fix(arborist): match allowScripts keys for local paths - #9929
Merged
Merged
Conversation
## Summary
Fixes `allowScripts` matching for local file and tarball dependencies,
particularly on Windows.
Arborist stores a resolved Windows file source in this form:
```text
file:C:\project\vendor\pkg.tgz
```
However, `npm-package-arg` parses an equivalent policy key into:
`saveSpec: file:C:/project/vendor/pkg.tgz`
`fetchSpec: C:\project\vendor\pkg.tgz`
The existing matcher compared `node.resolved` only with `saveSpec` and
`fetchSpec`. Neither comparison could match because one uses different
separators and the other lacks the `file:` prefix.
## Changes
• Match local file and directory sources against
`file:${parsed.fetchSpec}`, which is the same representation produced by
Arborist's `consistentResolve()`.
• Resolve relative `allowScripts` file keys from the Arborist project
root rather than the process working directory.
• Reuse the Arborist file/directory matcher in `allow-scripts-writer`,
keeping runtime enforcement and policy updates consistent.
• Preserve the existing exact matching behavior for remote URLs.
• Preserve deny-wins behavior when an existing local-file policy entry
is `false`.
The implementation intentionally does not globally normalize path
separators. On POSIX systems, a backslash can be a literal filename
character, so replacing every `\` with `/` could cause two different
sources to share an approval.
The change also does not modify dependency resolution, lockfile
generation, fetching, linking, or `consistentResolve()`.
## Security considerations
Local file and tarball dependencies continue to require an exact source
identity.
This change does not:
• Match local packages by their self-reported name or version.
• Case-fold paths.
• Match by basename.
• Resolve paths through `realpath()`.
• Treat remote URLs as local file sources.
• Change registry or Git identity matching.
This preserves the manifest-confusion protections in `allowScripts`
while recognizing the exact Windows representation npm already
generates.
## Testing
Added regression coverage for:
• Backslash and forward-slash absolute Windows keys matching the same
local tarball.
• Relative keys resolving from the project root.
• `versionedKeyFor()` producing a key accepted by `isScriptAllowed()`.
• Different local paths remaining unmatched.
• Existing `false` file entries continuing to block approval.
• Windows UNC paths matching through the same `file:${fetchSpec}`
representation.
• POSIX filenames containing literal backslashes remaining distinct.
• Remote URL policies not matching `file: sources`.
• `npm install-scripts prune` retaining valid local-file entries.
The focused Arborist matcher, policy-writer, and prune tests pass
locally. Native Windows path and UNC behavior is covered by
platform-specific tests and will run in the repository's Windows CI
matrix.
Fixes #9900
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
(cherry picked from commit d6c6122)
reggi
approved these changes
Aug 28, 2026
Merged
This was referenced Sep 23, 2026
This was referenced Sep 26, 2026
renovate Bot
added a commit
to gwennlbh/swarpc
that referenced
this pull request
Sep 29, 2026
##### [v11.20.0](https://github.com/npm/cli/releases/tag/v11.20.0) ##### Features - [`0b3c699`](npm/cli@0b3c699) [#9994](npm/cli#9994) token: support read-write-stage-only granular access tokens ([#9994](npm/cli#9994)) ([@github-actions](https://github.com/github-actions)\[bot], [@Tayvon](https://github.com/Tayvon), [@Copilot](https://github.com/Copilot)) - [`b872816`](npm/cli@b872816) [#9920](npm/cli#9920) stage: display staged package status ([#9920](npm/cli#9920)) ([@github-actions](https://github.com/github-actions)\[bot], [@joelverhagen](https://github.com/joelverhagen)) ##### Bug Fixes - [`ddbadfc`](npm/cli@ddbadfc) [#9947](npm/cli#9947) provenance-file takes precedence over OIDC auto-generated provenance ([#9947](npm/cli#9947)) ([@github-actions](https://github.com/github-actions)\[bot], [@yunseo-kim](https://github.com/yunseo-kim)) - [`64d4b4b`](npm/cli@64d4b4b) [#9937](npm/cli#9937) config: avoid exporting persistent allow-scripts ([#9937](npm/cli#9937)) ([@github-actions](https://github.com/github-actions)\[bot], [@Fnine59](https://github.com/Fnine59)) - [`70317da`](npm/cli@70317da) [#9930](npm/cli#9930) arborist: reject uninstall args that carry a version ([#9930](npm/cli#9930)) ([@github-actions](https://github.com/github-actions)\[bot], [@lazerg](https://github.com/lazerg)) - [`55ae484`](npm/cli@55ae484) [#9929](npm/cli#9929) arborist: match allowScripts keys for local paths ([#9929](npm/cli#9929)) ([@github-actions](https://github.com/github-actions)\[bot], [@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot)) - [`7f1f2b7`](npm/cli@7f1f2b7) [#9928](npm/cli#9928) keep dry-run output valid json ([#9928](npm/cli#9928)) ([@github-actions](https://github.com/github-actions)\[bot], [@martinrrm](https://github.com/martinrrm)) - [`f28cca9`](npm/cli@f28cca9) [#9927](npm/cli#9927) don't print the funding message for global installs ([#9927](npm/cli#9927)) ([@github-actions](https://github.com/github-actions)\[bot], [@lazerg](https://github.com/lazerg)) ##### Chores - [`6ff3000`](npm/cli@6ff3000) [#10010](npm/cli#10010) pack: select workspace through config ([#10010](npm/cli#10010)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi)) - [`afdc5bd`](npm/cli@afdc5bd) [#9932](npm/cli#9932) pass nodedir to node-gyp via npm\_package\_config env in node integration ([#9932](npm/cli#9932)) ([@reggi](https://github.com/reggi)) - [`83f95ff`](npm/cli@83f95ff) [#9931](npm/cli#9931) update `node-integration` workflow template to latest actions ([#9931](npm/cli#9931)) ([@reggi](https://github.com/reggi)) - [`f020fba`](npm/cli@f020fba) [#9925](npm/cli#9925) recognize prefixed Node.js PR titles ([#9925](npm/cli#9925)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi)) ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.2): `@npmcli/arborist@9.9.2` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.13.0): `@npmcli/config@10.13.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.13): `libnpmdiff@8.1.13` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.3): `libnpmexec@10.3.3` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.27): `libnpmfund@7.0.27` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.14): `libnpmpack@9.1.14` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v11.2.1): `libnpmpublish@11.2.1` ##### [v11.19.1](npm/cli@v11.19.0...d63a975) ##### [v11.19.0](npm/cli@v11.18.0...6a8a1b9) ##### [v11.18.0](npm/cli@v11.17.0...fef2b13) ##### [v11.17.0](https://github.com/npm/cli/releases/tag/v11.17.0) ##### Features - [`ae8ac4e`](npm/cli@ae8ac4e) [#9534](npm/cli#9534) add min-release-age-exclude config ([@JamieMagee](https://github.com/JamieMagee), [@caseyjhol](https://github.com/caseyjhol)) - [`8ff3e48`](npm/cli@8ff3e48) [#9483](npm/cli#9483) allowScripts tooling and inBundle hardening ([#9483](npm/cli#9483)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) ##### Bug Fixes - [`847cdf8`](npm/cli@847cdf8) [#9541](npm/cli#9541) match dotted and versioned args in approve-scripts/deny-scripts ([@owlstronaut](https://github.com/owlstronaut)) - [`d99f7cb`](npm/cli@d99f7cb) [#9535](npm/cli#9535) emit valid JSON from approve-scripts/deny-scripts --json ([@owlstronaut](https://github.com/owlstronaut)) - [`351a309`](npm/cli@351a309) [#9499](npm/cli#9499) pass script-shell to publish lifecycle hooks ([#9499](npm/cli#9499)) ([@github-actions](https://github.com/github-actions)\[bot]) - [`4fa81df`](npm/cli@4fa81df) [#9497](npm/cli#9497) recognize allowScripts for local link targets ([#9497](npm/cli#9497)) ([@github-actions](https://github.com/github-actions)\[bot], [@cyphercodes](https://github.com/cyphercodes), [@cyphercodes](https://github.com/cyphercodes)) - [`95cf2e9`](npm/cli@95cf2e9) [#9489](npm/cli#9489) validate registry path for allow-remote tarballs ([@Abhinav-143x](https://github.com/Abhinav-143x)) - [`9dd219b`](npm/cli@9dd219b) [#9462](npm/cli#9462) respect allowScripts policy in prune, dedupe, uninstall, audit, and link ([#9462](npm/cli#9462)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`cd8d18a`](npm/cli@cd8d18a) [#9482](npm/cli#9482) list pending scripts in approve-scripts when ignore-scripts is set ([#9482](npm/cli#9482)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`c14e87c`](npm/cli@c14e87c) [#9481](npm/cli#9481) suggest --allow-scripts for global installs in unreviewed-scripts warnings ([#9481](npm/cli#9481)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee)) - [`7ade52e`](npm/cli@7ade52e) [#9465](npm/cli#9465) invalid issue template YAML indentation ([#9465](npm/cli#9465)) ([@github-actions](https://github.com/github-actions)\[bot], [@fallintoplace](https://github.com/fallintoplace)) - [`c069622`](npm/cli@c069622) [#9464](npm/cli#9464) show full parent command path in subcommand usage errors ([#9464](npm/cli#9464)) ([@owlstronaut](https://github.com/owlstronaut)) - [`1bb62bb`](npm/cli@1bb62bb) [#9454](npm/cli#9454) config: clarify --all help so it's accurate for approve-scripts and deny-scripts ([@JamieMagee](https://github.com/JamieMagee)) - [`84eeb5f`](npm/cli@84eeb5f) [#9431](npm/cli#9431) audit: don't apply min-release-age before filter when verifying installed signatures ([@JamieMagee](https://github.com/JamieMagee)) - [`3bd3377`](npm/cli@3bd3377) [#9426](npm/cli#9426) block forbidden keys in Queryable setter to prevent prototype pollution ([@12122J](https://github.com/12122J), [@claude](https://github.com/claude)) ##### Documentation - [`a86a7a9`](npm/cli@a86a7a9) [#9522](npm/cli#9522) approve-scripts only throws EGLOBAL when run with -g ([@JamieMagee](https://github.com/JamieMagee)) - [`693bb3d`](npm/cli@693bb3d) [#9508](npm/cli#9508) clarify package.json override value specs ([#9508](npm/cli#9508)) ([@github-actions](https://github.com/github-actions)\[bot], [@ded-furby](https://github.com/ded-furby)) - [`ccffe4a`](npm/cli@ccffe4a) [#9501](npm/cli#9501) use the latest version for global update and outdated's `wanted` ([#9501](npm/cli#9501)) ([@github-actions](https://github.com/github-actions)\[bot], [@liangmiQwQ](https://github.com/liangmiQwQ)) - [`66e97c2`](npm/cli@66e97c2) [#9478](npm/cli#9478) update minimum npm required for npm trust ([@meeech](https://github.com/meeech)) ##### Dependencies - [`bd09b87`](npm/cli@bd09b87) [#9542](npm/cli#9542) `postcss-selector-parser@7.1.4` - [`95bfc4c`](npm/cli@95bfc4c) [#9542](npm/cli#9542) `tinyglobby@0.2.17` - [`8c0d5fd`](npm/cli@8c0d5fd) [#9542](npm/cli#9542) `tar@7.5.16` - [`967d377`](npm/cli@967d377) [#9542](npm/cli#9542) `semver@7.8.4` - [`cdaac1b`](npm/cli@cdaac1b) [#9542](npm/cli#9542) `pacote@21.5.1` - [`25c8a9e`](npm/cli@25c8a9e) [#9542](npm/cli#9542) `node-gyp@12.4.0` ##### Chores - [`2922fa4`](npm/cli@2922fa4) [#9542](npm/cli#9542) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.8.0): `@npmcli/arborist@9.8.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.11.0): `@npmcli/config@10.11.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.10): `libnpmdiff@8.1.10` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.0): `libnpmexec@10.3.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.24): `libnpmfund@7.0.24` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.10): `libnpmpack@9.1.10` ##### [v11.16.0](https://github.com/npm/cli/releases/tag/v11.16.0) ##### Features - [`4b67f6e`](npm/cli@4b67f6e) [#9416](npm/cli#9416) publish --access=private alias for restricted ([#9416](npm/cli#9416)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [`a10c7ca`](npm/cli@a10c7ca) [#9415](npm/cli#9415) Phase 1 of `allowScripts` opt-in install-script policy ([#9360](npm/cli#9360)) ([#9415](npm/cli#9415)) ([@owlstronaut](https://github.com/owlstronaut), [@JamieMagee](https://github.com/JamieMagee)) ##### Bug Fixes - [`1f7869b`](npm/cli@1f7869b) [#9411](npm/cli#9411) fix typo of fullMetadata ([@owlstronaut](https://github.com/owlstronaut)) - [`cde03ba`](npm/cli@cde03ba) [#9390](npm/cli#9390) config: pause progress spinner during interactive editor spawn ([#9388](npm/cli#9388)) ([@github-actions](https://github.com/github-actions)\[bot], [@Zelys-DFKH](https://github.com/Zelys-DFKH), [@claude](https://github.com/claude)) ##### Documentation - [`c5e9d73`](npm/cli@c5e9d73) [#9390](npm/cli#9390) Document `npm_old_version` and `npm_new_version` environment variables ([#9389](npm/cli#9389)) ([@github-actions](https://github.com/github-actions)\[bot], [@36degrees](https://github.com/36degrees)) ##### Dependencies - [`cdd7bbc`](npm/cli@cdd7bbc) [#9421](npm/cli#9421) `undici@6.26.0` - [`fde87c9`](npm/cli@fde87c9) [#9421](npm/cli#9421) `sigstore@4.1.1` - [`2779793`](npm/cli@2779793) [#9421](npm/cli#9421) `lru-cache@11.5.1` - [`dea702d`](npm/cli@dea702d) [#9421](npm/cli#9421) `@sigstore/verify@3.1.1` - [`4eab03f`](npm/cli@4eab03f) [#9421](npm/cli#9421) `@sigstore/core@3.2.1` - [`74c7323`](npm/cli@74c7323) [#9421](npm/cli#9421) `@npmcli/agent@4.0.2` - [`edc4ab3`](npm/cli@edc4ab3) [#9421](npm/cli#9421) `semver@7.8.1` - [`5f6ce33`](npm/cli@5f6ce33) [#9421](npm/cli#9421) `make-fetch-happen@15.0.6` ##### Chores - [`bd04976`](npm/cli@bd04976) [#9421](npm/cli#9421) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [`aeceb23`](npm/cli@aeceb23) [#9407](npm/cli#9407) sanitize newlines in flags table default and type values ([#9407](npm/cli#9407)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/arborist@9.7.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.10.0): `@npmcli/config@10.10.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.9): `libnpmdiff@8.1.9` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.9): `libnpmexec@10.2.9` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.23): `libnpmfund@7.0.23` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.9): `libnpmpack@9.1.9` - [workspace](https://github.com/npm/cli/releases/tag/libnpmversion-v8.0.4): `libnpmversion@8.0.4` ##### [v11.15.0](https://github.com/npm/cli/releases/tag/v11.15.0) ##### Features - [`0d5d899`](npm/cli@0d5d899) [#9379](npm/cli#9379) npm stage ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [`1433740`](npm/cli@1433740) [#9376](npm/cli#9376) add permissions support to trust commands ([#9376](npm/cli#9376)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [`8df10f5`](npm/cli@8df10f5) [#9339](npm/cli#9339) add allow-git/allow-file/allow-directory/allow-remote configs ([@owlstronaut](https://github.com/owlstronaut)) ##### Bug Fixes - [`39b625e`](npm/cli@39b625e) [#9381](npm/cli#9381) key stage download --json output by package name ([#9381](npm/cli#9381)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot)) - [`6aa332d`](npm/cli@6aa332d) [#9339](npm/cli#9339) allow min-release-age in npmrc to coexist with --before ([@raazkhnl](https://github.com/raazkhnl)) - [`468550f`](npm/cli@468550f) [#9339](npm/cli#9339) refactor #failureNode, adjust tests and safety ([@owlstronaut](https://github.com/owlstronaut)) - [`cabe249`](npm/cli@cabe249) [#9339](npm/cli#9339) allow-remote=none does not block registry tarballs ([@owlstronaut](https://github.com/owlstronaut)) ##### Dependencies - [`8416a60`](npm/cli@8416a60) [#9383](npm/cli#9383) `socks@2.8.9` - [`5e5a25b`](npm/cli@5e5a25b) [#9383](npm/cli#9383) `lru-cache@11.5.0` - [`a6f9ad2`](npm/cli@a6f9ad2) [#9383](npm/cli#9383) `ip-address@10.2.0` - [`63f8114`](npm/cli@63f8114) [#9383](npm/cli#9383) `brace-expansion@5.0.6` - [`6918b4c`](npm/cli@6918b4c) [#9383](npm/cli#9383) `bin-links@6.0.2` - [`bf84079`](npm/cli@bf84079) [#9383](npm/cli#9383) `tar@7.5.15` - [`bdef82c`](npm/cli@bdef82c) [#9383](npm/cli#9383) `semver@7.8.0` - [`3f38a67`](npm/cli@3f38a67) [#9383](npm/cli#9383) `hosted-git-info@9.0.3` ##### Chores - [`816f3bf`](npm/cli@816f3bf) [#9383](npm/cli#9383) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.1): `@npmcli/config@10.9.1` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.8): `libnpmdiff@8.1.8` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.8): `libnpmexec@10.2.8` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.22): `libnpmfund@7.0.22` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.8): `libnpmpack@9.1.8` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v11.2.0): `libnpmpublish@11.2.0` ##### [v11.14.1](https://github.com/npm/cli/releases/tag/v11.14.1) ##### Bug Fixes - [`dca12cb`](npm/cli@dca12cb) [#9328](npm/cli#9328) remove settings ([#9328](npm/cli#9328)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut)) ##### [v11.14.0](https://github.com/npm/cli/releases/tag/v11.14.0) ##### Features - [`45fc5e0`](npm/cli@45fc5e0) [#9288](npm/cli#9288) add allow-directory, allow-file, and allow-remote ([#9288](npm/cli#9288)) ([@github-actions](https://github.com/github-actions)\[bot], [@wraithgar](https://github.com/wraithgar)) ##### Bug Fixes - [`6c17544`](npm/cli@6c17544) [#9318](npm/cli#9318) sbom: dedupe per-node dependsOn / relationships ([#9318](npm/cli#9318)) ([@github-actions](https://github.com/github-actions)\[bot], [@mikaelkristiansson](https://github.com/mikaelkristiansson)) ##### Dependencies - [`840fe18`](npm/cli@840fe18) [#9322](npm/cli#9322) `socks@10.1.1` - [`b771289`](npm/cli@b771289) [#9322](npm/cli#9322) `ip-address@10.1.1` - [`addffcb`](npm/cli@addffcb) [#9322](npm/cli#9322) `cidr-regex@5.0.5` ##### Chores - [`041fd58`](npm/cli@041fd58) [#9322](npm/cli#9322) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [`89c505a`](npm/cli@89c505a) [#9320](npm/cli#9320) add cli-triage team as codeowner ([#9320](npm/cli#9320)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.0): `@npmcli/config@10.9.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.7): `libnpmdiff@8.1.7` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.7): `libnpmexec@10.2.7` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.21): `libnpmfund@7.0.21` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.7): `libnpmpack@9.1.7` ##### [v11.13.0](https://github.com/npm/cli/releases/tag/v11.13.0) ##### Features - [`8e8dadb`](npm/cli@8e8dadb) [#9246](npm/cli#9246) add `u` as alias for `update` command ([#9246](npm/cli#9246)) ([@github-actions](https://github.com/github-actions)\[bot], [@Ausoj](https://github.com/Ausoj)) ##### Bug Fixes - [`ecd161b`](npm/cli@ecd161b) [#9258](npm/cli#9258) ignore intended error code ([@owlstronaut](https://github.com/owlstronaut)) ##### Dependencies - [`8d2fdcd`](npm/cli@8d2fdcd) [#9272](npm/cli#9272) `lru-cache@11.3.5` - [`e603d36`](npm/cli@e603d36) [#9272](npm/cli#9272) `node-gyp@12.3.0` - [`d48b7da`](npm/cli@d48b7da) [#9272](npm/cli#9272) `is-cidr@6.0.4` - [`032a5ca`](npm/cli@032a5ca) [#9240](npm/cli#9240) `@sigstore/protobuf-specs@0.5.1` - [`33a81e7`](npm/cli@33a81e7) [#9240](npm/cli#9240) `tinyglobby@0.2.16` - [`68dc4a0`](npm/cli@68dc4a0) [#9240](npm/cli#9240) `picomatch@4.0.4` - [`1bb6703`](npm/cli@1bb6703) [#9240](npm/cli#9240) `lru-cache@11.3.3` - [`37059e4`](npm/cli@37059e4) [#9240](npm/cli#9240) `diff@8.0.4` - [`fb450ab`](npm/cli@fb450ab) [#9240](npm/cli#9240) `minimatch@10.2.5` - [`7c4bbbf`](npm/cli@7c4bbbf) [#9240](npm/cli#9240) `tar@7.5.13` - [`703a3bc`](npm/cli@703a3bc) [#9240](npm/cli#9240) `minipass-flush@1.0.6` ##### Chores - [`e0724ac`](npm/cli@e0724ac) [#9272](npm/cli#9272) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut)) - [`d249341`](npm/cli@d249341) [#9230](npm/cli#9230) don't run npm update in CI ([@owlstronaut](https://github.com/owlstronaut)) - [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.4.3): `@npmcli/arborist@9.4.3` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.6): `libnpmdiff@8.1.6` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.6): `libnpmexec@10.2.6` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.20): `libnpmfund@7.0.20` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.6): `libnpmpack@9.1.6`
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #9914 to
release/v11.