docs: clarify npm 12 unknown-config breaking change in changelogs - #9805
Merged
reggi merged 1 commit intoJul 27, 2026
Merged
Conversation
The stable 12.0.0 / config 11.0.0 breaking-change notes still said unknown .npmrc keys throw. That was reverted before the stable cut (npm#9729): file configs warn by default again, with strict-npmrc to opt into errors, while unknown CLI flags and abbreviations still throw. Align the published changelog bullets with the corrected pre.1 wording from npm#9733 so release notes match actual npm 12 behavior. Fixes npm#9802
martinrrm
approved these changes
Jul 27, 2026
reggi
approved these changes
Jul 27, 2026
Merged
spotdemo4
pushed a commit
to spotdemo4/TrevRPC
that referenced
this pull request
Aug 30, 2026
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [npm](https://docs.npmjs.com/) ([source](https://github.com/npm/cli)) | [`11.19.1` → `12.0.2`](https://renovatebot.com/diffs/npm/npm/11.19.1/12.0.2) |  |  | --- ### Release Notes <details> <summary>npm/cli (npm)</summary> ### [`v12.0.2`](https://github.com/npm/cli/blob/HEAD/CHANGELOG.md#1202-2026-07-27) [Compare Source](npm/cli@v12.0.1...v12.0.2) ##### Bug Fixes - [`834408e`](npm/cli@834408e) [#​9760](npm/cli#9760) pack: honor min-release-age-exclude ([#​9760](npm/cli#9760)) ([@​martinrrm](https://github.com/martinrrm), [@​Copilot](https://github.com/Copilot)) - [`ef6cfea`](npm/cli@ef6cfea) [#​9786](npm/cli#9786) owner: use scoped registry for user lookup ([#​9786](npm/cli#9786)) ([@​martinrrm](https://github.com/martinrrm), [@​Copilot](https://github.com/Copilot)) ##### Documentation - [`9e17dc0`](npm/cli@9e17dc0) [#​9805](npm/cli#9805) clarify npm 12 unknown-config breaking change in changelogs ([#​9805](npm/cli#9805)) ([@​Hashim1999164](https://github.com/Hashim1999164)) ##### Chores - [`7b1f6c1`](npm/cli@7b1f6c1) [#​9747](npm/cli#9747) parse pack --json object output in node integration ([#​9747](npm/cli#9747)) ([@​reggi](https://github.com/reggi), [@​Copilot](https://github.com/Copilot)) ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v10.0.2): `@npmcli/arborist@10.0.2` - [workspace](https://github.com/npm/cli/releases/tag/config-v11.0.1): `@npmcli/config@11.0.1` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v9.0.2): `libnpmdiff@9.0.2` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v11.0.2): `libnpmexec@11.0.2` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v8.0.2): `libnpmfund@8.0.2` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v10.0.2): `libnpmpack@10.0.2` ### [`v12.0.1`](https://github.com/npm/cli/blob/HEAD/CHANGELOG.md#1201-2026-07-10) [Compare Source](npm/cli@v12.0.0...v12.0.1) ##### Bug Fixes - [`ecb02a8`](npm/cli@ecb02a8) [#​9745](npm/cli#9745) view: avoid wrapping array results ([#​9745](npm/cli#9745)) ([@​reggi](https://github.com/reggi), [@​martinrrm](https://github.com/martinrrm), [@​Copilot](https://github.com/Copilot)) - [`47fc8b1`](npm/cli@47fc8b1) [#​9740](npm/cli#9740) correct bundled sigstore from dev dependency conflict ([#​9740](npm/cli#9740)) ([@​james-pre](https://github.com/james-pre)) ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v10.0.1): `@npmcli/arborist@10.0.1` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v9.0.1): `libnpmdiff@9.0.1` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v11.0.1): `libnpmexec@11.0.1` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v8.0.1): `libnpmfund@8.0.1` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v10.0.1): `libnpmpack@10.0.1` ### [`v12.0.0`](https://github.com/npm/cli/blob/HEAD/CHANGELOG.md#1200-2026-07-08) [Compare Source](npm/cli@v11.19.1...v12.0.0) #####⚠️ BREAKING CHANGES - npm view --json now always returns an array. - `npm sbom --sbom-format=cyclonedx` now reports the `name` field from each package's `package.json` instead of the on-disk directory name. The `name`, `bom-ref`, and `purl` of the root component and of aliased dependencies may change. - npm no longer registers man pages with the system when installed globally. `man npm-install` will no longer work, but `npm help install` is unaffected. - The `npm pkg` output is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly to `npm view`. - `npm shrinkwrap` is removed, the `shrinkwrap` config alias is removed, and `npm-shrinkwrap.json` is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root `npm-shrinkwrap.json` to `package-lock.json`; use `bundleDependencies` if you need to ship a locked dependency tree. - The Twitter and Freenode profile fields have been removed from the npm registry. This means that users will no longer be able to set or view these fields in their npm profiles. - npm will no longer attempt to resolve the path to node via whichnode. process.execPath is already set by Node to the resolved real path of the node binary, so the lookup was redundant. Scripts that expected npm to override process.execPath with a PATH-resolved (potentially symlinked) node path may be affected. - the --json output of `npm pack` and `npm publish` have changed. They are now always consistent, and in the same format. - the `star`, `stars` and `unstar` commands have been removed - The `npm adduser` command has been removed. Create and manage user accounts on the npm website, and use `npm login` to authenticate on the command line. - Preserve https protocol when working with git ([#​8703](npm/cli#8703)) - The default license for `npm init` has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages. - `npm` now supports node `^22.22.2 || ^24.15.0 || >=26.0.0` - allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies. - root \`preinstall\` now runs before dependencies are installed. - unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning. (Unknown `.npmrc` configs still warn by default; opt into erroring with the new `strict-npmrc` config.) - Dependency lifecycle scripts are now blocked by default unless allowed by the root package's `allowScripts` policy. After installing, run `npm install-scripts approve` to record approvals and `npm rebuild` to execute newly approved scripts. ##### Chores - [`b77b532`](npm/cli@b77b532) [#​9735](npm/cli#9735) remove pre-release mode from npm 12 and workspaces ([#​9735](npm/cli#9735)) ([@​reggi](https://github.com/reggi), [@​Copilot](https://github.com/Copilot)) ##### Dependencies - [workspace](https://github.com/npm/cli/releases/tag/arborist-v10.0.0): `@npmcli/arborist@10.0.0` - [workspace](https://github.com/npm/cli/releases/tag/config-v11.0.0): `@npmcli/config@11.0.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmaccess-v11.0.0): `libnpmaccess@11.0.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v9.0.0): `libnpmdiff@9.0.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v11.0.0): `libnpmexec@11.0.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v8.0.0): `libnpmfund@8.0.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmorg-v9.0.0): `libnpmorg@9.0.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v10.0.0): `libnpmpack@10.0.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v12.0.0): `libnpmpublish@12.0.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmsearch-v10.0.0): `libnpmsearch@10.0.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmteam-v9.0.0): `libnpmteam@9.0.0` - [workspace](https://github.com/npm/cli/releases/tag/libnpmversion-v9.0.0): `libnpmversion@9.0.0` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjI0LjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcCIsIm5vZGUiXX0=--> Reviewed-on: https://trev.zip/llc/TrevRPC/pulls/80
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #9802.
Before the npm 12 stable cut, #9729 restored warn-by-default for unknown
.npmrckeys (withstrict-npmrcto opt into errors). #9733 updated the12.0.0-pre.1changelog bullet to match, but the aggregated stable12.0.0/@npmcli/config@11.0.0breaking-change notes (and the config package'spre.1note) still said unknown.npmrcconfigs throw.That stale line also shipped in the published v12.0.0 GitHub release notes.
This aligns those changelog bullets with the corrected wording:
Maintainers may also want to refresh the published
v12.0.0release body to match; that cannot be updated via this PR alone.References
.npmrcconfigs)pre.1changelog note)