chore: release 11.16.0

.release-please-manifest.json

@@ -1,15 +1,15 @@
 {
-  ".": "11.15.0",
-  "workspaces/arborist": "9.6.0",
+  ".": "11.16.0",
+  "workspaces/arborist": "9.7.0",
   "workspaces/libnpmaccess": "10.0.3",
-  "workspaces/libnpmdiff": "8.1.8",
-  "workspaces/libnpmexec": "10.2.8",
-  "workspaces/libnpmfund": "7.0.22",
+  "workspaces/libnpmdiff": "8.1.9",
+  "workspaces/libnpmexec": "10.2.9",
+  "workspaces/libnpmfund": "7.0.23",
   "workspaces/libnpmorg": "8.0.1",
-  "workspaces/libnpmpack": "9.1.8",
+  "workspaces/libnpmpack": "9.1.9",
   "workspaces/libnpmpublish": "11.2.0",
   "workspaces/libnpmsearch": "9.0.1",
   "workspaces/libnpmteam": "8.0.2",
-  "workspaces/libnpmversion": "8.0.3",
-  "workspaces/config": "10.9.1"
+  "workspaces/libnpmversion": "8.0.4",
+  "workspaces/config": "10.10.0"
 }

CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## [11.16.0](https://github.com/npm/cli/compare/v11.15.0...v11.16.0) (2026-05-27)
+### Features
+* [`4b67f6e`](https://github.com/npm/cli/commit/4b67f6ed21a8bf7e47ae78b7fc9cc9fbdfa95057) [#9416](https://github.com/npm/cli/pull/9416) publish --access=private alias for restricted (#9416) (@github-actions[bot], @reggi, @Copilot)
+* [`a10c7ca`](https://github.com/npm/cli/commit/a10c7caf3ad9d2d5e17234c5c5e615dbce7717f9) [#9415](https://github.com/npm/cli/pull/9415) Phase 1 of `allowScripts` opt-in install-script policy (#9360) (#9415) (@owlstronaut, @JamieMagee)
+### Bug Fixes
+* [`1f7869b`](https://github.com/npm/cli/commit/1f7869b4828e24fbacad0d0f4c78d3ed286b0099) [#9411](https://github.com/npm/cli/pull/9411) fix typo of fullMetadata (@owlstronaut)
+* [`cde03ba`](https://github.com/npm/cli/commit/cde03ba84049124a431cea36e70558256ead7dbe) [#9390](https://github.com/npm/cli/pull/9390) config: pause progress spinner during interactive editor spawn (#9388) (@github-actions[bot], @Zelys-DFKH, @claude)
+### Documentation
+* [`c5e9d73`](https://github.com/npm/cli/commit/c5e9d73b47056c5a901a7100919f4b29fcfb4d0f) [#9390](https://github.com/npm/cli/pull/9390) Document `npm_old_version` and `npm_new_version` environment variables (#9389) (@github-actions[bot], @36degrees)
+### Dependencies
+* [`cdd7bbc`](https://github.com/npm/cli/commit/cdd7bbccf85a5b8f37f41c003c51908d7283e5fc) [#9421](https://github.com/npm/cli/pull/9421) `undici@6.26.0`
+* [`fde87c9`](https://github.com/npm/cli/commit/fde87c911c3103f0268aa7b912b8180cacea3b56) [#9421](https://github.com/npm/cli/pull/9421) `sigstore@4.1.1`
+* [`2779793`](https://github.com/npm/cli/commit/2779793e74f742e527449675cab19d1621d3a588) [#9421](https://github.com/npm/cli/pull/9421) `lru-cache@11.5.1`
+* [`dea702d`](https://github.com/npm/cli/commit/dea702da380f9b64c2c047e238272af81106bf39) [#9421](https://github.com/npm/cli/pull/9421) `@sigstore/verify@3.1.1`
+* [`4eab03f`](https://github.com/npm/cli/commit/4eab03fd43b7d8e0315efe2ebdf10e1eae5aad47) [#9421](https://github.com/npm/cli/pull/9421) `@sigstore/core@3.2.1`
+* [`74c7323`](https://github.com/npm/cli/commit/74c73235b22979acd38645e40ae9009154e6ffe5) [#9421](https://github.com/npm/cli/pull/9421) `@npmcli/agent@4.0.2`
+* [`edc4ab3`](https://github.com/npm/cli/commit/edc4ab3c8a6c3c47ac889a686b3e62e129ba9834) [#9421](https://github.com/npm/cli/pull/9421) `semver@7.8.1`
+* [`5f6ce33`](https://github.com/npm/cli/commit/5f6ce3385eacd862a5cf137514f583b7501d2f43) [#9421](https://github.com/npm/cli/pull/9421) `make-fetch-happen@15.0.6`
+### Chores
+* [`bd04976`](https://github.com/npm/cli/commit/bd049763bcc9c6177a3f32b740aa071377f561cc) [#9421](https://github.com/npm/cli/pull/9421) dev dependency updates (@owlstronaut)
+* [`aeceb23`](https://github.com/npm/cli/commit/aeceb23c016afbeb6792844fd77487e531c71ea6) [#9407](https://github.com/npm/cli/pull/9407) sanitize newlines in flags table default and type values (#9407) (@reggi, @Copilot)
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/arborist@9.7.0`
+* [workspace](https://github.com/npm/cli/releases/tag/config-v10.10.0): `@npmcli/config@10.10.0`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.9): `libnpmdiff@8.1.9`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.9): `libnpmexec@10.2.9`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.23): `libnpmfund@7.0.23`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.9): `libnpmpack@9.1.9`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmversion-v8.0.4): `libnpmversion@8.0.4`
+
 ## [11.15.0](https://github.com/npm/cli/compare/v11.14.1...v11.15.0) (2026-05-20)
 ### Features
 * [`0d5d899`](https://github.com/npm/cli/commit/0d5d899ea8a6981a2a1d3c724384d12fd1908a90) [#9379](https://github.com/npm/cli/pull/9379) npm stage (@reggi, @Copilot)

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "npm",
-  "version": "11.15.0",
+  "version": "11.16.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "npm",
-      "version": "11.15.0",
+      "version": "11.16.0",
       "bundleDependencies": [
         "@isaacs/string-locale-compare",
         "@npmcli/arborist",
@@ -84,8 +84,8 @@
       ],
       "dependencies": {
         "@isaacs/string-locale-compare": "^1.1.0",
-        "@npmcli/arborist": "^9.6.0",
-        "@npmcli/config": "^10.9.1",
+        "@npmcli/arborist": "^9.7.0",
+        "@npmcli/config": "^10.10.0",
         "@npmcli/fs": "^5.0.0",
         "@npmcli/map-workspaces": "^5.0.3",
         "@npmcli/metavuln-calculator": "^9.0.3",
@@ -109,15 +109,15 @@
         "is-cidr": "^6.0.4",
         "json-parse-even-better-errors": "^5.0.0",
         "libnpmaccess": "^10.0.3",
-        "libnpmdiff": "^8.1.8",
-        "libnpmexec": "^10.2.8",
-        "libnpmfund": "^7.0.22",
+        "libnpmdiff": "^8.1.9",
+        "libnpmexec": "^10.2.9",
+        "libnpmfund": "^7.0.23",
         "libnpmorg": "^8.0.1",
-        "libnpmpack": "^9.1.8",
+        "libnpmpack": "^9.1.9",
         "libnpmpublish": "^11.2.0",
         "libnpmsearch": "^9.0.1",
         "libnpmteam": "^8.0.2",
-        "libnpmversion": "^8.0.3",
+        "libnpmversion": "^8.0.4",
         "make-fetch-happen": "^15.0.6",
         "minimatch": "^10.2.5",
         "minipass": "^7.1.3",
@@ -14605,7 +14605,7 @@
     },
     "workspaces/arborist": {
       "name": "@npmcli/arborist",
-      "version": "9.6.0",
+      "version": "9.7.0",
       "license": "ISC",
       "dependencies": {
         "@gar/promise-retry": "^1.0.0",
@@ -14663,7 +14663,7 @@
     },
     "workspaces/config": {
       "name": "@npmcli/config",
-      "version": "10.9.1",
+      "version": "10.10.0",
       "license": "ISC",
       "dependencies": {
         "@npmcli/map-workspaces": "^5.0.0",
@@ -14703,10 +14703,10 @@
       }
     },
     "workspaces/libnpmdiff": {
-      "version": "8.1.8",
+      "version": "8.1.9",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.6.0",
+        "@npmcli/arborist": "^9.7.0",
         "@npmcli/installed-package-contents": "^4.0.0",
         "binary-extensions": "^3.0.0",
         "diff": "^8.0.2",
@@ -14725,11 +14725,11 @@
       }
     },
     "workspaces/libnpmexec": {
-      "version": "10.2.8",
+      "version": "10.2.9",
       "license": "ISC",
       "dependencies": {
         "@gar/promise-retry": "^1.0.0",
-        "@npmcli/arborist": "^9.6.0",
+        "@npmcli/arborist": "^9.7.0",
         "@npmcli/package-json": "^7.0.0",
         "@npmcli/run-script": "^10.0.0",
         "ci-info": "^4.0.0",
@@ -14756,10 +14756,10 @@
       }
     },
     "workspaces/libnpmfund": {
-      "version": "7.0.22",
+      "version": "7.0.23",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.6.0"
+        "@npmcli/arborist": "^9.7.0"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^5.0.1",
@@ -14789,10 +14789,10 @@
       }
     },
     "workspaces/libnpmpack": {
-      "version": "9.1.8",
+      "version": "9.1.9",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.6.0",
+        "@npmcli/arborist": "^9.7.0",
         "@npmcli/run-script": "^10.0.0",
         "npm-package-arg": "^13.0.0",
         "pacote": "^21.0.2"
@@ -14866,7 +14866,7 @@
       }
     },
     "workspaces/libnpmversion": {
-      "version": "8.0.3",
+      "version": "8.0.4",
       "license": "ISC",
       "dependencies": {
         "@npmcli/git": "^7.0.0",

package.json

@@ -1,5 +1,5 @@
 {
-  "version": "11.15.0",
+  "version": "11.16.0",
   "name": "npm",
   "description": "a package manager for JavaScript",
   "workspaces": [
@@ -52,8 +52,8 @@
   },
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",
-    "@npmcli/arborist": "^9.6.0",
-    "@npmcli/config": "^10.9.1",
+    "@npmcli/arborist": "^9.7.0",
+    "@npmcli/config": "^10.10.0",
     "@npmcli/fs": "^5.0.0",
     "@npmcli/map-workspaces": "^5.0.3",
     "@npmcli/metavuln-calculator": "^9.0.3",
@@ -77,15 +77,15 @@
     "is-cidr": "^6.0.4",
     "json-parse-even-better-errors": "^5.0.0",
     "libnpmaccess": "^10.0.3",
-    "libnpmdiff": "^8.1.8",
-    "libnpmexec": "^10.2.8",
-    "libnpmfund": "^7.0.22",
+    "libnpmdiff": "^8.1.9",
+    "libnpmexec": "^10.2.9",
+    "libnpmfund": "^7.0.23",
     "libnpmorg": "^8.0.1",
-    "libnpmpack": "^9.1.8",
+    "libnpmpack": "^9.1.9",
     "libnpmpublish": "^11.2.0",
     "libnpmsearch": "^9.0.1",
     "libnpmteam": "^8.0.2",
-    "libnpmversion": "^8.0.3",
+    "libnpmversion": "^8.0.4",
     "make-fetch-happen": "^15.0.6",
     "minimatch": "^10.2.5",
     "minipass": "^7.1.3",

workspaces/arborist/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [9.7.0](https://github.com/npm/cli/compare/arborist-v9.6.0...arborist-v9.7.0) (2026-05-27)
+### Features
+* [`a10c7ca`](https://github.com/npm/cli/commit/a10c7caf3ad9d2d5e17234c5c5e615dbce7717f9) [#9415](https://github.com/npm/cli/pull/9415) Phase 1 of `allowScripts` opt-in install-script policy (#9360) (#9415) (@owlstronaut, @JamieMagee)
+### Bug Fixes
+* [`d8a7803`](https://github.com/npm/cli/commit/d8a7803200c66f178f9a4f049a478a0f96107d39) [#9418](https://github.com/npm/cli/pull/9418) arborist: drop self-link materialization for undeclared workspaces (#9418) (@github-actions[bot], @manzoorwanijk)
+* [`4d141a0`](https://github.com/npm/cli/commit/4d141a09a8738ce83d4751033191385c9cede8e8) [#9417](https://github.com/npm/cli/pull/9417) skip hidden lockfile save on dry run (#9417) (@github-actions[bot], @puneetdixit200, @puneetdixit200)
+
 ## [9.6.0](https://github.com/npm/cli/compare/arborist-v9.5.0...arborist-v9.6.0) (2026-05-20)
 ### Features
 * [`8df10f5`](https://github.com/npm/cli/commit/8df10f5a399048c9d2dd7eba1d65c0b4b6a5b1c8) [#9339](https://github.com/npm/cli/pull/9339) add allow-git/allow-file/allow-directory/allow-remote configs (@owlstronaut)

workspaces/arborist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/arborist",
-  "version": "9.6.0",
+  "version": "9.7.0",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@gar/promise-retry": "^1.0.0",

workspaces/config/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [10.10.0](https://github.com/npm/cli/compare/config-v10.9.1...config-v10.10.0) (2026-05-27)
+### Features
+* [`4b67f6e`](https://github.com/npm/cli/commit/4b67f6ed21a8bf7e47ae78b7fc9cc9fbdfa95057) [#9416](https://github.com/npm/cli/pull/9416) publish --access=private alias for restricted (#9416) (@github-actions[bot], @reggi, @Copilot)
+* [`a10c7ca`](https://github.com/npm/cli/commit/a10c7caf3ad9d2d5e17234c5c5e615dbce7717f9) [#9415](https://github.com/npm/cli/pull/9415) Phase 1 of `allowScripts` opt-in install-script policy (#9360) (#9415) (@owlstronaut, @JamieMagee)
+
 ## [10.9.1](https://github.com/npm/cli/compare/config-v10.9.0...config-v10.9.1) (2026-05-20)
 ### Bug Fixes
 * [`25708d3`](https://github.com/npm/cli/commit/25708d3500a5193fd656e91fdd27695efe85426c) [#9339](https://github.com/npm/cli/pull/9339) min-release-age=0 doesn't filter, honor cross-source precedence (@owlstronaut)

workspaces/config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/config",
-  "version": "10.9.1",
+  "version": "10.10.0",
   "files": [
     "bin/",
     "lib/"

workspaces/libnpmdiff/CHANGELOG.md

@@ -76,6 +76,10 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0`
 
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/arborist@9.7.0`
+
 ## [8.1.0](https://github.com/npm/cli/compare/libnpmdiff-v8.0.13...libnpmdiff-v8.1.0) (2026-02-04)
 ### Features
 * [`f5f6cf7`](https://github.com/npm/cli/commit/f5f6cf7c9fc9315b96eb29c5c7d5ab63ad3a9122) [#8943](https://github.com/npm/cli/pull/8943) config: add --allow-git (@wraithgar)

workspaces/libnpmdiff/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmdiff",
-  "version": "8.1.8",
+  "version": "8.1.9",
   "description": "The registry diff",
   "repository": {
     "type": "git",
@@ -47,7 +47,7 @@
     "tap": "^16.3.8"
   },
   "dependencies": {
-    "@npmcli/arborist": "^9.6.0",
+    "@npmcli/arborist": "^9.7.0",
     "@npmcli/installed-package-contents": "^4.0.0",
     "binary-extensions": "^3.0.0",
     "diff": "^8.0.2",

workspaces/libnpmexec/CHANGELOG.md

@@ -48,6 +48,15 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0`
 
+## [10.2.9](https://github.com/npm/cli/compare/libnpmexec-v10.2.8...libnpmexec-v10.2.9) (2026-05-27)
+### Bug Fixes
+* [`5000cbf`](https://github.com/npm/cli/commit/5000cbf24f25b5b26beb0db06d5d9f23d698241a) [#9409](https://github.com/npm/cli/pull/9409) exempt local project introspection from allow-directory (@owlstronaut)
+
+
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/arborist@9.7.0`
+
 ## [10.2.6](https://github.com/npm/cli/compare/libnpmexec-v10.2.5...libnpmexec-v10.2.6) (2026-04-22)
 ### Bug Fixes
 * [`e200696`](https://github.com/npm/cli/commit/e200696c3555fc9a9a0e388064da0b5238ae2b73) [#9256](https://github.com/npm/cli/pull/9256) libnpmexec: skip redundant reify for cached directory specs (#9256) (@github-actions[bot], @manzoorwanijk)

workspaces/libnpmexec/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmexec",
-  "version": "10.2.8",
+  "version": "10.2.9",
   "files": [
     "bin/",
     "lib/"
@@ -61,7 +61,7 @@
   },
   "dependencies": {
     "@gar/promise-retry": "^1.0.0",
-    "@npmcli/arborist": "^9.6.0",
+    "@npmcli/arborist": "^9.7.0",
     "@npmcli/package-json": "^7.0.0",
     "@npmcli/run-script": "^10.0.0",
     "ci-info": "^4.0.0",

workspaces/libnpmfund/CHANGELOG.md

@@ -100,6 +100,10 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0`
 
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/arborist@9.7.0`
+
 ## [7.0.0](https://github.com/npm/cli/compare/libnpmfund-v7.0.0-pre.1...libnpmfund-v7.0.0) (2024-12-16)
 ### Features
 * [`a7bfc6d`](https://github.com/npm/cli/commit/a7bfc6df76882996ebb834dbca785fdf33b8c50d) [#7972](https://github.com/npm/cli/pull/7972) trigger release process (#7972) (@wraithgar)

workspaces/libnpmfund/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmfund",
-  "version": "7.0.22",
+  "version": "7.0.23",
   "main": "lib/index.js",
   "files": [
     "bin/",
@@ -46,7 +46,7 @@
     "tap": "^16.3.8"
   },
   "dependencies": {
-    "@npmcli/arborist": "^9.6.0"
+    "@npmcli/arborist": "^9.7.0"
   },
   "engines": {
     "node": "^20.17.0 || >=22.9.0"

workspaces/libnpmpack/CHANGELOG.md

@@ -84,6 +84,10 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.6.0): `@npmcli/arborist@9.6.0`
 
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.7.0): `@npmcli/arborist@9.7.0`
+
 ## [9.1.0](https://github.com/npm/cli/compare/libnpmpack-v9.0.13...libnpmpack-v9.1.0) (2026-02-04)
 ### Features
 * [`f5f6cf7`](https://github.com/npm/cli/commit/f5f6cf7c9fc9315b96eb29c5c7d5ab63ad3a9122) [#8943](https://github.com/npm/cli/pull/8943) config: add --allow-git (@wraithgar)

workspaces/libnpmpack/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmpack",
-  "version": "9.1.8",
+  "version": "9.1.9",
   "description": "Programmatic API for the bits behind npm pack",
   "author": "GitHub Inc.",
   "main": "lib/index.js",
@@ -37,7 +37,7 @@
   "bugs": "https://github.com/npm/libnpmpack/issues",
   "homepage": "https://npmjs.com/package/libnpmpack",
   "dependencies": {
-    "@npmcli/arborist": "^9.6.0",
+    "@npmcli/arborist": "^9.7.0",
     "@npmcli/run-script": "^10.0.0",
     "npm-package-arg": "^13.0.0",
     "pacote": "^21.0.2"

workspaces/libnpmversion/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [8.0.4](https://github.com/npm/cli/compare/libnpmversion-v8.0.3...libnpmversion-v8.0.4) (2026-05-27)
+### Documentation
+* [`c5e9d73`](https://github.com/npm/cli/commit/c5e9d73b47056c5a901a7100919f4b29fcfb4d0f) [#9390](https://github.com/npm/cli/pull/9390) Document `npm_old_version` and `npm_new_version` environment variables (#9389) (@github-actions[bot], @36degrees)
+### Chores
+* [`40fcab4`](https://github.com/npm/cli/commit/40fcab45d356545f8db7f34df3e5630116d0dd40) [#8991](https://github.com/npm/cli/pull/8991) `@npmcli/template-oss@4.29.0` (@wraithgar)
+
 ## [8.0.3](https://github.com/npm/cli/compare/libnpmversion-v8.0.2...libnpmversion-v8.0.3) (2025-11-19)
 ### Dependencies
 * [`05ac7a7`](https://github.com/npm/cli/commit/05ac7a7ea2a4d258658537a19ba350e07df34fda) [#8723](https://github.com/npm/cli/pull/8723) `proc-log@6.0.0`