npm · github-actions · Apr 17, 2026
@@ -1,12 +1,12 @@
 {
-  ".": "11.12.1",
-  "workspaces/arborist": "9.4.2",
+  ".": "12.0.0-pre.0.0",
+  "workspaces/arborist": "9.4.3-pre.0.0",
   "workspaces/libnpmaccess": "10.0.3",
-  "workspaces/libnpmdiff": "8.1.5",
-  "workspaces/libnpmexec": "10.2.5",
-  "workspaces/libnpmfund": "7.0.19",
+  "workspaces/libnpmdiff": "8.1.6-pre.0.0",
+  "workspaces/libnpmexec": "10.2.6-pre.0.0",
+  "workspaces/libnpmfund": "7.0.20-pre.0.0",
   "workspaces/libnpmorg": "8.0.1",
-  "workspaces/libnpmpack": "9.1.5",
+  "workspaces/libnpmpack": "9.1.6-pre.0.0",
   "workspaces/libnpmpublish": "11.1.3",
   "workspaces/libnpmsearch": "9.0.1",
   "workspaces/libnpmteam": "8.0.2",

@@ -1002,3 +1002,6 @@ Mohamed Akram <mohd.akram@outlook.com>
 Mitch Denny <mitchdenny@outlook.com>
 Matt Van Horn <mvanhorn@users.noreply.github.com>
 Daniel Foerster <pydsigner@gmail.com>
+Lovell Fuller <lovell@users.noreply.github.com>
+Josua Michalak <michalak.josua@googlemail.com>
+Caleb Everett <everett.caleb@gmail.com>
@@ -1,5 +1,40 @@
 # Changelog
 
+## [12.0.0-pre.0.0](https://github.com/npm/cli/compare/v11.12.1...v12.0.0-pre.0.0) (2026-04-17)
+### ⚠️ BREAKING CHANGES
+* npm will no longer attempt to resolve the path to node via whichnode. process.execPath is already set by Node to the resolved real path of the node binary, so the lookup was redundant. Scripts that expected npm to override process.execPath with a PATH-resolved (potentially symlinked) node path may be affected.
+* the --json output of `npm pack` and `npm publish` have changed. They are now always consistent, and in the same format.
+* the `star`, `stars` and `unstar` commands have been removed
+* The `npm adduser` command has been removed. Create and manage user accounts on the npm website, and use `npm login` to authenticate on the command line.
+### Features
+* [`738be10`](https://github.com/npm/cli/commit/738be10651522e94038f1eff0da12f15b10438ea) [#9196](https://github.com/npm/cli/pull/9196) remove star commands (#9196) (@wraithgar)
+* [`db7c1f8`](https://github.com/npm/cli/commit/db7c1f887eb1c1cb281ea7c9f6d84fba8f10d44d) [#9163](https://github.com/npm/cli/pull/9163) add `u` as alias for `update` command (#9163) (@Ausoj)
+* [`45e44dd`](https://github.com/npm/cli/commit/45e44dd7ac2a3af815684ece3bdc99ada2f317f7) [#9228](https://github.com/npm/cli/pull/9228) adds a backport script (@owlstronaut)
+### Bug Fixes
+* [`27567ab`](https://github.com/npm/cli/commit/27567ab27bef8af303bde0b2d7da0386da182b81) [#9257](https://github.com/npm/cli/pull/9257) ignore intended error code (@owlstronaut)
+* [`4ef5b6e`](https://github.com/npm/cli/commit/4ef5b6e0439297048dee92729b5c93529ad39488) [#9039](https://github.com/npm/cli/pull/9039) stop resolving node path via whichnode (@owlstronaut)
+* [`2e9b26e`](https://github.com/npm/cli/commit/2e9b26eff18114b2fe34ea7c8159500b5eafb98e) [#9247](https://github.com/npm/cli/pull/9247) sync json output of pack and publish (#9247) (@wraithgar)
+* [`7357d7f`](https://github.com/npm/cli/commit/7357d7fd82a61657618d632b5a842d4d04335be5) [#9036](https://github.com/npm/cli/pull/9036) remove npm adduser command (@owlstronaut)
+### Dependencies
+* [`9669d31`](https://github.com/npm/cli/commit/9669d31060a2ed7220e140c354a45cfe993a0e7d) [#9207](https://github.com/npm/cli/pull/9207) `@sigstore/protobuf-specs@0.5.1`
+* [`b09a5ac`](https://github.com/npm/cli/commit/b09a5ac3c59f6a70f05ee035c9c6ee03dfdd1eda) [#9207](https://github.com/npm/cli/pull/9207) `tinyglobby@0.2.16`
+* [`150231d`](https://github.com/npm/cli/commit/150231d74a90ff1fb34ec588eefb94aeb4979fd2) [#9207](https://github.com/npm/cli/pull/9207) `picomatch@4.0.4`
+* [`413e0a0`](https://github.com/npm/cli/commit/413e0a00aee08b4f190bffd360b53efb20783ad1) [#9207](https://github.com/npm/cli/pull/9207) `lru-cache@11.3.3`
+* [`6faa25e`](https://github.com/npm/cli/commit/6faa25ecff4eb72aa9c16adba53bf46d39d556df) [#9207](https://github.com/npm/cli/pull/9207) `diff@8.0.4`
+* [`87bb9d0`](https://github.com/npm/cli/commit/87bb9d069375e74354bcd69f39a081ad960009de) [#9207](https://github.com/npm/cli/pull/9207) `minimatch@10.2.5`
+* [`2501dd8`](https://github.com/npm/cli/commit/2501dd83ea9e9fc39b0bf6814728a132dd57fa6d) [#9207](https://github.com/npm/cli/pull/9207) `tar@7.5.13`
+* [`ccce5f6`](https://github.com/npm/cli/commit/ccce5f611daf50727a134ba1df46ac9c53caa61a) [#9207](https://github.com/npm/cli/pull/9207) `minipass-flush@1.0.6`
+### Chores
+* [`8131de4`](https://github.com/npm/cli/commit/8131de4453af45a351fd610a660a1d60724ef74f) [#9239](https://github.com/npm/cli/pull/9239) add action permission for backport workflow (@owlstronaut)
+* [`6df5f91`](https://github.com/npm/cli/commit/6df5f918a350e30d865a647cbbbe0a8e713d0189) [#9232](https://github.com/npm/cli/pull/9232) backports can trigger CI (@owlstronaut)
+* [`07552f5`](https://github.com/npm/cli/commit/07552f58111dea3aa563693ea103342fb625d47b) [#9224](https://github.com/npm/cli/pull/9224) don't run npm update in CI (@owlstronaut)
+* [`05dbba5`](https://github.com/npm/cli/commit/05dbba5b8d727ddb2c098ce0553714eae791c5f2) [#9195](https://github.com/npm/cli/pull/9195) enable prerelease mode (#9195) (@wraithgar)
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v9.4.3-pre.0.0): `@npmcli/arborist@9.4.3-pre.0.0`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v8.1.6-pre.0.0): `libnpmdiff@8.1.6-pre.0.0`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v10.2.6-pre.0.0): `libnpmexec@10.2.6-pre.0.0`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v7.0.20-pre.0.0): `libnpmfund@7.0.20-pre.0.0`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v9.1.6-pre.0.0): `libnpmpack@9.1.6-pre.0.0`
+
 ## [11.12.1](https://github.com/npm/cli/compare/v11.12.0...v11.12.1) (2026-03-24)
 ### Bug Fixes
 * [`596706a`](https://github.com/npm/cli/commit/596706a3d10100587e3751d860b4cfcc59342d2f) [#9148](https://github.com/npm/cli/pull/9148) revert prefer-offline/prefer-online exclusivity (#9129) (@owlstronaut)

@@ -21,8 +21,8 @@
     "libnpmversion"
   ],
   [
-    "@npmcli/map-workspaces",
     "@npmcli/run-script",
+    "@npmcli/map-workspaces",
     "libnpmaccess",
     "libnpmorg",
     "libnpmpublish",
@@ -41,43 +41,43 @@
   ],
   [
     "@npmcli/smoke-tests",
-    "@npmcli/installed-package-contents",
     "npm-pick-manifest",
+    "@npmcli/installed-package-contents",
     "cacache",
     "promzard"
   ],
   [
     "@npmcli/docs",
-    "@npmcli/fs",
-    "npm-bundled",
+    "npm-package-arg",
     "@npmcli/promise-spawn",
     "npm-install-checks",
-    "npm-package-arg",
+    "npm-bundled",
+    "@npmcli/fs",
     "npm-packlist",
+    "@npmcli/mock-globals",
     "bin-links",
     "nopt",
     "parse-conflict-json",
-    "@npmcli/mock-globals",
     "read"
   ],
   [
     "@npmcli/eslint-config",
     "@npmcli/template-oss",
     "ignore-walk",
     "semver",
-    "npm-normalize-package-bin",
-    "@npmcli/name-from-folder",
-    "which",
-    "ini",
     "hosted-git-info",
     "proc-log",
     "validate-npm-package-name",
+    "which",
+    "ini",
+    "npm-normalize-package-bin",
     "json-parse-even-better-errors",
-    "ssri",
     "@npmcli/node-gyp",
+    "ssri",
     "@npmcli/redact",
     "@npmcli/agent",
     "minipass-fetch",
+    "@npmcli/name-from-folder",
     "@npmcli/query",
     "cmd-shim",
     "read-cmd-shim",

@@ -727,9 +727,9 @@ packages higher up the chain.
  - @npmcli/arborist
  - @npmcli/metavuln-calculator
  - pacote, @npmcli/config, libnpmversion
- - @npmcli/map-workspaces, @npmcli/run-script, libnpmaccess, libnpmorg, libnpmpublish, libnpmsearch, libnpmteam, init-package-json, npm-profile
+ - @npmcli/run-script, @npmcli/map-workspaces, libnpmaccess, libnpmorg, libnpmpublish, libnpmsearch, libnpmteam, init-package-json, npm-profile
  - @npmcli/package-json, npm-registry-fetch
  - @npmcli/git, make-fetch-happen
- - @npmcli/smoke-tests, @npmcli/installed-package-contents, npm-pick-manifest, cacache, promzard
- - @npmcli/docs, @npmcli/fs, npm-bundled, @npmcli/promise-spawn, npm-install-checks, npm-package-arg, npm-packlist, bin-links, nopt, parse-conflict-json, @npmcli/mock-globals, read
- - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, npm-normalize-package-bin, @npmcli/name-from-folder, which, ini, hosted-git-info, proc-log, validate-npm-package-name, json-parse-even-better-errors, ssri, @npmcli/node-gyp, @npmcli/redact, @npmcli/agent, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, proggy, minify-registry-metadata, mute-stream, npm-audit-report, npm-user-validate
+ - @npmcli/smoke-tests, npm-pick-manifest, @npmcli/installed-package-contents, cacache, promzard
+ - @npmcli/docs, npm-package-arg, @npmcli/promise-spawn, npm-install-checks, npm-bundled, @npmcli/fs, npm-packlist, @npmcli/mock-globals, bin-links, nopt, parse-conflict-json, read
+ - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, hosted-git-info, proc-log, validate-npm-package-name, which, ini, npm-normalize-package-bin, json-parse-even-better-errors, @npmcli/node-gyp, ssri, @npmcli/redact, @npmcli/agent, minipass-fetch, @npmcli/name-from-folder, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, proggy, minify-registry-metadata, mute-stream, npm-audit-report, npm-user-validate
@@ -1,12 +1,12 @@
 {
   "name": "npm",
-  "version": "11.12.1",
+  "version": "12.0.0-pre.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "npm",
-      "version": "11.12.1",
+      "version": "12.0.0-pre.0.0",
       "bundleDependencies": [
         "@isaacs/string-locale-compare",
         "@npmcli/arborist",
@@ -84,7 +84,7 @@
       ],
       "dependencies": {
         "@isaacs/string-locale-compare": "^1.1.0",
-        "@npmcli/arborist": "^9.4.2",
+        "@npmcli/arborist": "^9.4.3-pre.0.0",
         "@npmcli/config": "^10.8.1",
         "@npmcli/fs": "^5.0.0",
         "@npmcli/map-workspaces": "^5.0.3",
@@ -109,11 +109,11 @@
         "is-cidr": "^6.0.3",
         "json-parse-even-better-errors": "^5.0.0",
         "libnpmaccess": "^10.0.3",
-        "libnpmdiff": "^8.1.5",
-        "libnpmexec": "^10.2.5",
-        "libnpmfund": "^7.0.19",
+        "libnpmdiff": "^8.1.6-pre.0.0",
+        "libnpmexec": "^10.2.6-pre.0.0",
+        "libnpmfund": "^7.0.20-pre.0.0",
         "libnpmorg": "^8.0.1",
-        "libnpmpack": "^9.1.5",
+        "libnpmpack": "^9.1.6-pre.0.0",
         "libnpmpublish": "^11.1.3",
         "libnpmsearch": "^9.0.1",
         "libnpmteam": "^8.0.2",
@@ -314,6 +314,55 @@
         "node": "^20.17.0 || >=22.9.0"
       }
     },
+    "mock-registry/node_modules/@npmcli/arborist": {
+      "version": "9.4.2",
+      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-9.4.2.tgz",
+      "integrity": "sha512-omJgPyzt11cEGrxzgrECoOyxAunmPMgBFTcAB/FbaB+9iOYhGmRdsQqySV8o0LWQ/l2kTeASUIMR4xJufVwmtw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "@gar/promise-retry": "^1.0.0",
+        "@isaacs/string-locale-compare": "^1.1.0",
+        "@npmcli/fs": "^5.0.0",
+        "@npmcli/installed-package-contents": "^4.0.0",
+        "@npmcli/map-workspaces": "^5.0.0",
+        "@npmcli/metavuln-calculator": "^9.0.2",
+        "@npmcli/name-from-folder": "^4.0.0",
+        "@npmcli/node-gyp": "^5.0.0",
+        "@npmcli/package-json": "^7.0.0",
+        "@npmcli/query": "^5.0.0",
+        "@npmcli/redact": "^4.0.0",
+        "@npmcli/run-script": "^10.0.0",
+        "bin-links": "^6.0.0",
+        "cacache": "^20.0.1",
+        "common-ancestor-path": "^2.0.0",
+        "hosted-git-info": "^9.0.0",
+        "json-stringify-nice": "^1.1.4",
+        "lru-cache": "^11.2.1",
+        "minimatch": "^10.0.3",
+        "nopt": "^9.0.0",
+        "npm-install-checks": "^8.0.0",
+        "npm-package-arg": "^13.0.0",
+        "npm-pick-manifest": "^11.0.1",
+        "npm-registry-fetch": "^19.0.0",
+        "pacote": "^21.0.2",
+        "parse-conflict-json": "^5.0.1",
+        "proc-log": "^6.0.0",
+        "proggy": "^4.0.0",
+        "promise-all-reject-late": "^1.0.0",
+        "promise-call-limit": "^3.0.1",
+        "semver": "^7.3.7",
+        "ssri": "^13.0.0",
+        "treeverse": "^3.0.0",
+        "walk-up-path": "^4.0.0"
+      },
+      "bin": {
+        "arborist": "bin/index.js"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
     "node_modules/@actions/core": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.3.tgz",
@@ -1978,6 +2027,55 @@
         "node": "^20.17.0 || >=22.9.0"
       }
     },
+    "node_modules/@npmcli/template-oss/node_modules/@npmcli/arborist": {
+      "version": "9.4.2",
+      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-9.4.2.tgz",
+      "integrity": "sha512-omJgPyzt11cEGrxzgrECoOyxAunmPMgBFTcAB/FbaB+9iOYhGmRdsQqySV8o0LWQ/l2kTeASUIMR4xJufVwmtw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "@gar/promise-retry": "^1.0.0",
+        "@isaacs/string-locale-compare": "^1.1.0",
+        "@npmcli/fs": "^5.0.0",
+        "@npmcli/installed-package-contents": "^4.0.0",
+        "@npmcli/map-workspaces": "^5.0.0",
+        "@npmcli/metavuln-calculator": "^9.0.2",
+        "@npmcli/name-from-folder": "^4.0.0",
+        "@npmcli/node-gyp": "^5.0.0",
+        "@npmcli/package-json": "^7.0.0",
+        "@npmcli/query": "^5.0.0",
+        "@npmcli/redact": "^4.0.0",
+        "@npmcli/run-script": "^10.0.0",
+        "bin-links": "^6.0.0",
+        "cacache": "^20.0.1",
+        "common-ancestor-path": "^2.0.0",
+        "hosted-git-info": "^9.0.0",
+        "json-stringify-nice": "^1.1.4",
+        "lru-cache": "^11.2.1",
+        "minimatch": "^10.0.3",
+        "nopt": "^9.0.0",
+        "npm-install-checks": "^8.0.0",
+        "npm-package-arg": "^13.0.0",
+        "npm-pick-manifest": "^11.0.1",
+        "npm-registry-fetch": "^19.0.0",
+        "pacote": "^21.0.2",
+        "parse-conflict-json": "^5.0.1",
+        "proc-log": "^6.0.0",
+        "proggy": "^4.0.0",
+        "promise-all-reject-late": "^1.0.0",
+        "promise-call-limit": "^3.0.1",
+        "semver": "^7.3.7",
+        "ssri": "^13.0.0",
+        "treeverse": "^3.0.0",
+        "walk-up-path": "^4.0.0"
+      },
+      "bin": {
+        "arborist": "bin/index.js"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
     "node_modules/@octokit/auth-token": {
       "version": "6.0.0",
       "dev": true,
@@ -14506,7 +14604,7 @@
     },
     "workspaces/arborist": {
       "name": "@npmcli/arborist",
-      "version": "9.4.2",
+      "version": "9.4.3-pre.0.0",
       "license": "ISC",
       "dependencies": {
         "@gar/promise-retry": "^1.0.0",
@@ -14604,10 +14702,10 @@
       }
     },
     "workspaces/libnpmdiff": {
-      "version": "8.1.5",
+      "version": "8.1.6-pre.0.0",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.4.2",
+        "@npmcli/arborist": "^9.4.3-pre.0.0",
         "@npmcli/installed-package-contents": "^4.0.0",
         "binary-extensions": "^3.0.0",
         "diff": "^8.0.2",
@@ -14626,11 +14724,11 @@
       }
     },
     "workspaces/libnpmexec": {
-      "version": "10.2.5",
+      "version": "10.2.6-pre.0.0",
       "license": "ISC",
       "dependencies": {
         "@gar/promise-retry": "^1.0.0",
-        "@npmcli/arborist": "^9.4.2",
+        "@npmcli/arborist": "^9.4.3-pre.0.0",
         "@npmcli/package-json": "^7.0.0",
         "@npmcli/run-script": "^10.0.0",
         "ci-info": "^4.0.0",
@@ -14657,10 +14755,10 @@
       }
     },
     "workspaces/libnpmfund": {
-      "version": "7.0.19",
+      "version": "7.0.20-pre.0.0",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.4.2"
+        "@npmcli/arborist": "^9.4.3-pre.0.0"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^5.0.1",
@@ -14690,10 +14788,10 @@
       }
     },
     "workspaces/libnpmpack": {
-      "version": "9.1.5",
+      "version": "9.1.6-pre.0.0",
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.4.2",
+        "@npmcli/arborist": "^9.4.3-pre.0.0",
         "@npmcli/run-script": "^10.0.0",
         "npm-package-arg": "^13.0.0",
         "pacote": "^21.0.2"

@@ -1,5 +1,5 @@
 {
-  "version": "11.12.1",
+  "version": "12.0.0-pre.0.0",
   "name": "npm",
   "description": "a package manager for JavaScript",
   "workspaces": [
@@ -52,7 +52,7 @@
   },
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",
-    "@npmcli/arborist": "^9.4.2",
+    "@npmcli/arborist": "^9.4.3-pre.0.0",
     "@npmcli/config": "^10.8.1",
     "@npmcli/fs": "^5.0.0",
     "@npmcli/map-workspaces": "^5.0.3",
@@ -77,11 +77,11 @@
     "is-cidr": "^6.0.3",
     "json-parse-even-better-errors": "^5.0.0",
     "libnpmaccess": "^10.0.3",
-    "libnpmdiff": "^8.1.5",
-    "libnpmexec": "^10.2.5",
-    "libnpmfund": "^7.0.19",
+    "libnpmdiff": "^8.1.6-pre.0.0",
+    "libnpmexec": "^10.2.6-pre.0.0",
+    "libnpmfund": "^7.0.20-pre.0.0",
     "libnpmorg": "^8.0.1",
-    "libnpmpack": "^9.1.5",
+    "libnpmpack": "^9.1.6-pre.0.0",
     "libnpmpublish": "^11.1.3",
     "libnpmsearch": "^9.0.1",
     "libnpmteam": "^8.0.2",