Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: npm/cli
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v12.0.0
Choose a base ref
...
head repository: npm/cli
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v12.0.1
Choose a head ref
  • 3 commits
  • 184 files changed
  • 5 contributors

Commits on Jul 10, 2026

  1. fix: correct bundled sigstore from dev dependency conflict (#9740) 

    This PR fixes #9722.

`mock-registry` pinned `@npmcli/arborist@^9.1.2`, which meant the local
workspace version wasn't linked and the dependency was pulled from the
registry instead. `sigstore@^4` got installed at the root node_modules
and `^5` was put into `workspaces/libnpmpublish/node_modules`. The
dev-only `^4` was then excluded when npm was packed.

Fix:
- `mock-registry`: arborist `^9.1.2` ->  `^10.0.0`
- `workspaces/arborist`: validate-npm-package-name `^7.0.2` -> `^8.0.0`
(need to release a patch for arborist)
- Lockfile regenerated via install + dedupe; `node . run dependencies`


The packed tarball now contains `package/node_modules/sigstore` and
`publish --dry-run` from the extracted tarball succeeds.
    @james-pre
    james-pre authored Jul 10, 2026
    Configuration menu
    Copy the full SHA
    47fc8b1 View commit details
    Browse the repository at this point in the history

  2. fix(view): avoid wrapping array results (#9745) 

    npm 12.0.0 breaks downstream updaters by returning nested arrays for
`npm view <pkg> versions --json`.

## The bug

On npm 12.0.0, a single array-valued field is wrapped in the outer
results array:

```
$ npm view abbrev versions --json
[["1.0.3","1.0.4", ...]]   # should be ["1.0.3","1.0.4", ...]
```

This happens in `lib/commands/view.js` `#packageOutput`: for a
single-field query it maps to `res.map(m => m[first[0]])`, and when that
field's value is itself an array (e.g. `versions`), it gets
double-wrapped.

## The fix

Return a sole array-valued JSON result directly instead of adding a
second result wrapper. Existing output shapes are preserved:

- scalar and object results still return in an array (`["1.0.0"]`,
`[{...}]`)
- multiple matching versions keep the result boundary (`[[...],[...]]`)
- a single array-valued result is returned directly
(`["1.0.0","1.0.1"]`)

Docs and tests updated to cover flat array, nested array,
object-wrapper, workspace, and multi-match cases.

Co-authored-by: Martin Ruiz <martin.ruiz.mares@gmail.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
    @reggi @martinrrm
    3 people authored Jul 10, 2026
    Configuration menu
    Copy the full SHA
    ecb02a8 View commit details
    Browse the repository at this point in the history

  3. chore: release 12.0.1

    @github-actions @reggi
    github-actions[bot] authored and reggi committed Jul 10, 2026
    Configuration menu
    Copy the full SHA
    72a6088 View commit details
    Browse the repository at this point in the history
Loading