deps: upgrade npm to 11.11.0 by npm-cli-bot · Pull Request #61994 · nodejs/node

npm-cli-bot · Feb 25, 2026

11.11.0 (2026-02-25)

Features

4fcd352 #9017 add :type(registry) to query selector syntax (#9017) (@wraithgar)
e1b21f0 #8909 adds circleci to trust command (#8909) (@owlstronaut)
9a33ad0 #8925 adds circleci to oidc (#8925) (@owlstronaut)

Bug Fixes

4426411 #9026 npm audit signatures for keyless attestation registries (#9026) (@ajayk)
658b323 #9010 handle legacy licenses array in sbom output (#9010) (@JNC4)

Documentation

143f8cd #9007 docs shouldn't wrap yaml description (#9007) (@owlstronaut)

Dependencies

7798b6e #9027 @gar/promise-retry@1.0.2
4838864 #9027 balanced-match@4.0.4
0c200dd #9027 brace-expansion@5.0.3
f0606bb #9027 spdx-license-ids@3.0.23
d43f350 #9027 make-fetch-happen@15.0.4
4d0918a #9027 @npmcli/git@7.0.2
8912ca7 #9027 minipass-fetch@5.0.2
450ff35 #9027 npm-packlist@10.0.4
20ef5a5 #9027 pacote@21.4.0
60f332c #9008 remove promise-retry
cb8b9c7 #9008 add @gar/promise-retry@1.0.0
workspace: @npmcli/arborist@9.4.0
workspace: libnpmdiff@8.1.3
workspace: libnpmexec@10.2.3
workspace: libnpmfund@7.0.17
workspace: libnpmpack@9.1.3

nodejs-github-bot · Feb 25, 2026

Review requested:

@nodejs/security-wg

nodejs-github-bot · Feb 25, 2026

CI: https://ci.nodejs.org/job/node-test-pull-request/71462/

nodejs-github-bot · Feb 27, 2026

Landed in c5b3f60

PR-URL: #61994 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Jordan Harband <ljharb@gmail.com>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | minor | `25.7.0` → `25.8.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v25.8.0`](https://github.com/nodejs/node/releases/tag/v25.8.0): 2026-03-03, Version 25.8.0 (Current), @richardlau [Compare Source](nodejs/node@v25.7.0...v25.8.0) ##### Notable Changes - \[[`e55eddea2a`](nodejs/node@e55eddea2a)] - **build, doc**: use new api doc tooling (flakey5) [#57343](nodejs/node#57343) - \[[`4c181e2277`](nodejs/node@4c181e2277)] - **(SEMVER-MINOR)** **sqlite**: add limits property to DatabaseSync (Mert Can Altin) [#61298](nodejs/node#61298) - \[[`46ee1eddd7`](nodejs/node@46ee1eddd7)] - **(SEMVER-MINOR)** **src**: add C++ support for diagnostics channels (RafaelGSS) [#61869](nodejs/node#61869) - \[[`9ddd1a9c27`](nodejs/node@9ddd1a9c27)] - **(SEMVER-MINOR)** **src,permission**: add --permission-audit (RafaelGSS) [#61869](nodejs/node#61869) - \[[`0d97ec4044`](nodejs/node@0d97ec4044)] - **(SEMVER-MINOR)** **test\_runner**: expose worker ID for concurrent test execution (Ali Hassan) [#61394](nodejs/node#61394) ##### Commits - \[[`940b58c8c1`](nodejs/node@940b58c8c1)] - **buffer**: optimize buffer.concat performance (Mert Can Altin) [#61721](nodejs/node#61721) - \[[`0589b0e5a1`](nodejs/node@0589b0e5a1)] - **build**: fix GN for new merve dep (Shelley Vohr) [#61984](nodejs/node#61984) - \[[`f3d3968dcd`](nodejs/node@f3d3968dcd)] - ***Revert*** "**build**: add temporal test on GHA windows" (Antoine du Hamel) [#61810](nodejs/node#61810) - \[[`e55eddea2a`](nodejs/node@e55eddea2a)] - **build, doc**: use new api doc tooling (flakey5) [#57343](nodejs/node#57343) - \[[`b7715292f8`](nodejs/node@b7715292f8)] - **child\_process**: add tracing channel for spawn (Marco) [#61836](nodejs/node#61836) - \[[`a32a598748`](nodejs/node@a32a598748)] - **crypto**: fix missing nullptr check on RSA\_new() (ndossche) [#61888](nodejs/node#61888) - \[[`dc384f95b3`](nodejs/node@dc384f95b3)] - **crypto**: fix handling of null BUF\_MEM\* in ToV8Value() (Nora Dossche) [#61885](nodejs/node#61885) - \[[`3337b095db`](nodejs/node@3337b095db)] - **crypto**: fix potential null pointer dereference when BIO\_meth\_new() fails (Nora Dossche) [#61788](nodejs/node#61788) - \[[`51ded81139`](nodejs/node@51ded81139)] - **deps**: update undici to 7.22.0 (Node.js GitHub Bot) [#62035](nodejs/node#62035) - \[[`8aa2fde931`](nodejs/node@8aa2fde931)] - **deps**: update minimatch to 10.2.4 (Node.js GitHub Bot) [#62016](nodejs/node#62016) - \[[`57dc092eaf`](nodejs/node@57dc092eaf)] - **deps**: upgrade npm to 11.11.0 (npm team) [#61994](nodejs/node#61994) - \[[`705bbd60a9`](nodejs/node@705bbd60a9)] - **deps**: update simdjson to 4.3.1 (Node.js GitHub Bot) [#61930](nodejs/node#61930) - \[[`4d411d72e5`](nodejs/node@4d411d72e5)] - **deps**: update acorn-walk to 8.3.5 (Node.js GitHub Bot) [#61928](nodejs/node#61928) - \[[`f53a32ab84`](nodejs/node@f53a32ab84)] - **deps**: update acorn to 8.16.0 (Node.js GitHub Bot) [#61925](nodejs/node#61925) - \[[`9b483fbb27`](nodejs/node@9b483fbb27)] - **deps**: update minimatch to 10.2.2 (Node.js GitHub Bot) [#61830](nodejs/node#61830) - \[[`4e54c103cb`](nodejs/node@4e54c103cb)] - **doc**: separate in-types and out-types in SQLite conversion docs (René) [#62034](nodejs/node#62034) - \[[`ca78ebbeaa`](nodejs/node@ca78ebbeaa)] - **doc**: fix small logic error in DETECT\_MODULE\_SYNTAX (René) [#62025](nodejs/node#62025) - \[[`e6b131f3fe`](nodejs/node@e6b131f3fe)] - **doc**: fix module.stripTypeScriptTypes indentation (René) [#61992](nodejs/node#61992) - \[[`7508540e19`](nodejs/node@7508540e19)] - **doc**: update DEP0040 (punycode) to application type deprecation (Mike McCready) [#61916](nodejs/node#61916) - \[[`33a364cb62`](nodejs/node@33a364cb62)] - **doc**: explicitly mention Slack handle (Rafael Gonzaga) [#61986](nodejs/node#61986) - \[[`46a61922bd`](nodejs/node@46a61922bd)] - **doc**: support toolchain Visual Studio 2022 & 2026 + Windows 11 SDK (Mike McCready) [#61864](nodejs/node#61864) - \[[`dc12a257aa`](nodejs/node@dc12a257aa)] - **doc**: rename invalid `function` parameter (René) [#61942](nodejs/node#61942) - \[[`dafdc0a5b8`](nodejs/node@dafdc0a5b8)] - **http**: validate headers in writeEarlyHints (Richard Clarke) [#61897](nodejs/node#61897) - \[[`3c94b56fa6`](nodejs/node@3c94b56fa6)] - **inspector**: unwrap internal/debugger/inspect imports (René) [#61974](nodejs/node#61974) - \[[`8a24c17648`](nodejs/node@8a24c17648)] - **lib**: improve argument handling in Blob constructor (Ms2ger) [#61980](nodejs/node#61980) - \[[`21d4baf256`](nodejs/node@21d4baf256)] - **meta**: bump github/codeql-action from 4.32.0 to 4.32.4 (dependabot\[bot]) [#61911](nodejs/node#61911) - \[[`59a726a8e3`](nodejs/node@59a726a8e3)] - **meta**: bump step-security/harden-runner from 2.14.1 to 2.14.2 (dependabot\[bot]) [#61909](nodejs/node#61909) - \[[`0072b7f991`](nodejs/node@0072b7f991)] - **meta**: bump actions/stale from 10.1.1 to 10.2.0 (dependabot\[bot]) [#61908](nodejs/node#61908) - \[[`999bf22f47`](nodejs/node@999bf22f47)] - **repl**: keep reference count for `process.on('newListener')` (Anna Henningsen) [#61895](nodejs/node#61895) - \[[`4c181e2277`](nodejs/node@4c181e2277)] - **(SEMVER-MINOR)** **sqlite**: add limits property to DatabaseSync (Mert Can Altin) [#61298](nodejs/node#61298) - \[[`aee2a18257`](nodejs/node@aee2a18257)] - **src**: fix flags argument offset in JSUdpWrap (Weixie Cui) [#61948](nodejs/node#61948) - \[[`46ee1eddd7`](nodejs/node@46ee1eddd7)] - **(SEMVER-MINOR)** **src**: add C++ support for diagnostics channels (RafaelGSS) [#61869](nodejs/node#61869) - \[[`9ddd1a9c27`](nodejs/node@9ddd1a9c27)] - **(SEMVER-MINOR)** **src,permission**: add --permission-audit (RafaelGSS) [#61869](nodejs/node#61869) - \[[`ea2df2a16f`](nodejs/node@ea2df2a16f)] - **stream**: fix pipeTo to defer writes per WHATWG spec (Matteo Collina) [#61800](nodejs/node#61800) - \[[`aa0c7b09e0`](nodejs/node@aa0c7b09e0)] - **test**: remove unnecessary `process.exit` calls from test files (Antoine du Hamel) [#62020](nodejs/node#62020) - \[[`ad96a6578f`](nodejs/node@ad96a6578f)] - **test**: skip `test-url` on `--shared-ada` builds (Antoine du Hamel) [#62019](nodejs/node#62019) - \[[`7c72a31e4b`](nodejs/node@7c72a31e4b)] - **test**: skip strace test with shared openssl (Richard Lau) [#61987](nodejs/node#61987) - \[[`604456c163`](nodejs/node@604456c163)] - **test**: avoid flaky debugger restart waits (Yuya Inoue) [#61773](nodejs/node#61773) - \[[`4890d6bd43`](nodejs/node@4890d6bd43)] - **test\_runner**: run afterEach on runtime skip (Igor Shevelenkov) [#61525](nodejs/node#61525) - \[[`fce2930110`](nodejs/node@fce2930110)] - **test\_runner**: expose expectFailure message (sangwook) [#61563](nodejs/node#61563) - \[[`0d97ec4044`](nodejs/node@0d97ec4044)] - **(SEMVER-MINOR)** **test\_runner**: expose worker ID for concurrent test execution (Ali Hassan) [#61394](nodejs/node#61394) - \[[`243e6b2009`](nodejs/node@243e6b2009)] - **test\_runner**: replace native methods with primordials (Ayoub Mabrouk) [#61219](nodejs/node#61219) - \[[`bf1ed7e647`](nodejs/node@bf1ed7e647)] - **tls**: forward keepAlive, keepAliveInitialDelay, noDelay to socket (Sergey Zelenov) [#62004](nodejs/node#62004) - \[[`0f15079d94`](nodejs/node@0f15079d94)] - **tools**: remove custom logic for skipping `test-strace-openat-openssl` (Antoine du Hamel) [#62038](nodejs/node#62038) - \[[`54a055a59d`](nodejs/node@54a055a59d)] - **tools**: bump minimatch from 3.1.2 to 3.1.3 in `/tools/clang-format` (dependabot\[bot]) [#61977](nodejs/node#61977) - \[[`a28744cb62`](nodejs/node@a28744cb62)] - **tools**: fix permissions for merve update script (Richard Lau) [#62023](nodejs/node#62023) - \[[`31e7936354`](nodejs/node@31e7936354)] - **tools**: revert tools GHA workflow to ubuntu-latest (Richard Lau) [#62024](nodejs/node#62024) - \[[`0a96a16e1f`](nodejs/node@0a96a16e1f)] - **tools**: bump minimatch from 3.1.2 to 3.1.3 in /tools/eslint (dependabot\[bot]) [#61976](nodejs/node#61976) - \[[`f279233412`](nodejs/node@f279233412)] - **tools**: roll back to x86 runner on `scorecard.yml` (Antoine du Hamel) [#61944](nodejs/node#61944) - \[[`192c0382f4`](nodejs/node@192c0382f4)] - **util**: add fast path to stripVTControlCharacters (Hiroki Osame) [#61833](nodejs/node#61833) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

PR-URL: #61994 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Jordan Harband <ljharb@gmail.com>

deps: upgrade npm to 11.11.0

4394f3c

nodejs-github-bot added needs-ci PRs that need a full CI run. npm Issues and PRs related to the npm client dependency or the npm registry. labels Feb 25, 2026

richardlau added dont-land-on-v20.x dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. labels Feb 25, 2026

richardlau approved these changes Feb 25, 2026

View reviewed changes

richardlau added the request-ci Add this label to start a Jenkins CI on a PR. label Feb 25, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Feb 25, 2026

cjihrig approved these changes Feb 26, 2026

View reviewed changes

richardlau added the commit-queue Add this label to land a pull request using GitHub Actions. label Feb 26, 2026

lpinca approved these changes Feb 26, 2026

View reviewed changes

ljharb approved these changes Feb 27, 2026

View reviewed changes

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Feb 27, 2026

nodejs-github-bot merged commit c5b3f60 into nodejs:main Feb 27, 2026
81 checks passed

github-actions Bot mentioned this pull request Mar 2, 2026

2026-03-03, Version 25.8.0 (Current) #62073

Merged

24s92tntks-oss mentioned this pull request Mar 9, 2026

## 2026-03-03, Version 25.8.0 (Current), @richardlau chrislgarry/Apollo-11#964

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

deps: upgrade npm to 11.11.0#61994

deps: upgrade npm to 11.11.0#61994
nodejs-github-bot merged 1 commit into
nodejs:mainnodejs/node:mainfrom
npm:npm-v11.11.0-mainnpm/node:npm-v11.11.0-mainCopy head branch name to clipboard

npm-cli-bot commented Feb 25, 2026

Uh oh!

nodejs-github-bot commented Feb 25, 2026

Uh oh!

nodejs-github-bot commented Feb 25, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Search code, repositories, users, issues, pull requests...

Uh oh!

Conversation

npm-cli-bot commented Feb 25, 2026

11.11.0 (2026-02-25)

Features

Bug Fixes

Documentation

Dependencies

Uh oh!

nodejs-github-bot commented Feb 25, 2026

Uh oh!

nodejs-github-bot commented Feb 25, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants