[pull] latest from npm:latest

.release-please-manifest.json

@@ -1,15 +1,15 @@
 {
-  ".": "11.5.2",
-  "workspaces/arborist": "9.1.3",
+  ".": "11.6.0",
+  "workspaces/arborist": "9.1.4",
   "workspaces/libnpmaccess": "10.0.1",
-  "workspaces/libnpmdiff": "8.0.6",
-  "workspaces/libnpmexec": "10.1.5",
-  "workspaces/libnpmfund": "7.0.6",
+  "workspaces/libnpmdiff": "8.0.7",
+  "workspaces/libnpmexec": "10.1.6",
+  "workspaces/libnpmfund": "7.0.7",
   "workspaces/libnpmorg": "8.0.0",
-  "workspaces/libnpmpack": "9.0.6",
+  "workspaces/libnpmpack": "9.0.7",
   "workspaces/libnpmpublish": "11.1.0",
   "workspaces/libnpmsearch": "9.0.0",
   "workspaces/libnpmteam": "8.0.1",
   "workspaces/libnpmversion": "8.0.1",
-  "workspaces/config": "10.3.1"
+  "workspaces/config": "10.4.0"
 }

AUTHORS

@@ -971,3 +971,7 @@ sam crochet <shmam@github.com>
 tarekwfa0110 <109884541+tarekwfa0110@users.noreply.github.com>
 Marc Bernard <marc@marcbernardtools.com>
 Gareth Jones <3151613+G-Rath@users.noreply.github.com>
+Aaron Jensen <atj@me.com>
+Jeepsboucher <42554351+Jeepsboucher@users.noreply.github.com>
+Arkadiusz Czekajski <aczekajski@gmail.com>
+Liam Mitchell <git@liam.geek.nz>

CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [11.6.0](https://github.com/npm/cli/compare/v11.5.2...v11.6.0) (2025-09-03)
+### Features
+* [`bdcc10d`](https://github.com/npm/cli/commit/bdcc10d9f848940987b3d326ccd4673fab2bcfef) [#8359](https://github.com/npm/cli/pull/8359) add support for optional env var replacements in .npmrc (#8359) (@aczekajski, @owlstronaut)
+### Bug Fixes
+* [`dd4cee9`](https://github.com/npm/cli/commit/dd4cee9026c8e2dd5e4c28fd45ac8bceae74fb89) [#8539](https://github.com/npm/cli/pull/8539) powershell: improve argument parsing (#8539) (@alexsch01)
+* [`5f18557`](https://github.com/npm/cli/commit/5f1855778b5e376c5f1389e0ee5f204dc86c4d32) [#8532](https://github.com/npm/cli/pull/8532) powershell: fix issue with modified InvocationName (#8532) (@alexsch01)
+* [`9e5abf1`](https://github.com/npm/cli/commit/9e5abf19b93359881b2035bc371e09794a1dad01) [#8529](https://github.com/npm/cli/pull/8529) add redaction to log format egress (#8529) (@wraithgar)
+* [`75ce64a`](https://github.com/npm/cli/commit/75ce64a5b21b806be203b97f35a48497b4afcb56) [#8524](https://github.com/npm/cli/pull/8524) revert handle signal exits gracefully (#8524) (@owlstronaut)
+* [`5d82d0b`](https://github.com/npm/cli/commit/5d82d0b4a4bd1424031fb68b4df740c1bbe5b172) [#8469](https://github.com/npm/cli/pull/8469) ps1 scripts in powershell 5.1 (#8469) (@splatteredbits)
+
+
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.1.4): `@npmcli/arborist@9.1.4`
+* [workspace](https://github.com/npm/cli/releases/tag/config-v10.4.0): `@npmcli/config@10.4.0`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.0.7): `libnpmdiff@8.0.7`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.1.6): `libnpmexec@10.1.6`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.7): `libnpmfund@7.0.7`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.0.7): `libnpmpack@9.0.7`
+
 ## [11.5.2](https://github.com/npm/cli/compare/v11.5.1...v11.5.2) (2025-07-30)
 ### Bug Fixes
 * [`7d900c4`](https://github.com/npm/cli/commit/7d900c4656cfffc8cca93240c6cda4b441fbbfaa) [#8467](https://github.com/npm/cli/pull/8467) oidc visibility check for provenance (#8467) (@reggi, @wraithgar)

docs/lib/content/configuring-npm/npmrc.md

@@ -25,11 +25,14 @@ The four relevant files are:
 * npm builtin config file (`/path/to/npm/npmrc`)
 
 All npm config files are an ini-formatted list of `key = value` parameters.
-Environment variables can be replaced using `${VARIABLE_NAME}`. For
+Environment variables can be replaced using `${VARIABLE_NAME}`. By default
+if the variable is not defined, it is left unreplaced. By adding `?` after
+variable name they can be forced to evaluate to an empty string instead. For
 example:
 
 ```bash
 cache = ${HOME}/.npm-packages
+node-options = "${NODE_OPTIONS?} --use-system-ca"
 ```
 
 Each of these files is loaded, and config options are resolved in priority

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "npm",
-  "version": "11.5.2",
+  "version": "11.6.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "npm",
-      "version": "11.5.2",
+      "version": "11.6.0",
       "bundleDependencies": [
         "@isaacs/string-locale-compare",
         "@npmcli/arborist",
@@ -85,8 +85,8 @@
       ],
       "dependencies": {
         "@isaacs/string-locale-compare": "^1.1.0",
-        "@npmcli/arborist": "^9.1.3",
-        "@npmcli/config": "^10.3.1",
+        "@npmcli/arborist": "^9.1.4",
+        "@npmcli/config": "^10.4.0",
         "@npmcli/fs": "^4.0.0",
         "@npmcli/map-workspaces": "^4.0.2",
         "@npmcli/package-json": "^6.2.0",
@@ -110,11 +110,11 @@
         "is-cidr": "^5.1.1",
         "json-parse-even-better-errors": "^4.0.0",
         "libnpmaccess": "^10.0.1",
-        "libnpmdiff": "^8.0.6",
-        "libnpmexec": "^10.1.5",
-        "libnpmfund": "^7.0.6",
+        "libnpmdiff": "^8.0.7",
+        "libnpmexec": "^10.1.6",
+        "libnpmfund": "^7.0.7",
         "libnpmorg": "^8.0.0",
-        "libnpmpack": "^9.0.6",
+        "libnpmpack": "^9.0.7",
         "libnpmpublish": "^11.1.0",
         "libnpmsearch": "^9.0.0",
         "libnpmteam": "^8.0.1",
@@ -18820,7 +18820,7 @@
     },
     "workspaces/arborist": {
       "name": "@npmcli/arborist",
-      "version": "9.1.3",
+      "version": "9.1.4",
       "license": "ISC",
       "dependencies": {
         "@isaacs/string-locale-compare": "^1.1.0",
@@ -18878,7 +18878,7 @@
     },
     "workspaces/config": {
       "name": "@npmcli/config",
-      "version": "10.3.1",
+      "version": "10.4.0",
       "license": "ISC",
       "dependencies": {
         "@npmcli/map-workspaces": "^4.0.1",
@@ -18918,10 +18918,10 @@
       }
     },
     "workspaces/libnpmdiff": {
-      "version": "8.0.6",
+      "version": "8.0.7",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.1.3",
+        "@npmcli/arborist": "^9.1.4",
         "@npmcli/installed-package-contents": "^3.0.0",
         "binary-extensions": "^3.0.0",
         "diff": "^7.0.0",
@@ -18940,10 +18940,10 @@
       }
     },
     "workspaces/libnpmexec": {
-      "version": "10.1.5",
+      "version": "10.1.6",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.1.3",
+        "@npmcli/arborist": "^9.1.4",
         "@npmcli/package-json": "^6.1.1",
         "@npmcli/run-script": "^9.0.1",
         "ci-info": "^4.0.0",
@@ -18970,10 +18970,10 @@
       }
     },
     "workspaces/libnpmfund": {
-      "version": "7.0.6",
+      "version": "7.0.7",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.1.3"
+        "@npmcli/arborist": "^9.1.4"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^5.0.1",
@@ -19003,10 +19003,10 @@
       }
     },
     "workspaces/libnpmpack": {
-      "version": "9.0.6",
+      "version": "9.0.7",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.1.3",
+        "@npmcli/arborist": "^9.1.4",
         "@npmcli/run-script": "^9.0.1",
         "npm-package-arg": "^12.0.0",
         "pacote": "^21.0.0"

package.json

@@ -1,5 +1,5 @@
 {
-  "version": "11.5.2",
+  "version": "11.6.0",
   "name": "npm",
   "description": "a package manager for JavaScript",
   "workspaces": [
@@ -52,8 +52,8 @@
   },
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",
-    "@npmcli/arborist": "^9.1.3",
-    "@npmcli/config": "^10.3.1",
+    "@npmcli/arborist": "^9.1.4",
+    "@npmcli/config": "^10.4.0",
     "@npmcli/fs": "^4.0.0",
     "@npmcli/map-workspaces": "^4.0.2",
     "@npmcli/package-json": "^6.2.0",
@@ -77,11 +77,11 @@
     "is-cidr": "^5.1.1",
     "json-parse-even-better-errors": "^4.0.0",
     "libnpmaccess": "^10.0.1",
-    "libnpmdiff": "^8.0.6",
-    "libnpmexec": "^10.1.5",
-    "libnpmfund": "^7.0.6",
+    "libnpmdiff": "^8.0.7",
+    "libnpmexec": "^10.1.6",
+    "libnpmfund": "^7.0.7",
     "libnpmorg": "^8.0.0",
-    "libnpmpack": "^9.0.6",
+    "libnpmpack": "^9.0.7",
     "libnpmpublish": "^11.1.0",
     "libnpmsearch": "^9.0.0",
     "libnpmteam": "^8.0.1",

workspaces/arborist/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [9.1.4](https://github.com/npm/cli/compare/arborist-v9.1.3...arborist-v9.1.4) (2025-09-03)
+### Bug Fixes
+* [`208c06e`](https://github.com/npm/cli/commit/208c06e91a187b03d6bdd75bff4e4285b365750c) [#8448](https://github.com/npm/cli/pull/8448) peer edge crash due to no parent or detached node (#8448) (@milaninfy)
+* [`3b54e9c`](https://github.com/npm/cli/commit/3b54e9c59c6dba342d2931cce6458a755e55960e) [#8534](https://github.com/npm/cli/pull/8534) installLinks works with transitive external file dependencies (#8534) (@owlstronaut)
+* [`ed71acb`](https://github.com/npm/cli/commit/ed71acb89fc3883e735987cc9be77efc2daff26a) [#8473](https://github.com/npm/cli/pull/8473) arborist: #8472 Keeps the registry protocol when modifying resolve URL (#8473) (@Jeepsboucher, Jean-Philippe Boucher)
+### Chores
+* [`619d43e`](https://github.com/npm/cli/commit/619d43e54ef7408d4ee6b38a776262b5132829b6) [#8540](https://github.com/npm/cli/pull/8540) fix pruner and reify tests for optional peer deps (#8540) (@liamcmitchell, Liam Mitchell)
+
 ## [9.1.3](https://github.com/npm/cli/compare/arborist-v9.1.2...arborist-v9.1.3) (2025-07-24)
 ### Bug Fixes
 * [`6dbe21a`](https://github.com/npm/cli/commit/6dbe21ab659c4e32657fec63fc58bb3f4992f4f1) [#8436](https://github.com/npm/cli/pull/8436) local transitive dependencies with --install-links=true (@owlstronaut)

workspaces/arborist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/arborist",
-  "version": "9.1.3",
+  "version": "9.1.4",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",

workspaces/arborist/tap-snapshots/test/arborist/load-actual.js.test.cjs

@@ -7784,4 +7784,4 @@ ArboristNode {
   "name": "yarn-lock-mkdirp-file-dep",
   "path": "yarn-lock-mkdirp-file-dep",
 }
-`
+`

workspaces/arborist/tap-snapshots/test/arborist/pruner.js.test.cjs

@@ -124,82 +124,6 @@ ArboristNode {
 }
 `
 
-exports[`test/arborist/pruner.js TAP prune with lockfile with implicit optional peer dependencies > should remove all deps from reified tree 1`] = `
-ArboristNode {
-  "children": Map {
-    "dedent" => ArboristNode {
-      "edgesIn": Set {
-        EdgeIn {
-          "from": "",
-          "name": "dedent",
-          "spec": "^1.6.0",
-          "type": "prod",
-        },
-      },
-      "edgesOut": Map {
-        "babel-plugin-macros" => EdgeOut {
-          "name": "babel-plugin-macros",
-          "spec": "^3.1.0",
-          "to": null,
-          "type": "peerOptional",
-        },
-      },
-      "location": "node_modules/dedent",
-      "name": "dedent",
-      "path": "{CWD}/test/arborist/tap-testdir-pruner-prune-with-lockfile-with-implicit-optional-peer-dependencies/node_modules/dedent",
-      "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.6.0.tgz",
-      "version": "1.6.0",
-    },
-  },
-  "edgesOut": Map {
-    "dedent" => EdgeOut {
-      "name": "dedent",
-      "spec": "^1.6.0",
-      "to": "node_modules/dedent",
-      "type": "prod",
-    },
-  },
-  "isProjectRoot": true,
-  "location": "",
-  "name": "tap-testdir-pruner-prune-with-lockfile-with-implicit-optional-peer-dependencies",
-  "packageName": "prune-lockfile-optional-peer",
-  "path": "{CWD}/test/arborist/tap-testdir-pruner-prune-with-lockfile-with-implicit-optional-peer-dependencies",
-  "version": "1.0.0",
-}
-`
-
-exports[`test/arborist/pruner.js TAP prune with lockfile with implicit optional peer dependencies > should remove optional peer dependencies in package-lock.json 1`] = `
-Object {
-  "lockfileVersion": 3,
-  "name": "prune-lockfile-optional-peer",
-  "packages": Object {
-    "": Object {
-      "dependencies": Object {
-        "dedent": "^1.6.0",
-      },
-      "name": "prune-lockfile-optional-peer",
-      "version": "1.0.0",
-    },
-    "node_modules/dedent": Object {
-      "integrity": "sha512-F1Z+5UCFpmQUzJa11agbyPVMbpgT/qA3/SKyJ1jyBgm7dUcUEa8v9JwDkerSQXfakBwFljIxhOJqGkjUwZ9FSA==",
-      "license": "MIT",
-      "peerDependencies": Object {
-        "babel-plugin-macros": "^3.1.0",
-      },
-      "peerDependenciesMeta": Object {
-        "babel-plugin-macros": Object {
-          "optional": true,
-        },
-      },
-      "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.6.0.tgz",
-      "version": "1.6.0",
-    },
-  },
-  "requires": true,
-  "version": "1.0.0",
-}
-`
-
 exports[`test/arborist/pruner.js TAP prune workspaces > must match snapshot 1`] = `
 ArboristNode {
   "children": Map {

workspaces/arborist/test/arborist/pruner.js

@@ -39,32 +39,19 @@ t.test('prune with lockfile', async t => {
 })
 
 t.test('prune with lockfile with implicit optional peer dependencies', async t => {
-  registry.audit({})
-  const opts = {}
-
-  // todo: for some reason on Windows when doing this test NPM looks for
-  //   the cache in the home directory, resulting in an unexpected real
-  //   call being made to the registry
-  if (process.platform === 'win32') {
-    opts.cache = 'C:\\npm\\cache\\_cacache'
-  }
-
   const path = fixture(t, 'prune-lockfile-optional-peer')
-  const tree = await pruneTree(path, opts)
+  const tree = await pruneTree(path, { audit: false })
 
   const dep = tree.children.get('dedent')
-  t.ok(dep, 'required prod dep was pruned from tree')
+  t.ok(dep, 'required prod dep was not pruned from tree')
 
   const optionalPeerDep = tree.children.get('babel-plugin-macros')
-  t.notOk(optionalPeerDep, 'all listed optional peer deps pruned from tree')
+  t.notOk(optionalPeerDep, 'optional peer dep was pruned from tree')
 
-  t.matchSnapshot(
-    require(path + '/package-lock.json'),
-    'should remove optional peer dependencies in package-lock.json'
-  )
-  t.matchSnapshot(
-    printTree(tree),
-    'should remove all deps from reified tree'
+  t.notMatch(
+    fs.readFileSync(path + '/package-lock.json'),
+    'node_modules/babel-plugin-macros',
+    'should remove optional peer dep from package-lock.json'
   )
 })