deps: Bump @npmcli/config from 10.12.0 to 11.0.1

[dependabot]

Bumps @npmcli/config from 10.12.0 to 11.0.1.

Release notes

Sourced from @​npmcli/config's releases.

libnpmexec: v11.0.1

Dependencies

• workspace: @npmcli/arborist@10.0.1

config: v11.0.1

11.0.1 (2026-07-27)

Documentation

• 9e17dc0 #9805 clarify npm 12 unknown-config breaking change in changelogs (#9805) (@​Hashim1999164)

config: v11.0.0

11.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning.

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

libnpmaccess: v11.0.0

11.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

libnpmexec: v11.0.0

11.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

Dependencies

• workspace: @npmcli/arborist@10.0.0

config: v11.0.0-pre.3

11.0.0-pre.3 (2026-07-08)

Features

• fd75880 #9729 warn instead of error on unknown .npmrc configs (#9729) (@​reggi)

config: v11.0.0-pre.2

11.0.0-pre.2 (2026-06-29)

Features

• b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@​u2mejc)
• 86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@​manzoorwanijk)

... (truncated)

Changelog

Sourced from @​npmcli/config's changelog.

11.0.1 (2026-07-27)

Documentation

• 9e17dc0 #9805 clarify npm 12 unknown-config breaking change in changelogs (#9805) (@​Hashim1999164)

11.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning. (Unknown .npmrc configs still warn by default; opt into erroring with the new strict-npmrc config.)

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

11.0.0-pre.3 (2026-07-08)

Features

• fd75880 #9729 warn instead of error on unknown .npmrc configs (#9729) (@​reggi)

11.0.0-pre.2 (2026-06-29)

Features

• b51d156 #9672 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9672) (@​u2mejc)
• 86416a6 #9674 graduate the linked install strategy from experimental to stable (#9674) (@​manzoorwanijk)
• 58cd8f5 #9586 .npm-extension transformManifest for imperative manifest repairs (#9586) (@​manzoorwanijk)

Bug Fixes

• 7655822 #9597 arborist: don't flag inert optional deps in strict-allow-scripts (#9597) (@​JamieMagee)

Documentation

• fdcfcee #9678 recommend install-strategy=linked to catch phantom dependencies (#9678) (@​manzoorwanijk)

11.0.0-pre.1 (2026-06-19)

⚠️ BREAKING CHANGES

• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning. (Unknown .npmrc configs still warn by default; opt into erroring with the new strict-npmrc config.)

Features

• 1db885c #9439 native dependency patching (npm patch add/commit/update/ls/rm) (#9439) (@​manzoorwanijk)
• fc80bb3 #9234 remove default license for npm init (@​owlstronaut)
• be8053c #9544 warn when min-release-age blocks an audit fix (#9544) (@​JamieMagee)
• 18eb967 #9559 bump to new node engine range (@​owlstronaut)
• c3e1a71 #9532 add min-release-age-exclude config (@​JamieMagee, @​caseyjhol)
• f6a9aad #9517 differentiate GitHub Actions environments in user-agent (#9517) (@​reggi, @​Copilot)
• 5cd5150 #9424 default-deny install scripts (allowScripts opt-in) [v12] (@​JamieMagee)
• caa3295 #9466 default allow-git and allow-remote to none (@​owlstronaut)
• f2e4a28 #9351 add a global npmignore file (#9351) (@​ljharb)
• c9be2d1 #9153 publish --access=private alias for restricted (#9153) (@​reggi, @​Copilot)
• 7068d42 #9360 Phase 1 of allowScripts opt-in install-script policy (#9360) (@​JamieMagee)
• 979518d #9276 error on unknown configs, flags, and abbreviations (#9276) (@​owlstronaut)

Bug Fixes

• 9b5c7b0 #9521 config: strict-allow-scripts default blocks with a warning, not silently (@​JamieMagee)
• 6efac6e #9453 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@​JamieMagee)

... (truncated)

Commits

• b888cc9 chore: release 12.0.2
• 9e17dc0 docs: clarify npm 12 unknown-config breaking change in changelogs (#9805)
• 4403f05 chore: release 12.0.0
• 230e221 chore: release 12.0.0-pre.3
• fd75880 feat: warn instead of error on unknown .npmrc configs (#9729)
• fb304e7 chore: release 12.0.0-pre.2
• b51d156 feat(arborist): extend replace-registry-host with URL prefix matching (#6110)...
• fdcfcee docs: recommend install-strategy=linked to catch phantom dependencies (#9678)
• 86416a6 feat: graduate the linked install strategy from experimental to stable (#9674)
• 7655822 fix(arborist): don't flag inert optional deps in strict-allow-scripts (#9597)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)