10.0.0-pre.1 (2026-06-19)
⚠️ BREAKING CHANGES
- Preserve https protocol when working with git (#8703)
npmnow supports node^22.22.2 || ^24.15.0 || >=26.0.0
Features
ce7681f#9496 packageExtensions for root-owned dependency manifest repairs (#9496) (@manzoorwanijk)1db885c#9439 native dependency patching (npm patch add/commit/update/ls/rm) (#9439) (@manzoorwanijk)be8053c#9544 warn when min-release-age blocks an audit fix (#9544) (@JamieMagee)18eb967#9559 bump to new node engine range (@owlstronaut)c3e1a71#9532 add min-release-age-exclude config (@JamieMagee, @caseyjhol)5cd5150#9424 default-deny install scripts (allowScripts opt-in) [v12] (@JamieMagee)64e3f79#9480 allowScripts tooling and inBundle hardening (#9480) (@JamieMagee)7068d42#9360 Phase 1 ofallowScriptsopt-in install-script policy (#9360) (@JamieMagee)
Bug Fixes
e96a7de#8703 Preserve https protocol when working with git (#8703) (@oldium)afce424#9551 arborist: expose store node_modules via NODE_PATH for linked-strategy install scripts (#9551) (@manzoorwanijk)8bbd70d#9550 arborist: allow-remote exemption for proxy/mirror-fronted registry tarballs (#9550) (@manzoorwanijk)315e3bd#9574 arborist: drop orphaned patch entry on uninstall instead of EPATCHUNUSED (#9574) (@manzoorwanijk)62b0694#9576 patch: explain out-of-sync lockfile after --ignore-patch-failures (#9576) (@manzoorwanijk)cfda867#9570 arborist: warn once for workspace packageExtensions selector match (#9570) (@manzoorwanijk)f9c977c#9569 arborist: re-apply packageExtensions to the linked actual tree (#9569) (@manzoorwanijk)fc3ef5a#9559 adapt to @npmcli/run-script@11 breaking changes (@owlstronaut)fc6268a#9523 keep nested file: deps and re-resolve changed git refs (#9523) (@owlstronaut)34dbdf5#9525 arborist: enforce allowScripts for file:/link: dep scripts (@JamieMagee)d70e116#9510 arborist: honor allow-remote=root for root-direct remote tarballs (#9510) (@manzoorwanijk)4bcba54#9495 arborist: apply registry-tarball allow-remote exemption in linked strategy (#9495) (@manzoorwanijk)2cbb13b#9490 recognize allowScripts for local link targets (#9490) (@cyphercodes, @cyphercodes)bf623e0#9473 validate registry path for allow-remote tarballs (@Abhinav-143x)a105799#9461 arborist: link meta-only optional peers in linked strategy (@manzoorwanijk)275bc69#9441 arborist: clean up orphaned scoped store entries in linked strategy (@manzoorwanijk)9f3c97f#9452 sanitize package name in linked-strategy path construction (@owlstronaut)a81f2f8#9428 arborist: read install scripts from disk on lockfile installs instead of a sentinel (@JamieMagee)c5292fa#9422 use prerelease strategy without a bug (@owlstronaut)dac7ff6#9399 arborist: drop self-link materialization for undeclared workspaces (#9399) (@manzoorwanijk)b77850e#9395 skip hidden lockfile save on dry run (#9395) (@puneetdixit200, @puneetdixit200)
Dependencies
cc45055#9559@npmcli/node-gyp@6.0.0a12e2c8#9559@npmcli/name-from-folder@5.0.0cc96d57#9559@npmcli/installed-package-contents@5.0.0b62db95#9559bin-links@7.0.02f5da83#9559@npmcli/fs@6.0.01502286#9559ssri@14.0.021df0ab#9559proc-log@7.0.08f85646#9559parse-conflict-json@6.0.0a44c1cf#9559pacote@22.0.01f9c567#9559npm-registry-fetch@20.0.1998ff1d#9559npm-pick-manifest@12.0.0d80859a#9559npm-package-arg@14.0.05e1d513#9559npm-install-checks@9.0.0471309f#9559nopt@10.0.1d867351#9559hosted-git-info@10.1.166d46bc#9559cacache@21.0.19d13ebf#9559@npmcli/run-script@11.0.027c4dcc#9559@npmcli/redact@5.0.00be6ae2#9559@npmcli/package-json@8.0.0f86a019#9559@npmcli/metavuln-calculator@10.0.04d234b2#9559@npmcli/map-workspaces@6.0.0
Chores
1453954#9559nock@14.0.0(@owlstronaut)0323f2d#9559 template-oss-apply (@owlstronaut)ee3d87f#9559@npmcli/template-oss@5.1.1(@owlstronaut)d25a179#9559 template-oss-apply (@owlstronaut)