All pull requests

Pull requests

• fix(arborist): preserve root peer sets during forced updates

  #10164·umtong opened Oct 26, 2026·

  ·
  1

• fix(arborist): keep the registry path for a package named like it

  #10160·lazerg opened Oct 23, 2026Contributor·

  ·
  1

• fix(ls): handle missing root deps with --workspaces=false

  #10158·lazerg opened Oct 23, 2026Contributor·

  ·
  1

• chore: release 12.2.2

  autorelease: pending
  #10156·github-actions[bot] opened Oct 23, 2026Bot·

  ·
  2

• fix: keep npx command flags after negated switches like --no

  #10155·mkantautas opened Oct 22, 2026·

  ·

• fix: reject nameless added packages before arborist reads edge.spec

  #10154·mvanhorn opened Oct 22, 2026Contributor·

  ·
  1

  2

• deps: update bin-links, promise-spawn, and pacote

  #10152·martinrrm opened Oct 21, 2026Contributor·

  ·

• fix(arborist): preserve failed targets while loading peer sets

  #10150·drewmt opened Oct 21, 2026·

  ·
  1

• fix: ignore implicit workspaces when running version

  #10147·Brytoxx021 opened Oct 20, 2026·

  ·

• fix: exempt explicit tarball targets from allow-file

  #10145·lazerg opened Oct 20, 2026Contributor·

  ·
  1

• fix(patch): exclude .git when copying tarballs into the rebase repo

  #10143·rootvector2 opened Oct 20, 2026Contributor·

  ·

• fix: preserve array items when deleting named properties

  #10142·drawliin opened Oct 19, 2026·

  ·
  1

• fix(arborist): keep an override written in two scopes on a shared node

  #10138·ump45nose opened Oct 16, 2026Contributor·

  ·
  1

• fix(publish): report publishConfig.tag in publish and stage notices

  #10136·ljharb opened Oct 15, 2026Contributor·

  ·

• fix(libnpmexec): install npx cache despite dryRun or packageLockOnly

  #10135·ljharb opened Oct 15, 2026Contributor·

  ·

• fix(arborist): reuse a link target spelled with a different drive-letter case

  #10133·vsolano9 opened Oct 15, 2026·

  ·

• fix(arborist): skip named-edge refresh work for empty leaves

  #10131·jeffwidman opened Oct 15, 2026Member·

  ·

• fix(arborist): skip normalization for canonical ASCII map keys

  #10132·jeffwidman opened Oct 15, 2026Member·

  ·

• fix(arborist): skip legacy dependency generation for v3 lockfiles

  #10130·jeffwidman opened Oct 15, 2026Member·

  ·
  2

• fix(arborist): block symlink escape in patch applier

  #10129·rootvector2 opened Oct 15, 2026Contributor·

  ·
  8

• fix(arborist): skip bundle checks without an applicable override

  #10128·jeffwidman opened Oct 15, 2026Member·

  ·

• fix(arborist): use a set for bundled-dependency traversal

  backport:v11
  #10127·jeffwidman opened Oct 15, 2026Member·

  ·
  1

• fix(arborist): bound concurrent package.json reads in loadActual

  #10126·SunnyScenery opened Oct 15, 2026·

  ·
  1

• fix(view): format publisher metadata containing actor information

  #10123·sergioperezcheco opened Oct 14, 2026·

  ·
  1

• fix(stage): validate staged manifest before writing the tarball

  #10121·rootvector2 opened Oct 14, 2026Contributor·

  ·