chore: bump @npmcli/config from 10.12.0 to 11.0.0

[dependabot]

Bumps @npmcli/config from 10.12.0 to 11.0.0.

Release notes

Sourced from @​npmcli/config's releases.

config: v11.0.0

11.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning.

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

libnpmaccess: v11.0.0

11.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

libnpmexec: v11.0.0

11.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

Dependencies

• workspace: @npmcli/arborist@10.0.0

config: v11.0.0-pre.3

11.0.0-pre.3 (2026-07-08)

Features

• fd75880 #9729 warn instead of error on unknown .npmrc configs (#9729) (@​reggi)

config: v11.0.0-pre.2

11.0.0-pre.2 (2026-06-29)

Features

• b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@​u2mejc)
• 86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@​manzoorwanijk)
• 58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@​manzoorwanijk)

Bug Fixes

• 7655822 #9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@​JamieMagee)

Documentation

• fdcfcee #9678 recommend install-strategy=linked to catch phantom dependencies (#9678) (@​manzoorwanijk)

config: v11.0.0-pre.1

11.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.

... (truncated)

Changelog

Sourced from @​npmcli/config's changelog.

11.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning.

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

11.0.0-pre.3 (2026-07-08)

Features

• fd75880 #9729 warn instead of error on unknown .npmrc configs (#9729) (@​reggi)

11.0.0-pre.2 (2026-06-29)

Features

• b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@​u2mejc)
• 86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@​manzoorwanijk)
• 58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@​manzoorwanijk)

Bug Fixes

• 7655822 #9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@​JamieMagee)

Documentation

• fdcfcee #9678 recommend install-strategy=linked to catch phantom dependencies (#9678) (@​manzoorwanijk)

11.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning.

Features

• 1db885c #9439 native dependency patching (npm patch add/commit/update/ls/rm) (#9439) (@​manzoorwanijk)
• fc80bb3 #9234 remove default license for npm init (@​owlstronaut)
• be8053c #9544 warn when min-release-age blocks an audit fix (#9544) (@​JamieMagee)
• 18eb967 #9559 bump to new node engine range (@​owlstronaut)
• c3e1a71 #9532 add min-release-age-exclude config (@​JamieMagee, @​caseyjhol)
• f6a9aad #9517 differentiate GitHub Actions environments in user-agent (#9517) (@​reggi, @​Copilot)
• 5cd5150 #9424 default-deny install scripts (allowScripts opt-in) [v12] (@​JamieMagee)
• caa3295 #9466 default allow-git and allow-remote to none (@​owlstronaut)
• f2e4a28 #9351 add a global npmignore file (#9351) (@​ljharb)
• c9be2d1 #9153 publish --access=private alias for restricted (#9153) (@​reggi, @​Copilot)
• 7068d42 #9360 Phase 1 of allowScripts opt-in install-script policy (#9360) (@​JamieMagee)
• 979518d #9276 error on unknown configs, flags, and abbreviations (#9276) (@​owlstronaut)

Bug Fixes

• 9b5c7b0 #9521 config: strict-allow-scripts default blocks with a warning, not silently (@​JamieMagee)
• 6efac6e #9453 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@​JamieMagee)
• c5292fa #9422 use prerelease strategy without a bug (@​owlstronaut)

Dependencies

• 21df0ab #9559 proc-log@7.0.0
• 471309f #9559 nopt@10.0.1

... (truncated)

Commits

• a481f57 chore: release 11.0.0
• a07f4e0 chore: @​npmcli/template-oss@​4.23.6
• cf52b8b chore: release 11.0.0-pre.1
• c0bcc2a deps: walk-up-path@4.0.0
• 2af31dd docs: change certfile to cafile (#7947)
• 523ad85 chore: release 11.0.0-pre.0
• 6edfe2f chore: @​npmcli/template-oss@​4.23.5
• 6e11eb2 fix!: for @​npmcli/config sets node engine range to ^20.17.0 || >=22.9.0
• 977fd57 chore: release 10.9.0
• 2072705 chore: update @​npmcli/eslint-config@​5.0.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)