restore 100% coverage on latest after #9626 (#9646) (@manzoorwanijk)
• 971500f #9606 approve-scripts: approve deps with no resolved URL by name (#9606) (@JamieMagee)
• 7655822 #9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@JamieMagee)
• 1a9ce8e #9592 link: scope npm link --workspace to the workspace, not the root (#9592) (@manzoorwanijk) ### Documentation
• fdcfcee #9678 recommend install-strategy=linked to catch phantom dependencies (#9678) (@manzoorwanijk) ### Dependencies
• f055ce6 #9695 undici@6.27.0
• 2d74bfb #9695 tinyglobby@0.2.17
• c1edadd #9695 postcss-selector-parser@7.1.4
• 2b7c6a4 #9695 cmd-shim@9.0.2
• c1d0a10 #9695 brace-expansion@5.0.7
• 8e6ba7a #9695 @sigstore/verify@4.1.0
• 09ce72f #9695 @sigstore/core@4.0.1
• a18679a #9695 @npmcli/agent@5.0.2
• 52349de #9695 tar@7.5.19
• 0f77bb1 #9695 semver@7.8.5
• ce11dcf #9596 npm-packlist@11.3.0 ### Chores
• bbd640d #9695 dev dependency updates (@owlstronaut)
• workspace: @npmcli/arborist@10.0.0-pre.2
• workspace: @npmcli/config@11.0.0-pre.2
• workspace: libnpmdiff@9.0.0-pre.1
• workspace: libnpmexec@11.0.0-pre.1
• workspace: libnpmfund@8.0.0-pre.1
• workspace: libnpmpack@10.0.0-pre.2

arborist: 10.0.0-pre.2

10.0.0-pre.2 (2026-06-29)

Features

• b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@u2mejc)
• 86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@manzoorwanijk)
• c4e5356 #9651 install-scripts: prune unused allowScripts entries (#9651) (@JamieMagee)
• 58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@manzoorwanijk) ### Bug Fixes
• 968e42f #9671 arborist: apply overrides across a file:/workspace link boundary (#9671) (@manzoorwanijk)
• ae6dbeb #9657 arborist: surface undeclared workspaces under the linked strategy (#9657) (@manzoorwanijk)
• 541c286 #9658 arborist: forward transitive overrides through linked store links (#9658) (@manzoorwanijk)
• f9e3a80 #9655 arborist: correct dev/prod dep flags for workspaces under the linked strategy (#9655) (@manzoorwanijk)
• 6a5bf26 #9654 arborist: load transitive optional deps into linked actual tree (#9654) (@manzoorwanijk)
• 803ba70 #9656 query: report logical dep location under linked strategy (#9656) (@manzoorwanijk)
• 60d0d3d #9652 allowScripts: close three enforcement gaps (#9652) (@JamieMagee)
• ca92323 #9647 arborist: clean up stale .store and hoisted dirs on strategy switch (#9647) (@manzoorwanijk)
• 2b976b5 #9637 arborist: invalid filterNode crash under the linked strategy (#9637) (@manzoorwanijk)
• 0ffce98 #9628 arborist: repair wrong-but-existing symlink target in linked strategy (#9628) (@manzoorwanijk)
• 981e249 #9632 arborist: remove stale .bin shims after uninstall under linked (#9632) (@manzoorwanijk)
• 6968015 #9630 arborist: record the linked .store layout in the hidden lockfile (#9630) (@manzoorwanijk)
• 2aa1c7c #9605 arborist: validate peerOptional conflicts in no-save mutations (#9605) (@dale-lakes, @dale-lakes)
• 690bf17 #9603 arborist: fix audit-report determinism due to dropped via links (#9603) (@arjun-vegeta)
• 851558c #9626 arborist: don't load store packages' devDependencies as required edges (#9626) (@manzoorwanijk)
• 989f571 #9625 arborist: audit the non-isolated tree under the linked strategy (#9625) (@manzoorwanijk)
• 7655822 #9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@JamieMagee)
• 00b9f9f #9591 arborist: symlink workspace file: deps on non-workspace local packages (#9591) (@manzoorwanijk)

config: 11.0.0-pre.2

11.0.0-pre.2 (2026-06-29)

Features

• b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@u2mejc)
• 86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@manzoorwanijk)
• 58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@manzoorwanijk) ### Bug Fixes
• 7655822 #9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@JamieMagee) ### Documentation
• fdcfcee #9678 recommend install-strategy=linked to catch phantom dependencies (#9678) (@manzoorwanijk)

libnpmdiff: 9.0.0-pre.1

Dependencies

• workspace: @npmcli/arborist@10.0.0-pre.2

libnpmexec: 11.0.0-pre.1

11.0.0-pre.1 (2026-06-29)

Bug Fixes

• 18b930f #9650 exec: prevent shared binPaths pollution across workspace runs (#9650) (@arjun-vegeta)
• 7655822 #9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@JamieMagee)

Dependencies

• workspace: @npmcli/arborist@10.0.0-pre.2

libnpmfund: 8.0.0-pre.1

Dependencies

• workspace: @npmcli/arborist@10.0.0-pre.2

libnpmpack: 10.0.0-pre.2

Dependencies

• workspace: @npmcli/arborist@10.0.0-pre.2