Bump @npmcli/arborist from 9.9.0 to 10.0.0

[dependabot]

Bumps @npmcli/arborist from 9.9.0 to 10.0.0.

Release notes

Sourced from @​npmcli/arborist's releases.

arborist: v10.0.0

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• Preserve https protocol when working with git (#8703)
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

libnpmpack: v10.0.0

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm pack and npm publish now error when a package's overrides apply to one or more of its bundled packages (bundledDependencies / bundleDependencies). Defining both fields is still allowed as long as no override actually targets a bundled package. To resolve the error, remove the affected entries from either overrides or the bundle.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

Dependencies

• workspace: @npmcli/arborist@10.0.0

libnpmsearch: v10.0.0

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

arborist: v10.0.0-pre.2

10.0.0-pre.2 (2026-06-29)

Features

• b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@​u2mejc)
• 86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@​manzoorwanijk)
• c4e5356 #9651 install-scripts: prune unused allowScripts entries (#9651) (@​JamieMagee)
• 58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@​manzoorwanijk)

Bug Fixes

• 968e42f #9671 arborist: apply overrides across a file:/workspace link boundary (#9671) (@​manzoorwanijk)
• ae6dbeb #9657 arborist: surface undeclared workspaces under the linked strategy (#9657) (@​manzoorwanijk)
• 541c286 #9658 arborist: forward transitive overrides through linked store links (#9658) (@​manzoorwanijk)
• f9e3a80 #9655 arborist: correct dev/prod dep flags for workspaces under the linked strategy (#9655) (@​manzoorwanijk)
• 6a5bf26 #9654 arborist: load transitive optional deps into linked actual tree (#9654) (@​manzoorwanijk)
• 803ba70 #9656 query: report logical dep location under linked strategy (#9656) (@​manzoorwanijk)
• 60d0d3d #9652 allowScripts: close three enforcement gaps (#9652) (@​JamieMagee)
• ca92323 #9647 arborist: clean up stale .store and hoisted dirs on strategy switch (#9647) (@​manzoorwanijk)
• 2b976b5 #9637 arborist: invalid filterNode crash under the linked strategy (#9637) (@​manzoorwanijk)
• 0ffce98 #9628 arborist: repair wrong-but-existing symlink target in linked strategy (#9628) (@​manzoorwanijk)
• 981e249 #9632 arborist: remove stale .bin shims after uninstall under linked (#9632) (@​manzoorwanijk)
• 6968015 #9630 arborist: record the linked .store layout in the hidden lockfile (#9630) (@​manzoorwanijk)

... (truncated)

Changelog

Sourced from @​npmcli/arborist's changelog.

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• Preserve https protocol when working with git (#8703)
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

10.0.0-pre.2 (2026-06-29)

Features

• b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@​u2mejc)
• 86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@​manzoorwanijk)
• c4e5356 #9651 install-scripts: prune unused allowScripts entries (#9651) (@​JamieMagee)
• 58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@​manzoorwanijk)

Bug Fixes

• 968e42f #9671 arborist: apply overrides across a file:/workspace link boundary (#9671) (@​manzoorwanijk)
• ae6dbeb #9657 arborist: surface undeclared workspaces under the linked strategy (#9657) (@​manzoorwanijk)
• 541c286 #9658 arborist: forward transitive overrides through linked store links (#9658) (@​manzoorwanijk)
• f9e3a80 #9655 arborist: correct dev/prod dep flags for workspaces under the linked strategy (#9655) (@​manzoorwanijk)
• 6a5bf26 #9654 arborist: load transitive optional deps into linked actual tree (#9654) (@​manzoorwanijk)
• 803ba70 #9656 query: report logical dep location under linked strategy (#9656) (@​manzoorwanijk)
• 60d0d3d #9652 allowScripts: close three enforcement gaps (#9652) (@​JamieMagee)
• ca92323 #9647 arborist: clean up stale .store and hoisted dirs on strategy switch (#9647) (@​manzoorwanijk)
• 2b976b5 #9637 arborist: invalid filterNode crash under the linked strategy (#9637) (@​manzoorwanijk)
• 0ffce98 #9628 arborist: repair wrong-but-existing symlink target in linked strategy (#9628) (@​manzoorwanijk)
• 981e249 #9632 arborist: remove stale .bin shims after uninstall under linked (#9632) (@​manzoorwanijk)
• 6968015 #9630 arborist: record the linked .store layout in the hidden lockfile (#9630) (@​manzoorwanijk)
• 2aa1c7c #9605 arborist: validate peerOptional conflicts in no-save mutations (#9605) (@​dale-lakes, @​dale-lakes)
• 690bf17 #9603 arborist: fix audit-report determinism due to dropped via links (#9603) (@​arjun-vegeta)
• 851558c #9626 arborist: don't load store packages' devDependencies as required edges (#9626) (@​manzoorwanijk)
• 989f571 #9625 arborist: audit the non-isolated tree under the linked strategy (#9625) (@​manzoorwanijk)
• 7655822 #9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@​JamieMagee)
• 00b9f9f #9591 arborist: symlink workspace file: deps on non-workspace local packages (#9591) (@​manzoorwanijk)

10.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

• Preserve https protocol when working with git (#8703)
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• ce7681f #9496 packageExtensions for root-owned dependency manifest repairs (#9496) (@​manzoorwanijk)
• 1db885c #9439 native dependency patching (npm patch add/commit/update/ls/rm) (#9439) (@​manzoorwanijk)
• be8053c #9544 warn when min-release-age blocks an audit fix (#9544) (@​JamieMagee)
• 18eb967 #9559 bump to new node engine range (@​owlstronaut)
• c3e1a71 #9532 add min-release-age-exclude config (@​JamieMagee, @​caseyjhol)
• 5cd5150 #9424 default-deny install scripts (allowScripts opt-in) [v12] (@​JamieMagee)
• 64e3f79 #9480 allowScripts tooling and inBundle hardening (#9480) (@​JamieMagee)
• 7068d42 #9360 Phase 1 of allowScripts opt-in install-script policy (#9360) (@​JamieMagee)

Bug Fixes

• e96a7de #8703 Preserve https protocol when working with git (#8703) (@​oldium)
• afce424 #9551 arborist: expose store node_modules via NODE_PATH for linked-strategy install scripts (#9551) (@​manzoorwanijk)

... (truncated)

Commits

• 3f9aa45 chore: release 10.0.0
• 7f81e96 chore: use maxSockets:1 for some flaky arborist reify tests
• 52cb638 chore: release 10.0.0-pre.1
• eb41977 deps: @​npmcli/run-script@​7.0.1
• f334466 deps: pacote@17.0.4
• bb63bf9 deps: @​npmcli/run-script@​7.0.0
• 43831d0 deps: pacote@17.0.3
• 44e8fec deps: pacote@17.0.2
• 425c6dd chore: nock@13.3.0
• 694e4cb chore: tap@16.3.8
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #28.