Skip to content

fix(arborist): forward transitive overrides through linked store links - #9658

Merged
owlstronaut merged 1 commit into
npm:latestfrom
manzoorwanijk:fix/linked-transitive-override-invalid-ls
Jun 25, 2026
Merged

fix(arborist): forward transitive overrides through linked store links#9658
owlstronaut merged 1 commit into
npm:latestfrom
manzoorwanijk:fix/linked-transitive-override-invalid-ls

Conversation

@manzoorwanijk

@manzoorwanijk manzoorwanijk commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

In continuation of our exploration of using install-strategy=linked in the Gutenberg monorepo, which powers the WordPress Block Editor.

Under install-strategy=linked, an override that forces a transitive dependency to a version outside its dependent's declared range was applied on disk but reported as invalid by npm ls --all, which then exited 1 (ELSPROBLEMS). The hoisted strategy reports the same edge as overridden and exits 0. The bug only surfaced when the overridden package's dependent was itself a transitive (store) package — a direct dependency of the root was handled correctly.

npm ls rebuilds the actual tree from the .store layout, and an OverrideSet propagates down the tree through Link.recalculateOutEdgesOverrides, which forwards the set from a store symlink to its target node. A prior fix (#9357) gated that forwarding on a rule naming a direct dependency of the target, to avoid flipping an unrelated target to "has overrides" and making npm ci re-resolve lockfile-pinned edges. That gate was too narrow: a store link whose own direct deps do not name the overridden package never forwarded the set, so the chain to the deeper dependent → overridden edge never received the rule and was reported invalid.

The fix walks the target's subtree (following resolved edges, dereferencing links) and forwards the set when an override rule actually applies to any reachable edge, matched via getEdgeRule on name and spec so a non-applicable version-qualified rule still does not flip an intermediate node. Because override propagation is event-driven during load, a store link can run its check before its subtree is resolved; loadActual therefore re-forwards through links once the tree is complete, so the filesystem-scan path resolves transitive overrides as overridden rather than invalid.

References

Fixes #9619

@manzoorwanijk
manzoorwanijk marked this pull request as ready for review June 25, 2026 11:36
@manzoorwanijk
manzoorwanijk requested review from a team as code owners June 25, 2026 11:36
@owlstronaut
owlstronaut merged commit 541c286 into npm:latest Jun 25, 2026
24 checks passed
@github-actions

github-actions Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

⚠️ Backport to release/v11 failed.

This usually means the cherry-pick had conflicts. Please create a manual backport:

git fetch origin release/v11
git checkout -b backport/v11/9658 origin/release/v11
git cherry-pick -x 541c2865bf2a961554c889f5764bf182cc7f60e2
# resolve any conflicts, then:
git push origin backport/v11/9658
Error details 
Command failed: git cherry-pick -x 541c2865bf2a961554c889f5764bf182cc7f60e2
error: could not apply 541c2865b... fix(arborist): forward transitive overrides through linked store links (#9658)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

@github-actions github-actions Bot mentioned this pull request Jun 25, 2026
Merged
@manzoorwanijk
manzoorwanijk deleted the fix/linked-transitive-override-invalid-ls branch June 25, 2026 18:22
@owlstronaut

owlstronaut commented Jun 25, 2026

Copy link
Copy Markdown

@manzoorwanijk this'll need a backport

@manzoorwanijk

manzoorwanijk commented Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

Already on it...

@manzoorwanijk manzoorwanijk mentioned this pull request Jun 25, 2026
Merged
@manzoorwanijk

manzoorwanijk commented Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

Here you go #9668

owlstronaut pushed a commit that referenced this pull request Jun 25, 2026
@manzoorwanijk
fix(arborist): forward transitive overrides through linked store links (
ede32d3 
#9658) (backport release/v11) (#9668)

Backport of #9658 to `release/v11`.

Under `install-strategy=linked`, an override forcing a transitive
dependency outside its dependent's declared range was applied on disk
but reported as `invalid` by `npm ls --all`, which then exited 1
(`ELSPROBLEMS`); hoisted reports it as `overridden` and exits 0. It only
surfaced when the overridden package's dependent was itself a transitive
(store) package.

`Link.recalculateOutEdgesOverrides` only forwarded an OverrideSet to a
store link's target when a rule named a direct dependency of the target,
so the chain to a deeper `dependent -> overridden` edge never received
the rule. The fix walks the target's subtree and forwards when a rule
actually applies to a reachable edge (matched via `getEdgeRule` on name
and spec, preserving #9357), and `loadActual` re-forwards through
links once the tree is complete.

Cherry-picked cleanly except for a context-only conflict in
`load-actual.js` and its test file: the unrelated `packageExtensions`
and `.npm-extension` methods and the `applies root packageExtensions to
a linked actual tree` test are not present on `release/v11`, so they
were dropped from the resolution. Only this fix's changes are included.

## References

Backports #9658
@github-actions github-actions Bot mentioned this pull request Jun 25, 2026
Merged
@npm-cli-bot npm-cli-bot mentioned this pull request Jun 29, 2026
Merged
@npm-cli-bot npm-cli-bot mentioned this pull request Jul 31, 2026
Closed
renovate Bot added a commit to gwennlbh/swarpc that referenced this pull request Oct 7, 2026
@renovate
⬆️ Update dependency npm to v11.21.0
96e2343 
##### [v11.21.0](npm/cli@v11.20.0...5fd1e17)

##### [v11.20.0](https://github.com/npm/cli/releases/tag/v11.20.0)

##### Features

- [`0b3c699`](npm/cli@0b3c699) [#9994](npm/cli#9994) token: support read-write-stage-only granular access tokens ([#9994](npm/cli#9994)) ([@github-actions](https://github.com/github-actions)\[bot], [@Tayvon](https://github.com/Tayvon), [@Copilot](https://github.com/Copilot))
- [`b872816`](npm/cli@b872816) [#9920](npm/cli#9920) stage: display staged package status ([#9920](npm/cli#9920)) ([@github-actions](https://github.com/github-actions)\[bot], [@joelverhagen](https://github.com/joelverhagen))

##### Bug Fixes

- [`ddbadfc`](npm/cli@ddbadfc) [#9947](npm/cli#9947) provenance-file takes precedence over OIDC auto-generated provenance ([#9947](npm/cli#9947)) ([@github-actions](https://github.com/github-actions)\[bot], [@yunseo-kim](https://github.com/yunseo-kim))
- [`64d4b4b`](npm/cli@64d4b4b) [#9937](npm/cli#9937) config: avoid exporting persistent allow-scripts ([#9937](npm/cli#9937)) ([@github-actions](https://github.com/github-actions)\[bot], [@Fnine59](https://github.com/Fnine59))
- [`70317da`](npm/cli@70317da) [#9930](npm/cli#9930) arborist: reject uninstall args that carry a version ([#9930](npm/cli#9930)) ([@github-actions](https://github.com/github-actions)\[bot], [@lazerg](https://github.com/lazerg))
- [`55ae484`](npm/cli@55ae484) [#9929](npm/cli#9929) arborist: match allowScripts keys for local paths ([#9929](npm/cli#9929)) ([@github-actions](https://github.com/github-actions)\[bot], [@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot))
- [`7f1f2b7`](npm/cli@7f1f2b7) [#9928](npm/cli#9928) keep dry-run output valid json ([#9928](npm/cli#9928)) ([@github-actions](https://github.com/github-actions)\[bot], [@martinrrm](https://github.com/martinrrm))
- [`f28cca9`](npm/cli@f28cca9) [#9927](npm/cli#9927) don't print the funding message for global installs ([#9927](npm/cli#9927)) ([@github-actions](https://github.com/github-actions)\[bot], [@lazerg](https://github.com/lazerg))

##### Chores

- [`6ff3000`](npm/cli@6ff3000) [#10010](npm/cli#10010) pack: select workspace through config ([#10010](npm/cli#10010)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi))
- [`afdc5bd`](npm/cli@afdc5bd) [#9932](npm/cli#9932) pass nodedir to node-gyp via npm_package_config env in node integration ([#9932](npm/cli#9932)) ([@reggi](https://github.com/reggi))
- [`83f95ff`](npm/cli@83f95ff) [#9931](npm/cli#9931) update `node-integration` workflow template to latest actions ([#9931](npm/cli#9931)) ([@reggi](https://github.com/reggi))
- [`f020fba`](npm/cli@f020fba) [#9925](npm/cli#9925) recognize prefixed Node.js PR titles ([#9925](npm/cli#9925)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi))

##### Dependencies

- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.2): `@npmcli/[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.13.0): `@npmcli/[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.13): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.3): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.27): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.14): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v11.2.1): `[email protected]`
##### [v11.19.1](https://github.com/npm/cli/releases/tag/v11.19.1)

##### Bug Fixes

- [`83b750d`](npm/cli@83b750d) [#9916](npm/cli#9916) exempt explicit pack targets from allow-directory ([#9916](npm/cli#9916)) ([@github-actions](https://github.com/github-actions)\[bot], [@ychampion](https://github.com/ychampion), [@ychampion](https://github.com/ychampion))

##### Dependencies

- [`4791b27`](npm/cli@4791b27) [#9872](npm/cli#9872) `[email protected]` ([@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot))
- [`823d647`](npm/cli@823d647) [#9872](npm/cli#9872) `[email protected]` ([@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot))
- [`04f8efe`](npm/cli@04f8efe) [#9872](npm/cli#9872) `[email protected]` ([@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot))
- [`1610280`](npm/cli@1610280) [#9842](npm/cli#9842) `[email protected]` ([#9842](npm/cli#9842)) ([@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot))
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.13): `[email protected]`
##### [v11.19.0](https://github.com/npm/cli/releases/tag/v11.19.0)

##### Features

- [`7d39aa6`](npm/cli@7d39aa6) [#9698](npm/cli#9698) install-scripts: use install-scripts as the warning log title ([@manzoorwanijk](https://github.com/manzoorwanijk))

##### Bug Fixes

- [`3529ca2`](npm/cli@3529ca2) [#9811](npm/cli#9811) pack: honor min-release-age-exclude ([#9811](npm/cli#9811)) ([@github-actions](https://github.com/github-actions)\[bot], [@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot))
- [`67f12ae`](npm/cli@67f12ae) [#9810](npm/cli#9810) owner: use scoped registry for user lookup ([#9810](npm/cli#9810)) ([@github-actions](https://github.com/github-actions)\[bot], [@martinrrm](https://github.com/martinrrm), [@Copilot](https://github.com/Copilot))

##### Dependencies

- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.1): `@npmcli/[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.12): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.2): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.26): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.12): `[email protected]`
##### [v11.18.0](https://github.com/npm/cli/releases/tag/v11.18.0)

##### Features

- [`3021ad6`](npm/cli@3021ad6) [#9694](npm/cli#9694) arborist: extend replace-registry-host with URL prefix matching ([#6110](npm/cli#6110)) ([#9694](npm/cli#9694)) ([@github-actions](https://github.com/github-actions)\[bot], [@u2mejc](https://github.com/u2mejc))
- [`abd8c6b`](npm/cli@abd8c6b) [#9677](npm/cli#9677) graduate the linked install strategy from experimental to stable ([#9677](npm/cli#9677)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`9420673`](npm/cli@9420673) [#9662](npm/cli#9662) install-scripts: prune unused allowScripts entries ([#9662](npm/cli#9662)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`fc9d4c7`](npm/cli@fc9d4c7) [#9635](npm/cli#9635) namespace install-script approval commands under npm install-scripts ([#9635](npm/cli#9635)) ([@manzoorwanijk](https://github.com/manzoorwanijk))
- [`073253f`](npm/cli@073253f) [#9564](npm/cli#9564) warn when min-release-age blocks an audit fix ([#9564](npm/cli#9564)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))

##### Bug Fixes

- [`598ffdb`](npm/cli@598ffdb) [#9693](npm/cli#9693) sbom: percent-encode vcs_url qualifier in generated purls ([#9693](npm/cli#9693)) ([@github-actions](https://github.com/github-actions)\[bot], [@ubeddulla](https://github.com/ubeddulla))
- [`05793d0`](npm/cli@05793d0) [#9691](npm/cli#9691) output all the required parameters for npm token list ([#9691](npm/cli#9691)) ([@github-actions](https://github.com/github-actions)\[bot], [@rijildaniel](https://github.com/rijildaniel))
- [`cd57139`](npm/cli@cd57139) [#9669](npm/cli#9669) arborist: surface undeclared workspaces under the linked strategy (backport release/v11) ([#9669](npm/cli#9669)) ([@manzoorwanijk](https://github.com/manzoorwanijk))
- [`5b6ff9c`](npm/cli@5b6ff9c) [#9667](npm/cli#9667) reify: report added count for fresh linked installs ([#9667](npm/cli#9667)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk), [@owlstronaut](https://github.com/owlstronaut))
- [`8f13beb`](npm/cli@8f13beb) [#9664](npm/cli#9664) query: report logical dep location under linked strategy ([#9664](npm/cli#9664)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`168ba30`](npm/cli@168ba30) [#9663](npm/cli#9663) allowScripts: close enforcement gaps ([#9652](npm/cli#9652)) (backport release/v11) ([#9663](npm/cli#9663)) ([@JamieMagee](https://github.com/JamieMagee))
- [`ae64f88`](npm/cli@ae64f88) [#9648](npm/cli#9648) exec: resolve workspace-local bin under the linked install strategy ([#9648](npm/cli#9648)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`784cbe9`](npm/cli@784cbe9) [#9636](npm/cli#9636) ls: restore 100% coverage on release/v11 after [#9633](npm/cli#9633) ([#9636](npm/cli#9636)) ([@manzoorwanijk](https://github.com/manzoorwanijk))
- [`70f0ea5`](npm/cli@70f0ea5) [#9607](npm/cli#9607) approve-scripts: approve deps with no resolved URL by name ([#9607](npm/cli#9607)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`b2e6338`](npm/cli@b2e6338) [#9602](npm/cli#9602) arborist: don't flag inert optional deps in strict-allow-scripts ([#9602](npm/cli#9602)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`6ad5715`](npm/cli@6ad5715) [#9595](npm/cli#9595) link: scope `npm link  --workspace` to the workspace, not the root ([#9595](npm/cli#9595)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))

##### Documentation

- [`3658bb5`](npm/cli@3658bb5) [#9690](npm/cli#9690) recommend install-strategy=linked to catch phantom dependencies ([#9690](npm/cli#9690)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))

##### Dependencies

- [`54656b6`](npm/cli@54656b6) [#9696](npm/cli#9696) `[email protected]`
- [`31c4773`](npm/cli@31c4773) [#9696](npm/cli#9696) `[email protected]`
- [`e773c77`](npm/cli@e773c77) [#9696](npm/cli#9696) `[email protected]`
- [`f05f6af`](npm/cli@f05f6af) [#9696](npm/cli#9696) `[email protected]`
- [`804f9ba`](npm/cli@804f9ba) [#9580](npm/cli#9580) `[email protected]`

##### Chores

- [`f79b37f`](npm/cli@f79b37f) [#9696](npm/cli#9696) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`a04cd84`](npm/cli@a04cd84) [#9584](npm/cli#9584) add web-login proxy doneUrl regression for npm-profile fix ([#9584](npm/cli#9584)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.12.0): `@npmcli/[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.11): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.1): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.25): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.11): `[email protected]`

arborist: 9.9.0

#### [9.9.0](npm/cli@arborist-v9.8.0...arborist-v9.9.0) (2026-06-29)

##### Features

- [`3021ad6`](npm/cli@3021ad6) [#9694](npm/cli#9694) arborist: extend replace-registry-host with URL prefix matching ([#6110](npm/cli#6110)) ([#9694](npm/cli#9694)) ([@github-actions](https://github.com/github-actions)\[bot], [@u2mejc](https://github.com/u2mejc))
- [`abd8c6b`](npm/cli@abd8c6b) [#9677](npm/cli#9677) graduate the linked install strategy from experimental to stable ([#9677](npm/cli#9677)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`9420673`](npm/cli@9420673) [#9662](npm/cli#9662) install-scripts: prune unused allowScripts entries ([#9662](npm/cli#9662)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`073253f`](npm/cli@073253f) [#9564](npm/cli#9564) warn when min-release-age blocks an audit fix ([#9564](npm/cli#9564)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))

##### Bug Fixes

- [`774875b`](npm/cli@774875b) [#9686](npm/cli#9686) arborist: keep bin links for allowScripts-denied packages ([#9686](npm/cli#9686)) ([@JamieMagee](https://github.com/JamieMagee))
- [`719de1e`](npm/cli@719de1e) [#9673](npm/cli#9673) arborist: apply overrides across a file: link (backport release/v11) ([#9673](npm/cli#9673)) ([@manzoorwanijk](https://github.com/manzoorwanijk))
- [`cd57139`](npm/cli@cd57139) [#9669](npm/cli#9669) arborist: surface undeclared workspaces under the linked strategy (backport release/v11) ([#9669](npm/cli#9669)) ([@manzoorwanijk](https://github.com/manzoorwanijk))
- [`ede32d3`](npm/cli@ede32d3) [#9668](npm/cli#9668) arborist: forward transitive overrides through linked store links ([#9658](npm/cli#9658)) (backport release/v11) ([#9668](npm/cli#9668)) ([@manzoorwanijk](https://github.com/manzoorwanijk))
- [`f503b07`](npm/cli@f503b07) [#9666](npm/cli#9666) correct dev/prod dep flags for workspaces under the linked strategy ([#9666](npm/cli#9666)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`f580889`](npm/cli@f580889) [#9665](npm/cli#9665) arborist: load transitive optional deps into linked actual tree ([#9665](npm/cli#9665)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`8f13beb`](npm/cli@8f13beb) [#9664](npm/cli#9664) query: report logical dep location under linked strategy ([#9664](npm/cli#9664)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`168ba30`](npm/cli@168ba30) [#9663](npm/cli#9663) allowScripts: close enforcement gaps ([#9652](npm/cli#9652)) (backport release/v11) ([#9663](npm/cli#9663)) ([@JamieMagee](https://github.com/JamieMagee))
- [`4c9eacb`](npm/cli@4c9eacb) [#9649](npm/cli#9649) arborist: clean up stale .store and hoisted dirs on strategy switch ([#9649](npm/cli#9649)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`d2c680e`](npm/cli@d2c680e) [#9645](npm/cli#9645) arborist: invalid filterNode crash under the linked strategy ([#9645](npm/cli#9645)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`4e40b1c`](npm/cli@4e40b1c) [#9644](npm/cli#9644) arborist: repair wrong-but-existing symlink target in linked strategy ([#9644](npm/cli#9644)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`9d1774e`](npm/cli@9d1774e) [#9643](npm/cli#9643) arborist: remove stale .bin shims after uninstall under linked ([#9643](npm/cli#9643)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`ed37d24`](npm/cli@ed37d24) [#9642](npm/cli#9642) arborist: record the linked .store layout in the hidden lockfile (backport [#9630](npm/cli#9630)) ([#9642](npm/cli#9642)) ([@manzoorwanijk](https://github.com/manzoorwanijk))
- [`e601d4a`](npm/cli@e601d4a) [#9641](npm/cli#9641) arborist: validate peerOptional conflicts in no-save mutations ([#9641](npm/cli#9641)) ([@owlstronaut](https://github.com/owlstronaut), [@dale-lakes](https://github.com/dale-lakes), [@dale-lakes](https://github.com/dale-lakes))
- [`03cee43`](npm/cli@03cee43) [#9638](npm/cli#9638) arborist: fix audit-report determinism due to dropped via links ([#9638](npm/cli#9638)) ([@github-actions](https://github.com/github-actions)\[bot], [@arjun-vegeta](https://github.com/arjun-vegeta))
- [`a30d855`](npm/cli@a30d855) [#9633](npm/cli#9633) arborist: don't load store packages' devDependencies as required edges ([#9633](npm/cli#9633)) ([@manzoorwanijk](https://github.com/manzoorwanijk))
- [`887ca97`](npm/cli@887ca97) [#9631](npm/cli#9631) arborist: audit the non-isolated tree under the linked strategy ([#9631](npm/cli#9631)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`b2e6338`](npm/cli@b2e6338) [#9602](npm/cli#9602) arborist: don't flag inert optional deps in strict-allow-scripts ([#9602](npm/cli#9602)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`390ebfa`](npm/cli@390ebfa) [#9593](npm/cli#9593) arborist: symlink workspace file: deps on non-workspace local packages ([#9593](npm/cli#9593)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`aaeb2f1`](npm/cli@aaeb2f1) [#9578](npm/cli#9578) arborist: expose store node_modules via NODE_PATH for linked-strategy install scripts ([#9578](npm/cli#9578)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`05b6f0f`](npm/cli@05b6f0f) [#9577](npm/cli#9577) arborist: allow-remote exemption for proxy/mirror-fronted registry tarballs ([#9577](npm/cli#9577)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))

config: 10.12.0

#### [10.12.0](npm/cli@config-v10.11.0...config-v10.12.0) (2026-06-29)

##### Features

- [`3021ad6`](npm/cli@3021ad6) [#9694](npm/cli#9694) arborist: extend replace-registry-host with URL prefix matching ([#6110](npm/cli#6110)) ([#9694](npm/cli#9694)) ([@github-actions](https://github.com/github-actions)\[bot], [@u2mejc](https://github.com/u2mejc))
- [`abd8c6b`](npm/cli@abd8c6b) [#9677](npm/cli#9677) graduate the linked install strategy from experimental to stable ([#9677](npm/cli#9677)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))
- [`073253f`](npm/cli@073253f) [#9564](npm/cli#9564) warn when min-release-age blocks an audit fix ([#9564](npm/cli#9564)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))

##### Bug Fixes

- [`b2e6338`](npm/cli@b2e6338) [#9602](npm/cli#9602) arborist: don't flag inert optional deps in strict-allow-scripts ([#9602](npm/cli#9602)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))

##### Documentation

- [`3658bb5`](npm/cli@3658bb5) [#9690](npm/cli#9690) recommend install-strategy=linked to catch phantom dependencies ([#9690](npm/cli#9690)) ([@github-actions](https://github.com/github-actions)\[bot], [@manzoorwanijk](https://github.com/manzoorwanijk))

libnpmdiff: 8.1.11

##### Dependencies

- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/[email protected]`

libnpmexec: 10.3.1

#### [10.3.1](npm/cli@libnpmexec-v10.3.0...libnpmexec-v10.3.1) (2026-06-29)

##### Bug Fixes

- [`f3f2465`](npm/cli@f3f2465) [#9692](npm/cli#9692) exec: prevent shared binPaths pollution across workspace runs ([#9692](npm/cli#9692)) ([@github-actions](https://github.com/github-actions)\[bot], [@arjun-vegeta](https://github.com/arjun-vegeta))
- [`b2e6338`](npm/cli@b2e6338) [#9602](npm/cli#9602) arborist: don't flag inert optional deps in strict-allow-scripts ([#9602](npm/cli#9602)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))

##### Dependencies

- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/[email protected]`

libnpmfund: 7.0.25

##### Dependencies

- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/[email protected]`

libnpmpack: 9.1.11

##### Dependencies

- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.9.0): `@npmcli/[email protected]`
##### [v11.17.0](https://github.com/npm/cli/releases/tag/v11.17.0)

##### Features

- [`ae8ac4e`](npm/cli@ae8ac4e) [#9534](npm/cli#9534) add min-release-age-exclude config ([@JamieMagee](https://github.com/JamieMagee), [@caseyjhol](https://github.com/caseyjhol))
- [`8ff3e48`](npm/cli@8ff3e48) [#9483](npm/cli#9483) allowScripts tooling and inBundle hardening ([#9483](npm/cli#9483)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))

##### Bug Fixes

- [`847cdf8`](npm/cli@847cdf8) [#9541](npm/cli#9541) match dotted and versioned args in approve-scripts/deny-scripts ([@owlstronaut](https://github.com/owlstronaut))
- [`d99f7cb`](npm/cli@d99f7cb) [#9535](npm/cli#9535) emit valid JSON from approve-scripts/deny-scripts --json ([@owlstronaut](https://github.com/owlstronaut))
- [`351a309`](npm/cli@351a309) [#9499](npm/cli#9499) pass script-shell to publish lifecycle hooks ([#9499](npm/cli#9499)) ([@github-actions](https://github.com/github-actions)\[bot])
- [`4fa81df`](npm/cli@4fa81df) [#9497](npm/cli#9497) recognize allowScripts for local link targets ([#9497](npm/cli#9497)) ([@github-actions](https://github.com/github-actions)\[bot], [@cyphercodes](https://github.com/cyphercodes), [@cyphercodes](https://github.com/cyphercodes))
- [`95cf2e9`](npm/cli@95cf2e9) [#9489](npm/cli#9489) validate registry path for allow-remote tarballs ([@Abhinav-143x](https://github.com/Abhinav-143x))
- [`9dd219b`](npm/cli@9dd219b) [#9462](npm/cli#9462) respect allowScripts policy in prune, dedupe, uninstall, audit, and link ([#9462](npm/cli#9462)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`cd8d18a`](npm/cli@cd8d18a) [#9482](npm/cli#9482) list pending scripts in approve-scripts when ignore-scripts is set ([#9482](npm/cli#9482)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`c14e87c`](npm/cli@c14e87c) [#9481](npm/cli#9481) suggest --allow-scripts for global installs in unreviewed-scripts warnings ([#9481](npm/cli#9481)) ([@github-actions](https://github.com/github-actions)\[bot], [@JamieMagee](https://github.com/JamieMagee))
- [`7ade52e`](npm/cli@7ade52e) [#9465](npm/cli#9465) invalid issue template YAML indentation ([#9465](npm/cli#9465)) ([@github-actions](https://github.com/github-actions)\[bot], [@fallintoplace](https://github.com/fallintoplace))
- [`c069622`](npm/cli@c069622) [#9464](npm/cli#9464) show full parent command path in subcommand usage errors ([#9464](npm/cli#9464)) ([@owlstronaut](https://github.com/owlstronaut))
- [`1bb62bb`](npm/cli@1bb62bb) [#9454](npm/cli#9454) config: clarify --all help so it's accurate for approve-scripts and deny-scripts ([@JamieMagee](https://github.com/JamieMagee))
- [`84eeb5f`](npm/cli@84eeb5f) [#9431](npm/cli#9431) audit: don't apply min-release-age before filter when verifying installed signatures ([@JamieMagee](https://github.com/JamieMagee))
- [`3bd3377`](npm/cli@3bd3377) [#9426](npm/cli#9426) block forbidden keys in Queryable setter to prevent prototype pollution ([@12122J](https://github.com/12122J), [@claude](https://github.com/claude))

##### Documentation

- [`a86a7a9`](npm/cli@a86a7a9) [#9522](npm/cli#9522) approve-scripts only throws EGLOBAL when run with -g ([@JamieMagee](https://github.com/JamieMagee))
- [`693bb3d`](npm/cli@693bb3d) [#9508](npm/cli#9508) clarify package.json override value specs ([#9508](npm/cli#9508)) ([@github-actions](https://github.com/github-actions)\[bot], [@ded-furby](https://github.com/ded-furby))
- [`ccffe4a`](npm/cli@ccffe4a) [#9501](npm/cli#9501) use the latest version for global update and outdated's `wanted` ([#9501](npm/cli#9501)) ([@github-actions](https://github.com/github-actions)\[bot], [@liangmiQwQ](https://github.com/liangmiQwQ))
- [`66e97c2`](npm/cli@66e97c2) [#9478](npm/cli#9478) update minimum npm required for npm trust ([@meeech](https://github.com/meeech))

##### Dependencies

- [`bd09b87`](npm/cli@bd09b87) [#9542](npm/cli#9542) `[email protected]`
- [`95bfc4c`](npm/cli@95bfc4c) [#9542](npm/cli#9542) `[email protected]`
- [`8c0d5fd`](npm/cli@8c0d5fd) [#9542](npm/cli#9542) `[email protected]`
- [`967d377`](npm/cli@967d377) [#9542](npm/cli#9542) `[email protected]`
- [`cdaac1b`](npm/cli@cdaac1b) [#9542](npm/cli#9542) `[email protected]`
- [`25c8a9e`](npm/cli@25c8a9e) [#9542](npm/cli#9542) `[email protected]`

##### Chores

- [`2922fa4`](npm/cli@2922fa4) [#9542](npm/cli#9542) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.8.0): `@npmcli/[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.11.0): `@npmcli/[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.10): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.3.0): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.24): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.10): `[email protected]`
##### [v11.16.0](https://github.com/npm/cli/releases/tag/v11.16.0)

##### Features

- [`4b67f6e`](npm/cli@4b67f6e) [#9416](npm/cli#9416) publish --access=private alias for restricted ([#9416](npm/cli#9416)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`a10c7ca`](npm/cli@a10c7ca) [#9415](npm/cli#9415) Phase 1 of `allowScripts` opt-in install-script policy ([#9360](npm/cli#9360)) ([#9415](npm/cli#9415)) ([@owlstronaut](https://github.com/owlstronaut), [@JamieMagee](https://github.com/JamieMagee))

##### Bug Fixes

- [`1f7869b`](npm/cli@1f7869b) [#9411](npm/cli#9411) fix typo of fullMetadata ([@owlstronaut](https://github.com/owlstronaut))
- [`cde03ba`](npm/cli@cde03ba) [#9390](npm/cli#9390) config: pause progress spinner during interactive editor spawn ([#9388](npm/cli#9388)) ([@github-actions](https://github.com/github-actions)\[bot], [@Zelys-DFKH](https://github.com/Zelys-DFKH), [@claude](https://github.com/claude))

##### Documentation

- [`c5e9d73`](npm/cli@c5e9d73) [#9390](npm/cli#9390) Document `npm_old_version` and `npm_new_version` environment variables ([#9389](npm/cli#9389)) ([@github-actions](https://github.com/github-actions)\[bot], [@36degrees](https://github.com/36degrees))

##### Dependencies

- [`cdd7bbc`](npm/cli@cdd7bbc) [#9421](npm/cli#9421) `[email protected]`
- [`fde87c9`](npm/cli@fde87c9) [#9421](npm/cli#9421) `[email protected]`
- [`2779793`](npm/cli@2779793) [#9421](npm/cli#9421) `[email protected]`
- [`dea702d`](npm/cli@dea702d) [#9421](npm/cli#9421) `@sigstore/[email protected]`
- [`4eab03f`](npm/cli@4eab03f) [#9421](npm/cli#9421) `@sigstore/[email protected]`
- [`74c7323`](npm/cli@74c7323) [#9421](npm/cli#9421) `@npmcli/[email protected]`
- [`edc4ab3`](npm/cli@edc4ab3) [#9421](npm/cli#9421) `[email protected]`
- [`5f6ce33`](npm/cli@5f6ce33) [#9421](npm/cli#9421) `[email protected]`

##### Chores

- [`bd04976`](npm/cli@bd04976) [#9421](npm/cli#9421) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`aeceb23`](npm/cli@aeceb23) [#9407](npm/cli#9407) sanitize newlines in flags table default and type values ([#9407](npm/cli#9407)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.10.0): `@npmcli/[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.9): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.9): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.23): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.9): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmversion-v8.0.4): `[email protected]`
##### [v11.15.0](https://github.com/npm/cli/releases/tag/v11.15.0)

##### Features

- [`0d5d899`](npm/cli@0d5d899) [#9379](npm/cli#9379) npm stage ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`1433740`](npm/cli@1433740) [#9376](npm/cli#9376) add permissions support to trust commands ([#9376](npm/cli#9376)) ([@github-actions](https://github.com/github-actions)\[bot], [@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`8df10f5`](npm/cli@8df10f5) [#9339](npm/cli#9339) add allow-git/allow-file/allow-directory/allow-remote configs ([@owlstronaut](https://github.com/owlstronaut))

##### Bug Fixes

- [`39b625e`](npm/cli@39b625e) [#9381](npm/cli#9381) key stage download --json output by package name ([#9381](npm/cli#9381)) ([@reggi](https://github.com/reggi), [@Copilot](https://github.com/Copilot))
- [`6aa332d`](npm/cli@6aa332d) [#9339](npm/cli#9339) allow min-release-age in npmrc to coexist with --before ([@raazkhnl](https://github.com/raazkhnl))
- [`468550f`](npm/cli@468550f) [#9339](npm/cli#9339) refactor #failureNode, adjust tests and safety ([@owlstronaut](https://github.com/owlstronaut))
- [`cabe249`](npm/cli@cabe249) [#9339](npm/cli#9339) allow-remote=none does not block registry tarballs ([@owlstronaut](https://github.com/owlstronaut))

##### Dependencies

- [`8416a60`](npm/cli@8416a60) [#9383](npm/cli#9383) `[email protected]`
- [`5e5a25b`](npm/cli@5e5a25b) [#9383](npm/cli#9383) `[email protected]`
- [`a6f9ad2`](npm/cli@a6f9ad2) [#9383](npm/cli#9383) `[email protected]`
- [`63f8114`](npm/cli@63f8114) [#9383](npm/cli#9383) `[email protected]`
- [`6918b4c`](npm/cli@6918b4c) [#9383](npm/cli#9383) `[email protected]`
- [`bf84079`](npm/cli@bf84079) [#9383](npm/cli#9383) `[email protected]`
- [`bdef82c`](npm/cli@bdef82c) [#9383](npm/cli#9383) `[email protected]`
- [`3f38a67`](npm/cli@3f38a67) [#9383](npm/cli#9383) `[email protected]`

##### Chores

- [`816f3bf`](npm/cli@816f3bf) [#9383](npm/cli#9383) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.1): `@npmcli/[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.8): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.8): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.22): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.8): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v11.2.0): `[email protected]`
##### [v11.14.1](https://github.com/npm/cli/releases/tag/v11.14.1)

##### Bug Fixes

- [`dca12cb`](npm/cli@dca12cb) [#9328](npm/cli#9328) remove settings ([#9328](npm/cli#9328)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut))
##### [v11.14.0](https://github.com/npm/cli/releases/tag/v11.14.0)

##### Features

- [`45fc5e0`](npm/cli@45fc5e0) [#9288](npm/cli#9288) add allow-directory, allow-file, and allow-remote ([#9288](npm/cli#9288)) ([@github-actions](https://github.com/github-actions)\[bot], [@wraithgar](https://github.com/wraithgar))

##### Bug Fixes

- [`6c17544`](npm/cli@6c17544) [#9318](npm/cli#9318) sbom: dedupe per-node dependsOn / relationships ([#9318](npm/cli#9318)) ([@github-actions](https://github.com/github-actions)\[bot], [@mikaelkristiansson](https://github.com/mikaelkristiansson))

##### Dependencies

- [`840fe18`](npm/cli@840fe18) [#9322](npm/cli#9322) `[email protected]`
- [`b771289`](npm/cli@b771289) [#9322](npm/cli#9322) `[email protected]`
- [`addffcb`](npm/cli@addffcb) [#9322](npm/cli#9322) `[email protected]`

##### Chores

- [`041fd58`](npm/cli@041fd58) [#9322](npm/cli#9322) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`89c505a`](npm/cli@89c505a) [#9320](npm/cli#9320) add cli-triage team as codeowner ([#9320](npm/cli#9320)) ([@github-actions](https://github.com/github-actions)\[bot], [@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.0): `@npmcli/[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.7): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.7): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.21): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.7): `[email protected]`
##### [v11.13.0](https://github.com/npm/cli/releases/tag/v11.13.0)

##### Features

- [`8e8dadb`](npm/cli@8e8dadb) [#9246](npm/cli#9246) add `u` as alias for `update` command ([#9246](npm/cli#9246)) ([@github-actions](https://github.com/github-actions)\[bot], [@Ausoj](https://github.com/Ausoj))

##### Bug Fixes

- [`ecd161b`](npm/cli@ecd161b) [#9258](npm/cli#9258) ignore intended error code ([@owlstronaut](https://github.com/owlstronaut))

##### Dependencies

- [`8d2fdcd`](npm/cli@8d2fdcd) [#9272](npm/cli#9272) `[email protected]`
- [`e603d36`](npm/cli@e603d36) [#9272](npm/cli#9272) `[email protected]`
- [`d48b7da`](npm/cli@d48b7da) [#9272](npm/cli#9272) `[email protected]`
- [`032a5ca`](npm/cli@032a5ca) [#9240](npm/cli#9240) `@sigstore/[email protected]`
- [`33a81e7`](npm/cli@33a81e7) [#9240](npm/cli#9240) `[email protected]`
- [`68dc4a0`](npm/cli@68dc4a0) [#9240](npm/cli#9240) `[email protected]`
- [`1bb6703`](npm/cli@1bb6703) [#9240](npm/cli#9240) `[email protected]`
- [`37059e4`](npm/cli@37059e4) [#9240](npm/cli#9240) `[email protected]`
- [`fb450ab`](npm/cli@fb450ab) [#9240](npm/cli#9240) `[email protected]`
- [`7c4bbbf`](npm/cli@7c4bbbf) [#9240](npm/cli#9240) `[email protected]`
- [`703a3bc`](npm/cli@703a3bc) [#9240](npm/cli#9240) `[email protected]`

##### Chores

- [`e0724ac`](npm/cli@e0724ac) [#9272](npm/cli#9272) dev dependency updates ([@owlstronaut](https://github.com/owlstronaut))
- [`d249341`](npm/cli@d249341) [#9230](https://github.com/npm/cli/pull/9230) don't run npm update in CI ([@owlstronaut](https://github.com/owlstronaut))
- [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.4.3): `@npmcli/[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.6): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.6): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.20): `[email protected]`
- [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.6): `[email protected]`
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@owlstronaut owlstronaut owlstronaut approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

backport:v11

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[BUG] install-strategy=linked: an applied override is reported invalid by npm ls (exit 1)

2 participants

@manzoorwanijk @owlstronaut