Bump @npmcli/arborist from 9.9.0 to 10.0.1

[dependabot]

Bumps @npmcli/arborist from 9.9.0 to 10.0.1.

Release notes

Sourced from @​npmcli/arborist's releases.

arborist: v10.0.1

10.0.1 (2026-07-10)

Bug Fixes

• 47fc8b1 #9740 correct bundled sigstore from dev dependency conflict (#9740) (@​james-pre)

libnpmpack: v10.0.1

Dependencies

• workspace: @npmcli/arborist@10.0.1

arborist: v10.0.0

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• Preserve https protocol when working with git (#8703)
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

libnpmpack: v10.0.0

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm pack and npm publish now error when a package's overrides apply to one or more of its bundled packages (bundledDependencies / bundleDependencies). Defining both fields is still allowed as long as no override actually targets a bundled package. To resolve the error, remove the affected entries from either overrides or the bundle.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

Dependencies

• workspace: @npmcli/arborist@10.0.0

libnpmsearch: v10.0.0

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

arborist: v10.0.0-pre.2

10.0.0-pre.2 (2026-06-29)

Features

• b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@​u2mejc)
• 86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@​manzoorwanijk)
• c4e5356 #9651 install-scripts: prune unused allowScripts entries (#9651) (@​JamieMagee)
• 58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@​manzoorwanijk)

Bug Fixes

• 968e42f #9671 arborist: apply overrides across a file:/workspace link boundary (#9671) (@​manzoorwanijk)
• ae6dbeb #9657 arborist: surface undeclared workspaces under the linked strategy (#9657) (@​manzoorwanijk)

... (truncated)

Changelog

Sourced from @​npmcli/arborist's changelog.

10.0.1 (2026-07-10)

Bug Fixes

• 47fc8b1 #9740 correct bundled sigstore from dev dependency conflict (#9740) (@​james-pre)

10.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• Preserve https protocol when working with git (#8703)
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

10.0.0-pre.2 (2026-06-29)

Features

• b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@​u2mejc)
• 86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@​manzoorwanijk)
• c4e5356 #9651 install-scripts: prune unused allowScripts entries (#9651) (@​JamieMagee)
• 58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@​manzoorwanijk)

Bug Fixes

• 968e42f #9671 arborist: apply overrides across a file:/workspace link boundary (#9671) (@​manzoorwanijk)
• ae6dbeb #9657 arborist: surface undeclared workspaces under the linked strategy (#9657) (@​manzoorwanijk)
• 541c286 #9658 arborist: forward transitive overrides through linked store links (#9658) (@​manzoorwanijk)
• f9e3a80 #9655 arborist: correct dev/prod dep flags for workspaces under the linked strategy (#9655) (@​manzoorwanijk)
• 6a5bf26 #9654 arborist: load transitive optional deps into linked actual tree (#9654) (@​manzoorwanijk)
• 803ba70 #9656 query: report logical dep location under linked strategy (#9656) (@​manzoorwanijk)
• 60d0d3d #9652 allowScripts: close three enforcement gaps (#9652) (@​JamieMagee)
• ca92323 #9647 arborist: clean up stale .store and hoisted dirs on strategy switch (#9647) (@​manzoorwanijk)
• 2b976b5 #9637 arborist: invalid filterNode crash under the linked strategy (#9637) (@​manzoorwanijk)
• 0ffce98 #9628 arborist: repair wrong-but-existing symlink target in linked strategy (#9628) (@​manzoorwanijk)
• 981e249 #9632 arborist: remove stale .bin shims after uninstall under linked (#9632) (@​manzoorwanijk)
• 6968015 #9630 arborist: record the linked .store layout in the hidden lockfile (#9630) (@​manzoorwanijk)
• 2aa1c7c #9605 arborist: validate peerOptional conflicts in no-save mutations (#9605) (@​dale-lakes, @​dale-lakes)
• 690bf17 #9603 arborist: fix audit-report determinism due to dropped via links (#9603) (@​arjun-vegeta)
• 851558c #9626 arborist: don't load store packages' devDependencies as required edges (#9626) (@​manzoorwanijk)
• 989f571 #9625 arborist: audit the non-isolated tree under the linked strategy (#9625) (@​manzoorwanijk)
• 7655822 #9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@​JamieMagee)
• 00b9f9f #9591 arborist: symlink workspace file: deps on non-workspace local packages (#9591) (@​manzoorwanijk)

10.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

• Preserve https protocol when working with git (#8703)
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• ce7681f #9496 packageExtensions for root-owned dependency manifest repairs (#9496) (@​manzoorwanijk)
• 1db885c #9439 native dependency patching (npm patch add/commit/update/ls/rm) (#9439) (@​manzoorwanijk)
• be8053c #9544 warn when min-release-age blocks an audit fix (#9544) (@​JamieMagee)
• 18eb967 #9559 bump to new node engine range (@​owlstronaut)
• c3e1a71 #9532 add min-release-age-exclude config (@​JamieMagee, @​caseyjhol)
• 5cd5150 #9424 default-deny install scripts (allowScripts opt-in) [v12] (@​JamieMagee)
• 64e3f79 #9480 allowScripts tooling and inBundle hardening (#9480) (@​JamieMagee)

... (truncated)

Commits

• a481f57 chore: release 11.0.0
• a07f4e0 chore: @​npmcli/template-oss@​4.23.6
• cf52b8b chore: release 11.0.0-pre.1
• f3ac7b7 feat!: no implicit latest tag on publish when latest > version (#7939)
• c0bcc2a deps: walk-up-path@4.0.0
• 4bf1901 deps: @​npmcli/metavuln-calculator@​9.0.0
• ca84b22 deps!: pacote@21.0.0
• 523ad85 chore: release 11.0.0-pre.0
• 6edfe2f chore: @​npmcli/template-oss@​4.23.5
• 6995303 feat!: adds --ignore-scripts flag to pack
• Additional commits viewable in compare view