11.17.0 (2026-06-11)
Features
ae8ac4e#9534 add min-release-age-exclude config (@JamieMagee, @caseyjhol)8ff3e48#9483 allowScripts tooling and inBundle hardening (#9483) (@github-actions[bot], @JamieMagee)
Bug Fixes
847cdf8#9541 match dotted and versioned args in approve-scripts/deny-scripts (@owlstronaut)d99f7cb#9535 emit valid JSON from approve-scripts/deny-scripts --json (@owlstronaut)351a309#9499 pass script-shell to publish lifecycle hooks (#9499) (@github-actions[bot])4fa81df#9497 recognize allowScripts for local link targets (#9497) (@github-actions[bot], @cyphercodes, @cyphercodes)95cf2e9#9489 validate registry path for allow-remote tarballs (@Abhinav-143x)9dd219b#9462 respect allowScripts policy in prune, dedupe, uninstall, audit, and link (#9462) (@github-actions[bot], @JamieMagee)cd8d18a#9482 list pending scripts in approve-scripts when ignore-scripts is set (#9482) (@github-actions[bot], @JamieMagee)c14e87c#9481 suggest --allow-scripts for global installs in unreviewed-scripts warnings (#9481) (@github-actions[bot], @JamieMagee)7ade52e#9465 invalid issue template YAML indentation (#9465) (@github-actions[bot], @fallintoplace)c069622#9464 show full parent command path in subcommand usage errors (#9464) (@owlstronaut)1bb62bb#9454 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@JamieMagee)84eeb5f#9431 audit: don't apply min-release-age before filter when verifying installed signatures (@JamieMagee)3bd3377#9426 block forbidden keys in Queryable setter to prevent prototype pollution (@12122J, @claude)
Documentation
a86a7a9#9522 approve-scripts only throws EGLOBAL when run with -g (@JamieMagee)693bb3d#9508 clarify package.json override value specs (#9508) (@github-actions[bot], @ded-furby)ccffe4a#9501 use the latest version for global update and outdated'swanted(#9501) (@github-actions[bot], @liangmiQwQ)66e97c2#9478 update minimum npm required for npm trust (@meeech)
Dependencies
bd09b87#9542postcss-selector-parser@7.1.495bfc4c#9542tinyglobby@0.2.178c0d5fd#9542tar@7.5.16967d377#9542semver@7.8.4cdaac1b#9542pacote@21.5.125c8a9e#9542node-gyp@12.4.0