Update npm to v12

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
npm (source)	11.14.0+sha512.ea37d9cea2bc11f5869d379941ef9b80cc78220884667ee4d5e338184f1213cd41de261c879d9d55230ed610b63a735b14b230cefc14914c6c38e7143c6d9723 → 12.0.2

---

Release Notes

npm/cli (npm)

v12.0.2

Compare Source

Bug Fixes

• 834408e #​9760 pack: honor min-release-age-exclude (#​9760) (@​martinrrm, @​Copilot)
• ef6cfea #​9786 owner: use scoped registry for user lookup (#​9786) (@​martinrrm, @​Copilot)

Documentation

• 9e17dc0 #​9805 clarify npm 12 unknown-config breaking change in changelogs (#​9805) (@​Hashim1999164)

Chores

• 7b1f6c1 #​9747 parse pack --json object output in node integration (#​9747) (@​reggi, @​Copilot)

Dependencies

• workspace: @npmcli/arborist@10.0.2
• workspace: @npmcli/config@11.0.1
• workspace: libnpmdiff@9.0.2
• workspace: libnpmexec@11.0.2
• workspace: libnpmfund@8.0.2
• workspace: libnpmpack@10.0.2

v12.0.1

Compare Source

Bug Fixes

• ecb02a8 #​9745 view: avoid wrapping array results (#​9745) (@​reggi, @​martinrrm, @​Copilot)
• 47fc8b1 #​9740 correct bundled sigstore from dev dependency conflict (#​9740) (@​james-pre)

Dependencies

• workspace: @npmcli/arborist@10.0.1
• workspace: libnpmdiff@9.0.1
• workspace: libnpmexec@11.0.1
• workspace: libnpmfund@8.0.1
• workspace: libnpmpack@10.0.1

v12.0.0

Compare Source

⚠️ BREAKING CHANGES

• npm view --json now always returns an array.
• npm sbom --sbom-format=cyclonedx now reports the name field from each package's package.json instead of the on-disk directory name. The name, bom-ref, and purl of the root component and of aliased dependencies may change.
• npm no longer registers man pages with the system when installed globally. man npm-install will no longer work, but npm help install is unaffected.
• The npm pkg output is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly to npm view.
• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• The Twitter and Freenode profile fields have been removed from the npm registry. This means that users will no longer be able to set or view these fields in their npm profiles.
• npm will no longer attempt to resolve the path to node via whichnode. process.execPath is already set by Node to the resolved real path of the node binary, so the lookup was redundant. Scripts that expected npm to override process.execPath with a PATH-resolved (potentially symlinked) node path may be affected.
• the --json output of npm pack and npm publish have changed. They are now always consistent, and in the same format.
• the star, stars and unstar commands have been removed
• The npm adduser command has been removed. Create and manage user accounts on the npm website, and use npm login to authenticate on the command line.
• Preserve https protocol when working with git (#​8703)
• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• root `preinstall` now runs before dependencies are installed.
• unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning.

Chores

• b77b532 #​9735 remove pre-release mode from npm 12 and workspaces (#​9735) (@​reggi, @​Copilot)

Dependencies

• workspace: @npmcli/arborist@10.0.0
• workspace: @npmcli/config@11.0.0
• workspace: libnpmaccess@11.0.0
• workspace: libnpmdiff@9.0.0
• workspace: libnpmexec@11.0.0
• workspace: libnpmfund@8.0.0
• workspace: libnpmorg@9.0.0
• workspace: libnpmpack@10.0.0
• workspace: libnpmpublish@12.0.0
• workspace: libnpmsearch@10.0.0
• workspace: libnpmteam@9.0.0
• workspace: libnpmversion@9.0.0

v11.19.0

Compare Source

v11.18.0

Compare Source

v11.17.0

Compare Source

Features

• ae8ac4e #​9534 add min-release-age-exclude config (@​JamieMagee, @​caseyjhol)
• 8ff3e48 #​9483 allowScripts tooling and inBundle hardening (#​9483) (@​github-actions[bot], @​JamieMagee)

Bug Fixes

• 847cdf8 #​9541 match dotted and versioned args in approve-scripts/deny-scripts (@​owlstronaut)
• d99f7cb #​9535 emit valid JSON from approve-scripts/deny-scripts --json (@​owlstronaut)
• 351a309 #​9499 pass script-shell to publish lifecycle hooks (#​9499) (@​github-actions[bot])
• 4fa81df #​9497 recognize allowScripts for local link targets (#​9497) (@​github-actions[bot], @​cyphercodes, @​cyphercodes)
• 95cf2e9 #​9489 validate registry path for allow-remote tarballs (@​Abhinav-143x)
• 9dd219b #​9462 respect allowScripts policy in prune, dedupe, uninstall, audit, and link (#​9462) (@​github-actions[bot], @​JamieMagee)
• cd8d18a #​9482 list pending scripts in approve-scripts when ignore-scripts is set (#​9482) (@​github-actions[bot], @​JamieMagee)
• c14e87c #​9481 suggest --allow-scripts for global installs in unreviewed-scripts warnings (#​9481) (@​github-actions[bot], @​JamieMagee)
• 7ade52e #​9465 invalid issue template YAML indentation (#​9465) (@​github-actions[bot], @​fallintoplace)
• c069622 #​9464 show full parent command path in subcommand usage errors (#​9464) (@​owlstronaut)
• 1bb62bb #​9454 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@​JamieMagee)
• 84eeb5f #​9431 audit: don't apply min-release-age before filter when verifying installed signatures (@​JamieMagee)
• 3bd3377 #​9426 block forbidden keys in Queryable setter to prevent prototype pollution (@​12122J, @​claude)

Documentation

• a86a7a9 #​9522 approve-scripts only throws EGLOBAL when run with -g (@​JamieMagee)
• 693bb3d #​9508 clarify package.json override value specs (#​9508) (@​github-actions[bot], @​ded-furby)
• ccffe4a #​9501 use the latest version for global update and outdated's wanted (#​9501) (@​github-actions[bot], @​liangmiQwQ)
• 66e97c2 #​9478 update minimum npm required for npm trust (@​meeech)

Dependencies

• bd09b87 #​9542 postcss-selector-parser@7.1.4
• 95bfc4c #​9542 tinyglobby@0.2.17
• 8c0d5fd #​9542 tar@7.5.16
• 967d377 #​9542 semver@7.8.4
• cdaac1b #​9542 pacote@21.5.1
• 25c8a9e #​9542 node-gyp@12.4.0

Chores

• 2922fa4 #​9542 dev dependency updates (@​owlstronaut)
• workspace: @npmcli/arborist@9.8.0
• workspace: @npmcli/config@10.11.0
• workspace: libnpmdiff@8.1.10
• workspace: libnpmexec@10.3.0
• workspace: libnpmfund@7.0.24
• workspace: libnpmpack@9.1.10

v11.16.0

Compare Source

Features

• 4b67f6e #​9416 publish --access=private alias for restricted (#​9416) (@​github-actions[bot], @​reggi, @​Copilot)
• a10c7ca #​9415 Phase 1 of allowScripts opt-in install-script policy (#​9360) (#​9415) (@​owlstronaut, @​JamieMagee)

Bug Fixes

• 1f7869b #​9411 fix typo of fullMetadata (@​owlstronaut)
• cde03ba #​9390 config: pause progress spinner during interactive editor spawn (#​9388) (@​github-actions[bot], @​Zelys-DFKH, @​claude)

Documentation

• c5e9d73 #​9390 Document npm_old_version and npm_new_version environment variables (#​9389) (@​github-actions[bot], @​36degrees)

Dependencies

• cdd7bbc #​9421 undici@6.26.0
• fde87c9 #​9421 sigstore@4.1.1
• 2779793 #​9421 lru-cache@11.5.1
• dea702d #​9421 @sigstore/verify@3.1.1
• 4eab03f #​9421 @sigstore/core@3.2.1
• 74c7323 #​9421 @npmcli/agent@4.0.2
• edc4ab3 #​9421 semver@7.8.1
• 5f6ce33 #​9421 make-fetch-happen@15.0.6

Chores

• bd04976 #​9421 dev dependency updates (@​owlstronaut)
• aeceb23 #​9407 sanitize newlines in flags table default and type values (#​9407) (@​reggi, @​Copilot)
• workspace: @npmcli/arborist@9.7.0
• workspace: @npmcli/config@10.10.0
• workspace: libnpmdiff@8.1.9
• workspace: libnpmexec@10.2.9
• workspace: libnpmfund@7.0.23
• workspace: libnpmpack@9.1.9
• workspace: libnpmversion@8.0.4

v11.15.0

Compare Source

Features

• 0d5d899 #​9379 npm stage (@​reggi, @​Copilot)
• 1433740 #​9376 add permissions support to trust commands (#​9376) (@​github-actions[bot], @​reggi, @​Copilot)
• 8df10f5 #​9339 add allow-git/allow-file/allow-directory/allow-remote configs (@​owlstronaut)

Bug Fixes

• 39b625e #​9381 key stage download --json output by package name (#​9381) (@​reggi, @​Copilot)
• 6aa332d #​9339 allow min-release-age in npmrc to coexist with --before (@​raazkhnl)
• 468550f #​9339 refactor #failureNode, adjust tests and safety (@​owlstronaut)
• cabe249 #​9339 allow-remote=none does not block registry tarballs (@​owlstronaut)

Dependencies

• 8416a60 #​9383 socks@2.8.9
• 5e5a25b #​9383 lru-cache@11.5.0
• a6f9ad2 #​9383 ip-address@10.2.0
• 63f8114 #​9383 brace-expansion@5.0.6
• 6918b4c #​9383 bin-links@6.0.2
• bf84079 #​9383 tar@7.5.15
• bdef82c #​9383 semver@7.8.0
• 3f38a67 #​9383 hosted-git-info@9.0.3

Chores

• 816f3bf #​9383 dev dependency updates (@​owlstronaut)
• workspace: @npmcli/arborist@9.6.0
• workspace: @npmcli/config@10.9.1
• workspace: libnpmdiff@8.1.8
• workspace: libnpmexec@10.2.8
• workspace: libnpmfund@7.0.22
• workspace: libnpmpack@9.1.8
• workspace: libnpmpublish@11.2.0

v11.14.1

Compare Source

Bug Fixes

• dca12cb #​9328 remove settings (#​9328) (@​github-actions[bot], @​owlstronaut)

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.