npm CLI 12.2.0: latest version, breaking changes and gotchas

npm CLI 12.2.0 (2026-09-30 16:47 UTC)

• dist-tag: support OIDC authentication for add, del, and ls (lib/commands/dist-tag.js, PR #10038). (source)
• update npm stage docs to reflect that it can create new packages (docs/lib/content/commands/npm-stage.md, PR #10017). (source)

npm CLI 11.20.0 (2026-09-22 21:34 UTC)

• token: backport support for read-write-stage-only granular access tokens (lib/commands/token.js, PR #9994). (source)
• stage: display staged package status in stage command (lib/commands/stage/index.js, PR #9920). (source)
• provenance-file takes precedence over OIDC auto-generated provenance (PR #9947). (source)

npm CLI 12.1.0 (2026-09-22 20:21 UTC)

• token: support read-write-stage-only granular access tokens and warn on direct-publish tokens (lib/commands/token.js, PR #9948). (source)
• stage: display staged package status in stage command (lib/commands/stage/index.js, PR #9898). (source)
• provenance-file config takes precedence over OIDC auto-generated provenance (PR #9882). (source)
• arborist: reject uninstall arguments that carry a version specification (lib/commands/uninstall.js, PR #9881). (source)

npm CLI 11.19.1 (2026-08-26 21:48 UTC)

• pack: exempt explicit pack directory targets from allow-directory check (lib/commands/pack.js, PR #9916). (source)
• Dependencies: updated tar to 7.5.22, undici to 6.28.0, ip-address to 10.5.0, brace-expansion to 5.0.9 (PR #9872, #9842). (source)

npm CLI 12.0.2 (2026-07-29 21:11 UTC)

• pack: honor min-release-age-exclude configuration option (lib/commands/pack.js, PR #9760). (source)
• owner: use scoped registry for user lookup (lib/commands/owner.js, PR #9786). (source)
• docs: clarify npm 12 unknown-config breaking change in changelogs (PR #9805). (source)

npm CLI 12.1.0 → 12.2.0

0 commands added, 0 removed, 0 commands with flags added or removed; 0 help pages changed.

Method: From source (not run): compared git tree and command definitions in lib/commands/ and workspaces/config between v12.1.0 and v12.2.0. No command or flag was added or removed.

• The last two releases on the npm 12 line. 12.2.0 added OIDC authentication handling to npm dist-tag and updated documentation for npm stage without altering the visible CLI surface.

npm CLI 11.20.0 → 12.2.0

1 command added, 5 removed, 1 command with flags added; 6 command surfaces changed.

Method: From source (not run): compared command definitions in lib/commands/, lib/utils/cmd-list.js, and workspaces/config between v11.20.0 (the newest npm 11 release) and v12.2.0 (the newest npm 12 release).

Commands added:

• npm patch

Commands removed:

• npm adduser
• npm shrinkwrap
• npm star
• npm stars
• npm unstar

• Compares the active npm 11 and npm 12 lines. npm patch was introduced in npm 12 to create and manage local dependency patches in patchedDependencies. Five legacy commands (adduser, shrinkwrap, star, stars, unstar) were removed.

npm CLI 12.0.2 → 12.1.0

0 commands added, 0 removed, 0 commands with flags added or removed; 0 help pages changed.

Method: From source (not run): compared command definitions and config definitions in workspaces/config between v12.0.2 and v12.1.0.

• 12.1.0 added the read-write-stage-only permission value to --packages-and-scopes-permission for npm token create, and added precedence handling for provenance-file.

npm CLI 11.18.0 → 12.0.0

1 command added, 5 removed, 1 command with flags added; 6 command surfaces changed.

Method: From source (not run): compared command definitions in lib/commands/, lib/utils/cmd-list.js, and workspaces/config between v11.18.0 and v12.0.0.

Commands added:

• npm patch

Commands removed:

• npm adduser
• npm shrinkwrap
• npm star
• npm stars
• npm unstar

• The major jump to npm 12. Added npm patch (add, commit, update, ls, rm) with dedicated patching flags. Removed npm adduser, npm shrinkwrap, npm star, npm stars, and npm unstar. Note that npm install-scripts and npm stage were introduced in late v11 in preparation for npm 12.

npm 12 blocks dependency postinstall scripts during installation (npm CLI 12.2.0)

npm i -g opencode-ai@1.18.35

npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:
npm warn install-scripts   opencode-ai@1.18.35 (postinstall: node ./postinstall.mjs)
npm warn install-scripts Run `npm install -g --allow-scripts=opencode-ai` to allow these scripts once, or `npm config set allow-scripts=opencode-ai --location=user` to allow them for all global installs.
# Note: install exits 0, but binary subsequently fails because postinstall was not run

Fix: Install with npm i -g --allow-scripts=opencode-ai opencode-ai@latest, or configure once via npm config set allow-scripts=opencode-ai --location=user. In local projects, approve using npm install-scripts approve <pkg> followed by npm rebuild. (source)

Git dependencies fail with EALLOWGIT because allow-git defaults to none (npm CLI 12.2.0)

npm install git+https://github.com/user/repo.git

npm error code EALLOWGIT
npm error Fetching packages of type "git" have been disabled
# exit 1 (quoted from workspaces/arborist/lib/arborist/build-ideal-tree.js line 852 at v12.2.0)

Fix: Run npm install --allow-git=all git+https://github.com/user/repo.git or set allow-git=all in project .npmrc (or allow-git=root if git deps are only declared in top-level package.json). (source)

Remote tarball dependencies fail with EALLOWREMOTE because allow-remote defaults to none (npm CLI 12.2.0)

npm install https://example.com/package.tgz

npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
# exit 1 (quoted from workspaces/arborist/lib/arborist/build-ideal-tree.js line 852 at v12.2.0)

Fix: Run npm install --allow-remote=all https://example.com/package.tgz or set allow-remote=all in .npmrc. (source)

Single-hyphen multi-character flags throw EUNKNOWNCONFIG (npm CLI 12.2.0)

npm install -save-dev lodash

npm error code EUNKNOWNCONFIG
npm error -save-dev is not a valid single-hyphen cli flag. Did you mean --save-dev?
# exit 1 (quoted from workspaces/config/lib/index.js line 387 at v12.2.0)

Fix: Use standard double hyphens for multi-character options: npm install --save-dev lodash (or short single flags like -D). (source)

Invalid abbreviated CLI flags throw EUNKNOWNCONFIG (npm CLI 12.2.0)

npm install --sav lodash

npm error code EUNKNOWNCONFIG
npm error Invalid abbreviated flag "--sav". Did you mean "--save"?
# exit 1 (quoted from workspaces/config/lib/index.js line 597 at v12.2.0)

Fix: Specify the full flag name: --save or --save-dev. Abbreviated flag resolution was disabled in npm 12. (source)

Removed commands like npm adduser fail with EUNKNOWNCOMMAND (npm CLI 12.2.0)

npm adduser

npm error code EUNKNOWNCOMMAND
npm error Unknown command adduser
# exit 1 (quoted from lib/npm.js line 23 at v12.2.0)

Fix: Use npm login to authenticate on the command line. Account registration and user creation must now be done on https://www.npmjs.com. (source)

2026-10: 12.2.0 (0 releases to 2026-10-07)

• 12.2.0 (2026-09-30) active: Node 26 LTS bundles npm 11.20.0, while standalone installs run npm 12.2.0. (source)

2026-09: 11.20.0 to 12.2.0 (3 releases)

• 12.2.0: dist-tag OIDC authentication; updated npm stage docs. (source)
• 12.1.0 & 11.20.0: granular access token stage-only permission (read-write-stage-only) with deprecation warning for direct-publish tokens. (source)

2026-08: 11.19.1 (1 release)

• 11.19.1: exempt explicit pack directory targets from allow-directory restriction; dependencies updated (tar@7.5.22, undici@6.28.0). (source)

2026-07: 10.9.9 to 12.0.2 (5 releases)

• 12.0.0 (2026-07-08): major release! Block dependency lifecycle scripts by default (allowScripts); allow-git and allow-remote default to none; npm patch added; removed adduser/shrinkwrap/star. (source)
• 12.0.2 & 11.19.0: pack honors min-release-age-exclude; scoped registry for owner user lookup. (source)

2026-06: 11.17.0 to 11.18.0 (2 releases)

• 11.18.0: preparation for npm 12 major release and lifecycle script controls. (source)
• 11.17.0: introduced allow-scripts command tooling in v11 line ahead of default blocking in v12. (source)

2026-05: 11.14.0 to 11.16.0 (4 releases)

• 11.16.0: security fixes and tree-building reliability updates. (source)
• 11.14.0: SBOM CycloneDX improvements and Arborist dependency resolution enhancements. (source)