deps: upgrade npm to 11.0.0 #56274

npm-cli-bot · 2024-12-16T17:40:39Z

11.0.0 (2024-12-16)

Documentation

8a911da #7963 ls: removed design change pending section note (#7963) (@milaninfy)

Dependencies

5319e48 #7973 remove unnecessary sprintf-js files in node_modules (#7973)
d369c77 #7976 socks-proxy-agent@8.0.5
3b2951a #7976 https-proxy-agent@7.0.6
a598b7b #7976 agent-base@7.1.3
52bcaf6 #7976 debug@4.4.0
aabf345 #7976 p-map@7.0.3
28e8761 #7976 npm-package-arg@12.0.1

Chores

ecd7190 #7976 dev dependency updates (@wraithgar)
a07f4e0 #7976 @npmcli/template-oss@4.23.6 (@wraithgar)
687ab12 #7970 remove pre-release mode from npm 11 and workspaces (#7970) (@wraithgar)
workspace: @npmcli/arborist@9.0.0
workspace: @npmcli/config@10.0.0
workspace: libnpmaccess@10.0.0
workspace: libnpmdiff@8.0.0
workspace: libnpmexec@10.0.0
workspace: libnpmfund@7.0.0
workspace: libnpmorg@8.0.0
workspace: libnpmpack@9.0.0
workspace: libnpmpublish@11.0.0
workspace: libnpmsearch@9.0.0
workspace: libnpmteam@8.0.0
workspace: libnpmversion@8.0.0

nodejs-github-bot · 2024-12-16T17:40:45Z

Review requested:

@nodejs/security-wg

github-actions · 2024-12-16T17:41:06Z

Fast-track has been requested by @nodejs-github-bot. Please 👍 to approve.

wraithgar · 2024-12-16T17:41:36Z

Breaking change list

npm now supports node ^20.17.0 || >=22.9.0
Upon publishing, in order to apply a default "latest" dist tag, the command now retrieves all prior versions of the package. It will require that the version you're trying to publish is above the latest semver version in the registry, not including pre-release tags.
When publishing a package with a pre-release version, you must explicitly specify a tag.
npm init now has a type prompt, and sorts the entries the created packages differently
The npm hook command has been removed
Attestations made by this package will no longer validate in npm versions prior to 10.6.0
bun.lockb files are now included in the strict ignore list during packing
--ignore-scripts now applies to all lifecycle scripts, include prepare
npm will no longer fall back to the old audit endpoint if the bulk advisory request fails.
npm will no longer switch to global mode if aliased to "npmg" or "npm-g" etc.

wraithgar · 2024-12-16T17:45:29Z

Just so we are clear, this is a breaking change! This should not be backported to node 22 (at least not without a good discussion first).

wraithgar · 2024-12-16T17:55:18Z

Why don't land on v23? I thought that's where breaking changes landed.

ljharb · 2024-12-16T17:59:24Z

I might be wrong, but v23 is already released, and main is v24, and breaking changes to non-experimental things can't land in an existing major. Anyone is of course free to remove the label if my understanding is correct.

wraithgar · 2024-12-16T18:07:40Z

Based on past discussions:

It was only "LTS" that was the concern.

Additionally, given the "integrating with node" outline, nothing in this release breaks anything in that list.

richardlau · 2024-12-16T18:19:55Z

Why don't land on v23? I thought that's where breaking changes landed.

No, 23 follows semver like all Node.js releases. The odd releases have much shorter life times than the even ones, that become LTS. It's been a long-standing mismatch between npm's release policy and Node.js' policy and the compromise, in all of those linked issues, is that we would take a semver major npm version during a release line if it could be demonstrated that the breaking changes were not breaking to users.

wraithgar · 2024-12-16T18:30:49Z

👍 ok thanks for the clarification. We'll let you decide how far back to backport this.

The only things this will affect for folks running npm install would be:

folks who are using it with --ignore-scripts but also still expecting prepare to run (i.e. with git dependencies)
folks who somehow have a server they are using that supports its own audit endpoint, but only the fallback one
folks who have a (useless) bun.lockb file they are expecting to show up in their published package

ljharb · 2024-12-16T18:34:17Z

Of those three, only the first one seems even remotely likely to be a concern, and a pretty unlikely one at that.

nodejs-github-bot · 2024-12-17T00:34:12Z

CI: https://ci.nodejs.org/job/node-test-pull-request/64074/

bricss · 2024-12-31T15:56:56Z

It's time for gentle landing 🛬 on the main runway 👨‍✈️

nodejs-github-bot · 2025-01-10T16:20:29Z

Landed in 25b22e4

PR-URL: nodejs#56274 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

Semver-Major Commits: buffer: * (SEMVER-MAJOR) make `buflen` in integer range (zhenweijin) #51821 build: * (SEMVER-MAJOR) bump supported macOS version to 13.5 (Michaël Zasso) #57115 * (SEMVER-MAJOR) increase minimum Xcode version to 16.1 (Michaël Zasso) #56824 * (SEMVER-MAJOR) link V8 with atomic library (Michaël Zasso) #55014 * (SEMVER-MAJOR) remove support for ppc 32-bit (Michaël Zasso) #55014 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #55014 child_process: * (SEMVER-MAJOR) deprecate passing `args` to `spawn` and `execFile` (Daniel Venable) #57199 deps: * (SEMVER-MAJOR) V8: cherry-pick f915fa4c9f41 (Olivier Flückiger) #55014 * (SEMVER-MAJOR) V8: cherry-pick 0d5d6e71bbb0 (Yagiz Nizipli) #55014 * (SEMVER-MAJOR) V8: cherry-pick 0c11feeeca4a (Michaël Zasso) #55014 * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #55014 * (SEMVER-MAJOR) always define V8_NODISCARD as no-op (Michaël Zasso) #55014 * (SEMVER-MAJOR) fix FP16 bitcasts.h (Stefan Stojanovic) #55014 * (SEMVER-MAJOR) patch V8 to support compilation with MSVC (StefanStojanovic) #55014 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #55014 * (SEMVER-MAJOR) disable V8 concurrent sparkplug compilation (Michaël Zasso) #55014 * (SEMVER-MAJOR) always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #55014 * (SEMVER-MAJOR) update V8 to 13.0.245.25 (Michaël Zasso) #55014 * (SEMVER-MAJOR) upgrade npm to 11.0.0 (npm team) #56274 * (SEMVER-MAJOR) update undici to 7.0.0 (Node.js GitHub Bot) #56070 fs: * (SEMVER-MAJOR) remove ability to call truncate with fd (Yagiz Nizipli) #57567 * (SEMVER-MAJOR) remove `fs.F_OK`, `fs.R_OK`, `fs.W_OK`, `fs.X_OK` (Livia Medeiros) #55862 * (SEMVER-MAJOR) deprecate passing invalid types in `fs.existsSync` (Carlos Espa) #55753 * (SEMVER-MAJOR) runtime deprecate `fs.F_OK`, `fs.R_OK`, `fs.W_OK`, `fs.X_OK` (Livia Medeiros) #49686 * (SEMVER-MAJOR) remove `dirent.path` (Antoine du Hamel) #55548 lib: * (SEMVER-MAJOR) remove obsolete Cipher export (James M Snell) #57266 * (SEMVER-MAJOR) unexpose six process bindings (Michaël Zasso) #57149 * (SEMVER-MAJOR) make ALS default to AsyncContextFrame (Stephen Belanger) #55552 * (SEMVER-MAJOR) runtime deprecate SlowBuffer (Rafael Gonzaga) #55175 net: * (SEMVER-MAJOR) make _setSimultaneousAccepts() end-of-life deprecated (Yagiz Nizipli) #57550 repl: * (SEMVER-MAJOR) runtime deprecate instantiating without new (Aviv Keller) #54869 src: * (SEMVER-MAJOR) update GetForegroundTaskRunner override (Etienne Pierre-doray) #55014 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 134 (Michaël Zasso) #55014 * (SEMVER-MAJOR) drop --experimental-permission in favour of --permission (Rafael Gonzaga) #56240 * (SEMVER-MAJOR) add async context frame to AsyncResource (Gerhard Stöbich) #56082 * (SEMVER-MAJOR) nuke deprecated and un-used enum members in `OptionEnvvarSettings` (Juan José) #53079 stream: * (SEMVER-MAJOR) catch and forward error from dest.write (jakecastelli) #55270 test: * (SEMVER-MAJOR) disable fast API call count checks (Michaël Zasso) #55014 test_runner: * (SEMVER-MAJOR) remove promises returned by t.test() (Colin Ihrig) #56664 * (SEMVER-MAJOR) remove promises returned by test() (Colin Ihrig) #56664 * (SEMVER-MAJOR) automatically wait for subtests to finish (Colin Ihrig) #56664 timers: * (SEMVER-MAJOR) check for immediate instance in clearImmediate (Gürgün Dayıoğlu) #57069 * (SEMVER-MAJOR) set several methods EOL (Yagiz Nizipli) #56966 tls: * (SEMVER-MAJOR) remove deprecated tls.createSecurePair (Jonas) #57361 * (SEMVER-MAJOR) make server.prototype.setOptions end-of-life (Yagiz Nizipli) #57339 tools: * (SEMVER-MAJOR) update V8 gypfiles for 13.0 (Michaël Zasso) #55014 url: * (SEMVER-MAJOR) expose urlpattern as global (Jonas) #56950 * (SEMVER-MAJOR) runtime deprecate url.parse (Yagiz Nizipli) #55017 zlib: * (SEMVER-MAJOR) deprecate classes usage without `new` (Yagiz Nizipli) #55718 PR-URL: TBD

Semver-Major Commits: buffer: * (SEMVER-MAJOR) make `buflen` in integer range (zhenweijin) #51821 build: * (SEMVER-MAJOR) bump supported macOS version to 13.5 (Michaël Zasso) #57115 * (SEMVER-MAJOR) increase minimum Xcode version to 16.1 (Michaël Zasso) #56824 * (SEMVER-MAJOR) link V8 with atomic library (Michaël Zasso) #55014 * (SEMVER-MAJOR) remove support for ppc 32-bit (Michaël Zasso) #55014 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #55014 child_process: * (SEMVER-MAJOR) deprecate passing `args` to `spawn` and `execFile` (Daniel Venable) #57199 deps: * (SEMVER-MAJOR) V8: cherry-pick f915fa4c9f41 (Olivier Flückiger) #55014 * (SEMVER-MAJOR) V8: cherry-pick 0d5d6e71bbb0 (Yagiz Nizipli) #55014 * (SEMVER-MAJOR) V8: cherry-pick 0c11feeeca4a (Michaël Zasso) #55014 * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #55014 * (SEMVER-MAJOR) always define V8_NODISCARD as no-op (Michaël Zasso) #55014 * (SEMVER-MAJOR) fix FP16 bitcasts.h (Stefan Stojanovic) #55014 * (SEMVER-MAJOR) patch V8 to support compilation with MSVC (StefanStojanovic) #55014 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #55014 * (SEMVER-MAJOR) disable V8 concurrent sparkplug compilation (Michaël Zasso) #55014 * (SEMVER-MAJOR) always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #55014 * (SEMVER-MAJOR) update V8 to 13.0.245.25 (Michaël Zasso) #55014 * (SEMVER-MAJOR) upgrade npm to 11.0.0 (npm team) #56274 * (SEMVER-MAJOR) update undici to 7.0.0 (Node.js GitHub Bot) #56070 fs: * (SEMVER-MAJOR) remove ability to call truncate with fd (Yagiz Nizipli) #57567 * (SEMVER-MAJOR) remove `fs.F_OK`, `fs.R_OK`, `fs.W_OK`, `fs.X_OK` (Livia Medeiros) #55862 * (SEMVER-MAJOR) deprecate passing invalid types in `fs.existsSync` (Carlos Espa) #55753 * (SEMVER-MAJOR) runtime deprecate `fs.F_OK`, `fs.R_OK`, `fs.W_OK`, `fs.X_OK` (Livia Medeiros) #49686 * (SEMVER-MAJOR) remove `dirent.path` (Antoine du Hamel) #55548 lib: * (SEMVER-MAJOR) remove obsolete Cipher export (James M Snell) #57266 * (SEMVER-MAJOR) unexpose six process bindings (Michaël Zasso) #57149 * (SEMVER-MAJOR) make ALS default to AsyncContextFrame (Stephen Belanger) #55552 * (SEMVER-MAJOR) runtime deprecate SlowBuffer (Rafael Gonzaga) #55175 net: * (SEMVER-MAJOR) make _setSimultaneousAccepts() end-of-life deprecated (Yagiz Nizipli) #57550 repl: * (SEMVER-MAJOR) runtime deprecate instantiating without new (Aviv Keller) #54869 src: * (SEMVER-MAJOR) update GetForegroundTaskRunner override (Etienne Pierre-doray) #55014 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 134 (Michaël Zasso) #55014 * (SEMVER-MAJOR) drop --experimental-permission in favour of --permission (Rafael Gonzaga) #56240 * (SEMVER-MAJOR) add async context frame to AsyncResource (Gerhard Stöbich) #56082 * (SEMVER-MAJOR) nuke deprecated and un-used enum members in `OptionEnvvarSettings` (Juan José) #53079 stream: * (SEMVER-MAJOR) catch and forward error from dest.write (jakecastelli) #55270 test: * (SEMVER-MAJOR) disable fast API call count checks (Michaël Zasso) #55014 test_runner: * (SEMVER-MAJOR) remove promises returned by t.test() (Colin Ihrig) #56664 * (SEMVER-MAJOR) remove promises returned by test() (Colin Ihrig) #56664 * (SEMVER-MAJOR) automatically wait for subtests to finish (Colin Ihrig) #56664 timers: * (SEMVER-MAJOR) check for immediate instance in clearImmediate (Gürgün Dayıoğlu) #57069 * (SEMVER-MAJOR) set several methods EOL (Yagiz Nizipli) #56966 tls: * (SEMVER-MAJOR) remove deprecated tls.createSecurePair (Jonas) #57361 * (SEMVER-MAJOR) make server.prototype.setOptions end-of-life (Yagiz Nizipli) #57339 tools: * (SEMVER-MAJOR) update V8 gypfiles for 13.0 (Michaël Zasso) #55014 url: * (SEMVER-MAJOR) expose urlpattern as global (Jonas) #56950 * (SEMVER-MAJOR) runtime deprecate url.parse (Yagiz Nizipli) #55017 zlib: * (SEMVER-MAJOR) deprecate classes usage without `new` (Yagiz Nizipli) #55718 PR-URL: #57609

Semver-Major Commits: buffer: * (SEMVER-MAJOR) make `buflen` in integer range (zhenweijin) #51821 build: * (SEMVER-MAJOR) bump supported macOS version to 13.5 (Michaël Zasso) #57115 * (SEMVER-MAJOR) increase minimum Xcode version to 16.1 (Michaël Zasso) #56824 * (SEMVER-MAJOR) link V8 with atomic library (Michaël Zasso) #55014 * (SEMVER-MAJOR) remove support for ppc 32-bit (Michaël Zasso) #55014 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #55014 child_process: * (SEMVER-MAJOR) deprecate passing `args` to `spawn` and `execFile` (Daniel Venable) #57199 deps: * (SEMVER-MAJOR) V8: cherry-pick f915fa4c9f41 (Olivier Flückiger) #55014 * (SEMVER-MAJOR) V8: cherry-pick 0d5d6e71bbb0 (Yagiz Nizipli) #55014 * (SEMVER-MAJOR) V8: cherry-pick 0c11feeeca4a (Michaël Zasso) #55014 * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #55014 * (SEMVER-MAJOR) always define V8_NODISCARD as no-op (Michaël Zasso) #55014 * (SEMVER-MAJOR) fix FP16 bitcasts.h (Stefan Stojanovic) #55014 * (SEMVER-MAJOR) patch V8 to support compilation with MSVC (StefanStojanovic) #55014 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #55014 * (SEMVER-MAJOR) disable V8 concurrent sparkplug compilation (Michaël Zasso) #55014 * (SEMVER-MAJOR) always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #55014 * (SEMVER-MAJOR) update V8 to 13.0.245.25 (Michaël Zasso) #55014 * (SEMVER-MAJOR) upgrade npm to 11.0.0 (npm team) #56274 * (SEMVER-MAJOR) update undici to 7.0.0 (Node.js GitHub Bot) #56070 fs: * (SEMVER-MAJOR) remove ability to call truncate with fd (Yagiz Nizipli) #57567 * (SEMVER-MAJOR) deprecate passing invalid types in `fs.existsSync` (Carlos Espa) #55753 * (SEMVER-MAJOR) runtime deprecate `fs.F_OK`, `fs.R_OK`, `fs.W_OK`, `fs.X_OK` (Livia Medeiros) #49686 * (SEMVER-MAJOR) remove `dirent.path` (Antoine du Hamel) #55548 lib: * (SEMVER-MAJOR) remove obsolete Cipher export (James M Snell) #57266 * (SEMVER-MAJOR) unexpose six process bindings (Michaël Zasso) #57149 * (SEMVER-MAJOR) make ALS default to AsyncContextFrame (Stephen Belanger) #55552 * (SEMVER-MAJOR) runtime deprecate SlowBuffer (Rafael Gonzaga) #55175 net: * (SEMVER-MAJOR) make _setSimultaneousAccepts() end-of-life deprecated (Yagiz Nizipli) #57550 repl: * (SEMVER-MAJOR) runtime deprecate instantiating without new (Aviv Keller) #54869 src: * (SEMVER-MAJOR) update GetForegroundTaskRunner override (Etienne Pierre-doray) #55014 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 134 (Michaël Zasso) #55014 * (SEMVER-MAJOR) drop --experimental-permission in favour of --permission (Rafael Gonzaga) #56240 * (SEMVER-MAJOR) add async context frame to AsyncResource (Gerhard Stöbich) #56082 * (SEMVER-MAJOR) nuke deprecated and un-used enum members in `OptionEnvvarSettings` (Juan José) #53079 stream: * (SEMVER-MAJOR) catch and forward error from dest.write (jakecastelli) #55270 test: * (SEMVER-MAJOR) disable fast API call count checks (Michaël Zasso) #55014 test_runner: * (SEMVER-MAJOR) remove promises returned by t.test() (Colin Ihrig) #56664 * (SEMVER-MAJOR) remove promises returned by test() (Colin Ihrig) #56664 * (SEMVER-MAJOR) automatically wait for subtests to finish (Colin Ihrig) #56664 timers: * (SEMVER-MAJOR) check for immediate instance in clearImmediate (Gürgün Dayıoğlu) #57069 * (SEMVER-MAJOR) set several methods EOL (Yagiz Nizipli) #56966 tls: * (SEMVER-MAJOR) remove deprecated tls.createSecurePair (Jonas) #57361 * (SEMVER-MAJOR) make server.prototype.setOptions end-of-life (Yagiz Nizipli) #57339 tools: * (SEMVER-MAJOR) update V8 gypfiles for 13.0 (Michaël Zasso) #55014 url: * (SEMVER-MAJOR) expose urlpattern as global (Jonas) #56950 * (SEMVER-MAJOR) runtime deprecate url.parse (Yagiz Nizipli) #55017 zlib: * (SEMVER-MAJOR) deprecate classes usage without `new` (Yagiz Nizipli) #55718 PR-URL: #57609 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

deps: upgrade npm to 11.0.0

6303bf6

nodejs-github-bot added fast-track PRs that do not need to wait for 48 hours to land. needs-ci PRs that need a full CI run. npm Issues and PRs related to the npm client dependency or the npm registry. labels Dec 16, 2024

ljharb approved these changes Dec 16, 2024

View reviewed changes

ljharb removed the dont-land-on-v23.x PRs that should not land on the v23.x-staging branch and should not be released in v23.x. label Dec 16, 2024

lpinca approved these changes Dec 16, 2024

View reviewed changes

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Dec 17, 2024

targos approved these changes Dec 17, 2024

View reviewed changes

richardlau mentioned this pull request Dec 20, 2024

Update npm to 11.0.0 #56326

Closed

RafaelGSS approved these changes Dec 31, 2024

View reviewed changes

This comment was marked as off-topic.

Sign in to view

bricss mentioned this pull request Jan 3, 2025

2025-01-07, Version 23.6.0 (Current) #56450

Merged

legendecas linked an issue Jan 3, 2025 that may be closed by this pull request

Update npm to 11.0.0 #56326

Closed

targos added the commit-queue Add this label to land a pull request using GitHub Actions. label Jan 10, 2025

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Jan 10, 2025

nodejs-github-bot merged commit 25b22e4 into nodejs:main Jan 10, 2025
94 checks passed

RafaelGSS mentioned this pull request Mar 24, 2025

2025-04-23, Version 24.0.0 (Current) #57609

Open

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

deps: upgrade npm to 11.0.0 #56274

deps: upgrade npm to 11.0.0 #56274

npm-cli-bot commented Dec 16, 2024

nodejs-github-bot commented Dec 16, 2024

github-actions bot commented Dec 16, 2024

wraithgar commented Dec 16, 2024 •

edited

Loading

wraithgar commented Dec 16, 2024

wraithgar commented Dec 16, 2024

ljharb commented Dec 16, 2024

wraithgar commented Dec 16, 2024

richardlau commented Dec 16, 2024

wraithgar commented Dec 16, 2024

ljharb commented Dec 16, 2024

nodejs-github-bot commented Dec 17, 2024

bricss commented Dec 31, 2024 •

edited

Loading

This comment was marked as off-topic.

nodejs-github-bot commented Jan 10, 2025

deps: upgrade npm to 11.0.0 #56274

deps: upgrade npm to 11.0.0 #56274

Conversation

npm-cli-bot commented Dec 16, 2024

11.0.0 (2024-12-16)

Documentation

Dependencies

Chores

nodejs-github-bot commented Dec 16, 2024

github-actions bot commented Dec 16, 2024

wraithgar commented Dec 16, 2024 • edited Loading

wraithgar commented Dec 16, 2024

wraithgar commented Dec 16, 2024

ljharb commented Dec 16, 2024

wraithgar commented Dec 16, 2024

richardlau commented Dec 16, 2024

wraithgar commented Dec 16, 2024

ljharb commented Dec 16, 2024

nodejs-github-bot commented Dec 17, 2024

bricss commented Dec 31, 2024 • edited Loading

This comment was marked as off-topic.

nodejs-github-bot commented Jan 10, 2025

wraithgar commented Dec 16, 2024 •

edited

Loading

bricss commented Dec 31, 2024 •

edited

Loading