chore: release 11.11.1

[github-actions]

🤖 I have created a release beep boop

11.11.1

11.11.1 (2026-03-10)

Bug Fixes

• a9d242b #9099 include all subcommands on main command help (fix: include all subcommands on main command help #9099) (@wraithgar)
• 29b8407 #9087 unwrap comments and lines meant for output (fix: unwrap comments and lines meant for output #9087) (@wraithgar)
• b56986a #9095 ls: suppress false UNMET DEPENDENCYs in linked strategy (fix(ls): suppress false UNMET DEPENDENCYs in linked strategy #9095) (@manzoorwanijk)
• 76c76e5 #9083 ci: don't error on optional deps in the lockfile (fix(ci): don't error on optional deps in the lockfile #9083) (@wraithgar)
• a29aeee #9028 arborist: retry bin-links on Windows EPERM (fix(arborist): retry bin-links on Windows EPERM #9028) (@manzoorwanijk)
• 6565eeb #9045 bypass packument cache to prevent ETARGET errors after publish (fix: bypass packument cache to prevent ETARGET errors after publish #9045) (@Jadu07)

Documentation

• 3b96929 #9074 scripts: remove mention of obsolete root user behavior (docs(scripts): remove mention of obsolete root user behavior #9074) (@mohd-akram)
• 16ac4e0 #9054 fix workspace cross-dependency documentation (@owlstronaut)

Dependencies

• 075ae23 #9086 tar@7.5.11
• 13fa40d #9086 pacote@21.5.0
• bf7ea2b #9060 brace-expansion@5.0.4
• 2000d2c #9060 minimatch@10.2.4
• d86b260 #9060 tar@7.5.10
• dff1853 #9060 @npmcli/run-script@10.0.4
• 93c3365 #9060 write-file-atomic@7.0.1

Chores

• d1996a7 #9060 dev dependency updates (@wraithgar)
• workspace: @npmcli/arborist@9.4.1
• workspace: libnpmdiff@8.1.4
• workspace: libnpmexec@10.2.4
• workspace: libnpmfund@7.0.18
• workspace: libnpmpack@9.1.4

arborist: 9.4.1

9.4.1 (2026-03-10)

Bug Fixes

• 5b7c0cc #9096 arborist: exclude store nodes from :root > * in linked strategy (fix(arborist): exclude store nodes from :root > * in linked strategy #9096) (@manzoorwanijk)
• 3b70a9d #9097 arborist: simplify rootDeclaredDeps initialization (fix(arborist): simplify rootDeclaredDeps initialization #9097) (@manzoorwanijk)
• c7702d0 #9094 arborist: fix non-idempotent linked install with workspace projects (fix(arborist): fix non-idempotent linked install with workspace projects #9094) (@manzoorwanijk)
• 1a744b5 #9081 arborist: omit root dev deps in linked strategy when shared with workspaces (fix(arborist): omit root dev deps in linked strategy when shared with workspaces #9081) (@manzoorwanijk)
• ff51827 #9076 arborist: do not hoist undeclared workspaces in linked strategy (fix(arborist): do not hoist undeclared workspaces in linked strategy #9076) (@manzoorwanijk)
• 1206f8b #9069 consolidate isolated node/link attributes (fix: consolidate isolated node/link attributes #9069) (@wraithgar)
• a774fb7 #9066 arborist: respect --omit flag in linked install strategy (fix(arborist): respect --omit flag in linked install strategy #9066) (@manzoorwanijk)
• 8614b2a #9031 arborist: avoid full reinstall on subsequent linked strategy runs (fix(arborist): avoid full reinstall on subsequent linked strategy runs #9031) (@manzoorwanijk)
• 16fbe13 #9030 resolve relative file: dependencies correctly with install-strategy=linked (fix: resolve relative file: dependencies correctly with install-strategy=linked #9030) (@manzoorwanijk)
• 983742b #9055 isolated mode code cleanup (fix: isolated mode code cleanup #9055) (@wraithgar)
• a29aeee #9028 arborist: retry bin-links on Windows EPERM (fix(arborist): retry bin-links on Windows EPERM #9028) (@manzoorwanijk)
• 10d5302 #9051 arborist: unwrap Link nodes in legacyPeerDeps for linked strategy (fix(arborist): unwrap Link nodes in legacyPeerDeps for linked strategy #9051) (@manzoorwanijk)
• 94bfef5 #9044 audit: exclude locally linked packages from vulnerability audit (fix(audit): exclude locally linked packages from vulnerability audit  #9044) (@lucas-gomes-santana)
• 26fa40e #9041 fix workspace-filtered install with linked strategy (@owlstronaut)

libnpmdiff: 8.1.4

Dependencies

• workspace: @npmcli/arborist@9.4.1

libnpmexec: 10.2.4

Dependencies

• workspace: @npmcli/arborist@9.4.1

libnpmfund: 7.0.18

Dependencies

• workspace: @npmcli/arborist@9.4.1

libnpmpack: 9.1.4

Dependencies

• workspace: @npmcli/arborist@9.4.1

---

This PR was generated with Release Please. See documentation.

[github-actions]

Release Manager

Release workflow run: https://github.com/npm/cli/actions/runs/22926669098

Release Checklist for v11.11.1

• 1. Checkout the release branch

  Ensure git status is not dirty on this branch after resetting deps. If it is, then something is probably wrong with the automated release process.

  gh pr checkout 9047 --force

  npm run resetdeps

  node scripts/git-dirty.js

• 2. Check CI status

  gh pr checks --watch

• 3. Log in to npm

  npm login sessions are short lived, so you will want to have a fresh one before you publish.

  npm login

• 4. Publish the CLI and workspaces

  Warning:
  This will publish all updated workspaces to latest, prerelease or backport depending on their version, and will publish the CLI with the dist-tag set to next-11.

  Note:
  The --test argument can optionally be omitted to run the publish process without running any tests locally.

  node scripts/publish.js --test

• 5. Optionally install and test npm@11.11.1 locally

  npm i -g npm@11.11.1

  npm --version
  npm whoami
  npm help install
  # etc

• 6. Set latest dist-tag to newly published version

  Warning:
  NOT FOR PRERELEASE: Do not run this step for prereleases or if 11 is not being set to latest.

  node . dist-tag add npm@11.11.1 latest

• 7. Trigger docs.npmjs.com update

  gh workflow run update-cli.yml --repo npm/documentation

• 8. Approve and Merge release PR

  gh pr review --approve

  gh pr merge --rebase

  git checkout latest

  git fetch

  git reset --hard origin/latest

  node . run resetdeps

• 9. Wait For Release Tags

  Warning:
  The remaining steps all require the GitHub tags and releases to be created first. These are done once this PR has been labelled with autorelease: tagged.

  Release Please will run on the just merged release commit and create GitHub releases and tags for each package. The release bot will will comment on this PR when the releases and tags are created.

  Note:
  The release workflow also includes the Node integration tests which do not need to finish before continuing.

  You can watch the release workflow in your terminal with the following command:

  gh run watch `gh run list -R npm/cli -w release -b latest -L 1 --json databaseId -q ".[0].databaseId"`
  

• 10. Mark GitHub Release as latest

  Warning:
  You must wait for CI to create the release tags before running this step. These are done once this PR has been labelled with autorelease: tagged.

  Release Please will make GitHub Releases for the CLI and all workspaces, but GitHub has UI affordances for which release should appear as the "latest", which should always be the CLI. To mark the CLI release as latest run this command:

  gh release -R npm/cli edit v11.11.1 --latest

• 11. Open nodejs/node PR to update npm to latest

  Warning:
  You must wait for CI to create the release tags before running this step. These are done once this PR has been labelled with autorelease: tagged.

  Trigger the Create Node PR action. This will open a PR on nodejs/node to the main branch.

  Note:
  The resulting PR may need to be labelled if it is not intended to land on old Node versions.

  First, sync our fork of node with the upstream source:

  gh repo sync npm/node --source nodejs/node --force

  Then, if we are opening a PR against the latest version of node:

  gh workflow run create-node-pr.yml -R npm/cli -f spec=next-11

  If the PR should be opened on a different branch (such as when doing backports) then run it with -f branch=<BRANCH_NAME>. There is also a shortcut to target a specific Node version by specifying a major version number with -f branch=18 (or similar).

  For example, this will create a PR on nodejs/node to the v16.x-staging branch:

  gh workflow run create-node-pr.yml -R npm/cli -f spec=next-11 -f branch=16

• 12. Label and fast-track nodejs/node PR

  Note:
  This requires being a nodejs collaborator. This could be you!

  • Thumbs-up reaction on the Fast-track comment
  • Add an LGTM / Approval
  • Add request-ci label to get it running CI
  • Add commit-queue label once everything is green

[manzoorwanijk]

@wraithgar are we good here?

[manzoorwanijk]

Meanwhile, I am conducting more aggressive testing of the linked strategy. I hope I don't find more bugs 😄

[manzoorwanijk]

OK, I found 4 bugs, nothing critical though

• [BUG] linked strategy: npm ls reports undeclared workspaces as UNMET DEPENDENCY #9090
• [BUG] linked strategy: non-idempotent install with workspace projects #9091
• [BUG] linked strategy: npm ls --all reports false UNMET DEPENDENCYs for devDeps of store packages #9092
• [BUG] linked strategy: npm query ':root > *' returns incorrect results #9093

[wraithgar]

We typically release on Wednesday.

[manzoorwanijk]

We typically release on Wednesday.

Good to know. Thank you.