b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@u2mejc)
86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@manzoorwanijk)
c4e5356 #9651 install-scripts: prune unused allowScripts entries (#9651) (@JamieMagee)
0c4dd41 #9629 namespace install-script approval commands under npm install-scripts (#9629) (@manzoorwanijk)
58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@manzoorwanijk) ### Bug Fixes
024e6d9 #9670 sbom: percent-encode vcs_url qualifier in generated purls (#9670) (@ubeddulla)
6da6555 #9588 output all the required parameters for npm token list (#9588) (@rijildaniel)
ae6dbeb #9657 arborist: surface undeclared workspaces under the linked strategy (#9657) (@manzoorwanijk)
0c33947 #9661 reify: report added count for fresh linked installs (#9661) (@manzoorwanijk)
803ba70 #9656 query: report logical dep location under linked strategy (#9656) (@manzoorwanijk)
60d0d3d #9652 allowScripts: close three enforcement gaps (#9652) (@JamieMagee)
d6fbb55 #9639 exec: resolve workspace-local bin under the linked install strategy (#9639) (@manzoorwanijk)
7e29a19 #9646 ls: restore 100% coverage on latest after #9626 (#9646) (@manzoorwanijk)
971500f #9606 approve-scripts: approve deps with no resolved URL by name (#9606) (@JamieMagee)
7655822 #9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@JamieMagee)
1a9ce8e #9592 link: scope npm link --workspace to the workspace, not the root (#9592) (@manzoorwanijk) ### Documentation
fdcfcee #9678 recommend install-strategy=linked to catch phantom dependencies (#9678) (@manzoorwanijk) ### Dependencies
f055ce6 #9695 [email protected]
2d74bfb #9695 [email protected]
c1edadd #9695 [email protected]
2b7c6a4 #9695 [email protected]
c1d0a10 #9695 [email protected]
8e6ba7a #9695 @sigstore/[email protected]
09ce72f #9695 @sigstore/[email protected]
a18679a #9695 @npmcli/[email protected]
52349de #9695 [email protected]
0f77bb1 #9695 [email protected]
ce11dcf #9596 [email protected] ### Chores
bbd640d #9695 dev dependency updates (@owlstronaut)
workspace: @npmcli/[email protected]
workspace: @npmcli/[email protected]
workspace: [email protected]
workspace: [email protected]
workspace: [email protected]
workspace: [email protected]

arborist: 10.0.0-pre.2

10.0.0-pre.2 (2026-06-29)

Features

b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@u2mejc)
86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@manzoorwanijk)
c4e5356 #9651 install-scripts: prune unused allowScripts entries (#9651) (@JamieMagee)
58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@manzoorwanijk) ### Bug Fixes
968e42f #9671 arborist: apply overrides across a file:/workspace link boundary (#9671) (@manzoorwanijk)
ae6dbeb #9657 arborist: surface undeclared workspaces under the linked strategy (#9657) (@manzoorwanijk)
541c286 #9658 arborist: forward transitive overrides through linked store links (#9658) (@manzoorwanijk)
f9e3a80 #9655 arborist: correct dev/prod dep flags for workspaces under the linked strategy (#9655) (@manzoorwanijk)
6a5bf26 #9654 arborist: load transitive optional deps into linked actual tree (#9654) (@manzoorwanijk)
803ba70 #9656 query: report logical dep location under linked strategy (#9656) (@manzoorwanijk)
60d0d3d #9652 allowScripts: close three enforcement gaps (#9652) (@JamieMagee)
ca92323 #9647 arborist: clean up stale .store and hoisted dirs on strategy switch (#9647) (@manzoorwanijk)
2b976b5 #9637 arborist: invalid filterNode crash under the linked strategy (#9637) (@manzoorwanijk)
0ffce98 #9628 arborist: repair wrong-but-existing symlink target in linked strategy (#9628) (@manzoorwanijk)
981e249 #9632 arborist: remove stale .bin shims after uninstall under linked (#9632) (@manzoorwanijk)
6968015 #9630 arborist: record the linked .store layout in the hidden lockfile (#9630) (@manzoorwanijk)
2aa1c7c #9605 arborist: validate peerOptional conflicts in no-save mutations (#9605) (@dale-lakes, @dale-lakes)
690bf17 #9603 arborist: fix audit-report determinism due to dropped via links (#9603) (@arjun-vegeta)
851558c #9626 arborist: don't load store packages' devDependencies as required edges (#9626) (@manzoorwanijk)
989f571 #9625 arborist: audit the non-isolated tree under the linked strategy (#9625) (@manzoorwanijk)
7655822 #9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@JamieMagee)
00b9f9f #9591 arborist: symlink workspace file: deps on non-workspace local packages (#9591) (@manzoorwanijk)

config: 11.0.0-pre.2

11.0.0-pre.2 (2026-06-29)

Features

b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@u2mejc)
86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@manzoorwanijk)
58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@manzoorwanijk) ### Bug Fixes
7655822 #9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@JamieMagee) ### Documentation
fdcfcee #9678 recommend install-strategy=linked to catch phantom dependencies (#9678) (@manzoorwanijk)

libnpmdiff: 9.0.0-pre.1

Dependencies

workspace: @npmcli/[email protected]

libnpmexec: 11.0.0-pre.1

11.0.0-pre.1 (2026-06-29)

Bug Fixes

18b930f #9650 exec: prevent shared binPaths pollution across workspace runs (#9650) (@arjun-vegeta)
7655822 #9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@JamieMagee)

Dependencies

workspace: @npmcli/[email protected]

libnpmfund: 8.0.0-pre.1

Dependencies

workspace: @npmcli/[email protected]

libnpmpack: 10.0.0-pre.2

Dependencies

workspace: @npmcli/[email protected]