chore: release 11.14.0

.release-please-manifest.json

@@ -1,15 +1,15 @@
 {
-  ".": "11.13.0",
-  "workspaces/arborist": "9.4.3",
+  ".": "11.14.0",
+  "workspaces/arborist": "9.5.0",
   "workspaces/libnpmaccess": "10.0.3",
-  "workspaces/libnpmdiff": "8.1.6",
-  "workspaces/libnpmexec": "10.2.6",
-  "workspaces/libnpmfund": "7.0.20",
+  "workspaces/libnpmdiff": "8.1.7",
+  "workspaces/libnpmexec": "10.2.7",
+  "workspaces/libnpmfund": "7.0.21",
   "workspaces/libnpmorg": "8.0.1",
-  "workspaces/libnpmpack": "9.1.6",
+  "workspaces/libnpmpack": "9.1.7",
   "workspaces/libnpmpublish": "11.1.3",
   "workspaces/libnpmsearch": "9.0.1",
   "workspaces/libnpmteam": "8.0.2",
   "workspaces/libnpmversion": "8.0.3",
-  "workspaces/config": "10.8.1"
+  "workspaces/config": "10.9.0"
 }

AUTHORS

@@ -1002,3 +1002,6 @@ Mohamed Akram <mohd.akram@outlook.com>
 Mitch Denny <mitchdenny@outlook.com>
 Matt Van Horn <mvanhorn@users.noreply.github.com>
 Daniel Foerster <pydsigner@gmail.com>
+lawrence3699 <lawrence3699@users.noreply.github.com>
+Caleb Everett <calebev@amazon.com>
+Vishal Doshi <vishal.doshi@gmail.com>

CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [11.14.0](https://github.com/npm/cli/compare/v11.13.0...v11.14.0) (2026-05-06)
+### Features
+* [`45fc5e0`](https://github.com/npm/cli/commit/45fc5e0dd144bb21148d7aa35439695ab44cdfda) [#9288](https://github.com/npm/cli/pull/9288) add allow-directory, allow-file, and allow-remote (#9288) (@github-actions[bot], @wraithgar)
+### Bug Fixes
+* [`6c17544`](https://github.com/npm/cli/commit/6c17544d757a4ee167edd03b47ad5e5da92d8ce6) [#9318](https://github.com/npm/cli/pull/9318) sbom: dedupe per-node dependsOn / relationships (#9318) (@github-actions[bot], @mikaelkristiansson)
+### Dependencies
+* [`840fe18`](https://github.com/npm/cli/commit/840fe18eb466d0253ad5891fdf211e0bcb174936) [#9322](https://github.com/npm/cli/pull/9322) `socks@10.1.1`
+* [`b771289`](https://github.com/npm/cli/commit/b77128922b59cc3b4a7578131a1d75b53b84065e) [#9322](https://github.com/npm/cli/pull/9322) `ip-address@10.1.1`
+* [`addffcb`](https://github.com/npm/cli/commit/addffcb389388d753fe8f394077ffeb2a6590efb) [#9322](https://github.com/npm/cli/pull/9322) `cidr-regex@5.0.5`
+### Chores
+* [`041fd58`](https://github.com/npm/cli/commit/041fd5879704c39a0cde6eaba299285877c728c7) [#9322](https://github.com/npm/cli/pull/9322) dev dependency updates (@owlstronaut)
+* [`89c505a`](https://github.com/npm/cli/commit/89c505aec8f9263acb43cd892b9582e4860dde8a) [#9320](https://github.com/npm/cli/pull/9320) add cli-triage team as codeowner (#9320) (@github-actions[bot], @owlstronaut)
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0`
+* [workspace](https://github.com/npm/cli/releases/tag/config-v10.9.0): `@npmcli/config@10.9.0`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.7): `libnpmdiff@8.1.7`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.7): `libnpmexec@10.2.7`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.21): `libnpmfund@7.0.21`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.7): `libnpmpack@9.1.7`
+
 ## [11.13.0](https://github.com/npm/cli/compare/v11.12.1...v11.13.0) (2026-04-22)
 ### Features
 * [`8e8dadb`](https://github.com/npm/cli/commit/8e8dadb8ae378c1dde0b98c15167d739abaa9b37) [#9246](https://github.com/npm/cli/pull/9246) add `u` as alias for `update` command (#9246) (@github-actions[bot], @Ausoj)

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "npm",
-  "version": "11.13.0",
+  "version": "11.14.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "npm",
-      "version": "11.13.0",
+      "version": "11.14.0",
       "bundleDependencies": [
         "@isaacs/string-locale-compare",
         "@npmcli/arborist",
@@ -84,8 +84,8 @@
       ],
       "dependencies": {
         "@isaacs/string-locale-compare": "^1.1.0",
-        "@npmcli/arborist": "^9.4.3",
-        "@npmcli/config": "^10.8.1",
+        "@npmcli/arborist": "^9.5.0",
+        "@npmcli/config": "^10.9.0",
         "@npmcli/fs": "^5.0.0",
         "@npmcli/map-workspaces": "^5.0.3",
         "@npmcli/metavuln-calculator": "^9.0.3",
@@ -109,11 +109,11 @@
         "is-cidr": "^6.0.4",
         "json-parse-even-better-errors": "^5.0.0",
         "libnpmaccess": "^10.0.3",
-        "libnpmdiff": "^8.1.6",
-        "libnpmexec": "^10.2.6",
-        "libnpmfund": "^7.0.20",
+        "libnpmdiff": "^8.1.7",
+        "libnpmexec": "^10.2.7",
+        "libnpmfund": "^7.0.21",
         "libnpmorg": "^8.0.1",
-        "libnpmpack": "^9.1.6",
+        "libnpmpack": "^9.1.7",
         "libnpmpublish": "^11.1.3",
         "libnpmsearch": "^9.0.1",
         "libnpmteam": "^8.0.2",
@@ -14608,7 +14608,7 @@
     },
     "workspaces/arborist": {
       "name": "@npmcli/arborist",
-      "version": "9.4.3",
+      "version": "9.5.0",
       "license": "ISC",
       "dependencies": {
         "@gar/promise-retry": "^1.0.0",
@@ -14666,7 +14666,7 @@
     },
     "workspaces/config": {
       "name": "@npmcli/config",
-      "version": "10.8.1",
+      "version": "10.9.0",
       "license": "ISC",
       "dependencies": {
         "@npmcli/map-workspaces": "^5.0.0",
@@ -14706,10 +14706,10 @@
       }
     },
     "workspaces/libnpmdiff": {
-      "version": "8.1.6",
+      "version": "8.1.7",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.4.3",
+        "@npmcli/arborist": "^9.5.0",
         "@npmcli/installed-package-contents": "^4.0.0",
         "binary-extensions": "^3.0.0",
         "diff": "^8.0.2",
@@ -14728,11 +14728,11 @@
       }
     },
     "workspaces/libnpmexec": {
-      "version": "10.2.6",
+      "version": "10.2.7",
       "license": "ISC",
       "dependencies": {
         "@gar/promise-retry": "^1.0.0",
-        "@npmcli/arborist": "^9.4.3",
+        "@npmcli/arborist": "^9.5.0",
         "@npmcli/package-json": "^7.0.0",
         "@npmcli/run-script": "^10.0.0",
         "ci-info": "^4.0.0",
@@ -14759,10 +14759,10 @@
       }
     },
     "workspaces/libnpmfund": {
-      "version": "7.0.20",
+      "version": "7.0.21",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.4.3"
+        "@npmcli/arborist": "^9.5.0"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^5.0.1",
@@ -14792,10 +14792,10 @@
       }
     },
     "workspaces/libnpmpack": {
-      "version": "9.1.6",
+      "version": "9.1.7",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.4.3",
+        "@npmcli/arborist": "^9.5.0",
         "@npmcli/run-script": "^10.0.0",
         "npm-package-arg": "^13.0.0",
         "pacote": "^21.0.2"

package.json

@@ -1,5 +1,5 @@
 {
-  "version": "11.13.0",
+  "version": "11.14.0",
   "name": "npm",
   "description": "a package manager for JavaScript",
   "workspaces": [
@@ -52,8 +52,8 @@
   },
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",
-    "@npmcli/arborist": "^9.4.3",
-    "@npmcli/config": "^10.8.1",
+    "@npmcli/arborist": "^9.5.0",
+    "@npmcli/config": "^10.9.0",
     "@npmcli/fs": "^5.0.0",
     "@npmcli/map-workspaces": "^5.0.3",
     "@npmcli/metavuln-calculator": "^9.0.3",
@@ -77,11 +77,11 @@
     "is-cidr": "^6.0.4",
     "json-parse-even-better-errors": "^5.0.0",
     "libnpmaccess": "^10.0.3",
-    "libnpmdiff": "^8.1.6",
-    "libnpmexec": "^10.2.6",
-    "libnpmfund": "^7.0.20",
+    "libnpmdiff": "^8.1.7",
+    "libnpmexec": "^10.2.7",
+    "libnpmfund": "^7.0.21",
     "libnpmorg": "^8.0.1",
-    "libnpmpack": "^9.1.6",
+    "libnpmpack": "^9.1.7",
     "libnpmpublish": "^11.1.3",
     "libnpmsearch": "^9.0.1",
     "libnpmteam": "^8.0.2",

workspaces/arborist/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [9.5.0](https://github.com/npm/cli/compare/arborist-v9.4.3...arborist-v9.5.0) (2026-05-06)
+### Features
+* [`20fb6a0`](https://github.com/npm/cli/commit/20fb6a0d0f2ffc65656d08504eb6ca14980d2c71) [#9312](https://github.com/npm/cli/pull/9312) arborist: add lockfileString() for in-memory lockfile generation (@ljharb)
+### Bug Fixes
+* [`c3ea2cf`](https://github.com/npm/cli/commit/c3ea2cf9ce37f23992bbfcc3eef976897ef2e5a0) [#9315](https://github.com/npm/cli/pull/9315) arborist: clean up orphan top-level symlinks in linked strategy (#9315) (@github-actions[bot], @manzoorwanijk)
+* [`3298369`](https://github.com/npm/cli/commit/329836962f2b2438196a827688e8d9047e5c4c4d) [#9303](https://github.com/npm/cli/pull/9303) arborist: ignore hidden entries in global update (#9299) (@Grynn)
+* [`e19b349`](https://github.com/npm/cli/commit/e19b349e33675be90dc10c86e35c51a39de94125) [#9301](https://github.com/npm/cli/pull/9301) prefer existing tree nodes for peerOptional deps (#9249) (#9283) (@everett1992)
+* [`e7805c3`](https://github.com/npm/cli/commit/e7805c3a47b3c78093e78ac796c8e4120ffea876) [#9254](https://github.com/npm/cli/pull/9254) arborist: propagate overrides through Link nodes to targets (#9198) (@manzoorwanijk)
+
 ## [9.4.3](https://github.com/npm/cli/compare/arborist-v9.4.2...arborist-v9.4.3) (2026-04-22)
 ### Bug Fixes
 * [`7cd45c6`](https://github.com/npm/cli/commit/7cd45c6037e2a09e7692d64d6bf16e1eaa24550a) [#9253](https://github.com/npm/cli/pull/9253) arborist: handle `npm link` with install-strategy=linked (@manzoorwanijk)

workspaces/arborist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/arborist",
-  "version": "9.4.3",
+  "version": "9.5.0",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@gar/promise-retry": "^1.0.0",

workspaces/config/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [10.9.0](https://github.com/npm/cli/compare/config-v10.8.1...config-v10.9.0) (2026-05-06)
+### Features
+* [`45fc5e0`](https://github.com/npm/cli/commit/45fc5e0dd144bb21148d7aa35439695ab44cdfda) [#9288](https://github.com/npm/cli/pull/9288) add allow-directory, allow-file, and allow-remote (#9288) (@github-actions[bot], @wraithgar)
+### Bug Fixes
+* [`574b73a`](https://github.com/npm/cli/commit/574b73a9bef6d8c88329b0d19a54dcf6817c45a8) [#9293](https://github.com/npm/cli/pull/9293) config: preserve min-release-age after flattening (@lawrence3699)
+
 ## [10.8.1](https://github.com/npm/cli/compare/config-v10.8.0...config-v10.8.1) (2026-03-24)
 ### Bug Fixes
 * [`596706a`](https://github.com/npm/cli/commit/596706a3d10100587e3751d860b4cfcc59342d2f) [#9148](https://github.com/npm/cli/pull/9148) revert prefer-offline/prefer-online exclusivity (#9129) (@owlstronaut)

workspaces/config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/config",
-  "version": "10.8.1",
+  "version": "10.9.0",
   "files": [
     "bin/",
     "lib/"

workspaces/libnpmdiff/CHANGELOG.md

@@ -68,6 +68,10 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.4.3): `@npmcli/arborist@9.4.3`
 
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0`
+
 ## [8.1.0](https://github.com/npm/cli/compare/libnpmdiff-v8.0.13...libnpmdiff-v8.1.0) (2026-02-04)
 ### Features
 * [`f5f6cf7`](https://github.com/npm/cli/commit/f5f6cf7c9fc9315b96eb29c5c7d5ab63ad3a9122) [#8943](https://github.com/npm/cli/pull/8943) config: add --allow-git (@wraithgar)

workspaces/libnpmdiff/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmdiff",
-  "version": "8.1.6",
+  "version": "8.1.7",
   "description": "The registry diff",
   "repository": {
     "type": "git",
@@ -47,7 +47,7 @@
     "tap": "^16.3.8"
   },
   "dependencies": {
-    "@npmcli/arborist": "^9.4.3",
+    "@npmcli/arborist": "^9.5.0",
     "@npmcli/installed-package-contents": "^4.0.0",
     "binary-extensions": "^3.0.0",
     "diff": "^8.0.2",

workspaces/libnpmexec/CHANGELOG.md

@@ -40,6 +40,10 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.4.2): `@npmcli/arborist@9.4.2`
 
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0`
+
 ## [10.2.6](https://github.com/npm/cli/compare/libnpmexec-v10.2.5...libnpmexec-v10.2.6) (2026-04-22)
 ### Bug Fixes
 * [`e200696`](https://github.com/npm/cli/commit/e200696c3555fc9a9a0e388064da0b5238ae2b73) [#9256](https://github.com/npm/cli/pull/9256) libnpmexec: skip redundant reify for cached directory specs (#9256) (@github-actions[bot], @manzoorwanijk)

workspaces/libnpmexec/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmexec",
-  "version": "10.2.6",
+  "version": "10.2.7",
   "files": [
     "bin/",
     "lib/"
@@ -61,7 +61,7 @@
   },
   "dependencies": {
     "@gar/promise-retry": "^1.0.0",
-    "@npmcli/arborist": "^9.4.3",
+    "@npmcli/arborist": "^9.5.0",
     "@npmcli/package-json": "^7.0.0",
     "@npmcli/run-script": "^10.0.0",
     "ci-info": "^4.0.0",

workspaces/libnpmfund/CHANGELOG.md

@@ -92,6 +92,10 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.4.3): `@npmcli/arborist@9.4.3`
 
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0`
+
 ## [7.0.0](https://github.com/npm/cli/compare/libnpmfund-v7.0.0-pre.1...libnpmfund-v7.0.0) (2024-12-16)
 ### Features
 * [`a7bfc6d`](https://github.com/npm/cli/commit/a7bfc6df76882996ebb834dbca785fdf33b8c50d) [#7972](https://github.com/npm/cli/pull/7972) trigger release process (#7972) (@wraithgar)

workspaces/libnpmfund/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmfund",
-  "version": "7.0.20",
+  "version": "7.0.21",
   "main": "lib/index.js",
   "files": [
     "bin/",
@@ -46,7 +46,7 @@
     "tap": "^16.3.8"
   },
   "dependencies": {
-    "@npmcli/arborist": "^9.4.3"
+    "@npmcli/arborist": "^9.5.0"
   },
   "engines": {
     "node": "^20.17.0 || >=22.9.0"

workspaces/libnpmpack/CHANGELOG.md

@@ -76,6 +76,10 @@
 
 * [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.4.3): `@npmcli/arborist@9.4.3`
 
+### Dependencies
+
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.5.0): `@npmcli/arborist@9.5.0`
+
 ## [9.1.0](https://github.com/npm/cli/compare/libnpmpack-v9.0.13...libnpmpack-v9.1.0) (2026-02-04)
 ### Features
 * [`f5f6cf7`](https://github.com/npm/cli/commit/f5f6cf7c9fc9315b96eb29c5c7d5ab63ad3a9122) [#8943](https://github.com/npm/cli/pull/8943) config: add --allow-git (@wraithgar)

workspaces/libnpmpack/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmpack",
-  "version": "9.1.6",
+  "version": "9.1.7",
   "description": "Programmatic API for the bits behind npm pack",
   "author": "GitHub Inc.",
   "main": "lib/index.js",
@@ -37,7 +37,7 @@
   "bugs": "https://github.com/npm/libnpmpack/issues",
   "homepage": "https://npmjs.com/package/libnpmpack",
   "dependencies": {
-    "@npmcli/arborist": "^9.4.3",
+    "@npmcli/arborist": "^9.5.0",
     "@npmcli/run-script": "^10.0.0",
     "npm-package-arg": "^13.0.0",
     "pacote": "^21.0.2"