npm: arborist-v9.9.0 Release

9.9.0 (2026-06-29)

Features

• 3021ad6 #9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)
• abd8c6b #9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)
• 9420673 #9662 install-scripts: prune unused allowScripts entries (#9662) (@github-actions[bot], @JamieMagee)
• 073253f #9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee) ### Bug Fixes
• 774875b #9686 arborist: keep bin links for allowScripts-denied packages (#9686) (@JamieMagee)
• 719de1e #9673 arborist: apply overrides across a file: link (backport release/v11) (#9673) (@manzoorwanijk)
• cd57139 #9669 arborist: surface undeclared workspaces under the linked strategy (backport release/v11) (#9669) (@manzoorwanijk)
• ede32d3 #9668 arborist: forward transitive overrides through linked store links (#9658) (backport release/v11) (#9668) (@manzoorwanijk)
• f503b07 #9666 correct dev/prod dep flags for workspaces under the linked strategy (#9666) (@github-actions[bot], @manzoorwanijk)
• f580889 #9665 arborist: load transitive optional deps into linked actual tree (#9665) (@github-actions[bot], @manzoorwanijk)
• 8f13beb #9664 query: report logical dep location under linked strategy (#9664) (@github-actions[bot], @manzoorwanijk)
• 168ba30 #9663 allowScripts: close enforcement gaps (#9652) (backport release/v11) (#9663) (@JamieMagee)
• 4c9eacb #9649 arborist: clean up stale .store and hoisted dirs on strategy switch (#9649) (@github-actions[bot], @manzoorwanijk)
• d2c680e #9645 arborist: invalid filterNode crash under the linked strategy (#9645) (@github-actions[bot], @manzoorwanijk)
• 4e40b1c #9644 arborist: repair wrong-but-existing symlink target in linked strategy (#9644) (@github-actions[bot], @manzoorwanijk)
• 9d1774e #9643 arborist: remove stale .bin shims after uninstall under linked (#9643) (@github-actions[bot], @manzoorwanijk)
• ed37d24 #9642 arborist: record the linked .store layout in the hidden lockfile (backport #9630) (#9642) (@manzoorwanijk)
• e601d4a #9641 arborist: validate peerOptional conflicts in no-save mutations (#9641) (@owlstronaut, @dale-lakes, @dale-lakes)
• 03cee43 #9638 arborist: fix audit-report determinism due to dropped via links (#9638) (@github-actions[bot], @arjun-vegeta)
• a30d855 #9633 arborist: don't load store packages' devDependencies as required edges (#9633) (@manzoorwanijk)
• 887ca97 #9631 arborist: audit the non-isolated tree under the linked strategy (#9631) (@github-actions[bot], @manzoorwanijk)
• b2e6338 #9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)
• 390ebfa #9593 arborist: symlink workspace file: deps on non-workspace local packages (#9593) (@github-actions[bot], @manzoorwanijk)
• aaeb2f1 #9578 arborist: expose store node_modules via NODE_PATH for linked-strategy install scripts (#9578) (@github-actions[bot], @manzoorwanijk)
• 05b6f0f #9577 arborist: allow-remote exemption for proxy/mirror-fronted registry tarballs (#9577) (@github-actions[bot], @manzoorwanijk)