chore: release 11.4.0

[github-actions]

🤖 I have created a release beep boop

11.4.0

11.4.0 (2025-05-15)

Features

• a0e60fb #8246 added init-private option (@owlstronaut)
• 57aa89f #8265 use run by default and run-script as the alias (feat: use run by default and run-script as the alias #8265) (@owlstronaut)
• 0d4c023 #8234 install: add package info to json output (feat(install): add package info to json output #8234) (@wraithgar)

Bug Fixes

• 8794fd9 #8297 powershell: support pipeline input with Invoke-Expression (fix(powershell): support pipeline input with Invoke-Expression #8297) (@alexsch01)
• b5173d1 #8293 docs: corrected github_path (fix(docs): corrected github_path #8293) (@xaos7991)
• 2210d7a #8278 powershell: use Invoke-Expression to pass args (fix(powershell): use Invoke-Expression to pass args #8278) (@alexsch01)
• 8669d09 #8228 add otplease for enable-2fa, disable-2fa, access (fix: add otplease for enable-2fa, disable-2fa, access #8228) (@reggi, @wraithgar)
• 78b5a6f #8269 correctly handle scenario where prefix is the cwd (fix: correctly handle scenario where prefix is the cwd #8269) (@owlstronaut, @ficocelliguy)
• fdc3413 #8221 exec: Fails to Execute Binaries Named After Shell Keywords (fix(exec): Fails to Execute Binaries Named After Shell Keywords #8221) (@13sfaith)
• 4b08e2e #8245 docs: prepare script runs for local package links (@milaninfy)
• 1622ac4 #8241 handle missing time in packument to prevent crash on npm view (@owlstronaut)
• db8f5da #8110 outdated: add dependent location in long output (fix(outdated): add dependent location in long output #8110) (@milaninfy, @wraithgar)

Documentation

• d2498df #8295 Remove CHANGELOG from never-ignored list (docs: Remove CHANGELOG from never-ignored list #8295) (@mrazauskas)
• 4d5c3c1 #8283 fix overrides example in package-json.md (docs: fix overrides example in package-json.md #8283) (@glasser)
• 96cc4f9 #8226 format publish as code to highlight it (@LiangYingC)
• 4990ea0 #8226 clarify legacy token creation in npm login and adduser commands (@LiangYingC)

Dependencies

• c97ef8a #8246 init-package-json@8.2.1
• f48613d #8292 @sigstore/verify@2.1.1
• a4c5e74 #8292 tinyglobby@0.2.13
• b9156d2 #8292 http-cache-semantics@4.2.0
• 472a685 #8292 binary-extensions@3.1.0
• 988696e #8292 @sigstore/tuf@3.1.1
• 569ac84 #8292 semver@7.7.2
• 2521c9b #8233 @sigstore/protobuf-specs@0.4.1
• 3274d68 #8233 @npmcli/query@4.0.1
• c263626 #8233 abbrev@3.0.1
• 78df711 #8233 hosted-git-info@8.1.0

Chores

• e80e38e #8292 dev dependency updates (@wraithgar)
• 3231ee9 #8244 update snapshots (@owlstronaut)
• c561a33 #8233 dev dependency updates (@owlstronaut)
• 7eca19c #8215 update workflow permissions for updating Node PR (@owlstronaut)
• workspace: @npmcli/arborist@9.1.0
• workspace: @npmcli/config@10.3.0
• workspace: libnpmaccess@10.0.1
• workspace: libnpmdiff@8.0.3
• workspace: libnpmexec@10.1.2
• workspace: libnpmfund@7.0.3
• workspace: libnpmpack@9.0.3
• workspace: libnpmteam@8.0.1
• workspace: libnpmversion@8.0.1

arborist: 9.1.0

9.1.0 (2025-05-15)

Features

• 57aa89f #8265 use run by default and run-script as the alias (feat: use run by default and run-script as the alias #8265) (@owlstronaut)

Bug Fixes

• d5bcf38 #8268 arborist: Add better error message when lockfile is malformed (fix(arborist): Add better error message when lockfile is malformed #8268) (@owlstronaut)
• 5e1fed9 #8290 arborist: improve README markdown (fix(arborist): improve README markdown #8290) (@mbtools)
• 0886e7a #8222 preserve registry path when replacing a host (@owlstronaut)
• 815311b #8206 arborist: workspaces correctly path to file: packages from overrides (@owlstronaut)

config: 10.3.0

10.3.0 (2025-05-15)

Features

• a0e60fb #8246 added init-private option (@owlstronaut)
• 57aa89f #8265 use run by default and run-script as the alias (feat: use run by default and run-script as the alias #8265) (@owlstronaut)

Bug Fixes

• ed1a28e #8238 config: use exclusive for save types (@owlstronaut)

libnpmaccess: 10.0.1

10.0.1 (2025-05-15)

Bug Fixes

• 5b5e886 #8289 libnpmaccess: formatting of options in README (fix(libnpmaccess): formatting of options in README #8289) (@mbtools)

libnpmdiff: 8.0.3

Dependencies

• workspace: @npmcli/arborist@9.1.0

libnpmexec: 10.1.2

10.1.2 (2025-05-15)

Bug Fixes

• fdc3413 #8221 exec: Fails to Execute Binaries Named After Shell Keywords (fix(exec): Fails to Execute Binaries Named After Shell Keywords #8221) (@13sfaith)

Dependencies

• workspace: @npmcli/arborist@9.1.0

libnpmfund: 7.0.3

Dependencies

• workspace: @npmcli/arborist@9.1.0

libnpmpack: 9.0.3

Dependencies

• workspace: @npmcli/arborist@9.1.0

libnpmteam: 8.0.1

8.0.1 (2025-05-15)

Bug Fixes

• b734099 #8291 libnpmteam: update README (fix(libnpmteam): update README #8291) (@mbtools)

libnpmversion: 8.0.1

8.0.1 (2025-05-15)

Bug Fixes

• 71bb817 #8279 version: include prerelease when retriving tag (fix(version): include prerelease when retriving tag #8279) (@milaninfy)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Release Manager

Release workflow run: https://github.com/npm/cli/actions/runs/15050139942

Release Checklist for v11.4.0

• 1. Checkout the release branch

  Ensure git status is not dirty on this branch after resetting deps. If it is, then something is probably wrong with the automated release process.

  gh pr checkout 8214 --force

  npm run resetdeps

  node scripts/git-dirty.js

• 2. Check CI status

  gh pr checks --watch

• 3. Publish the CLI and workspaces

  Warning:
  This will publish all updated workspaces to latest, prerelease or backport depending on their version, and will publish the CLI with the dist-tag set to next-11.

  Note:
  The --test argument can optionally be omitted to run the publish process without running any tests locally.

  node scripts/publish.js --test

• 4. Optionally install and test npm@11.4.0 locally

  npm i -g npm@11.4.0

  npm --version
  npm whoami
  npm help install
  # etc

• 5. Set latest dist-tag to newly published version

  Warning:
  NOT FOR PRERELEASE: Do not run this step for prereleases or if 11 is not being set to latest.

  node . dist-tag add npm@11.4.0 latest

• 6. Trigger docs.npmjs.com update

  gh workflow run update-cli.yml --repo npm/documentation

• 7. Approve and Merge release PR

  gh pr review --approve

  gh pr merge --rebase

  git checkout latest

  git fetch

  git reset --hard origin/latest

  node . run resetdeps

• 8. Wait For Release Tags

  Warning:
  The remaining steps all require the GitHub tags and releases to be created first. These are done once this PR has been labelled with autorelease: tagged.

  Release Please will run on the just merged release commit and create GitHub releases and tags for each package. The release bot will will comment on this PR when the releases and tags are created.

  Note:
  The release workflow also includes the Node integration tests which do not need to finish before continuing.

  You can watch the release workflow in your terminal with the following command:

  gh run watch `gh run list -R npm/cli -w release -b latest -L 1 --json databaseId -q ".[0].databaseId"`
  

• 9. Mark GitHub Release as latest

  Warning:
  You must wait for CI to create the release tags before running this step. These are done once this PR has been labelled with autorelease: tagged.

  Release Please will make GitHub Releases for the CLI and all workspaces, but GitHub has UI affordances for which release should appear as the "latest", which should always be the CLI. To mark the CLI release as latest run this command:

  gh release -R npm/cli edit v11.4.0 --latest

• 10. Open nodejs/node PR to update npm to latest

  Warning:
  You must wait for CI to create the release tags before running this step. These are done once this PR has been labelled with autorelease: tagged.

  Trigger the Create Node PR action. This will open a PR on nodejs/node to the main branch.

  Note:
  The resulting PR may need to be labelled if it is not intended to land on old Node versions.

  First, sync our fork of node with the upstream source:

  gh repo sync npm/node --source nodejs/node --force

  Then, if we are opening a PR against the latest version of node:

  gh workflow run create-node-pr.yml -f spec=next-11

  If the PR should be opened on a different branch (such as when doing backports) then run it with -f branch=<BRANCH_NAME>. There is also a shortcut to target a specific Node version by specifying a major version number with -f branch=18 (or similar).

  For example, this will create a PR on nodejs/node to the v16.x-staging branch:

  gh workflow run create-node-pr.yml -f spec=next-11 -f branch=16

• 11. Label and fast-track nodejs/node PR

  Note:
  This requires being a nodejs collaborator. This could be you!

  • Thumbs-up reaction on the Fast-track comment
  • Add an LGTM / Approval
  • Add request-ci label to get it running CI
  • Add commit-queue label once everything is green

[mbtools]

@wraithgar, please add @mbtools to 8278. Thx 🙏

[wraithgar]

That will have to be a follow up commit post-release. The changelog is auto generated for each release. We can post-edit things but can't live-edit if that makes sense.

Adding a co-authored-by footer also works (ref, but that wont' help here because the commit already landed. Sorry about that.

[wraithgar]

I can add you to the release notes for the release which will at least make it right there, and I believe it's what powers the PR into the nodejs repo.

[mbtools]

Thanks

[wraithgar]

Waiting on #8246 to land before we release

[alexsch01]

Hold up @wraithgar

before this lands, I missed a case with the invoke-expression code

[alexsch01]

ok here #8297 @wraithgar

[github-actions]

🤖 Created releases:

• v11.4.0
• arborist-v9.1.0
• config-v10.3.0
• libnpmaccess-v10.0.1
• libnpmdiff-v8.0.3
• libnpmexec-v10.1.2
• libnpmfund-v7.0.3
• libnpmpack-v9.0.3
• libnpmteam-v8.0.1
• libnpmversion-v8.0.1

🌻

[github-actions]

Release Workflow

• npm@11.4.0 https://github.com/npm/cli/releases/tag/v11.4.0
• @npmcli/arborist@9.1.0 https://github.com/npm/cli/releases/tag/arborist-v9.1.0
• @npmcli/config@10.3.0 https://github.com/npm/cli/releases/tag/config-v10.3.0
• libnpmaccess@10.0.1 https://github.com/npm/cli/releases/tag/libnpmaccess-v10.0.1
• libnpmdiff@8.0.3 https://github.com/npm/cli/releases/tag/libnpmdiff-v8.0.3
• libnpmexec@10.1.2 https://github.com/npm/cli/releases/tag/libnpmexec-v10.1.2
• libnpmfund@7.0.3 https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.3
• libnpmpack@9.0.3 https://github.com/npm/cli/releases/tag/libnpmpack-v9.0.3
• libnpmteam@8.0.1 https://github.com/npm/cli/releases/tag/libnpmteam-v8.0.1
• libnpmversion@8.0.1 https://github.com/npm/cli/releases/tag/libnpmversion-v8.0.1
• Workflow run: ❌ https://github.com/npm/cli/actions/runs/15050974748

🚨🚨🚨

@npm/cli-team: The post-release workflow failed for this release. Manual steps may need to be taken after examining the workflow output.

🚨🚨🚨