deps: upgrade npm to 12.1.0 by npm-cli-bot · Pull Request #66212 · nodejs/node

npm-cli-bot · 2026-09-22T20:27:03Z

This PR contains changes from: npm@12.0.0 npm@12.0.1 npm@12.0.2 npm@12.1.0

12.0.0

12.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

npm view --json now always returns an array.
npm sbom --sbom-format=cyclonedx now reports the name field from each package's package.json instead of the on-disk directory name. The name, bom-ref, and purl of the root component and of aliased dependencies may change.
npm no longer registers man pages with the system when installed globally. man npm-install will no longer work, but npm help install is unaffected.
The npm pkg output is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly to npm view.
npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
The Twitter and Freenode profile fields have been removed from the npm registry. This means that users will no longer be able to set or view these fields in their npm profiles.
npm will no longer attempt to resolve the path to node via whichnode. process.execPath is already set by Node to the resolved real path of the node binary, so the lookup was redundant. Scripts that expected npm to override process.execPath with a PATH-resolved (potentially symlinked) node path may be affected.
the --json output of npm pack and npm publish have changed. They are now always consistent, and in the same format.
the star, stars and unstar commands have been removed
The npm adduser command has been removed. Create and manage user accounts on the npm website, and use npm login to authenticate on the command line.
Preserve https protocol when working with git (#8703)
The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
root `preinstall` now runs before dependencies are installed.
unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning.
Dependency lifecycle scripts are now blocked by default unless allowed by the root package's allowScripts policy. After installing, run npm install-scripts approve to record approvals and npm rebuild to execute newly approved scripts.

Chores

b77b532 #9735 remove pre-release mode from npm 12 and workspaces (#9735) (@reggi, @Copilot)

Dependencies

workspace: @npmcli/arborist@10.0.0
workspace: @npmcli/config@11.0.0
workspace: libnpmaccess@11.0.0
workspace: libnpmdiff@9.0.0
workspace: libnpmexec@11.0.0
workspace: libnpmfund@8.0.0
workspace: libnpmorg@9.0.0
workspace: libnpmpack@10.0.0
workspace: libnpmpublish@12.0.0
workspace: libnpmsearch@10.0.0
workspace: libnpmteam@9.0.0
workspace: libnpmversion@9.0.0

12.0.1

12.0.1 (2026-07-10)

Bug Fixes

ecb02a8 #9745 view: avoid wrapping array results (#9745) (@reggi, @martinrrm, @Copilot)
47fc8b1 #9740 correct bundled sigstore from dev dependency conflict (#9740) (@james-pre)

Dependencies

workspace: @npmcli/arborist@10.0.1
workspace: libnpmdiff@9.0.1
workspace: libnpmexec@11.0.1
workspace: libnpmfund@8.0.1
workspace: libnpmpack@10.0.1

12.0.2

12.0.2 (2026-07-27)

Bug Fixes

834408e #9760 pack: honor min-release-age-exclude (#9760) (@martinrrm, @Copilot)
ef6cfea #9786 owner: use scoped registry for user lookup (#9786) (@martinrrm, @Copilot)

Documentation

9e17dc0 #9805 clarify npm 12 unknown-config breaking change in changelogs (#9805) (@Hashim1999164)

Chores

7b1f6c1 #9747 parse pack --json object output in node integration (#9747) (@reggi, @Copilot)

Dependencies

workspace: @npmcli/arborist@10.0.2
workspace: @npmcli/config@11.0.1
workspace: libnpmdiff@9.0.2
workspace: libnpmexec@11.0.2
workspace: libnpmfund@8.0.2
workspace: libnpmpack@10.0.2

12.1.0

12.1.0 (2026-09-21)

Features

6400533 #9948 token: support read-write-stage-only granular access tokens (#9948) (@Tayvon, @Copilot)
8723f53 #9898 stage: display staged package status (#9898) (@joelverhagen)

Bug Fixes

c9876d7 #9882 provenance-file takes precedence over OIDC auto-generated provenance (#9882) (@yunseo-kim)
b016aa2 #9913 config: avoid exporting persistent allow-scripts (#9913) (@Fnine59)
d6c6122 #9914 arborist: match allowScripts keys for local paths (#9914) (@martinrrm, @Copilot)
a8c9b2f #9823 keep dry-run output valid json (#9823) (@martinrrm)
da50c34 #9881 arborist: reject uninstall args that carry a version (#9881) (@lazerg)
71915e8 #9756 exempt explicit pack targets from allow-directory (#9756) (@ychampion, @ychampion)
51c2bf8 #9864 don't print the funding message for global installs (#9864) (@lazerg)

Documentation

bea9066 #9838 document npm 12 install script blocking (#9838) (@reggi)

Dependencies

6e40f73 #9871 undici@6.28.0 (@martinrrm, @Copilot)
05bd2a4 #9871 ip-address@10.5.0 (@martinrrm, @Copilot)
b7c490d #9871 brace-expansion@5.0.9 (@martinrrm, @Copilot)
75a943d #9843 tar@7.5.22 (#9843) (@martinrrm, @Copilot)

Chores

7b50811 #9961 pack: select workspace through config (#9961) (@reggi)
81a901c #9915 recognize prefixed Node.js PR titles (#9915) (@reggi)
4cdccea #9836 update node-integration workflow template to latest actions (#9836) (@MikeMcC399)
278df04 #9822 pass nodedir to node-gyp via npm_package_config env in node integration (#9822) (@reggi, @Copilot)
workspace: @npmcli/arborist@10.0.3
workspace: @npmcli/config@11.1.0
workspace: libnpmdiff@9.0.3
workspace: libnpmexec@11.0.3
workspace: libnpmfund@8.0.3
workspace: libnpmpack@10.0.3
workspace: libnpmpublish@12.0.1

nodejs-github-bot · 2026-09-22T20:27:10Z

Review requested:

@nodejs/security-wg

reggi · 2026-09-22T20:52:49Z

👋 I initiated this pr and I'm shepherding this along, please ping me for anything npm! I'm excited to get this into Node.js 27 📣

nodejs-github-bot · 2026-09-22T21:31:21Z

CI: https://ci.nodejs.org/job/node-test-pull-request/77767/

MikeMcC399 · 2026-09-23T15:29:22Z

Leaving the dont land labels explicitly, alongside semver-major, since this was the decision in nodejs/Release#1161 (comment)

The Release WG has decided not to land npm 12 on Node.js 26, 24 or 22.

github-actions · 2026-09-23T16:27:12Z

The notable-change PRs with changes that should be highlighted in changelogs. label has been added by @Renegade334.

Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment. Otherwise, the commit will be placed in the Other Notable Changes section.

nodejs-github-bot · 2026-09-24T20:43:42Z

Landed in 4eb3908

Notable changes: async_hooks: * (SEMVER-MAJOR) remove legacy AsyncLocalStorage implementation (Matteo Collina) #63641 benchmark: * (SEMVER-MAJOR) protect against accidental fork bomb (James M Snell) #66132 build: * (SEMVER-MAJOR) remove the bundled FIPS provider build (Filip Skokan) #64777 * (SEMVER-MAJOR) require OpenSSL 3 or later (Filip Skokan) #64777 * (SEMVER-MAJOR) downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 crypto: * (SEMVER-MAJOR) move DEP0093 to End-of-Life (Filip Skokan) #64777 * (SEMVER-MAJOR) remove legacy OpenSSL code paths (Filip Skokan) #64777 * (SEMVER-MAJOR) validate digest output encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate update input encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 * (SEMVER-MAJOR) move DEP0198 to End-of-Life (Filip Skokan) #64000 * (SEMVER-MAJOR) move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 * (SEMVER-MAJOR) reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 * (SEMVER-MAJOR) throw on uninitialized DH computeSecret (Filip Skokan) #63922 * (SEMVER-MAJOR) runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 crypto,https,tls: * (SEMVER-MAJOR) end OpenSSL engine support (Filip Skokan) #64777 deps: * (SEMVER-MAJOR) update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 * (SEMVER-MAJOR) update V8 to 15.6.75.13 (Joyee Cheung) #66601 * (SEMVER-MAJOR) update V8 to 15.5.35.20 (Joyee Cheung) #66537 * (SEMVER-MAJOR) update V8 to 15.2.124.38 (Joyee Cheung) #65161 * (SEMVER-MAJOR) upgrade npm to 12.1.0 (npm team) #66212 dgram: * (SEMVER-MAJOR) skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 dns: * (SEMVER-MAJOR) do not consult hosts file in reverse lookups (Archkon) #64268 * (SEMVER-MAJOR) stop using deprecated functions in `SetServers` (Antoine du Hamel) #64356 doc: * (SEMVER-MAJOR) remove OpenSSL 1.x references (Filip Skokan) #64777 * (SEMVER-MAJOR) update Node.js 27 official binary toolchains (Richard Lau) #66377 domain: * (SEMVER-MAJOR) runtime-deprecate the module (Matteo Collina) #65074 * (SEMVER-MAJOR) port to AsyncLocalStorage (Matteo Collina) #61095 fs: * (SEMVER-MAJOR) implement glob natively (Aviv Keller) #65392 * (SEMVER-MAJOR) return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397 http: * (SEMVER-MAJOR) reject responses exceeding header limit (Matteo Collina) #65010 * (SEMVER-MAJOR) runtime deprecate instantiating without new (Yagiz Nizipli) #64853 * (SEMVER-MAJOR) increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782 * (SEMVER-MAJOR) make req.headers have a null prototype (Matteo Collina) #62900 * (SEMVER-MAJOR) reject addTrailers after finish (Ryuhei Shima) #62832 http2: * (SEMVER-MAJOR) increase default window sizes (Matteo Collina) #64623 lib: * (SEMVER-MAJOR) deprecate _http_* (Sebastian Beltran) #58535 * (SEMVER-MAJOR) insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928 * (SEMVER-MAJOR) use `Object.freeze` to avoid defensive cloning in `SourceMap` (Daijiro Wachi) #62830 * (SEMVER-MAJOR) reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046 lib,src: * (SEMVER-MAJOR) remove `--no-experimental-websocket` CLI flag (Antoine du Hamel) #65284 net: * (SEMVER-MAJOR) race family autoselection attempts (Matteo Collina) #66229 * (SEMVER-MAJOR) throw on multiple listen calls (Matteo Collina) #64871 * (SEMVER-MAJOR) runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794 * (SEMVER-MAJOR) add experimental net/promises API (Ethan Arrowood) #63965 repl: * (SEMVER-MAJOR) use inspector over vm (Aviv Keller) #64034 src: * (SEMVER-MAJOR) officially deprecate `node::ObjectWrap` (Anna Henningsen) #63756 * (SEMVER-MAJOR) merge `CreateEnvironment()` overloads (Anna Henningsen) #63596 src, test: src,lib: * (SEMVER-MAJOR) add --allow-env permission (James M Snell) #66132 stream: * (SEMVER-MAJOR) destroy source when map iterator closes early (Y1D7NG) #64264 test: * (SEMVER-MAJOR) fix fs write encoding coverage (Filip Skokan) #66247 test,benchmark: * (SEMVER-MAJOR) drop OpenSSL 1.x-only coverage (Filip Skokan) #64777 test,tools: * (SEMVER-MAJOR) drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) #64777 test_runner: * use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795 tls: * (SEMVER-MAJOR) move _tls_* to end-of-life (Sebastian Beltran) #60658 zlib: * (SEMVER-MAJOR) convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849 PR-URL: #67062

Notable changes: build: * (SEMVER-MAJOR) remove the bundled FIPS provider build (Filip Skokan) #64777 * (SEMVER-MAJOR) require OpenSSL 3 or later (Filip Skokan) #64777 * (SEMVER-MAJOR) downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 crypto: * (SEMVER-MAJOR) move DEP0093 to End-of-Life (Filip Skokan) #64777 * (SEMVER-MAJOR) remove legacy OpenSSL code paths (Filip Skokan) #64777 * (SEMVER-MAJOR) validate digest output encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate update input encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 * (SEMVER-MAJOR) move DEP0198 to End-of-Life (Filip Skokan) #64000 * (SEMVER-MAJOR) move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 * (SEMVER-MAJOR) reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 * (SEMVER-MAJOR) throw on uninitialized DH computeSecret (Filip Skokan) #63922 * (SEMVER-MAJOR) runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 crypto,https,tls: * (SEMVER-MAJOR) end OpenSSL engine support (Filip Skokan) #64777 deps: * (SEMVER-MAJOR) update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 * (SEMVER-MAJOR) update V8 to 15.6.75.13 (Joyee Cheung) #66601 * (SEMVER-MAJOR) upgrade npm to 12.1.0 (npm team) #66212 dgram: * (SEMVER-MAJOR) skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 dns: * (SEMVER-MAJOR) do not consult hosts file in reverse lookups (Archkon) #64268 * (SEMVER-MAJOR) stop using deprecated functions in `SetServers` (Antoine du Hamel) #64356 doc: * (SEMVER-MAJOR) remove OpenSSL 1.x references (Filip Skokan) #64777 * (SEMVER-MAJOR) update Node.js 27 official binary toolchains (Richard Lau) #66377 domain: * (SEMVER-MAJOR) runtime-deprecate the module (Matteo Collina) #65074 * (SEMVER-MAJOR) port to AsyncLocalStorage (Matteo Collina) #61095 fs: * (SEMVER-MAJOR) implement glob natively (Aviv Keller) #65392 * (SEMVER-MAJOR) return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397 http: * (SEMVER-MAJOR) reject responses exceeding header limit (Matteo Collina) #65010 * (SEMVER-MAJOR) runtime deprecate instantiating without new (Yagiz Nizipli) #64853 * (SEMVER-MAJOR) increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782 * (SEMVER-MAJOR) make req.headers have a null prototype (Matteo Collina) #62900 * (SEMVER-MAJOR) reject addTrailers after finish (Ryuhei Shima) #62832 http2: * (SEMVER-MAJOR) increase default window sizes (Matteo Collina) #64623 lib: * (SEMVER-MAJOR) deprecate _http_* (Sebastian Beltran) #58535 * (SEMVER-MAJOR) insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928 * (SEMVER-MAJOR) use `Object.freeze` to avoid defensive cloning in `SourceMap` (Daijiro Wachi) #62830 * (SEMVER-MAJOR) reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046 lib,src: * (SEMVER-MAJOR) remove `--no-experimental-websocket` CLI flag (Antoine du Hamel) #65284 net: * (SEMVER-MAJOR) race family autoselection attempts (Matteo Collina) #66229 * (SEMVER-MAJOR) throw on multiple listen calls (Matteo Collina) #64871 * (SEMVER-MAJOR) runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794 * (SEMVER-MAJOR) add experimental net/promises API (Ethan Arrowood) #63965 repl: * (SEMVER-MAJOR) use inspector over vm (Aviv Keller) #64034 src: * (SEMVER-MAJOR) officially deprecate `node::ObjectWrap` (Anna Henningsen) #63756 * (SEMVER-MAJOR) merge `CreateEnvironment()` overloads (Anna Henningsen) #63596 src,lib: * (SEMVER-MAJOR) add --allow-env permission (James M Snell) #66132 stream: * (SEMVER-MAJOR) destroy source when map iterator closes early (Y1D7NG) #64264 test_runner: * use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795 tls: * (SEMVER-MAJOR) move _tls_* to end-of-life (Sebastian Beltran) #60658 zlib: * (SEMVER-MAJOR) convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849 PR-URL: #67062

deps: upgrade npm to 12.1.0

fe33158

nodejs-github-bot added needs-ci PRs that need a full CI run. npm Issues and PRs related to the npm client dependency or the npm registry. labels Sep 22, 2026

MikeMcC399 mentioned this pull request Sep 22, 2026

Request for npm 12 (re-)submission to Node.js main branch npm/cli#9997

Closed

MikeMcC399 approved these changes Sep 22, 2026

View reviewed changes

MikeMcC399 added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 22, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 22, 2026

ljharb approved these changes Sep 23, 2026

View reviewed changes

MikeMcC399 mentioned this pull request Sep 23, 2026

[DOCS] Unknown configs throw error in npm@12.0.0 release notes - re-open npm/cli#9812

Open

MikeMcC399 added the author ready PRs with CI started, the required approvals, and no outstanding review comments. label Sep 23, 2026

aduh95 added the commit-queue PRs queued for automated landing through the Commit Queue. label Sep 23, 2026

richardlau approved these changes Sep 23, 2026

View reviewed changes

marco-ippolito approved these changes Sep 23, 2026

View reviewed changes

MikeMcC399 added the semver-major PRs that contain breaking changes and should be released in the next major version. label Sep 23, 2026

cjihrig approved these changes Sep 23, 2026

View reviewed changes

reggi mentioned this pull request Sep 23, 2026

deps: upgrade npm to 11.20.0 #66245

Closed

Renegade334 added the notable-change PRs with changes that should be highlighted in changelogs. label Sep 23, 2026

This comment was marked as resolved.

Sign in to view

lpinca approved these changes Sep 23, 2026

View reviewed changes

reggi mentioned this pull request Sep 24, 2026

[v26.x] deps: upgrade npm to 11.20.0 #66259

Closed

nodejs-github-bot merged commit 4eb3908 into nodejs:main Sep 24, 2026
106 checks passed

nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Sep 24, 2026

RafaelGSS mentioned this pull request Oct 27, 2026

2026-10-28, Version 27.0.0-alpha.0.0.0 (Alpha) #67062

Open

Navigation Menu

Repository navigation

deps: upgrade npm to 12.1.0 - #66212

deps: upgrade npm to 12.1.0#66212
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
npm:npm-v12.1.0-main

npm-cli-bot commented Sep 22, 2026

Uh oh!

nodejs-github-bot commented Sep 22, 2026

Uh oh!

reggi commented Sep 22, 2026

Uh oh!

nodejs-github-bot commented Sep 22, 2026

Uh oh!

MikeMcC399 commented Sep 23, 2026

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

nodejs-github-bot commented Sep 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

Conversation

npm-cli-bot commented Sep 22, 2026

12.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

Chores

Dependencies

12.0.1 (2026-07-10)

Bug Fixes

Dependencies

12.0.2 (2026-07-27)

Bug Fixes

Documentation

Chores

Dependencies

12.1.0 (2026-09-21)

Features

Bug Fixes

Documentation

Dependencies

Chores

Uh oh!

nodejs-github-bot commented Sep 22, 2026

Uh oh!

reggi commented Sep 22, 2026

Uh oh!

nodejs-github-bot commented Sep 22, 2026

Uh oh!

MikeMcC399 commented Sep 23, 2026

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

nodejs-github-bot commented Sep 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants