fix(deps): update dependency @npmcli/arborist to v10#113
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^4.0.0→^10.0.0Release Notes
npm/cli (@npmcli/arborist)
v10.0.0Compare Source
npm shrinkwrapis removed, theshrinkwrapconfig alias is removed, andnpm-shrinkwrap.jsonis no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-rootnpm-shrinkwrap.jsontopackage-lock.json; usebundleDependenciesif you need to ship a locked dependency tree.npmnow supports node^22.22.2 || ^24.15.0 || >=26.0.0Features
5b83698#9737 trigger release process (#9737) (@reggi)v9.9.0Compare Source
Features
ecda95a#6841 add npm sbom command (#6841) (@bdehamer)fdb8a86#6794 add package-lock-only mode to npm query (@wraithgar)16c04b1#6877 add no-package-lock mode to npm audit (@wraithgar)66ef765#6776 Add--cpuand--osoption to override platform specific install (#6776) (@yukukotani)Bug Fixes
c9406f7#6791 deprecate: ignore implicit workspace mode (#6758) (#6791) (@wraithgar)0b1d7c3#6779 allow searching packages with no description (#6779) (@wraithgar, @lukekarrys)Documentation
9750720#6694 fix example path (#6694) (@fvilers)Dependencies
588a245#6756npm-pick-manifest@8.0.2a76b1df#6877sigstore@1.9.095b5ab0#6877npm-install-checks@6.2.0@npmcli/arborist@6.5.0@npmcli/config@6.4.0libnpmdiff@5.0.20libnpmexec@6.0.4libnpmfund@4.2.1libnpmpack@5.0.20v9.8.0Compare Source
Features
67459e7#6626 addpkg fixsubcommand (@wraithgar)89b2741#6548 add ps1 scripts (#6548) (@mribbons, @lukekarrys)Dependencies
b252164#6626@npmcli/package-json@4.0.09238682#6623sigstore@1.7.0(#6623)@npmcli/arborist@6.3.0libnpmdiff@5.0.19libnpmexec@6.0.2libnpmfund@4.0.19libnpmpack@5.0.19libnpmpublish@7.5.0v9.7.0Compare Source
Features
a63a6d8#6490 add provenanceFile option for libnpmpublish (@bdehamer)2a8f4f2#6490 add new exclusive config item publish-file (@wraithgar)361e194#6483 implement flag --prefer-dedupe fornpm install(#6483) (@m4rch3n1ng)Bug Fixes
38eb39b#6514 strip ansi characters from search results (#6514) (@wraithgar)4b5ccfc#6477 make usage and completion static functions (#6477) (@lukekarrys)4f39e8c#6479 refactor engines validation to lint syntax (#6479) (@lukekarrys)f3cfe12#6482 remove unused lib/npm relics (#6482) (@lukekarrys)87de0c7#6472 move explore command to @npmcli/package-json (@wraithgar)636e29e#6472 move to @npmcli/package-json where possible (@wraithgar)37cc797#6418 retrieve registry keys via TUF (#6418) (@bdehamer)Documentation
83cd5bd#6480 add global option for uninstall (#6480) (@m4rch3n1ng)0400ce3#6481 add cli params tonpm set,npm get(#6481) (@m4rch3n1ng)c3638ce#6468 removepackage-lockoption fornpm ci(#6468) (@m4rch3n1ng)Dependencies
060d587chalk@5.2.0,npm-audit-report@5.0.0fc52ca8#6472 remove read-package-json-fast3238aa7#6472 remove read-package-json@npmcli/config@6.2.0libnpmexec@6.0.0libnpmpublish@7.3.0v9.6.0Compare Source
Features
84fbaf2#6216 add preliminary fish shell completion (@wraithgar)Bug Fixes
c4c8754audit: add signatures to completion (@wraithgar)fc46489access: only complete once (@wraithgar)b43961acmd-list: alias only to real commands (@wraithgar)Documentation
2695e1f#6187 npm v9 creates package-lock.json v3 (#6187) (@tuukka)Dependencies
71ae406#6218@npmcli/installed-package-contents@2.0.2@npmcli/arborist@6.2.4libnpmdiff@5.0.12libnpmexec@5.0.12libnpmfund@4.0.12libnpmpack@5.0.12v9.5.0Compare Source
Features
79bfd03#6153 audit signatures verifies attestations (@feelepxyz)5fc6473add provenance attestation (@bdehamer)Bug Fixes
53f75a4#6158 gracefully fallback from auth-type=web (#6158) (@MylesBorins)ed59aae#6162 refactor error reporting in audit command (@bdehamer)Dependencies
fad0473minipass@4.0.3678c6bfminimatch@6.2.09b4b366ci-info@3.8.0d20ee2apacote@15.1.0libnpmpublish@7.1.0libnpmteam@5.0.3v9.4.3Compare Source
v9.4.2Compare Source
Bug Fixes
21ea382#9110 arborist: resolve sibling override sets via common ancestor (#9110) (@manzoorwanijk)51365b1#9107 arborist: update store symlinks when hash changes in linked strategy (#9107) (@manzoorwanijk)8e0a731#9108 arborist: skip linked actual tree diff in package-lock-only mode (#9108) (@manzoorwanijk)v9.4.1Compare Source
Bug Fixes
5b7c0cc#9096 arborist: exclude store nodes from :root > * in linked strategy (#9096) (@manzoorwanijk)3b70a9d#9097 arborist: simplify rootDeclaredDeps initialization (#9097) (@manzoorwanijk)c7702d0#9094 arborist: fix non-idempotent linked install with workspace projects (#9094) (@manzoorwanijk)1a744b5#9081 arborist: omit root dev deps in linked strategy when shared with workspaces (#9081) (@manzoorwanijk)ff51827#9076 arborist: do not hoist undeclared workspaces in linked strategy (#9076) (@manzoorwanijk)1206f8b#9069 consolidate isolated node/link attributes (#9069) (@wraithgar)a774fb7#9066 arborist: respect --omit flag in linked install strategy (#9066) (@manzoorwanijk)8614b2a#9031 arborist: avoid full reinstall on subsequent linked strategy runs (#9031) (@manzoorwanijk)16fbe13#9030 resolve relative file: dependencies correctly with install-strategy=linked (#9030) (@manzoorwanijk)983742b#9055 isolated mode code cleanup (#9055) (@wraithgar)a29aeee#9028 arborist: retry bin-links on Windows EPERM (#9028) (@manzoorwanijk)10d5302#9051 arborist: unwrap Link nodes in legacyPeerDeps for linked strategy (#9051) (@manzoorwanijk)94bfef5#9044 audit: exclude locally linked packages from vulnerability audit (#9044) (@lucas-gomes-santana)26fa40e#9041 fix workspace-filtered install with linked strategy (@owlstronaut)v9.4.0Compare Source
Features
4fcd352#9017 add :type(registry) to query selector syntax (#9017) (@wraithgar)Bug Fixes
880ecb7#9013 arborist: skip postinstall on store links in linked strategy (#9013) (@manzoorwanijk)07e6edd#9025 save libc field to package-lock.json (@owlstronaut)a2154cd#8996 linked strategy fixes for scoped packages, aliases, and peer deps (#8996) (@manzoorwanijk)v9.3.1Compare Source
Bug Fixes
bb135cc#8981 arborist: fixpeerOptionaldependency resolution inbuildIdealTree(#8981) (@Saibamen, @cursoragent)Chores
40fcab4#8991@npmcli/template-oss@4.29.0(@wraithgar)v9.3.0Compare Source
Features
7c038b7#8968 add support for git-256 sha lengths (#8968) (@wraithgar)v9.2.0Compare Source
Features
f5f6cf7#8943 config: add --allow-git (@wraithgar)v9.1.10Compare Source
Dependencies
f951820#8919common-ancestor-path@2.0.0v9.1.9Compare Source
Bug Fixes
0765289#8721 handle ENOTEMPTY errors in moveFile (@keegancsmith)v9.1.8Compare Source
Bug Fixes
b118364#8760 undefined override set conflicts shouldn't error (@owlstronaut)Dependencies
f963223#8770proggy@4.0.0f51e4aa#8770nopt@9.0.02d15040#8770@npmcli/query@5.0.058650dc#8770@npmcli/fs@5.0.0v9.1.7Compare Source
Bug Fixes
3225fa3#8737 fix usage of path of custom registry (#8737) (@flj2mu2)e9f0418#8689 arborist: improve override conflict detection with semantic comparison (#8689) (@Artur-)05319f0#8677 code cleanup (#8677) (@wraithgar)49a4eef#8676 use look behind regex for trailing slash stripping (#8676) (@wraithgar)b1aee62#8645 dep flag calculation (#8645) (@liamcmitchell)Dependencies
8cc9f70#8723ssri@13.0.059b3c6a#8723@npmcli/redact@4.0.06cb77df#8723@npmcli/installed-package-contents@4.0.005ac7a7#8723proc-log@6.0.00a74f6d#8723bin-links@6.0.0041b9b2#8723parse-conflict-json@5.0.1a1b0fea#8723@npmcli/name-from-folder@4.0.03404dca#8723npm-install-checks@8.0.0542fcf3#8723@npmcli/node-gyp@5.0.0v9.1.6Compare Source
Bug Fixes
0a8b8c2#8621 typo bugs and other spelling fixes (#8621) (@jsoref)54fd27f#8602 refactor node.ideallyInert to node.inert (#8602) (@liamcmitchell)13d8df6#8537 optional set calculation (#8537) (@liamcmitchell)Chores
180e9f7#8610 fix spelling in workspaces/arborist (#8610) (@jsoref)91393de#8599 Update references for arborist to cli (#8599) (@jsoref)v9.1.5Compare Source
Bug Fixes
60aa94b#8576 attach path to json parse error (@wraithgar)1eedf82#8576 use @npmcli/package-json to parse package.json (@wraithgar)f6c868d#8566 calculate omit in diff (#8566) (@liamcmitchell, Liam Mitchell)d389614#8579 corrects peer dependency flag propagation (@owlstronaut)Dependencies
566f1b7#8576minimatch@10.0.3ea7ca5f#8576lru-cache@11.2.1bf6b686#8576npm-package-arg@13.0.09392488#8576npm-package-manifest@11.0.1633c4ed#8576hosted-git-info@9.0.01149971#8576npm-registry-fetch@19.0.06221e27#8576@npmcli/metavuln-calculator@9.0.2da81a37#8576cacache@20.0.16b4c5f9#8576@npmcli/run-script@10.0.0b6bb9ae#8576pacote@21.0.31b4433f#8576@npmcli/map-workspaces@5.0.0ceae674#8576@npmcli/package-json@7.0.14f37534#8576 remove read-package-json-fastChores
4059dfa#8576 properly use arborist and cache in test (@owlstronaut)402a0ab#8576@npmcli/template-oss@4.25.1(@wraithgar)v9.1.4Compare Source
Bug Fixes
208c06e#8448 peer edge crash due to no parent or detached node (#8448) (@milaninfy)3b54e9c#8534 installLinks works with transitive external file dependencies (#8534) (@owlstronaut)ed71acb#8473 arborist: #8472 Keeps the registry protocol when modifying resolve URL (#8473) (@Jeepsboucher, Jean-Philippe Boucher)Chores
619d43e#8540 fix pruner and reify tests for optional peer deps (#8540) (@liamcmitchell, Liam Mitchell)v9.1.3Compare Source
Bug Fixes
6dbe21a#8436 local transitive dependencies with --install-links=true (@owlstronaut)8042af3#8431 prune optional peer dependencies that are no longer explicitly depended on (#8431) (@G-Rath)c457c75#8430 remove duplicate loop (#8430) (@G-Rath)f7b056f#8400 clean up audit-report code (#8400) (@wraithgar)f163d01#8372 use omit when checking ideal tree engine (#8372) (@owlstronaut)Chores
3f60b5f#8383@npmcli/template-oss@4.24.4(#8383) (@wraithgar)01f8cc6#8381@npmcli/template-oss@4.24.3(#8381) (@wraithgar)v9.1.2Compare Source
Bug Fixes
887385d#8356 arborist: use hosted-git-info to correctly parse resolved git urls (#8356) (@milaninfy)v9.1.1Compare Source
Dependencies
f951820#8919common-ancestor-path@2.0.0v9.1.0Compare Source
Features
57aa89f#8265 use run by default and run-script as the alias (#8265) (@owlstronaut)Bug Fixes
d5bcf38#8268 arborist: Add better error message when lockfile is malformed (#8268) (@owlstronaut)5e1fed9#8290 arborist: improve README markdown (#8290) (@mbtools)0886e7a#8222 preserve registry path when replacing a host (@owlstronaut)815311b#8206 arborist: workspaces correctly path to file: packages from overrides (@owlstronaut)v9.0.2Compare Source
Bug Fixes
a96d8f6#8184 arborist: omit failed optional dependencies from installed deps (#8184) (@owlstronaut, @zkat)04f53ce#8180 arborist: safely fallback on unresolved $ dependency references (#8180) (@owlstronaut)885accd#8185 arborist: only replace hostname for resolved URL (#8185) (@billy-briggs-dev)8b7bb12#8168 arborist: Allow downgrades to hoisted version dedupe workspace i… (#8168) (@owlstronaut)1642556#8160 arborist: workspaces respect overrides on subsequent installs (#8160) (@owlstronaut)Chores
88a7b52#8174 add load-virtual and reify tests for workspace override test coverage (#8174) (@owlstronaut, @TrevorBurnham)v9.0.1Compare Source
Bug Fixes
b9225e5#8089 resolve override conflicts and apply correct versions (#8089) (@owlstronaut)d586f3b#8117 remove duplicate var (#8117) (@TrevorBurnham)811ca29#8115 stop working around bug fixed innpm-package-arg@12.0.2(@TrevorBurnham)v9.0.0Compare Source
Features
a7bfc6d#7972 trigger release process (#7972) (@wraithgar)Chores
a07f4e0#7976@npmcli/template-oss@4.23.6(@wraithgar)v8.0.5Compare Source
v8.0.0Compare Source
@npmcli/arboristnow supports node^18.17.0 || >=20.5.0Features
4d57928#7766 devEngines (#7766) (@reggi)Bug Fixes
365580a#7803 align @npmcli/arborist to npm 10 node engine range (@reggi)Dependencies
5795987#7803 updateproggy@3.0.099ccae3#7803 updatebin-links@5.0.075786ad#7803 update@npmcli/query@4.0.01c25a1d#7803 update@npmcli/node-gyp@4.0.02d7fc3d#7803 update@npmcli/name-from-folder@3.0.01e09334#7803 update@npmcli/metavuln-calculator@8.0.0820e983#7803 update@npmcli/installed-package-contents@3.0.09cd6603#7803 updateread-package-json-fast@4.0.08206c4f#7803 updatessri@12.0.0f6909a0#7803 updateproc-log@5.0.0f9b2e18#7803 updateparse-conflict-json@4.0.0e7ab206#7803 updatepacote@19.0.0d13a20b#7803 updatenpm-registry-fetch@18.0.1092f41f#7803 updatenpm-pick-manifest@10.0.050a7bc8#7803 updatenpm-package-arg@12.0.0591130d#7803 updatenpm-install-checks@7.1.0105fa2b#7803 updatenopt@8.0.07214149#7803 updatejson-parse-even-better-errors@4.0.06deae9e#7803 updatehosted-git-info@8.0.0034c729#7803 updatecacache@19.0.1538a4cc#7803 update@npmcli/run-script@9.0.1b80d048#7803 update@npmcli/redact@3.0.02076368#7803 update@npmcli/package-json@6.0.1feac87c#7803 update@npmcli/map-workspaces@4.0.1dd90f9e#7803 update@npmcli/fs@4.0.0Chores
be1e6da#7803 updateminify-registry-metadata@4.0.0(@reggi)2072705#7803 update@npmcli/eslint-config@5.0.1(@reggi)8035725](https://redirect.github.com/npm/cli/commit/80357253ecd8483463cd66c7Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.