22.0.0 (2026年06月15日)

⚠️ BREAKING CHANGES

• pacote now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• git specs using the https or git+https protocol now resolve to git+https URLs instead of being switched to git+ssh. Shortcut specs (e.g. github:user/repo, user/repo) and git+ssh/git:// specs are unchanged.

Features

• 09316f5 #504 bump to new node engine range (@owlstronaut)
• 2ab74b0 #497 strip patchedDependencies from the packed package.json (#497) (@manzoorwanijk)
• 66e7ea7 #487 forward globalIgnoreFile option to npm-packlist (@ljharb)

Bug Fixes

• ce804fb #498 avoid ReDoS in addGitSha committish stripping (#498) (@owlstronaut)
• 1f5f131 #494 pass --global=false when preparing git dependencies (@owlstronaut)
• e0af7f6 #486 respect ignoreScripts option for git dependencies (@owlstronaut)
• 12c8c8f #481 fall back to git clone when tarball response is not a valid archive (@babyhuey)
• 61f065a #481 use statusCode instead of constructor name for tarball fallback in git fetcher (@j1mb0-1)
• 6d160c1 #434 do not switch to git+ssh for https repository links (#434) (@oldium)

Dependencies

• 371e8b0 #504 ssri@14.0.0
• b68c6c2 #504 sigstore@5.0.0
• 57793ab #504 proc-log@7.0.0
• 33eacc9 #504 npm-registry-fetch@20.0.1
• a131916 #504 npm-pick-manifest@12.0.0
• 2b03527 #504 npm-packlist@11.2.0
• 5f8ad42 #504 npm-package-arg@14.0.0
• ee3b96d #504 cacache@21.0.1
• 033f655 #504 @npmcli/run-script@11.0.0
• ddcc738 #504 @npmcli/promise-spawn@10.0.0
• 6a28eb2 #504 @npmcli/package-json@8.0.0
• 5879416 #504 @npmcli/installed-package-contents@5.0.0
• 41ea727 #504 @npmcli/git@8.0.0

Chores

• 3fc5fd4 #504 @npmcli/eslint-config@7.0.0 (@owlstronaut)
• 7350ab8 #504 hosted-git-info@10.1.1 (@owlstronaut)
• c7c7d7f #504 template-oss-apply (@owlstronaut)
• e9ac85e #501 template-oss-apply (@owlstronaut)
• e184356 #501 template-oss@5.1.0 (@owlstronaut)
• 644ebb6 #479 template-oss-apply (@owlstronaut)
• ee64bea #479 @npmcli/template-oss@4.30.0 (@owlstronaut)

Contributors

• @ljharb
• @owlstronaut
• @oldium
• @babyhuey
• @manzoorwanijk
• @j1mb0-1

21.5.1 (2026年06月09日)

Bug Fixes

• 627a7dc #499 avoid ReDoS in addGitSha committish stripping (@owlstronaut)

Chores

• 790a24b #500 template-oss-apply (#500) (@owlstronaut, test)
• 09cb304 #499 template-oss-apply (@owlstronaut)
• bea9f84 #499 @npmcli/template-oss@5.1.0 (@owlstronaut)

Contributors

• @owlstronaut

21.5.0 (2026年03月09日)

Features

• d912f17 #457 expose fetched attestation bundles on manifest (#457) (@mitchdenny)

Chores

• 586a55d #471 template-oss-apply for new macos images (#471) (@wraithgar)
• d1cc5c8 #460 template-oss-apply for release branches (#460) (@wraithgar)
• b741e8b #468 bump @npmcli/template-oss from 4.28.0 to 4.29.0 (#468) (@dependabot[bot], @npm-cli-bot)

Contributors

• @wraithgar
• @mitchdenny
• @dependabot
• @npm-cli-bot

20.0.1 (2026年03月06日)

Dependencies

• f8e2931 #461 tar@7.5.10

Chores

• 01a126d #466 enable backport mode for v20 (#466) (@wraithgar)
• 98f72f6 #461 tests should not inherit --ignore-scripts flag from `npm run t... (#422) (@owlstronaut)
• f8cf9ba #461 @npmcli/template-oss@4.29.0 (@wraithgar)

Contributors

• @wraithgar
• @owlstronaut

19.0.2 (2026年03月06日)

Dependencies

• bf6e354 #459 tar@7.5.10

Chores

• b7f2691 #465 enable backport mode for v19 (#465) (@wraithgar)
• ed1aef0 #459 tests should not inherit --ignore-scripts flag from `npm run t... (#422) (@owlstronaut)
• 415e369 #459 @npmcli/template-oss@4.29.0 (@wraithgar)

Contributors

• @wraithgar
• @owlstronaut

21.4.0 (2026年02月24日)

Features

• 6912f24 #451 add allowRegistry option (#451) (@wraithgar)

Bug Fixes

• ab37bc1 #452 prevent path duplication in attestation URL for registries with ... (#452) (@ajayk)
• ab37bc1 #452 prevent path duplication in attestation URL for registries with (@ajayk)
• 8b8ea3b #454 skip registry key check for keyless (Sigstore/Fulcio) attestations (#454) (@ajayk)
• 8b8ea3b #454 skip registry key check for keyless (Sigstore/Fulcio) attestations (@ajayk)

Chores

• 0dfd1cd #456 remove git config from tests (#456) (@wraithgar)

Contributors

• @wraithgar
• @ajayk

21.3.1 (2026年02月10日)

Bug Fixes

• 96e571a #439 ensure that resolved git ref matches expected sha (#439) (@klassiker, pacotedev)

Chores

• 91847c4 #447 fix test for ssri ignoring invalid hashes (#447) (@wraithgar)

Contributors

• @wraithgar
• @klassiker

21.3.0 (2026年02月09日)

Features

• 8f5091d #445 add support for git-256 sha lengths (#445) (@wraithgar)

Contributors

• @wraithgar

21.2.0 (2026年02月06日)

Features

• db21624 #442 implement gitSubdir according to npa spec (#442) (@Kakadus)
• c2a4217 #443 add allowRemote, allowFile, allowDirectory (#443) (@wraithgar)

Contributors

• @wraithgar
• @Kakadus

21.1.0 (2026年01月28日)

Features

• 258e5fd #440 add allowGit option (#440) (@wraithgar)

Contributors

• @wraithgar