Search results

node-integration.yml workflow uses deprecated actions based on node16 & node20

Status: Open.

#9834 In npm/cli;

· MikeMcC399 opened on Aug 3, 2026

GHSA-r292-9mhp-454m severity vulnerability in tar@7.5.19 for npm@10.9.9,npm@11.9.0 npm@12.0.2 in Node.js

Status: Open.

#9833 In npm/cli;

· aliceshi-aaaaaokkk opened on Aug 3, 2026

CVE-2026-14257 severity vulnerability in brace-expansion@5.0.7 for npm@10.9.9,npm@11.9.0 npm@12.0.2 in Node.js

Status: Open.

#9832 In npm/cli;

· aliceshi-aaaaaokkk opened on Aug 3, 2026

[BUG] custom viewer ignored in npm help

Bugthing that needs fixingthing that needs fixing

Needs Triageneeds review for next stepsneeds review for next steps

Status: Open.

#9828 In npm/cli;

· marmitar opened on Aug 2, 2026

Keeping npm up to date in Node.js

Status: Open.

#9827 In npm/cli;

· reggi opened on Jul 31, 2026

[BUG] npm ignores node-gyp config setting

Bugthing that needs fixingthing that needs fixing

Needs Triageneeds review for next stepsneeds review for next steps

Status: Open.

#9826 In npm/cli;

· bricss opened on Jul 31, 2026

[BUG] npm install drops nested lockfile entries inside a bundled dependency that npm ci then requires (npm 10 and 11 alike)

Status: Open.

#9821 In npm/cli;

· edreanernst opened on Jul 30, 2026

[DOCS] Unknown configs throw error in npm@12.0.0 release notes - re-open

Status: Open.

#9812 In npm/cli;

· MikeMcC399 opened on Jul 28, 2026

[BUG] ERESOLVE on in-place update: conflict from an optional peer that never gets installed

Bugthing that needs fixingthing that needs fixing

Needs Triageneeds review for next stepsneeds review for next steps

Status: Open.

#9807 In npm/cli;

· igordanchenko opened on Jul 27, 2026

[BUG] npm deprecate fails with "deprecations must be strings" once any version is already deprecated

Status: Open.

#9803 In npm/cli;

· MrRefactoring opened on Jul 25, 2026

[BUG] --dry-run fails with EALLOWREMOTE on registry tarballs for packages that declare bundleDependencies

Status: Open.

#9800 In npm/cli;

· kelnei opened on Jul 25, 2026

[BUG] npm update of a single global package requires allow-scripts for all installed packages

Bugthing that needs fixingthing that needs fixing

Needs Triageneeds review for next stepsneeds review for next steps

Status: Open.

#9797 In npm/cli;

· JasperTeng opened on Jul 24, 2026