11.20.0 (2026-09-21)
Features
0b3c699#9994 token: support read-write-stage-only granular access tokens (#9994) (@github-actions[bot], @Tayvon, @Copilot)b872816#9920 stage: display staged package status (#9920) (@github-actions[bot], @joelverhagen)
Bug Fixes
ddbadfc#9947 provenance-file takes precedence over OIDC auto-generated provenance (#9947) (@github-actions[bot], @yunseo-kim)64d4b4b#9937 config: avoid exporting persistent allow-scripts (#9937) (@github-actions[bot], @Fnine59)70317da#9930 arborist: reject uninstall args that carry a version (#9930) (@github-actions[bot], @lazerg)55ae484#9929 arborist: match allowScripts keys for local paths (#9929) (@github-actions[bot], @martinrrm, @Copilot)7f1f2b7#9928 keep dry-run output valid json (#9928) (@github-actions[bot], @martinrrm)f28cca9#9927 don't print the funding message for global installs (#9927) (@github-actions[bot], @lazerg)
Chores
6ff3000#10010 pack: select workspace through config (#10010) (@github-actions[bot], @reggi)afdc5bd#9932 pass nodedir to node-gyp via npm_package_config env in node integration (#9932) (@reggi)83f95ff#9931 updatenode-integrationworkflow template to latest actions (#9931) (@reggi)f020fba#9925 recognize prefixed Node.js PR titles (#9925) (@github-actions[bot], @reggi)