chore(deps): update dependency npm to v10.9.9 - #47
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/npm-10.x
branch
from
March 5, 2026 00:38
4b6e50b to
8e18789
Compare
renovate
Bot
force-pushed
the
renovate/npm-10.x
branch
from
March 11, 2026 21:03
8e18789 to
e6e1e78
Compare
renovate
Bot
force-pushed
the
renovate/npm-10.x
branch
from
March 19, 2026 01:42
e6e1e78 to
f7328e4
Compare
renovate
Bot
force-pushed
the
renovate/npm-10.x
branch
from
March 27, 2026 17:14
f7328e4 to
d5baf84
Compare
renovate
Bot
force-pushed
the
renovate/npm-10.x
branch
from
July 29, 2026 18:47
d5baf84 to
bd884bb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
10.8.0→10.9.9Release Notes
npm/cli (npm)
v10.9.9Compare Source
Dependencies
5e9f451#9814tar@7.5.22(#9814) (@martinrrm, @Copilot)Chores
189ba13#9319 add cli-triage team as codeowner (#9319) (@github-actions[bot], Michael Smith)v10.9.8Compare Source
Dependencies
@npmcli/arborist@8.0.5libnpmdiff@7.0.5libnpmexec@9.0.5libnpmfund@6.0.5libnpmpack@8.0.5v10.9.7Compare Source
Bug Fixes
bbcd455#9120 arborist: v10 - backport store, lock-only, and override sibling fixes (#9120) (@manzoorwanijk)Dependencies
cc9a4de#9130 hoist production @sigstore dependenciesChores
e5c1309#9130 dev dependency updates (@wraithgar)@npmcli/arborist@8.0.4libnpmdiff@7.0.4libnpmexec@9.0.4libnpmfund@6.0.4libnpmpack@8.0.4v10.9.6Compare Source
Bug Fixes
d6fe671#9098 arborist: v10 - backport multiple fixes for linked install (#9098) (@manzoorwanijk)Dependencies
a5dadad#9067tar@7.5.1187abb92#9067pacote@20.0.1c2f0fd2#9067pacote@19.0.2@npmcli/arborist@8.0.3libnpmdiff@7.0.3libnpmexec@9.0.3libnpmfund@6.0.3libnpmpack@8.0.3v10.9.5Compare Source
Bug Fixes
794f6c8#9011 backport linked strategy fixes from multiple PRs to v10 (#9011) (@manzoorwanijk)Dependencies
6717032#9056tuf-js@3.1.0e4e25ea#9056tinyglobby@0.2.159464329#9056socks@2.8.723c3e17#9056postcss-selector-parser@7.1.177f9c29#9056p-map@7.0.4f1a0315#9056npm-install-checks@7.1.2ad7d3ac#9056normalize-package-data@7.0.163a7c82#9056node-gyp@11.5.0569d807#9056isexe@3.1.57dbe993#9056fdir@6.5.0f241a38#9056exponential-backoff@3.1.3bdeabff#9056ci-info@4.4.0d8ebcd5#9056aproba@2.1.0be1b008#9056spdx-license-ids@3.0.231005efd#9056strip-ansi@7.2.0d00bf96#9056diff@5.2.27a74819#9056debug@4.4.3938db00#9056minipass@7.1.370e90e5#9056minimatch@9.0.9733ff41#9056glob@10.5.0ea8227a#9056ansi-styles@6.2.3edd20ef#9056ansi-regex@6.2.22592b45#9056agent-base@7.7.43174366#9056semver@7.7.4380df0e#9056tar@7.5.949025ae#9056chalk@5.6.264601cd#9056@npmcli/promise-spawn@8.0.30e23c00#9056validate-npm-package-name@6.0.2Chores
72cc7de#9056template-oss@4.29.0(@wraithgar)51711b8#9056 dev dependency updates (@wraithgar)@npmcli/arborist@8.0.2libnpmdiff@7.0.2libnpmexec@9.0.2libnpmfund@6.0.2libnpmpack@8.0.2libnpmpublish@10.0.2v10.9.4Compare Source
Bug Fixes
f7ff89c#8551 powershell: fix StrictMode and improve argument parsing (#8551) (@alexsch01, @splatteredbits)v10.9.3Compare Source
Bug Fixes
7cff878#8343 powershell: use Invoke-Expression to pass args (#8343) (@alexsch01)78dc057#8378 stop working around bug fixed innpm-package-arg@12.0.2(@TrevorBurnham)e510f14#8248 docs: 'pacakge' -> 'package' (#8248) (@t3hmrman)Dependencies
c38ec84#8378validate-npm-package-name@6.0.172564c5#8378spdx-license-ids@3.0.2120fa199#8378socks@2.8.548c193a#8378socks-proxy-agent@8.0.500fccfb#8378semver@7.7.25ab8aac#8378read@4.1.0224c69e#8378p-map@7.0.31e41678#8378npm-package-arg@12.0.2e9cf30e#8378nopt@8.1.02bedf25#8378minizlib@3.0.2a795ee0#8378minipass-fetch@4.0.18ed043c#8378https-proxy-agent@7.0.674518d0#8378http-cache-semantics@4.2.0cc7dcfc#8378hosted-git-info@8.1.013aea40#8378foreground-child@3.3.19c81599#8378exponential-backoff@3.1.2b59097f#8378node-gyp@11.2.08b29435#8378debug@4.4.14c8e170#8378cidr-regex@4.1.39bb94a3#8378is-cidr@5.1.1a1dbb0b#8378ci-info@4.2.00a5f2ff#8378chalk@5.4.17912c9c#8378brace-expansion@2.0.219028b8#8378agent-base@7.1.3fd26776#8378abbrev@3.0.1dbb23ab#8378sigstore@3.1.092feb9b#8378@sigstore/protobuf-specs@0.4.34fd7174#8378@sigstore/tuf@3.1.1b327bc2#8378@npmcli/run-script@9.1.004e7e1c#8378@npmcli/redact@3.2.2.90d2aab#8378@npmcli/query@4.0.12e47537#8378@npmcli/package-json@6.2.0a5eb5dd#8378@npmcli/git@6.0.3Chores
15e545b#8384@npmcli/template-oss@4.24.4(#8384) (@wraithgar)fb5a9f2#8378@npmcli/template-oss@4.24.3(@wraithgar)19da79a#8378 dev dependency updates (@wraithgar)@npmcli/arborist@8.0.1libnpmdiff@7.0.1libnpmexec@9.0.1libnpmfund@6.0.1libnpmpack@8.0.1v10.9.2Compare Source
Dependencies
ae9345e#7959@npmcli/run-script@9.0.239a19b3#7959node-gyp@11.0.093e2186#7956@npmcli/map-workspaces@4.0.2bf0ea00#7956@npmcli/package-json@6.1.0c84baa3#7956init-package-json@7.0.2e642099#7956node-gyp@10.3.1v10.9.1Compare Source
Bug Fixes
c7fe0db#7924 perf: enable compile cache if present (#7924) (@H4ad)Dependencies
a221db7#7931npm-install-checks@7.1.1fbad17a#7931hosted-git-info@8.0.265d2a86#7922@sigstore/tuf@3.0.0be45963#7922sigstore@3.0.0fb0bfbd#7922spdx-license-ids@3.0.20ccadf2a#7922promise-call-limit@3.0.2b25712e#7922package-json-from-dist@1.0.11c9e96f#7922negotiator@0.6.4f13bc9c#7922debug@4.3.7029060c#7922cross-spawn@7.0.69350950#7922@npmcli/metavuln-calculator@8.0.1c003827#7922ansi-regex@6.1.0d6194f5#7922pacote@19.0.14ff29f6#7922npm-registry-fetch@18.0.2fd6f4fb#7922make-fetch-happen@14.0.3b3f3004#7922ci-info@4.1.0a1f9d48#7922promise-spawn@8.0.2Chores
3ace1c1#7922 update arborist in mock-registry (@wraithgar)libnpmpublish@10.0.1v10.9.0Compare Source
Features
4d57928#7766 devEngines (#7766) (@reggi)Bug Fixes
6ca609e#7789 ping and doctor commands fix for checking if registry is online (#7789) (@milaninfy)Documentation
63d6a73#7783 package.json: add brief section on exports, link to Node.js docs (#7783) (@wheresrhys)366c07e#7776 remove incorrect note about npm install (#7776) (@wraithgar)Dependencies
60a7ee5#7803 hoist npm-normalize-package-bin20dd44f#7803 hoist minipass-fetch5795987#7803 updateproggy@3.0.099ccae3#7803 updatebin-links@5.0.075786ad#7803 update@npmcli/query@4.0.01c25a1d#7803 update@npmcli/node-gyp@4.0.02d7fc3d#7803 update@npmcli/name-from-folder@3.0.01e09334#7803 update@npmcli/metavuln-calculator@8.0.0820e983#7803 update@npmcli/installed-package-contents@3.0.09cd6603#7803 updateread-package-json-fast@4.0.0b84d907#7803 update@npmcli/git@6.0.153ed632#7803 updatewrite-file-atomic@6.0.0ab40dab#7803 updatewhich@5.0.0b1c4770#7803 updatevalidate-npm-package-name@6.0.08206c4f#7803 updatessri@12.0.08b7dbc8#7803 updateread@4.0.0f6909a0#7803 updateproc-log@5.0.0f9b2e18#7803 updateparse-conflict-json@4.0.0e7ab206#7803 updatepacote@19.0.0b28dbb1#7803 updatenpm-user-validate@3.0.0d13a20b#7803 updatenpm-registry-fetch@18.0.15208f74#7803 updatenpm-profile@11.0.1092f41f#7803 updatenpm-pick-manifest@10.0.050a7bc8#7803 updatenpm-package-arg@12.0.0591130d#7803 updatenpm-install-checks@7.1.0be6ae96#7803 updatenpm-audit-report@6.0.08d4060a#7803 updatenormalize-package-data@7.0.0105fa2b#7803 updatenopt@8.0.0eae4f57#7803 updatemake-fetch-happen@14.0.17214149#7803 updatejson-parse-even-better-errors@4.0.0c4bed31#7803 updateinit-package-json@7.0.1f54b155#7803 updateini@5.0.06deae9e#7803 updatehosted-git-info@8.0.0034c729#7803 updatecacache@19.0.1ddb8be0#7803 updateabbrev@3.0.0538a4cc#7803 update@npmcli/run-script@9.0.1b80d048#7803 update@npmcli/redact@3.0.081137fc#7803 update@npmcli/promise-spawn@8.0.12076368#7803 update@npmcli/package-json@6.0.1feac87c#7803 update@npmcli/map-workspaces@4.0.1dd90f9e#7803 update@npmcli/fs@4.0.0Chores
95e2cb1#7810 ignore .github folder in release-please (@reggi)be1e6da#7803 updateminify-registry-metadata@4.0.0(@reggi)43f2374#7803 updateignore-walk@7.0.0(@reggi)bb03036#7803 updatenpm-packlist@9.0.0(@reggi)2072705#7803 update@npmcli/eslint-config@5.0.1(@reggi)949d8f8#7803 engine ^18.17.0 || >=20.5.0 in package template (@reggi)fefd509#7764 deps: bump actions/download-artifact from 3 to 4 in /.github/workflows (#7764) (@dependabot[bot], @wraithgar)@npmcli/arborist@8.0.0@npmcli/config@9.0.0libnpmaccess@9.0.0libnpmdiff@7.0.0libnpmexec@9.0.0libnpmfund@6.0.0libnpmhook@11.0.0libnpmorg@7.0.0libnpmpack@8.0.0libnpmpublish@10.0.0libnpmsearch@8.0.0libnpmteam@7.0.0libnpmversion@7.0.0v10.8.3Compare Source
Bug Fixes
7e61151#7759 docs: init usage description corrected (#7759) (@milaninfy)2404c7e#7738 publish: consider package-spec when inside workspace dir (#7738) (@milaninfy)91e46a3#7721 init: use locally installed version of given package (#7721) (@milaninfy)4e81a6a#7674 always set exit code if exiting uncleanly (#7674) (@wraithgar, @hashtagchris)a947f25#7679 update lifecycle script list in run-script (#7679) (@sonsurim)Documentation
e674987#7743 update docs for npmrc and package-json (#7743) (@milaninfy)24d5350#7742 fix and update scoped configuration example (#7742) (@demedos)Dependencies
3fd7a48#7737lru-cache@10.4.3d7e462b#7737jackspeak@3.4.3df58b0c#7737glob@10.4.57342c24#7737foreground-child@3.3.02986f4e#7737cacache@18.0.4a44ab26#7737postcss-selector-parser@6.1.24e965ad#7737semver@7.6.312587fa#7737npm-package-arg@11.0.31a9ac86#7737debug@4.3.6a303ddd#7737node-gyp@10.2.0Chores
1772276#7756 fix duplicate changelog entries (@wraithgar)8035725#7756@npmcli/template-oss@4.23.3(@wraithgar)ed4add1#7737 dev dependency updates (@wraithgar)86b05fc#7683 allow for longer timer values (#7683) (@wraithgar)libnpmexec@8.1.4v10.8.2Compare Source
Bug Fixes
3101a40#7631 limit concurrent open files during 'npm cache verify' (#7631) (@oikumene)2273183#7595 outdated: fixed wanted range for alias with version range (#7595) (@milaninfy)15be6dd#7574 don't try parsing workspaces if none exist (@wraithgar)Documentation
ac937d4#7616 install: add save-peer flag (#7616) (@drew4237)55639ef#7615 use git+https in package.com url examples (#7615) (@MikeMcC399)93883bb#7582 Improve manpage section forpackage.jsonfundingproperties (#7582) (@kemitchell)92e71e6#7576 fix links to community discussions (#7576) (@leobalter)Dependencies
1c1adae#7636npm-pick-manifest@9.1.05e4fa18#7636socks-proxy-agent@8.0.4d8fa116#7636https-proxy-agent@7.0.576dab91#7636normalize-package-data@6.0.2094c4ea#7636minimatch@9.0.51c8d41d#7636@npmcli/git@5.0.8e5451e1#7605jackspeak@3.4.07b584d3#7605foreground-child@3.2.1941d0d7#7605debug@4.3.58b8ce7a#7605glob@10.4.24646768#7605npm-registry-fetch@17.1.06f0d7ce#7605@npmcli/redact@2.0.129204c8#7605@npmcli/package-json@5.2.004d6910#7574@npmcli/package-json@5.1.14ef4830#7574 remove read-package-json-fastChores
2490b49#7621 remove .github/workflows/benchmark.yml (#7621) (@wraithgar)3b8b111#7605 update devDependencies in lockfile (@wraithgar)v10.8.1Compare Source
Bug Fixes
6b55646#7569 exec: look in workspace and root for bin entries (#7569) (@wraithgar)e4c7a41#7564 publish: skip workspace packages marked private on publish (#7564) (@milaninfy)8f94ae8#7556 utils/tar: index access while match is null (#7555) (#7556) (@NormanPerrin)2d1d8d0#7559 addsnode:specifier to all native node modules (#7559) (@reggi)7d89b55#7490 ci: rm workspace node_modules (#7490) (@reggi)9122fb6#7516 cache: add both full and minified packument to cache (#7516) (@milaninfy)9e6686b#7545 send proper otp token on web auth (#7545) (@wraithgar)b1db070#7534 refactor: use output.buffer and set explicit json mode in query (#7534) (@lukekarrys)53cda32#7542 refactor ls to use output.buffer for json (#7542) (@lukekarrys)61d5771#7541 remove json.stringify from all commands (#7541) (@lukekarrys)4dfc7d2#7540 pass strings to JSON.stringify in --json mode (#7540) (@lukekarrys)3cefdf6#7538 outdated: return array for outdated deps from multiple workspaces (@lukekarrys)ef4c975#7508 view: dont immediately exit on first workspace 404 (#7508) (@lukekarrys)Documentation
fd6479f#7560 update publish docs: dist-tag + publish case (#7560) (@davidlj95)Dependencies
e3f0fd4#7568@npmcli/package-json@5.1.1447a8d7#7566spdx-license-ids@3.0.1883fed2e#7566sigstore@2.3.141291ba#7566@sigstore/tuf@2.3.418b42a4#7566glob@10.4.15c6759d#7566postcss-selector-parser@6.1.02508a83#7566is-cidr@5.1.06278fe4#7566ini@4.1.3[10.8.1](https://redirect.github.com/npm/cli/compare/
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.