deps: upgrade npm to 12.0.2

[npm-cli-bot]

This PR contains changes from: npm@12.0.0 npm@12.0.1 npm@12.0.2

---

12.0.0

12.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm view --json now always returns an array.
• npm sbom --sbom-format=cyclonedx now reports the name field from each package's package.json instead of the on-disk directory name. The name, bom-ref, and purl of the root component and of aliased dependencies may change.
• npm no longer registers man pages with the system when installed globally. man npm-install will no longer work, but npm help install is unaffected.
• The npm pkg output is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly to npm view.
• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• The Twitter and Freenode profile fields have been removed from the npm registry. This means that users will no longer be able to set or view these fields in their npm profiles.
• npm will no longer attempt to resolve the path to node via whichnode. process.execPath is already set by Node to the resolved real path of the node binary, so the lookup was redundant. Scripts that expected npm to override process.execPath with a PATH-resolved (potentially symlinked) node path may be affected.
• the --json output of npm pack and npm publish have changed. They are now always consistent, and in the same format.
• the star, stars and unstar commands have been removed
• The npm adduser command has been removed. Create and manage user accounts on the npm website, and use npm login to authenticate on the command line.
• Preserve https protocol when working with git (#8703)
• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• root `preinstall` now runs before dependencies are installed.
• unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning.

Chores

• b77b532 #9735 remove pre-release mode from npm 12 and workspaces (#9735) (@reggi, @Copilot)

Dependencies

• workspace: @npmcli/arborist@10.0.0
• workspace: @npmcli/config@11.0.0
• workspace: libnpmaccess@11.0.0
• workspace: libnpmdiff@9.0.0
• workspace: libnpmexec@11.0.0
• workspace: libnpmfund@8.0.0
• workspace: libnpmorg@9.0.0
• workspace: libnpmpack@10.0.0
• workspace: libnpmpublish@12.0.0
• workspace: libnpmsearch@10.0.0
• workspace: libnpmteam@9.0.0
• workspace: libnpmversion@9.0.0

12.0.1

12.0.1 (2026-07-10)

Bug Fixes

• ecb02a8 #9745 view: avoid wrapping array results (#9745) (@reggi, @martinrrm, @Copilot)
• 47fc8b1 #9740 correct bundled sigstore from dev dependency conflict (#9740) (@james-pre)

Dependencies

• workspace: @npmcli/arborist@10.0.1
• workspace: libnpmdiff@9.0.1
• workspace: libnpmexec@11.0.1
• workspace: libnpmfund@8.0.1
• workspace: libnpmpack@10.0.1

12.0.2

12.0.2 (2026-07-27)

Bug Fixes

• 834408e #9760 pack: honor min-release-age-exclude (#9760) (@martinrrm, @Copilot)
• ef6cfea #9786 owner: use scoped registry for user lookup (#9786) (@martinrrm, @Copilot)

Documentation

• 9e17dc0 #9805 clarify npm 12 unknown-config breaking change in changelogs (#9805) (@Hashim1999164)

Chores

• 7b1f6c1 #9747 parse pack --json object output in node integration (#9747) (@reggi, @Copilot)

Dependencies

• workspace: @npmcli/arborist@10.0.2
• workspace: @npmcli/config@11.0.1
• workspace: libnpmdiff@9.0.2
• workspace: libnpmexec@11.0.2
• workspace: libnpmfund@8.0.2
• workspace: libnpmpack@10.0.2

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/75361/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/75367/

[marco-ippolito]

Possibly this should just be labeled with semver-major PRs that contain breaking changes and should be released in the next major version.

Anyway, pending the outcome of nodejs/Release#1161

The outcome is that npm 12 wont be backported. That has been discussed and decided by the release wg
nodejs/Release#1161 (comment)

[marco-ippolito]

The outcome is that npm 12 wont be backported. That has been discussed and decided by the release wg nodejs/Release#1161 (comment)

I'm fine with that decision, but it should be clearly documented into that issue. The comment that you referred to, I interpreted as the decision still being open, even if the Releasers Team had formed a preferred opinion.

This does appear to be the consensus ...

is not the same as writing "We have decided ..."

Since the decision is owned by the release team, and the final consensus of the release team is to ship it as semver major, I think it is pretty much decided.

[nodejs-github-bot]

Commit Queue failed

- Loading data for nodejs/node/pull/64882
✔  Done loading data for nodejs/node/pull/64882
----------------------------------- PR info ------------------------------------
Title      deps: upgrade npm to 12.0.2 (#64882)
   ⚠  Could not retrieve the email or name of the PR author's from user's GitHub profile!
Branch     npm-cli-bot:npm-v12.0.2-main -> nodejs:main
Labels     semver-major, npm, author ready, needs-ci
Commits    1
 - deps: upgrade npm to 12.0.2
Committers 1
 - npm CLI robot <npm-cli+bot@github.com>
PR-URL: https://github.com/nodejs/node/pull/64882
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/64882
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Fri, 31 Jul 2026 20:17:08 GMT
   ✔  Approvals: 6
   ✔  - Jordan Harband (@ljharb): https://github.com/nodejs/node/pull/64882#pullrequestreview-4832185636
   ✔  - Aviv Keller (@avivkeller): https://github.com/nodejs/node/pull/64882#pullrequestreview-4832322700
   ✔  - Colin Ihrig (@cjihrig): https://github.com/nodejs/node/pull/64882#pullrequestreview-4834841084
   ✔  - Mike McCready (@MikeMcC399): https://github.com/nodejs/node/pull/64882#pullrequestreview-4834975352
   ✔  - Luigi Pinca (@lpinca): https://github.com/nodejs/node/pull/64882#pullrequestreview-4835142203
   ✔  - Trivikram Kamat (@trivikr): https://github.com/nodejs/node/pull/64882#pullrequestreview-4836771561
   ✘  semver-major requires at least 2 TSC approvals
   ✔  Last GitHub CI successful
   ℹ  Last Full PR CI on 2026-08-01T14:25:21Z: https://ci.nodejs.org/job/node-test-pull-request/75367/
- Querying data for job/node-test-pull-request/75367/
✔  Build data downloaded
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu

https://github.com/nodejs/node/actions/runs/30766015471

[mcollina]

lgtm

[MikeMcC399]

https://ci.nodejs.org/job/citgm-smoker/3750/

[MikeMcC399]

In nodejs/Release#1161 there is a statement from the npm team (@JamieMagee):

Testing

We'll hold npm 12 to the integrating-with-node guidelines: no new failures in Node's own test suite, no new failures installing or testing the citgm package set, and no backwards-incompatible changes to existing package-lock.json files.

As with npm 10, we'll run our node-integration workflow in GitHub Actions against every npm 12 prerelease so regressions show up early, and CI runs on every PR the npm team opens.

That sounds like it was supposed to be an acceptance test, so I ran it in my fork https://github.com/MikeMcC399/npm-cli against Node.js nightly

Comparing npm 11.19.0 with npm 12.0.2, there were 2 regressions:

• JSONStream@1.3.5 which is deprecated since 2018
• thread-sleep@2.2.0 marked as flaky

which both look like they can be ignored.

These are the test failures:

Test	npm 11.19.0	npm 12.0.2
test npm	fail	fail
citgm - JSONStream@1.3.5	pass	fail
citgm - binary-split@1.0.5	fail	fail
citgm - leveldown@6.1.1	fail	fail
citgm - microtime@3.1.1	fail	fail
citgm - q@1.5.1	fail	fail
citgm - thread-sleep@2.2.0 (flaky)	pass	fail

As a result of testing, I submitted 2 PRs to improve the test process:

npm/cli#9836 to update the actions used by node-integration workflow to supported versions (Edit: now landed) and
nodejs/citgm#1114 to drop the deprecated JSONStream from citgm

[ljharb]

it is absolutely critical that npm forever continue to be able to install non-lowercased package names, both for legacy packages like JSONStream and for custom registries, so if that's revealing a real regression then it's a problem.

[MikeMcC399]

it is absolutely critical that npm forever continue to be able to install non-lowercased package names, both for legacy packages like JSONStream and for custom registries, so if that's revealing a real regression then it's a problem.

I don't see any evidence that the mixed case of the package name is a problem. The package installs correctly from the npm@12.0.2 CLI. It only fails in citgm with:

warn: JSONStream npm-install:| npm error code EALLOWGIT
warn: JSONStream npm-install:| npm error Fetching packages of type "git" have been disabled

I didn't investigate that further, as JSONStream is unsupported since 2018.

One of npm@12's breaking changes is to disable git by default. allow-git defaults to none.

Edit: I did actually investigate further and the git dependency "fomatto": "git://github.com/BonsaiDen/Fomatto.git#468666f600b46f9067e3da7200fd9df428923ea6" comes from the assertions package, published 11 years ago with source repo archived on Mar 23, 2019. It's a transient of devDependencies of JSONStream.

Hopefully somebody from the citgm team can take a look at nodejs/citgm#1114 with a view to removing the obsolete JSONStream package from the list used by citgm.