NPM Files

11.20.0 (2026-09-21)

Features

• 0b3c699 #9994 token: support read-write-stage-only granular access tokens (#9994) (@github-actions[bot], @Tayvon, @Copilot)
• b872816 #9920 stage: display staged package status (#9920) (@github-actions[bot], @joelverhagen)

Bug Fixes

• ddbadfc #9947 provenance-file takes precedence over OIDC auto-generated provenance (#9947) (@github-actions[bot], @yunseo-kim)
• 64d4b4b #9937 config: avoid exporting persistent allow-scripts (#9937) (@github-actions[bot], @Fnine59)
• 70317da #9930 arborist: reject uninstall args that carry a version (#9930) (@github-actions[bot], @lazerg)
• 55ae484 #9929 arborist: match allowScripts keys for local paths (#9929) (@github-actions[bot], @martinrrm, @Copilot)
• 7f1f2b7 #9928 keep dry-run output valid json (#9928) (@github-actions[bot], @martinrrm)
• f28cca9 #9927 don't print the funding message for global installs (#9927) (@github-actions[bot], @lazerg)

Chores

• 6ff3000 #10010 pack: select workspace through config (#10010) (@github-actions[bot], @reggi)
• afdc5bd #9932 pass nodedir to node-gyp via npm_package_config env in node integration (#9932) (@reggi)
• 83f95ff #9931 update node-integration workflow template to latest actions (#9931) (@reggi)
• f020fba #9925 recognize prefixed Node.js PR titles (#9925) (@github-actions[bot], @reggi)

Dependencies

• workspace: @npmcli/arborist@9.9.2
• workspace: @npmcli/config@10.13.0
• workspace: libnpmdiff@8.1.13
• workspace: libnpmexec@10.3.3
• workspace: libnpmfund@7.0.27
• workspace: libnpmpack@9.1.14
• workspace: libnpmpublish@11.2.1