npm/cli config-v11.0.0-pre.1 on GitHub

11.0.0-pre.1 (2026-06-19)

The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning.

1db885c #9439 native dependency patching (npm patch add/commit/update/ls/rm) (#9439) (@manzoorwanijk)
fc80bb3 #9234 remove default license for npm init (@owlstronaut)
be8053c #9544 warn when min-release-age blocks an audit fix (#9544) (@JamieMagee)
18eb967 #9559 bump to new node engine range (@owlstronaut)
c3e1a71 #9532 add min-release-age-exclude config (@JamieMagee, @caseyjhol)
f6a9aad #9517 differentiate GitHub Actions environments in user-agent (#9517) (@reggi, @Copilot)
5cd5150 #9424 default-deny install scripts (allowScripts opt-in) [v12] (@JamieMagee)
caa3295 #9466 default allow-git and allow-remote to none (@owlstronaut)
f2e4a28 #9351 add a global npmignore file (#9351) (@ljharb)
c9be2d1 #9153 publish --access=private alias for restricted (#9153) (@reggi, @Copilot)
7068d42 #9360 Phase 1 of allowScripts opt-in install-script policy (#9360) (@JamieMagee)
979518d #9276 error on unknown configs, flags, and abbreviations (#9276) (@owlstronaut)

9b5c7b0 #9521 config: strict-allow-scripts default blocks with a warning, not silently (@JamieMagee)
6efac6e #9453 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@JamieMagee)
c5292fa #9422 use prerelease strategy without a bug (@owlstronaut)