chore: release 11.18.0

.release-please-manifest.json

@@ -1,15 +1,15 @@
 {
-  ".": "11.17.0",
-  "workspaces/arborist": "9.8.0",
+  ".": "11.18.0",
+  "workspaces/arborist": "9.9.0",
   "workspaces/libnpmaccess": "10.0.3",
-  "workspaces/libnpmdiff": "8.1.10",
-  "workspaces/libnpmexec": "10.3.0",
-  "workspaces/libnpmfund": "7.0.24",
+  "workspaces/libnpmdiff": "8.1.11",
+  "workspaces/libnpmexec": "10.3.1",
+  "workspaces/libnpmfund": "7.0.25",
   "workspaces/libnpmorg": "8.0.1",
-  "workspaces/libnpmpack": "9.1.10",
+  "workspaces/libnpmpack": "9.1.11",
   "workspaces/libnpmpublish": "11.2.0",
   "workspaces/libnpmsearch": "9.0.1",
   "workspaces/libnpmteam": "8.0.2",
   "workspaces/libnpmversion": "8.0.4",
-  "workspaces/config": "10.11.0"
+  "workspaces/config": "10.12.0"
 }

CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [11.18.0](https://github.com/npm/cli/compare/v11.17.0...v11.18.0) (2026-06-25)
+### Features
+* [`9420673`](https://github.com/npm/cli/commit/9420673bcdc59c4acb35c406308bb641c2aef635) [#9662](https://github.com/npm/cli/pull/9662) install-scripts: prune unused allowScripts entries (#9662) (@github-actions[bot], @JamieMagee)
+* [`fc9d4c7`](https://github.com/npm/cli/commit/fc9d4c72d8ee300a843e8186c5fc39e9c3e874ae) [#9635](https://github.com/npm/cli/pull/9635) namespace install-script approval commands under npm install-scripts (#9635) (@manzoorwanijk)
+* [`073253f`](https://github.com/npm/cli/commit/073253f8642d1177000b8d18ebe0abcad2ac9b1a) [#9564](https://github.com/npm/cli/pull/9564) warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)
+### Bug Fixes
+* [`168ba30`](https://github.com/npm/cli/commit/168ba30915a844075d9217de46030a8f6ce09903) [#9663](https://github.com/npm/cli/pull/9663) allowScripts: close enforcement gaps (#9652) (backport release/v11) (#9663) (@JamieMagee)
+* [`ae64f88`](https://github.com/npm/cli/commit/ae64f883f8345f53cb20f968fafffbb2e6d0c9f6) [#9648](https://github.com/npm/cli/pull/9648) exec: resolve workspace-local bin under the linked install strategy (#9648) (@github-actions[bot], @manzoorwanijk)
+* [`784cbe9`](https://github.com/npm/cli/commit/784cbe99c3e35b128ee0a5e6ff569517305a5c33) [#9636](https://github.com/npm/cli/pull/9636) ls: restore 100% coverage on release/v11 after #9633 (#9636) (@manzoorwanijk)
+* [`70f0ea5`](https://github.com/npm/cli/commit/70f0ea5a0642919f8d2bee9c3c61490e12846b4e) [#9607](https://github.com/npm/cli/pull/9607) approve-scripts: approve deps with no resolved URL by name (#9607) (@github-actions[bot], @JamieMagee)
+* [`b2e6338`](https://github.com/npm/cli/commit/b2e63385c991cfc1430e8e5c347f33a7fd47e0e9) [#9602](https://github.com/npm/cli/pull/9602) arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)
+* [`6ad5715`](https://github.com/npm/cli/commit/6ad5715c6500b388c64f76826a5038db990aea3a) [#9595](https://github.com/npm/cli/pull/9595) link: scope `npm link <path> --workspace` to the workspace, not the root (#9595) (@github-actions[bot], @manzoorwanijk)
+### Dependencies
+* [`804f9ba`](https://github.com/npm/cli/commit/804f9badd99c5c530db0a6c288b18104512d10c3) [#9580](https://github.com/npm/cli/pull/9580) `npm-profile@12.0.2`
+### Chores
+* [`a04cd84`](https://github.com/npm/cli/commit/a04cd845e9784ac8a03c1db721dc7a366eadb4f1) [#9584](https://github.com/npm/cli/pull/9584) add web-login proxy doneUrl regression for npm-profile fix (#9584) (@github-actions[bot], @manzoorwanijk)
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0`
+* [workspace](https://github.com/npm/cli/releases/tag/config-v10.12.0): `@npmcli/config@10.12.0`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.11): `libnpmdiff@8.1.11`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.1): `libnpmexec@10.3.1`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.25): `libnpmfund@7.0.25`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.11): `libnpmpack@9.1.11`
+
 ## [11.17.0](https://github.com/npm/cli/compare/v11.16.0...v11.17.0) (2026-06-11)
 ### Features
 * [`ae8ac4e`](https://github.com/npm/cli/commit/ae8ac4ea39776f74551fc850f4a5e766b81c5545) [#9534](https://github.com/npm/cli/pull/9534) add min-release-age-exclude config (@JamieMagee, @caseyjhol)

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "npm",
-  "version": "11.17.0",
+  "version": "11.18.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "npm",
-      "version": "11.17.0",
+      "version": "11.18.0",
       "bundleDependencies": [
         "@isaacs/string-locale-compare",
         "@npmcli/arborist",
@@ -84,8 +84,8 @@
       ],
       "dependencies": {
         "@isaacs/string-locale-compare": "^1.1.0",
-        "@npmcli/arborist": "^9.8.0",
-        "@npmcli/config": "^10.11.0",
+        "@npmcli/arborist": "^9.9.0",
+        "@npmcli/config": "^10.12.0",
         "@npmcli/fs": "^5.0.0",
         "@npmcli/map-workspaces": "^5.0.3",
         "@npmcli/metavuln-calculator": "^9.0.3",
@@ -109,11 +109,11 @@
         "is-cidr": "^6.0.4",
         "json-parse-even-better-errors": "^5.0.0",
         "libnpmaccess": "^10.0.3",
-        "libnpmdiff": "^8.1.10",
-        "libnpmexec": "^10.3.0",
-        "libnpmfund": "^7.0.24",
+        "libnpmdiff": "^8.1.11",
+        "libnpmexec": "^10.3.1",
+        "libnpmfund": "^7.0.25",
         "libnpmorg": "^8.0.1",
-        "libnpmpack": "^9.1.10",
+        "libnpmpack": "^9.1.11",
         "libnpmpublish": "^11.2.0",
         "libnpmsearch": "^9.0.1",
         "libnpmteam": "^8.0.2",
@@ -14306,7 +14306,7 @@
     },
     "workspaces/arborist": {
       "name": "@npmcli/arborist",
-      "version": "9.8.0",
+      "version": "9.9.0",
       "license": "ISC",
       "dependencies": {
         "@gar/promise-retry": "^1.0.0",
@@ -14364,7 +14364,7 @@
     },
     "workspaces/config": {
       "name": "@npmcli/config",
-      "version": "10.11.0",
+      "version": "10.12.0",
       "license": "ISC",
       "dependencies": {
         "@npmcli/map-workspaces": "^5.0.0",
@@ -14404,10 +14404,10 @@
       }
     },
     "workspaces/libnpmdiff": {
-      "version": "8.1.10",
+      "version": "8.1.11",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.8.0",
+        "@npmcli/arborist": "^9.9.0",
         "@npmcli/installed-package-contents": "^4.0.0",
         "binary-extensions": "^3.0.0",
         "diff": "^8.0.2",
@@ -14426,11 +14426,11 @@
       }
     },
     "workspaces/libnpmexec": {
-      "version": "10.3.0",
+      "version": "10.3.1",
       "license": "ISC",
       "dependencies": {
         "@gar/promise-retry": "^1.0.0",
-        "@npmcli/arborist": "^9.8.0",
+        "@npmcli/arborist": "^9.9.0",
         "@npmcli/package-json": "^7.0.0",
         "@npmcli/run-script": "^10.0.0",
         "ci-info": "^4.0.0",
@@ -14457,10 +14457,10 @@
       }
     },
     "workspaces/libnpmfund": {
-      "version": "7.0.24",
+      "version": "7.0.25",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.8.0"
+        "@npmcli/arborist": "^9.9.0"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^5.0.1",
@@ -14490,10 +14490,10 @@
       }
     },
     "workspaces/libnpmpack": {
-      "version": "9.1.10",
+      "version": "9.1.11",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.8.0",
+        "@npmcli/arborist": "^9.9.0",
         "@npmcli/run-script": "^10.0.0",
         "npm-package-arg": "^13.0.0",
         "pacote": "^21.0.2"

package.json

@@ -1,5 +1,5 @@
 {
-  "version": "11.17.0",
+  "version": "11.18.0",
   "name": "npm",
   "description": "a package manager for JavaScript",
   "workspaces": [
@@ -52,8 +52,8 @@
   },
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",
-    "@npmcli/arborist": "^9.8.0",
-    "@npmcli/config": "^10.11.0",
+    "@npmcli/arborist": "^9.9.0",
+    "@npmcli/config": "^10.12.0",
     "@npmcli/fs": "^5.0.0",
     "@npmcli/map-workspaces": "^5.0.3",
     "@npmcli/metavuln-calculator": "^9.0.3",
@@ -77,11 +77,11 @@
     "is-cidr": "^6.0.4",
     "json-parse-even-better-errors": "^5.0.0",
     "libnpmaccess": "^10.0.3",
-    "libnpmdiff": "^8.1.10",
-    "libnpmexec": "^10.3.0",
-    "libnpmfund": "^7.0.24",
+    "libnpmdiff": "^8.1.11",
+    "libnpmexec": "^10.3.1",
+    "libnpmfund": "^7.0.25",
     "libnpmorg": "^8.0.1",
-    "libnpmpack": "^9.1.10",
+    "libnpmpack": "^9.1.11",
     "libnpmpublish": "^11.2.0",
     "libnpmsearch": "^9.0.1",
     "libnpmteam": "^8.0.2",

workspaces/arborist/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [9.9.0](https://github.com/npm/cli/compare/arborist-v9.8.0...arborist-v9.9.0) (2026-06-25)
+### Features
+* [`9420673`](https://github.com/npm/cli/commit/9420673bcdc59c4acb35c406308bb641c2aef635) [#9662](https://github.com/npm/cli/pull/9662) install-scripts: prune unused allowScripts entries (#9662) (@github-actions[bot], @JamieMagee)
+* [`073253f`](https://github.com/npm/cli/commit/073253f8642d1177000b8d18ebe0abcad2ac9b1a) [#9564](https://github.com/npm/cli/pull/9564) warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)
+### Bug Fixes
+* [`168ba30`](https://github.com/npm/cli/commit/168ba30915a844075d9217de46030a8f6ce09903) [#9663](https://github.com/npm/cli/pull/9663) allowScripts: close enforcement gaps (#9652) (backport release/v11) (#9663) (@JamieMagee)
+* [`4c9eacb`](https://github.com/npm/cli/commit/4c9eacb8e3ebf4485cba5734f1aa16060e271cda) [#9649](https://github.com/npm/cli/pull/9649) arborist: clean up stale .store and hoisted dirs on strategy switch (#9649) (@github-actions[bot], @manzoorwanijk)
+* [`d2c680e`](https://github.com/npm/cli/commit/d2c680ea687b535b1fa47dd8512b5d3445d1f56f) [#9645](https://github.com/npm/cli/pull/9645) arborist: invalid filterNode crash under the linked strategy (#9645) (@github-actions[bot], @manzoorwanijk)
+* [`4e40b1c`](https://github.com/npm/cli/commit/4e40b1c03cfc3a17c04e81717d420631255d21b9) [#9644](https://github.com/npm/cli/pull/9644) arborist: repair wrong-but-existing symlink target in linked strategy (#9644) (@github-actions[bot], @manzoorwanijk)
+* [`9d1774e`](https://github.com/npm/cli/commit/9d1774e6fca23ca16a2817068416c92140c1a48d) [#9643](https://github.com/npm/cli/pull/9643) arborist: remove stale .bin shims after uninstall under linked (#9643) (@github-actions[bot], @manzoorwanijk)
+* [`ed37d24`](https://github.com/npm/cli/commit/ed37d24c11622c147b69602ba154286acd662d7a) [#9642](https://github.com/npm/cli/pull/9642) arborist: record the linked .store layout in the hidden lockfile (backport #9630) (#9642) (@manzoorwanijk)
+* [`e601d4a`](https://github.com/npm/cli/commit/e601d4ad7a8e45e6e2b2f5dcb2bfc264965fbd1b) [#9641](https://github.com/npm/cli/pull/9641) arborist: validate peerOptional conflicts in no-save mutations (#9641) (@owlstronaut, @dale-lakes, @dale-lakes)
+* [`03cee43`](https://github.com/npm/cli/commit/03cee437c2c2d6d32ed3a8c28753d02dfbe7f9f0) [#9638](https://github.com/npm/cli/pull/9638) arborist: fix audit-report determinism due to dropped via links (#9638) (@github-actions[bot], @arjun-vegeta)
+* [`a30d855`](https://github.com/npm/cli/commit/a30d8559ca4aa26704c2d962c9c4dbcc0366ef67) [#9633](https://github.com/npm/cli/pull/9633) arborist: don't load store packages' devDependencies as required edges (#9633) (@manzoorwanijk)
+* [`887ca97`](https://github.com/npm/cli/commit/887ca9720915de0eeb4f1a24eff6b923b8d39c92) [#9631](https://github.com/npm/cli/pull/9631) arborist: audit the non-isolated tree under the linked strategy (#9631) (@github-actions[bot], @manzoorwanijk)
+* [`b2e6338`](https://github.com/npm/cli/commit/b2e63385c991cfc1430e8e5c347f33a7fd47e0e9) [#9602](https://github.com/npm/cli/pull/9602) arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)
+* [`390ebfa`](https://github.com/npm/cli/commit/390ebfa6b89f51259aa2ae1c19b9e13a520b1fb5) [#9593](https://github.com/npm/cli/pull/9593) arborist: symlink workspace file: deps on non-workspace local packages (#9593) (@github-actions[bot], @manzoorwanijk)
+* [`aaeb2f1`](https://github.com/npm/cli/commit/aaeb2f19548c47e7bc262e4aa9c76b93376fac82) [#9578](https://github.com/npm/cli/pull/9578) arborist: expose store node_modules via NODE_PATH for linked-strategy install scripts (#9578) (@github-actions[bot], @manzoorwanijk)
+* [`05b6f0f`](https://github.com/npm/cli/commit/05b6f0f5bb356891678eb7d3840b6899f04fbfaf) [#9577](https://github.com/npm/cli/pull/9577) arborist: allow-remote exemption for proxy/mirror-fronted registry tarballs (#9577) (@github-actions[bot], @manzoorwanijk)
+
 ## [9.8.0](https://github.com/npm/cli/compare/arborist-v9.7.0...arborist-v9.8.0) (2026-06-11)
 ### Features
 * [`ae8ac4e`](https://github.com/npm/cli/commit/ae8ac4ea39776f74551fc850f4a5e766b81c5545) [#9534](https://github.com/npm/cli/pull/9534) add min-release-age-exclude config (@JamieMagee, @caseyjhol)

workspaces/arborist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/arborist",
-  "version": "9.8.0",
+  "version": "9.9.0",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@gar/promise-retry": "^1.0.0",

workspaces/config/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [10.12.0](https://github.com/npm/cli/compare/config-v10.11.0...config-v10.12.0) (2026-06-25)
+### Features
+* [`073253f`](https://github.com/npm/cli/commit/073253f8642d1177000b8d18ebe0abcad2ac9b1a) [#9564](https://github.com/npm/cli/pull/9564) warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)
+### Bug Fixes
+* [`b2e6338`](https://github.com/npm/cli/commit/b2e63385c991cfc1430e8e5c347f33a7fd47e0e9) [#9602](https://github.com/npm/cli/pull/9602) arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)
+
 ## [10.11.0](https://github.com/npm/cli/compare/config-v10.10.0...config-v10.11.0) (2026-06-11)
 ### Features
 * [`5f73e31`](https://github.com/npm/cli/commit/5f73e3111a39646f549bad7e39b9c3a9b69865cb) [#9539](https://github.com/npm/cli/pull/9539) differentiate GitHub Actions environments in user-agent (#9517) (@reggi, @Copilot)

workspaces/config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/config",
-  "version": "10.11.0",
+  "version": "10.12.0",
   "files": [
     "bin/",
     "lib/"

workspaces/libnpmdiff/CHANGELOG.md

@@ -84,6 +84,10 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.8.0): `@npmcli/arborist@9.8.0`
 
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0`
+
 ## [8.1.0](https://github.com/npm/cli/compare/libnpmdiff-v8.0.13...libnpmdiff-v8.1.0) (2026-02-04)
 ### Features
 * [`f5f6cf7`](https://github.com/npm/cli/commit/f5f6cf7c9fc9315b96eb29c5c7d5ab63ad3a9122) [#8943](https://github.com/npm/cli/pull/8943) config: add --allow-git (@wraithgar)

workspaces/libnpmdiff/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmdiff",
-  "version": "8.1.10",
+  "version": "8.1.11",
   "description": "The registry diff",
   "repository": {
     "type": "git",
@@ -47,7 +47,7 @@
     "tap": "^16.3.8"
   },
   "dependencies": {
-    "@npmcli/arborist": "^9.8.0",
+    "@npmcli/arborist": "^9.9.0",
     "@npmcli/installed-package-contents": "^4.0.0",
     "binary-extensions": "^3.0.0",
     "diff": "^8.0.2",

workspaces/libnpmexec/CHANGELOG.md

@@ -48,6 +48,15 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0`
 
+## [10.3.1](https://github.com/npm/cli/compare/libnpmexec-v10.3.0...libnpmexec-v10.3.1) (2026-06-25)
+### Bug Fixes
+* [`b2e6338`](https://github.com/npm/cli/commit/b2e63385c991cfc1430e8e5c347f33a7fd47e0e9) [#9602](https://github.com/npm/cli/pull/9602) arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)
+
+
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0`
+
 ## [10.3.0](https://github.com/npm/cli/compare/libnpmexec-v10.2.9...libnpmexec-v10.3.0) (2026-06-11)
 ### Features
 * [`8ff3e48`](https://github.com/npm/cli/commit/8ff3e48113a53576a8d450d7d5a1cb190a1986e1) [#9483](https://github.com/npm/cli/pull/9483) allowScripts tooling and inBundle hardening (#9483) (@github-actions[bot], @JamieMagee)

workspaces/libnpmexec/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmexec",
-  "version": "10.3.0",
+  "version": "10.3.1",
   "files": [
     "bin/",
     "lib/"
@@ -61,7 +61,7 @@
   },
   "dependencies": {
     "@gar/promise-retry": "^1.0.0",
-    "@npmcli/arborist": "^9.8.0",
+    "@npmcli/arborist": "^9.9.0",
     "@npmcli/package-json": "^7.0.0",
     "@npmcli/run-script": "^10.0.0",
     "ci-info": "^4.0.0",

workspaces/libnpmfund/CHANGELOG.md

@@ -108,6 +108,10 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.8.0): `@npmcli/arborist@9.8.0`
 
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0`
+
 ## [7.0.0](https://github.com/npm/cli/compare/libnpmfund-v7.0.0-pre.1...libnpmfund-v7.0.0) (2024-12-16)
 ### Features
 * [`a7bfc6d`](https://github.com/npm/cli/commit/a7bfc6df76882996ebb834dbca785fdf33b8c50d) [#7972](https://github.com/npm/cli/pull/7972) trigger release process (#7972) (@wraithgar)

workspaces/libnpmfund/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmfund",
-  "version": "7.0.24",
+  "version": "7.0.25",
   "main": "lib/index.js",
   "files": [
     "bin/",
@@ -46,7 +46,7 @@
     "tap": "^16.3.8"
   },
   "dependencies": {
-    "@npmcli/arborist": "^9.8.0"
+    "@npmcli/arborist": "^9.9.0"
   },
   "engines": {
     "node": "^20.17.0 || >=22.9.0"

workspaces/libnpmpack/CHANGELOG.md

@@ -88,6 +88,10 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/arborist@9.7.0`
 
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/arborist@9.9.0`
+
 ## [9.1.10](https://github.com/npm/cli/compare/libnpmpack-v9.1.9...libnpmpack-v9.1.10) (2026-06-11)
 ### Bug Fixes
 * [`33d421a`](https://github.com/npm/cli/commit/33d421a6fd56fc549e68c6b91adb32e3bb6073f4) [#9468](https://github.com/npm/cli/pull/9468) flatten path separators in pack output filename (#9468) (@github-actions[bot], @rootvector2)

workspaces/libnpmpack/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmpack",
-  "version": "9.1.10",
+  "version": "9.1.11",
   "description": "Programmatic API for the bits behind npm pack",
   "author": "GitHub Inc.",
   "main": "lib/index.js",
@@ -37,7 +37,7 @@
   "bugs": "https://github.com/npm/libnpmpack/issues",
   "homepage": "https://npmjs.com/package/libnpmpack",
   "dependencies": {
-    "@npmcli/arborist": "^9.8.0",
+    "@npmcli/arborist": "^9.9.0",
     "@npmcli/run-script": "^10.0.0",
     "npm-package-arg": "^13.0.0",
     "pacote": "^21.0.2"