{
  "tool": "npm",
  "name": "npm CLI",
  "long_name": "npm CLI (npm)",
  "aliases": [
    "npm-cli",
    "npmjs",
    "npm12",
    "npm-12"
  ],
  "homepage": "https://docs.npmjs.com",
  "url": "https://insidetheloop.dev/tools/npm",
  "markdown_url": "https://insidetheloop.dev/tools/npm.md",
  "date_modified": "2026-10-07T15:44:13Z",
  "title": "npm CLI 12.2.0: latest version, breaking changes and gotchas",
  "description": "npm CLI 12.2.0 (2026-09-30 UTC): upgrade commands, source diffs, blocked install-scripts, allow-git/remote defaults, and Node 26 LTS vs npm 12 migration fixes.",
  "answer": "The latest npm CLI (`npm`, repo npm/cli) is 12.2.0, released 2026-09-30 16:47 UTC (published to the npm registry at 16:46 UTC). Upgrade with `npm i -g npm@latest` or `npm i -g npm@12.2.0`. Node.js 26 LTS (v26.11.0, 2026-10-07) bundles npm 11.20.0, so environments vary between npm 11 and npm 12. In npm 12, dependency lifecycle scripts are blocked by default unless granted in `allowScripts` or allowed via `--allow-scripts=<pkg>`, `allow-git` and `allow-remote` default to `none`, `npm patch` was added, and unknown flags or single-hyphen shorthands throw `EUNKNOWNCONFIG`.",
  "latest": {
    "version": "12.2.0",
    "released_at": "2026-09-30T16:47:29Z",
    "url": "https://github.com/npm/cli/releases/tag/v12.2.0"
  },
  "upgrade": [
    {
      "label": "Upgrade to latest npm",
      "command": "npm i -g npm@latest\nnpm --version   # 12.2.0"
    },
    {
      "label": "Pin npm 12 latest",
      "command": "npm i -g npm@12.2.0"
    },
    {
      "label": "Stay on npm 11 (Node 26 LTS line)",
      "command": "npm i -g npm@11.20.0"
    },
    {
      "label": "Using Homebrew (macOS / Linux)",
      "command": "brew install node"
    },
    {
      "label": "Allow dependency install scripts on global install (npm 12)",
      "command": "npm i -g --allow-scripts=<pkg> <pkg>\n# or set permanently for user:\nnpm config set allow-scripts=<pkg> --location=user"
    }
  ],
  "verified": {
    "date": "2026-10-07",
    "version": "12.2.0",
    "method": "From source inspection (not run): verified release notes, commit comparisons across tags (v11.18.0, v11.19.1, v11.20.0, v12.0.0, v12.0.2, v12.1.0, v12.2.0), command definitions in lib/commands/ and lib/utils/cmd-list.js, config options in @npmcli/config, and error strings in @npmcli/arborist from GitHub source with sandboxes paused."
  },
  "updated_at": "2026-10-07T15:44:13Z",
  "key_facts": [
    "Latest release: 12.2.0 on 2026-09-30 16:47 UTC (GitHub tag `v12.2.0`; npm publish 16:46 UTC). Previous release on the v12 line: 12.1.0 on 2026-09-22 20:21 UTC.",
    "Node.js 26 LTS (v26.11.0, released 2026-10-07) bundles npm 11.20.0, not npm 12. Agents running in freshly spawned Node 26 containers encounter npm 11 by default, while environments running `npm i -g npm@latest` run npm 12.",
    "npm 12 requires Node.js `^22.22.2 || ^24.15.0 || >=26.0.0` (`engines.node` in `package.json`). Node 20 is no longer supported in npm 12 (npm 11 supported `^20.17.0 || >=22.9.0`).",
    "Lifecycle scripts blocked by default: npm 12 blocks dependency `preinstall`, `install`, and `postinstall` scripts unless authorized in `allowScripts` in `package.json` or bypassed with `--allow-scripts=<pkg>`. Global installs print a warning and suggest `npm config set allow-scripts=<pkg> --location=user`.",
    "Git and remote tarball dependencies disabled: `allow-git` and `allow-remote` default to `none` in npm 12 (changed from `all` in npm 11). Dependencies from git URLs throw `EALLOWGIT`; remote tarball URLs throw `EALLOWREMOTE`. Set `allow-git=all` or `allow-remote=all` in `.npmrc` to restore npm 11 behaviour.",
    "Strict CLI flag validation: unknown CLI flags, single-hyphen multi-char flags (like `-flag` instead of `--flag`), and abbreviated flags throw `EUNKNOWNCONFIG` in npm 12 instead of merely warning.",
    "Authoritative command count: 68 commands in npm 12.2.0 vs 72 commands in npm 11.20.0. npm 12 added `npm patch` (`add`, `commit`, `update`, `ls`, `rm`) and removed 5 deprecated commands: `npm adduser` (use `npm login`), `npm shrinkwrap`, `npm star`, `npm stars`, `npm unstar`.",
    "npm 12.1.0 introduced `read-write-stage-only` as an option for `--packages-and-scopes-permission` in `npm token create`, warning that bypass-2fa direct-publish tokens will stop working in January 2027 in favour of staged releases via `npm stage`.",
    "19,571,278 weekly downloads on the npm registry in the week 2026-09-28 to 2026-10-04; 10,174 GitHub stars and Artistic-2.0 licence on 2026-10-07."
  ],
  "releases": [
    {
      "version": "12.2.0",
      "released_at": "2026-09-30T16:47:29Z",
      "url": "https://github.com/npm/cli/releases/tag/v12.2.0",
      "changes": [
        {
          "text": "dist-tag: support OIDC authentication for add, del, and ls (`lib/commands/dist-tag.js`, PR #10038).",
          "url": "https://github.com/npm/cli/pull/10038"
        },
        {
          "text": "update npm stage docs to reflect that it can create new packages (`docs/lib/content/commands/npm-stage.md`, PR #10017).",
          "url": "https://github.com/npm/cli/pull/10017"
        }
      ]
    },
    {
      "version": "11.20.0",
      "released_at": "2026-09-22T21:34:44Z",
      "url": "https://github.com/npm/cli/releases/tag/v11.20.0",
      "changes": [
        {
          "text": "token: backport support for read-write-stage-only granular access tokens (`lib/commands/token.js`, PR #9994).",
          "url": "https://github.com/npm/cli/pull/9994"
        },
        {
          "text": "stage: display staged package status in stage command (`lib/commands/stage/index.js`, PR #9920).",
          "url": "https://github.com/npm/cli/pull/9920"
        },
        {
          "text": "provenance-file takes precedence over OIDC auto-generated provenance (PR #9947).",
          "url": "https://github.com/npm/cli/pull/9947"
        }
      ]
    },
    {
      "version": "12.1.0",
      "released_at": "2026-09-22T20:21:08Z",
      "url": "https://github.com/npm/cli/releases/tag/v12.1.0",
      "changes": [
        {
          "text": "token: support read-write-stage-only granular access tokens and warn on direct-publish tokens (`lib/commands/token.js`, PR #9948).",
          "url": "https://github.com/npm/cli/pull/9948"
        },
        {
          "text": "stage: display staged package status in stage command (`lib/commands/stage/index.js`, PR #9898).",
          "url": "https://github.com/npm/cli/pull/9898"
        },
        {
          "text": "provenance-file config takes precedence over OIDC auto-generated provenance (PR #9882).",
          "url": "https://github.com/npm/cli/pull/9882"
        },
        {
          "text": "arborist: reject uninstall arguments that carry a version specification (`lib/commands/uninstall.js`, PR #9881).",
          "url": "https://github.com/npm/cli/pull/9881"
        }
      ]
    },
    {
      "version": "11.19.1",
      "released_at": "2026-08-26T21:48:47Z",
      "url": "https://github.com/npm/cli/releases/tag/v11.19.1",
      "changes": [
        {
          "text": "pack: exempt explicit pack directory targets from allow-directory check (`lib/commands/pack.js`, PR #9916).",
          "url": "https://github.com/npm/cli/pull/9916"
        },
        {
          "text": "Dependencies: updated tar to 7.5.22, undici to 6.28.0, ip-address to 10.5.0, brace-expansion to 5.0.9 (PR #9872, #9842).",
          "url": "https://github.com/npm/cli/pull/9872"
        }
      ]
    },
    {
      "version": "12.0.2",
      "released_at": "2026-07-29T21:11:46Z",
      "url": "https://github.com/npm/cli/releases/tag/v12.0.2",
      "changes": [
        {
          "text": "pack: honor min-release-age-exclude configuration option (`lib/commands/pack.js`, PR #9760).",
          "url": "https://github.com/npm/cli/pull/9760"
        },
        {
          "text": "owner: use scoped registry for user lookup (`lib/commands/owner.js`, PR #9786).",
          "url": "https://github.com/npm/cli/pull/9786"
        },
        {
          "text": "docs: clarify npm 12 unknown-config breaking change in changelogs (PR #9805).",
          "url": "https://github.com/npm/cli/pull/9805"
        }
      ]
    }
  ],
  "surface": [
    {
      "from": "12.1.0",
      "to": "12.2.0",
      "method": "From source (not run): compared git tree and command definitions in lib/commands/ and workspaces/config between v12.1.0 and v12.2.0. No command or flag was added or removed.",
      "summary": "0 commands added, 0 removed, 0 commands with flags added or removed; 0 help pages changed.",
      "commands_added": [],
      "commands_removed": [],
      "flags": [],
      "notes": [
        "The last two releases on the npm 12 line. 12.2.0 added OIDC authentication handling to `npm dist-tag` and updated documentation for `npm stage` without altering the visible CLI surface."
      ]
    },
    {
      "from": "11.20.0",
      "to": "12.2.0",
      "method": "From source (not run): compared command definitions in lib/commands/, lib/utils/cmd-list.js, and workspaces/config between v11.20.0 (the newest npm 11 release) and v12.2.0 (the newest npm 12 release).",
      "summary": "1 command added, 5 removed, 1 command with flags added; 6 command surfaces changed.",
      "commands_added": [
        "npm patch"
      ],
      "commands_removed": [
        "npm adduser",
        "npm shrinkwrap",
        "npm star",
        "npm stars",
        "npm unstar"
      ],
      "flags": [
        {
          "command": "npm patch",
          "added": [
            "--allow-unused-patches",
            "--edit-dir",
            "--ignore-existing",
            "--ignore-patch-failures",
            "--keep-edit-dir",
            "--patches-dir",
            "--registry",
            "--to"
          ],
          "removed": []
        }
      ],
      "notes": [
        "Compares the active npm 11 and npm 12 lines. `npm patch` was introduced in npm 12 to create and manage local dependency patches in `patchedDependencies`. Five legacy commands (`adduser`, `shrinkwrap`, `star`, `stars`, `unstar`) were removed."
      ]
    },
    {
      "from": "12.0.2",
      "to": "12.1.0",
      "method": "From source (not run): compared command definitions and config definitions in workspaces/config between v12.0.2 and v12.1.0.",
      "summary": "0 commands added, 0 removed, 0 commands with flags added or removed; 0 help pages changed.",
      "commands_added": [],
      "commands_removed": [],
      "flags": [],
      "notes": [
        "12.1.0 added the `read-write-stage-only` permission value to `--packages-and-scopes-permission` for `npm token create`, and added precedence handling for `provenance-file`."
      ]
    },
    {
      "from": "11.18.0",
      "to": "12.0.0",
      "method": "From source (not run): compared command definitions in lib/commands/, lib/utils/cmd-list.js, and workspaces/config between v11.18.0 and v12.0.0.",
      "summary": "1 command added, 5 removed, 1 command with flags added; 6 command surfaces changed.",
      "commands_added": [
        "npm patch"
      ],
      "commands_removed": [
        "npm adduser",
        "npm shrinkwrap",
        "npm star",
        "npm stars",
        "npm unstar"
      ],
      "flags": [
        {
          "command": "npm patch",
          "added": [
            "--allow-unused-patches",
            "--edit-dir",
            "--ignore-existing",
            "--ignore-patch-failures",
            "--keep-edit-dir",
            "--patches-dir",
            "--registry",
            "--to"
          ],
          "removed": []
        }
      ],
      "notes": [
        "The major jump to npm 12. Added `npm patch` (`add`, `commit`, `update`, `ls`, `rm`) with dedicated patching flags. Removed `npm adduser`, `npm shrinkwrap`, `npm star`, `npm stars`, and `npm unstar`. Note that `npm install-scripts` and `npm stage` were introduced in late v11 in preparation for npm 12."
      ]
    }
  ],
  "breaking": [
    {
      "version": "12.0.0",
      "change": "Dependency lifecycle scripts (preinstall, install, postinstall) are blocked by default unless authorized by the root package's allowScripts policy.",
      "migrate": "Run `npm install-scripts approve <pkg>` to approve in a project's package.json, or pass `--allow-scripts=<pkg>` (e.g. `npm i -g --allow-scripts=foo foo`). For global installs, configure once with `npm config set allow-scripts=<pkg> --location=user`.",
      "url": "https://github.com/npm/cli/releases/tag/v12.0.0"
    },
    {
      "version": "12.0.0",
      "change": "allow-git and allow-remote now default to 'none' (previously 'all'). Installing from git repositories or direct tarball URLs fails with EALLOWGIT or EALLOWREMOTE.",
      "migrate": "Set `allow-git=all` and `allow-remote=all` in `.npmrc` or pass `--allow-git=all` / `--allow-remote=all` on the command line if your project relies on git or remote tarball dependencies.",
      "url": "https://github.com/npm/cli/releases/tag/v12.0.0"
    },
    {
      "version": "12.0.0",
      "change": "Unknown flags on the command line, unknown configs in .npmrc when strict-npmrc is set, single-hyphen multi-character shorthands (-flag), and abbreviated flags throw EUNKNOWNCONFIG instead of warning.",
      "migrate": "Replace single-hyphen flags with double-hyphen flags (e.g. `--save` not `-save`), expand abbreviated flags to full names, and run `npm help config` to remove unrecognized options from `.npmrc`.",
      "url": "https://github.com/npm/cli/releases/tag/v12.0.0"
    },
    {
      "version": "12.0.0",
      "change": "Legacy commands npm adduser, npm shrinkwrap, npm star, npm stars, and npm unstar were removed. npm view --json now always outputs an array.",
      "migrate": "Use `npm login` instead of `npm adduser`. Use `package-lock.json` instead of `npm-shrinkwrap.json`. Manage package stars on npmjs.com. In scripts parsing `npm view --json`, expect an array even for single version results.",
      "url": "https://github.com/npm/cli/releases/tag/v12.0.0"
    },
    {
      "version": "12.0.0",
      "change": "Minimum supported Node.js version raised to ^22.22.2 || ^24.15.0 || >=26.0.0. Node 20 is no longer supported.",
      "migrate": "Upgrade the runtime environment to Node.js 22.22.2+, 24.15.0+, or 26.0.0+ before upgrading to npm 12.",
      "url": "https://github.com/npm/cli/releases/tag/v12.0.0"
    }
  ],
  "gotchas": [
    {
      "title": "npm 12 blocks dependency postinstall scripts during installation",
      "version": "12.2.0",
      "command": "npm i -g opencode-ai@1.18.35",
      "output": "npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:\nnpm warn install-scripts   opencode-ai@1.18.35 (postinstall: node ./postinstall.mjs)\nnpm warn install-scripts Run `npm install -g --allow-scripts=opencode-ai` to allow these scripts once, or `npm config set allow-scripts=opencode-ai --location=user` to allow them for all global installs.\n# Note: install exits 0, but binary subsequently fails because postinstall was not run",
      "fix": "Install with `npm i -g --allow-scripts=opencode-ai opencode-ai@latest`, or configure once via `npm config set allow-scripts=opencode-ai --location=user`. In local projects, approve using `npm install-scripts approve <pkg>` followed by `npm rebuild`.",
      "url": "https://github.com/npm/cli/blob/v12.2.0/lib/utils/reify-output.js#L247-L285"
    },
    {
      "title": "Git dependencies fail with EALLOWGIT because allow-git defaults to none",
      "version": "12.2.0",
      "command": "npm install git+https://github.com/user/repo.git",
      "output": "npm error code EALLOWGIT\nnpm error Fetching packages of type \"git\" have been disabled\n# exit 1 (quoted from workspaces/arborist/lib/arborist/build-ideal-tree.js line 852 at v12.2.0)",
      "fix": "Run `npm install --allow-git=all git+https://github.com/user/repo.git` or set `allow-git=all` in project `.npmrc` (or `allow-git=root` if git deps are only declared in top-level package.json).",
      "url": "https://github.com/npm/cli/blob/v12.2.0/workspaces/arborist/lib/arborist/build-ideal-tree.js#L852"
    },
    {
      "title": "Remote tarball dependencies fail with EALLOWREMOTE because allow-remote defaults to none",
      "version": "12.2.0",
      "command": "npm install https://example.com/package.tgz",
      "output": "npm error code EALLOWREMOTE\nnpm error Fetching packages of type \"remote\" have been disabled\n# exit 1 (quoted from workspaces/arborist/lib/arborist/build-ideal-tree.js line 852 at v12.2.0)",
      "fix": "Run `npm install --allow-remote=all https://example.com/package.tgz` or set `allow-remote=all` in `.npmrc`.",
      "url": "https://github.com/npm/cli/blob/v12.2.0/workspaces/arborist/lib/arborist/build-ideal-tree.js#L852"
    },
    {
      "title": "Single-hyphen multi-character flags throw EUNKNOWNCONFIG",
      "version": "12.2.0",
      "command": "npm install -save-dev lodash",
      "output": "npm error code EUNKNOWNCONFIG\nnpm error -save-dev is not a valid single-hyphen cli flag. Did you mean --save-dev?\n# exit 1 (quoted from workspaces/config/lib/index.js line 387 at v12.2.0)",
      "fix": "Use standard double hyphens for multi-character options: `npm install --save-dev lodash` (or short single flags like `-D`).",
      "url": "https://github.com/npm/cli/blob/v12.2.0/workspaces/config/lib/index.js#L387"
    },
    {
      "title": "Invalid abbreviated CLI flags throw EUNKNOWNCONFIG",
      "version": "12.2.0",
      "command": "npm install --sav lodash",
      "output": "npm error code EUNKNOWNCONFIG\nnpm error Invalid abbreviated flag \"--sav\". Did you mean \"--save\"?\n# exit 1 (quoted from workspaces/config/lib/index.js line 597 at v12.2.0)",
      "fix": "Specify the full flag name: `--save` or `--save-dev`. Abbreviated flag resolution was disabled in npm 12.",
      "url": "https://github.com/npm/cli/blob/v12.2.0/workspaces/config/lib/index.js#L597"
    },
    {
      "title": "Removed commands like npm adduser fail with EUNKNOWNCOMMAND",
      "version": "12.2.0",
      "command": "npm adduser",
      "output": "npm error code EUNKNOWNCOMMAND\nnpm error Unknown command adduser\n# exit 1 (quoted from lib/npm.js line 23 at v12.2.0)",
      "fix": "Use `npm login` to authenticate on the command line. Account registration and user creation must now be done on https://www.npmjs.com.",
      "url": "https://github.com/npm/cli/blob/v12.2.0/lib/npm.js#L23"
    }
  ],
  "monthly": [
    {
      "month": "2026-10",
      "versions": "12.2.0 (0 releases to 2026-10-07)",
      "highlights": [
        {
          "text": "12.2.0 (2026-09-30) active: Node 26 LTS bundles npm 11.20.0, while standalone installs run npm 12.2.0.",
          "url": "https://github.com/npm/cli/releases/tag/v12.2.0"
        }
      ]
    },
    {
      "month": "2026-09",
      "versions": "11.20.0 to 12.2.0 (3 releases)",
      "highlights": [
        {
          "text": "12.2.0: dist-tag OIDC authentication; updated npm stage docs.",
          "url": "https://github.com/npm/cli/releases/tag/v12.2.0"
        },
        {
          "text": "12.1.0 & 11.20.0: granular access token stage-only permission (read-write-stage-only) with deprecation warning for direct-publish tokens.",
          "url": "https://github.com/npm/cli/releases/tag/v12.1.0"
        }
      ]
    },
    {
      "month": "2026-08",
      "versions": "11.19.1 (1 release)",
      "highlights": [
        {
          "text": "11.19.1: exempt explicit pack directory targets from allow-directory restriction; dependencies updated (tar@7.5.22, undici@6.28.0).",
          "url": "https://github.com/npm/cli/releases/tag/v11.19.1"
        }
      ]
    },
    {
      "month": "2026-07",
      "versions": "10.9.9 to 12.0.2 (5 releases)",
      "highlights": [
        {
          "text": "12.0.0 (2026-07-08): major release! Block dependency lifecycle scripts by default (allowScripts); allow-git and allow-remote default to none; npm patch added; removed adduser/shrinkwrap/star.",
          "url": "https://github.com/npm/cli/releases/tag/v12.0.0"
        },
        {
          "text": "12.0.2 & 11.19.0: pack honors min-release-age-exclude; scoped registry for owner user lookup.",
          "url": "https://github.com/npm/cli/releases/tag/v12.0.2"
        }
      ]
    },
    {
      "month": "2026-06",
      "versions": "11.17.0 to 11.18.0 (2 releases)",
      "highlights": [
        {
          "text": "11.18.0: preparation for npm 12 major release and lifecycle script controls.",
          "url": "https://github.com/npm/cli/releases/tag/v11.18.0"
        },
        {
          "text": "11.17.0: introduced allow-scripts command tooling in v11 line ahead of default blocking in v12.",
          "url": "https://github.com/npm/cli/releases/tag/v11.17.0"
        }
      ]
    },
    {
      "month": "2026-05",
      "versions": "11.14.0 to 11.16.0 (4 releases)",
      "highlights": [
        {
          "text": "11.16.0: security fixes and tree-building reliability updates.",
          "url": "https://github.com/npm/cli/releases/tag/v11.16.0"
        },
        {
          "text": "11.14.0: SBOM CycloneDX improvements and Arborist dependency resolution enhancements.",
          "url": "https://github.com/npm/cli/releases/tag/v11.14.0"
        }
      ]
    }
  ],
  "sources": [
    {
      "title": "npm 12.2.0 release on GitHub",
      "url": "https://github.com/npm/cli/releases/tag/v12.2.0",
      "read": "2026-10-07"
    },
    {
      "title": "npm 12.2.0 release on npm registry",
      "url": "https://registry.npmjs.org/npm",
      "read": "2026-10-07"
    },
    {
      "title": "npm 12.1.0 release on GitHub",
      "url": "https://github.com/npm/cli/releases/tag/v12.1.0",
      "read": "2026-10-07"
    },
    {
      "title": "npm 11.20.0 release on GitHub",
      "url": "https://github.com/npm/cli/releases/tag/v11.20.0",
      "read": "2026-10-07"
    },
    {
      "title": "npm 11.19.1 release on GitHub",
      "url": "https://github.com/npm/cli/releases/tag/v11.19.1",
      "read": "2026-10-07"
    },
    {
      "title": "npm 12.0.2 release on GitHub",
      "url": "https://github.com/npm/cli/releases/tag/v12.0.2",
      "read": "2026-10-07"
    },
    {
      "title": "npm 11.19.0 release on GitHub",
      "url": "https://github.com/npm/cli/releases/tag/v11.19.0",
      "read": "2026-10-07"
    },
    {
      "title": "npm 10.9.9 release on GitHub",
      "url": "https://github.com/npm/cli/releases/tag/v10.9.9",
      "read": "2026-10-07"
    },
    {
      "title": "npm 12.0.1 release on GitHub",
      "url": "https://github.com/npm/cli/releases/tag/v12.0.1",
      "read": "2026-10-07"
    },
    {
      "title": "npm 12.0.0 release on GitHub",
      "url": "https://github.com/npm/cli/releases/tag/v12.0.0",
      "read": "2026-10-07"
    },
    {
      "title": "npm 11.18.0 release on GitHub",
      "url": "https://github.com/npm/cli/releases/tag/v11.18.0",
      "read": "2026-10-07"
    },
    {
      "title": "npm 11.17.0 release on GitHub",
      "url": "https://github.com/npm/cli/releases/tag/v11.17.0",
      "read": "2026-10-07"
    },
    {
      "title": "PR #10038: dist-tag: support OIDC authentication",
      "url": "https://github.com/npm/cli/pull/10038",
      "read": "2026-10-07"
    },
    {
      "title": "PR #10017: update npm stage docs to reflect that it can create new packages",
      "url": "https://github.com/npm/cli/pull/10017",
      "read": "2026-10-07"
    },
    {
      "title": "PR #9948: token: support read-write-stage-only granular access tokens",
      "url": "https://github.com/npm/cli/pull/9948",
      "read": "2026-10-07"
    },
    {
      "title": "PR #9898: stage: display staged package status",
      "url": "https://github.com/npm/cli/pull/9898",
      "read": "2026-10-07"
    },
    {
      "title": "PR #9882: provenance-file takes precedence over OIDC auto-generated provenance",
      "url": "https://github.com/npm/cli/pull/9882",
      "read": "2026-10-07"
    },
    {
      "title": "PR #9913: config: avoid exporting persistent allow-scripts",
      "url": "https://github.com/npm/cli/pull/9913",
      "read": "2026-10-07"
    },
    {
      "title": "PR #9914: arborist: match allowScripts keys for local paths",
      "url": "https://github.com/npm/cli/pull/9914",
      "read": "2026-10-07"
    },
    {
      "title": "PR #9760: pack: honor min-release-age-exclude",
      "url": "https://github.com/npm/cli/pull/9760",
      "read": "2026-10-07"
    },
    {
      "title": "PR #9786: owner: use scoped registry for user lookup",
      "url": "https://github.com/npm/cli/pull/9786",
      "read": "2026-10-07"
    },
    {
      "title": "PR #9805: clarify npm 12 unknown-config breaking change in changelogs",
      "url": "https://github.com/npm/cli/pull/9805",
      "read": "2026-10-07"
    },
    {
      "title": "PR #9745: view: avoid wrapping array results",
      "url": "https://github.com/npm/cli/pull/9745",
      "read": "2026-10-07"
    },
    {
      "title": "GitHub Changelog: Upcoming breaking changes for npm v12",
      "url": "https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/",
      "read": "2026-10-07"
    },
    {
      "title": "Node.js releases and bundled npm versions index",
      "url": "https://nodejs.org/dist/index.json",
      "read": "2026-10-07"
    },
    {
      "title": "npm registry weekly download statistics",
      "url": "https://api.npmjs.org/downloads/point/last-week/npm",
      "read": "2026-10-07"
    },
    {
      "title": "npm/cli repository metadata (stars, license)",
      "url": "https://api.github.com/repos/npm/cli",
      "read": "2026-10-07"
    },
    {
      "title": "npm package.json at v12.2.0 (engines, license)",
      "url": "https://github.com/npm/cli/blob/v12.2.0/package.json",
      "read": "2026-10-07"
    },
    {
      "title": "npm lib/commands/patch.js at v12.2.0",
      "url": "https://github.com/npm/cli/blob/v12.2.0/lib/commands/patch.js",
      "read": "2026-10-07"
    },
    {
      "title": "npm lib/commands/install-scripts.js at v12.2.0",
      "url": "https://github.com/npm/cli/blob/v12.2.0/lib/commands/install-scripts.js",
      "read": "2026-10-07"
    },
    {
      "title": "npm lib/utils/reify-output.js at v12.2.0 (unreviewedScripts warning)",
      "url": "https://github.com/npm/cli/blob/v12.2.0/lib/utils/reify-output.js",
      "read": "2026-10-07"
    },
    {
      "title": "npm lib/utils/check-allow-scripts.js at v12.2.0",
      "url": "https://github.com/npm/cli/blob/v12.2.0/lib/utils/check-allow-scripts.js",
      "read": "2026-10-07"
    },
    {
      "title": "npm lib/utils/allow-scripts-remediation.js at v12.2.0",
      "url": "https://github.com/npm/cli/blob/v12.2.0/lib/utils/allow-scripts-remediation.js",
      "read": "2026-10-07"
    },
    {
      "title": "npm lib/utils/cmd-list.js at v12.2.0 (authoritative commands)",
      "url": "https://github.com/npm/cli/blob/v12.2.0/lib/utils/cmd-list.js",
      "read": "2026-10-07"
    },
    {
      "title": "npm lib/base-cmd.js at v12.2.0 (validateCli, EUNKNOWNCONFIG)",
      "url": "https://github.com/npm/cli/blob/v12.2.0/lib/base-cmd.js",
      "read": "2026-10-07"
    },
    {
      "title": "npm workspaces/config/lib/index.js at v12.2.0",
      "url": "https://github.com/npm/cli/blob/v12.2.0/workspaces/config/lib/index.js",
      "read": "2026-10-07"
    },
    {
      "title": "npm workspaces/config definitions at v12.2.0 (allow-git, allow-remote, strict-npmrc)",
      "url": "https://github.com/npm/cli/blob/v12.2.0/workspaces/config/lib/definitions/definitions.js",
      "read": "2026-10-07"
    },
    {
      "title": "npm workspaces/arborist build-ideal-tree.js at v12.2.0 (#checkAllow, EALLOWGIT, EALLOWREMOTE)",
      "url": "https://github.com/npm/cli/blob/v12.2.0/workspaces/arborist/lib/arborist/build-ideal-tree.js",
      "read": "2026-10-07"
    }
  ],
  "fixes": []
}